Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP5:Update
bind
bind-9.11.37-0001-CVE-2021-25220.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File bind-9.11.37-0001-CVE-2021-25220.patch of Package bind
Index: bind-9.11.22/lib/dns/resolver.c =================================================================== --- bind-9.11.22.orig/lib/dns/resolver.c +++ bind-9.11.22/lib/dns/resolver.c @@ -63,6 +63,7 @@ #include <dns/stats.h> #include <dns/tsig.h> #include <dns/validator.h> +#include <dns/zone.h> #ifdef WANT_QUERYTRACE #define RTRACE(m) isc_log_write(dns_lctx, \ @@ -311,6 +312,8 @@ struct fetchctx { bool ns_ttl_ok; uint32_t ns_ttl; isc_counter_t * qc; + dns_fixedname_t fwdfname; + dns_name_t *fwdname; /*% * The number of events we're waiting for. @@ -3357,6 +3360,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool if (result == ISC_R_SUCCESS) { fwd = ISC_LIST_HEAD(forwarders->fwdrs); fctx->fwdpolicy = forwarders->fwdpolicy; + dns_name_copy(domain, fctx->fwdname, NULL); if (fctx->fwdpolicy == dns_fwdpolicy_only && isstrictsubdomain(domain, &fctx->domain)) { fcount_decr(fctx); @@ -4387,6 +4391,9 @@ fctx_create(dns_resolver_t *res, dns_nam fctx->restarts = 0; fctx->querysent = 0; fctx->referrals = 0; + + fctx->fwdname = dns_fixedname_initname(&fctx->fwdfname); + TIME_NOW(&fctx->start); fctx->timeouts = 0; fctx->lamecount = 0; @@ -4445,8 +4452,10 @@ fctx_create(dns_resolver_t *res, dns_nam domain = dns_fixedname_initname(&fixed); result = dns_fwdtable_find2(fctx->res->view->fwdtable, fwdname, domain, &forwarders); - if (result == ISC_R_SUCCESS) + if (result == ISC_R_SUCCESS) { fctx->fwdpolicy = forwarders->fwdpolicy; + dns_name_copy(domain, fctx->fwdname, NULL); + } if (fctx->fwdpolicy != dns_fwdpolicy_only) { /* @@ -6190,6 +6199,107 @@ mark_related(dns_name_t *name, dns_rdata rdataset->attributes |= DNS_RDATASETATTR_EXTERNAL; } +/* + * Returns true if 'name' is external to the namespace for which + * the server being queried can answer, either because it's not a + * subdomain or because it's below a forward declaration or a + * locally served zone. + */ +static inline bool +name_external(dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) { + isc_result_t result; + dns_forwarders_t *forwarders = NULL; + dns_fixedname_t fixed, zfixed; + dns_name_t *fname = dns_fixedname_initname(&fixed); + dns_name_t *zfname = dns_fixedname_initname(&zfixed); + dns_name_t *apex = NULL; + dns_name_t suffix; + dns_zone_t *zone = NULL; + unsigned int labels; + dns_namereln_t rel; + + apex = ISFORWARDER(fctx->addrinfo) ? fctx->fwdname : &fctx->domain; + + /* + * The name is outside the queried namespace. + */ + rel = dns_name_fullcompare(name, apex, &(int){ 0 }, + &(unsigned int){ 0U }); + if (rel != dns_namereln_subdomain && rel != dns_namereln_equal) { + return (true); + } + + /* + * If the record lives in the parent zone, adjust the name so we + * look for the correct zone or forward clause. + */ + labels = dns_name_countlabels(name); + if (dns_rdatatype_atparent(type) && labels > 1U) { + dns_name_init(&suffix, NULL); + dns_name_getlabelsequence(name, 1, labels - 1, &suffix); + name = &suffix; + } else if (rel == dns_namereln_equal) { + /* If 'name' is 'apex', no further checking is needed. */ + return (false); + } + + /* + * If there is a locally served zone between 'apex' and 'name' + * then don't cache. + */ + LOCK(&fctx->res->view->lock); + if (fctx->res->view->zonetable != NULL) { + unsigned int options = DNS_ZTFIND_NOEXACT; + result = dns_zt_find(fctx->res->view->zonetable, name, options, + zfname, &zone); + if (zone != NULL) { + dns_zone_detach(&zone); + } + if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) { + if (dns_name_fullcompare(zfname, apex, &(int){ 0 }, + &(unsigned int){ 0U }) == + dns_namereln_subdomain) + { + UNLOCK(&fctx->res->view->lock); + return (true); + } + } + } + UNLOCK(&fctx->res->view->lock); + + /* + * Look for a forward declaration below 'name'. + */ + result = dns_fwdtable_find2(fctx->res->view->fwdtable, name, fname, + &forwarders); + + if (ISFORWARDER(fctx->addrinfo)) { + /* + * See if the forwarder declaration is better. + */ + if (result == ISC_R_SUCCESS) { + return (!dns_name_equal(fname, fctx->fwdname)); + } + + /* + * If the lookup failed, the configuration must have + * changed: play it safe and don't cache. + */ + return (true); + } else if (result == ISC_R_SUCCESS && + forwarders->fwdpolicy == dns_fwdpolicy_only && + !ISC_LIST_EMPTY(forwarders->fwdrs)) + { + /* + * If 'name' is covered by a 'forward only' clause then we + * can't cache this repsonse. + */ + return (true); + } + + return (false); +} + static isc_result_t check_section(void *arg, dns_name_t *addname, dns_rdatatype_t type, dns_section_t section) @@ -6216,7 +6326,7 @@ check_section(void *arg, dns_name_t *add result = dns_message_findname(fctx->rmessage, section, addname, dns_rdatatype_any, 0, &name, NULL); if (result == ISC_R_SUCCESS) { - external = !dns_name_issubdomain(name, &fctx->domain); + external = name_external(name, type, fctx); if (type == dns_rdatatype_a) { for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL; @@ -7094,6 +7204,13 @@ answer_response(fetchctx_t *fctx) { case dns_namereln_subdomain: /* + * Don't accept DNAME from parent namespace. + */ + if (name_external(name, dns_rdatatype_dname, fctx)) { + continue; + } + + /* * In-scope DNAME records must have at least * as many labels as the domain being queried. * They also must be less that qname's labels @@ -7321,11 +7438,9 @@ answer_response(fetchctx_t *fctx) { */ result = dns_message_firstname(message, DNS_SECTION_AUTHORITY); while (!done && result == ISC_R_SUCCESS) { - bool external; name = NULL; dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name); - external = !dns_name_issubdomain(name, &fctx->domain); - if (!external) { + if (!name_external(name, dns_rdatatype_ns, fctx)) { /* * We expect to find NS or SIG NS rdatasets, and * nothing else.
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor