Fixes for CVE-2006-4095 and CVE-2006-4096 from bind-9.3.2-P1
* Assertion failure in ISC BIND SIG query processing (CVE-2006-4095) - Recursive servers Queries for SIG records will trigger an assertion failure if more than one RRset is returned. However exposure can be minimized by restricting which sources can ask for recursion. - Authoritative servers If a nameserver is serving a RFC 2535 DNSSEC zone and is queried for the SIG records where there are multiple RRsets, then the named program will trigger an assertion failure when it tries to construct the response. * INSIST failure in ISC BIND recursive query handling code (CVE-2006-4096) It is possible to trigger an INSIST failure by sending enough recursive queries such that the response to the query arrives after all the clients waiting for the response have left the recursion queue. However exposure can be minimized by restricting which sources can ask for recursion. ok'ed christos@
This commit is contained in:
adrianp
parent
38566f3287
commit
ee74a1421a
6
dist/bind/bin/named/query.c
vendored
6
dist/bind/bin/named/query.c
vendored
@ -1,4 +1,4 @@
|
||||
/* $NetBSD: query.c,v 1.2 2006/05/11 09:28:45 mrg Exp $ */
|
||||
/* $NetBSD: query.c,v 1.3 2006/09/05 19:31:47 adrianp Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
@ -2395,7 +2395,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
|
||||
authoritative = ISC_FALSE;
|
||||
|
||||
qtype = event->qtype;
|
||||
if (qtype == dns_rdatatype_rrsig)
|
||||
if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
|
||||
type = dns_rdatatype_any;
|
||||
else
|
||||
type = qtype;
|
||||
@ -2436,7 +2436,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
|
||||
/*
|
||||
* If it's a SIG query, we'll iterate the node.
|
||||
*/
|
||||
if (qtype == dns_rdatatype_rrsig)
|
||||
if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
|
||||
type = dns_rdatatype_any;
|
||||
else
|
||||
type = qtype;
|
||||
|
||||
51
dist/bind/lib/dns/resolver.c
vendored
51
dist/bind/lib/dns/resolver.c
vendored
@ -1,4 +1,4 @@
|
||||
/* $NetBSD: resolver.c,v 1.1.1.4 2005/12/21 23:16:37 christos Exp $ */
|
||||
/* $NetBSD: resolver.c,v 1.2 2006/09/05 19:31:47 adrianp Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
@ -764,7 +764,8 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) {
|
||||
INSIST(result != ISC_R_SUCCESS ||
|
||||
dns_rdataset_isassociated(event->rdataset) ||
|
||||
fctx->type == dns_rdatatype_any ||
|
||||
fctx->type == dns_rdatatype_rrsig);
|
||||
fctx->type == dns_rdatatype_rrsig ||
|
||||
fctx->type == dns_rdatatype_sig);
|
||||
|
||||
isc_task_sendanddetach(&task, ISC_EVENT_PTR(&event));
|
||||
}
|
||||
@ -3190,7 +3191,8 @@ validated(isc_task_t *task, isc_event_t *event) {
|
||||
if (hevent != NULL) {
|
||||
if (!negative && !chaining &&
|
||||
(fctx->type == dns_rdatatype_any ||
|
||||
fctx->type == dns_rdatatype_rrsig)) {
|
||||
fctx->type == dns_rdatatype_rrsig ||
|
||||
fctx->type == dns_rdatatype_sig)) {
|
||||
/*
|
||||
* Don't bind rdatasets; the caller
|
||||
* will iterate the node.
|
||||
@ -3308,7 +3310,8 @@ validated(isc_task_t *task, isc_event_t *event) {
|
||||
if (!ISC_LIST_EMPTY(fctx->validators)) {
|
||||
INSIST(!negative);
|
||||
INSIST(fctx->type == dns_rdatatype_any ||
|
||||
fctx->type == dns_rdatatype_rrsig);
|
||||
fctx->type == dns_rdatatype_rrsig ||
|
||||
fctx->type == dns_rdatatype_sig);
|
||||
/*
|
||||
* Don't send a response yet - we have
|
||||
* more rdatasets that still need to
|
||||
@ -3457,14 +3460,15 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
|
||||
return (result);
|
||||
anodep = &event->node;
|
||||
/*
|
||||
* If this is an ANY or SIG query, we're not going
|
||||
* to return any rdatasets, unless we encountered
|
||||
* If this is an ANY, SIG or RRSIG query, we're not
|
||||
* going to return any rdatasets, unless we encountered
|
||||
* a CNAME or DNAME as "the answer". In this case,
|
||||
* we're going to return DNS_R_CNAME or DNS_R_DNAME
|
||||
* and we must set up the rdatasets.
|
||||
*/
|
||||
if ((fctx->type != dns_rdatatype_any &&
|
||||
fctx->type != dns_rdatatype_rrsig) ||
|
||||
fctx->type != dns_rdatatype_rrsig &&
|
||||
fctx->type != dns_rdatatype_sig) ||
|
||||
(name->attributes & DNS_NAMEATTR_CHAINING) != 0) {
|
||||
ardataset = event->rdataset;
|
||||
asigrdataset = event->sigrdataset;
|
||||
@ -3523,7 +3527,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
|
||||
*/
|
||||
if (secure_domain && rdataset->trust != dns_trust_glue) {
|
||||
/*
|
||||
* SIGs are validated as part of validating the
|
||||
* RRSIGs are validated as part of validating the
|
||||
* type they cover.
|
||||
*/
|
||||
if (rdataset->type == dns_rdatatype_rrsig)
|
||||
@ -3593,7 +3597,8 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
|
||||
|
||||
if (ANSWER(rdataset) && need_validation) {
|
||||
if (fctx->type != dns_rdatatype_any &&
|
||||
fctx->type != dns_rdatatype_rrsig) {
|
||||
fctx->type != dns_rdatatype_rrsig &&
|
||||
fctx->type != dns_rdatatype_sig) {
|
||||
/*
|
||||
* This is The Answer. We will
|
||||
* validate it, but first we cache
|
||||
@ -3765,23 +3770,28 @@ ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
|
||||
isc_result_t *eresultp)
|
||||
{
|
||||
isc_result_t result;
|
||||
dns_rdataset_t rdataset;
|
||||
|
||||
if (ardataset == NULL) {
|
||||
dns_rdataset_init(&rdataset);
|
||||
ardataset = &rdataset;
|
||||
}
|
||||
result = dns_ncache_add(message, cache, node, covers, now,
|
||||
maxttl, ardataset);
|
||||
if (result == DNS_R_UNCHANGED) {
|
||||
if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) {
|
||||
/*
|
||||
* The data in the cache are better than the negative cache
|
||||
* entry we're trying to add.
|
||||
* If the cache now contains a negative entry and we
|
||||
* care about whether it is DNS_R_NCACHENXDOMAIN or
|
||||
* DNS_R_NCACHENXRRSET then extract it.
|
||||
*/
|
||||
if (ardataset != NULL && ardataset->type == 0) {
|
||||
if (ardataset->type == 0) {
|
||||
/*
|
||||
* The cache data is also a negative cache
|
||||
* entry.
|
||||
* The cache data is a negative cache entry.
|
||||
*/
|
||||
if (NXDOMAIN(ardataset))
|
||||
*eresultp = DNS_R_NCACHENXDOMAIN;
|
||||
else
|
||||
*eresultp = DNS_R_NCACHENXRRSET;
|
||||
result = ISC_R_SUCCESS;
|
||||
} else {
|
||||
/*
|
||||
* Either we don't care about the nature of the
|
||||
@ -3793,14 +3803,11 @@ ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
|
||||
* XXXRTH There's a CNAME/DNAME problem here.
|
||||
*/
|
||||
*eresultp = ISC_R_SUCCESS;
|
||||
result = ISC_R_SUCCESS;
|
||||
}
|
||||
} else if (result == ISC_R_SUCCESS) {
|
||||
if (NXDOMAIN(ardataset))
|
||||
*eresultp = DNS_R_NCACHENXDOMAIN;
|
||||
else
|
||||
*eresultp = DNS_R_NCACHENXRRSET;
|
||||
result = ISC_R_SUCCESS;
|
||||
}
|
||||
if (ardataset == &rdataset && dns_rdataset_isassociated(ardataset))
|
||||
dns_rdataset_disassociate(ardataset);
|
||||
|
||||
return (result);
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user