bind9.16/bind-9.16-CVE-2024-1737-runtime-env.patch

From f88517c844075f57f631dc3aac527145f21e038f Mon Sep 17 00:00:00 2001
From: Petr Mensik <pemensik@redhat.com>
Date: Mon, 29 Jul 2024 16:20:50 +0200
Subject: [PATCH] Allow global runtime definition by DNS_RBTDB_MAX_RTYPES

Modify rbtdb to not set it only at runtime, but allow setting that also
in runtime via environment variable. It is still possible to modify
default during the build define. In addition to it allows runtime change
also. Can be positive number to set limit, 0 disabled the check.

Similarly add also DNS_RDATASET_MAX_RECORDS to set maximum number of
records for a single name. This must be positive number, 0 is no accepted.

These replaces max-records-per-type and max-types-per-name in later
versions. But can be configured only by environment and can be
configured only globally, not in each view or zone.
---
 lib/dns/rbtdb.c     | 21 +++++++++++++++++++--
 lib/dns/rdataslab.c | 24 ++++++++++++++++++++++--
 2 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index e840c06..25242b2 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -6225,15 +6225,29 @@ update_recordsandxfrsize(bool add, rbtdb_version_t *rbtversion,
 #define DNS_RBTDB_MAX_RTYPES 100
 #endif /* DNS_RBTDB_MAX_RTYPES */
 
+static uint32_t dns_g_rbtdb_max_rtypes = DNS_RBTDB_MAX_RTYPES;
+
+static void
+init_max_rtypes(void) {
+	/* Red Hat change, allow setting different max value by environment. */
+	const char *max = getenv("DNS_RBTDB_MAX_RTYPES");
+	if (max) {
+		char *endp = NULL;
+		long l = strtol(max, &endp, 10);
+		if (max != endp && endp && !*endp && l >= 0)
+			dns_g_rbtdb_max_rtypes = l;
+	}
+}
+
 static bool
 overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
 	UNUSED(rbtdb);
 
-	if (DNS_RBTDB_MAX_RTYPES == 0) {
+	if (dns_g_rbtdb_max_rtypes == 0) {
 		return (false);
 	}
 
-	return (ntypes >= DNS_RBTDB_MAX_RTYPES);
+	return (ntypes >= dns_g_rbtdb_max_rtypes);
 }
 
 static bool
@@ -8785,6 +8799,8 @@ static dns_dbmethods_t cache_methods = { attach,
 					 NULL,
 					 adjusthashsize };
 
+static isc_once_t once_db = ISC_ONCE_INIT;
+
 isc_result_t
 dns_rbtdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 		 dns_rdataclass_t rdclass, unsigned int argc, char *argv[],
@@ -8798,6 +8814,7 @@ dns_rbtdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 
 	/* Keep the compiler happy. */
 	UNUSED(driverarg);
+	RUNTIME_CHECK(isc_once_do(&once_db, init_max_rtypes) == ISC_R_SUCCESS);
 
 	rbtdb = isc_mem_get(mctx, sizeof(*rbtdb));
 
diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
index dda9038..cef86af 100644
--- a/lib/dns/rdataslab.c
+++ b/lib/dns/rdataslab.c
@@ -15,6 +15,7 @@
 #include <stdlib.h>
 
 #include <isc/mem.h>
+#include <isc/once.h>
 #include <isc/region.h>
 #include <isc/string.h> /* Required for HP/UX (and others?) */
 #include <isc/util.h>
@@ -114,6 +115,23 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
 #define DNS_RDATASET_MAX_RECORDS 100
 #endif /* DNS_RDATASET_MAX_RECORDS */
 
+static unsigned int dns_g_rdataset_max_records = DNS_RDATASET_MAX_RECORDS;
+static isc_once_t once = ISC_ONCE_INIT;
+
+static void
+init_max_records(void) {
+	/* Red Hat change, allow setting different max value by environment. */
+	const char *max = getenv("DNS_RDATASET_MAX_RECORDS");
+	if (max) {
+		char *endp = NULL;
+		long l = strtol(max, &endp, 10);
+		if (max != endp && endp && !*endp && l > 0)
+			dns_g_rdataset_max_records = l;
+	}
+}
+
+
+
 isc_result_t
 dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 			   isc_region_t *region, unsigned int reservelen) {
@@ -158,7 +176,9 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 		return (ISC_R_SUCCESS);
 	}
 
-	if (nitems > DNS_RDATASET_MAX_RECORDS) {
+	RUNTIME_CHECK(isc_once_do(&once, init_max_records) == ISC_R_SUCCESS);
+
+	if (nitems > dns_g_rdataset_max_records) {
 		return (DNS_R_TOOMANYRECORDS);
 	}
 
@@ -528,7 +548,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 #endif /* if DNS_RDATASET_FIXED */
 	INSIST(ocount > 0 && ncount > 0);
 
-	if (ocount + ncount > DNS_RDATASET_MAX_RECORDS) {
+	if (ocount + ncount > dns_g_rdataset_max_records) {
 		return (DNS_R_TOOMANYRECORDS);
 	}
 
-- 
2.45.2