Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/netbsd-3-0]: src/dist/bind Pull up following revision(s) (requested by a...
details: https://anonhg.NetBSD.org/src/rev/fc939fa8477a
branches: netbsd-3-0
changeset: 579290:fc939fa8477a
user: tron <tron%NetBSD.org@localhost>
date: Wed Sep 06 06:01:19 2006 +0000
description:
Pull up following revision(s) (requested by adrianp in ticket #1498):
dist/bind/lib/dns/resolver.c: revision 1.2
dist/bind/bin/named/query.c: revision 1.3
Fixes for CVE-2006-4095 and CVE-2006-4096 from bind-9.3.2-P1
* Assertion failure in ISC BIND SIG query processing (CVE-2006-4095)
- Recursive servers
Queries for SIG records will trigger an assertion failure if more
than one RRset is returned. However exposure can be minimized by
restricting which sources can ask for recursion.
- Authoritative servers
If a nameserver is serving a RFC 2535 DNSSEC zone and is queried
for the SIG records where there are multiple RRsets, then the
named program will trigger an assertion failure when it tries
to construct the response.
* INSIST failure in ISC BIND recursive query handling code (CVE-2006-4096)
It is possible to trigger an INSIST failure by sending enough
recursive queries such that the response to the query arrives after
all the clients waiting for the response have left the recursion
queue. However exposure can be minimized by restricting which sources
can ask for recursion.
ok'ed christos@
diffstat:
dist/bind/bin/named/query.c | 6 ++--
dist/bind/lib/dns/resolver.c | 51 +++++++++++++++++++++++++------------------
2 files changed, 32 insertions(+), 25 deletions(-)
diffs (158 lines):
diff -r 5c3dce7f38d8 -r fc939fa8477a dist/bind/bin/named/query.c
--- a/dist/bind/bin/named/query.c Fri Sep 01 15:14:30 2006 +0000
+++ b/dist/bind/bin/named/query.c Wed Sep 06 06:01:19 2006 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: query.c,v 1.1.1.2 2004/11/06 23:53:35 christos Exp $ */
+/* $NetBSD: query.c,v 1.1.1.2.4.1 2006/09/06 06:01:19 tron Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -2391,7 +2391,7 @@
is_zone = ISC_FALSE;
qtype = event->qtype;
- if (qtype == dns_rdatatype_rrsig)
+ if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
type = dns_rdatatype_any;
else
type = qtype;
@@ -2432,7 +2432,7 @@
/*
* If it's a SIG query, we'll iterate the node.
*/
- if (qtype == dns_rdatatype_rrsig)
+ if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
type = dns_rdatatype_any;
else
type = qtype;
diff -r 5c3dce7f38d8 -r fc939fa8477a dist/bind/lib/dns/resolver.c
--- a/dist/bind/lib/dns/resolver.c Fri Sep 01 15:14:30 2006 +0000
+++ b/dist/bind/lib/dns/resolver.c Wed Sep 06 06:01:19 2006 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: resolver.c,v 1.1.1.2 2004/11/06 23:55:41 christos Exp $ */
+/* $NetBSD: resolver.c,v 1.1.1.2.4.1 2006/09/06 06:01:19 tron Exp $ */
/*
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
@@ -730,7 +730,8 @@
INSIST(result != ISC_R_SUCCESS ||
dns_rdataset_isassociated(event->rdataset) ||
fctx->type == dns_rdatatype_any ||
- fctx->type == dns_rdatatype_rrsig);
+ fctx->type == dns_rdatatype_rrsig ||
+ fctx->type == dns_rdatatype_sig);
isc_task_sendanddetach(&task, ISC_EVENT_PTR(&event));
}
@@ -3087,7 +3088,8 @@
if (hevent != NULL) {
if (!negative && !chaining &&
(fctx->type == dns_rdatatype_any ||
- fctx->type == dns_rdatatype_rrsig)) {
+ fctx->type == dns_rdatatype_rrsig ||
+ fctx->type == dns_rdatatype_sig)) {
/*
* Don't bind rdatasets; the caller
* will iterate the node.
@@ -3199,7 +3201,8 @@
if (!ISC_LIST_EMPTY(fctx->validators)) {
INSIST(!negative);
INSIST(fctx->type == dns_rdatatype_any ||
- fctx->type == dns_rdatatype_rrsig);
+ fctx->type == dns_rdatatype_rrsig ||
+ fctx->type == dns_rdatatype_sig);
/*
* Don't send a response yet - we have
* more rdatasets that still need to
@@ -3345,14 +3348,15 @@
return (result);
anodep = &event->node;
/*
- * If this is an ANY or SIG query, we're not going
- * to return any rdatasets, unless we encountered
+ * If this is an ANY, SIG or RRSIG query, we're not
+ * going to return any rdatasets, unless we encountered
* a CNAME or DNAME as "the answer". In this case,
* we're going to return DNS_R_CNAME or DNS_R_DNAME
* and we must set up the rdatasets.
*/
if ((fctx->type != dns_rdatatype_any &&
- fctx->type != dns_rdatatype_rrsig) ||
+ fctx->type != dns_rdatatype_rrsig &&
+ fctx->type != dns_rdatatype_sig) ||
(name->attributes & DNS_NAMEATTR_CHAINING) != 0) {
ardataset = event->rdataset;
asigrdataset = event->sigrdataset;
@@ -3411,7 +3415,7 @@
*/
if (secure_domain && rdataset->trust != dns_trust_glue) {
/*
- * SIGs are validated as part of validating the
+ * RRSIGs are validated as part of validating the
* type they cover.
*/
if (rdataset->type == dns_rdatatype_rrsig)
@@ -3481,7 +3485,8 @@
if (ANSWER(rdataset) && need_validation) {
if (fctx->type != dns_rdatatype_any &&
- fctx->type != dns_rdatatype_rrsig) {
+ fctx->type != dns_rdatatype_rrsig &&
+ fctx->type != dns_rdatatype_sig) {
/*
* This is The Answer. We will
* validate it, but first we cache
@@ -3668,23 +3673,28 @@
isc_result_t *eresultp)
{
isc_result_t result;
+ dns_rdataset_t rdataset;
+
+ if (ardataset == NULL) {
+ dns_rdataset_init(&rdataset);
+ ardataset = &rdataset;
+ }
result = dns_ncache_add(message, cache, node, covers, now,
maxttl, ardataset);
- if (result == DNS_R_UNCHANGED) {
+ if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) {
/*
- * The data in the cache are better than the negative cache
- * entry we're trying to add.
+ * If the cache now contains a negative entry and we
+ * care about whether it is DNS_R_NCACHENXDOMAIN or
+ * DNS_R_NCACHENXRRSET then extract it.
*/
- if (ardataset != NULL && ardataset->type == 0) {
+ if (ardataset->type == 0) {
/*
- * The cache data is also a negative cache
- * entry.
+ * The cache data is a negative cache entry.
*/
if (NXDOMAIN(ardataset))
*eresultp = DNS_R_NCACHENXDOMAIN;
else
*eresultp = DNS_R_NCACHENXRRSET;
- result = ISC_R_SUCCESS;
} else {
/*
* Either we don't care about the nature of the
@@ -3696,14 +3706,11 @@
* XXXRTH There's a CNAME/DNAME problem here.
*/
*eresultp = ISC_R_SUCCESS;
- result = ISC_R_SUCCESS;
}
- } else if (result == ISC_R_SUCCESS) {
- if (NXDOMAIN(ardataset))
- *eresultp = DNS_R_NCACHENXDOMAIN;
- else
- *eresultp = DNS_R_NCACHENXRRSET;
+ result = ISC_R_SUCCESS;
}
+ if (ardataset == &rdataset && dns_rdataset_isassociated(ardataset))
+ dns_rdataset_disassociate(ardataset);
return (result);
}
Home |
Main Index |
Thread Index |
Old Index