!223 fix some CVEs
From: @chengyechun Reviewed-by: @jiangheng12 Signed-off-by: @jiangheng12
This commit is contained in:
openeuler-ci-bot
Gitee
commit
a95016184c
94
backport-0001-CVE-2024-1737.patch
Normal file
94
backport-0001-CVE-2024-1737.patch
Normal file
@ -0,0 +1,94 @@
|
|||||||
|
From fdabf4b9570a60688f9f7d1e88d885f7a3718bca Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
|
||||||
|
Date: Fri, 1 Mar 2024 08:26:07 +0100
|
||||||
|
Subject: [PATCH 1/3] Add a limit to the number of RRs in RRSets
|
||||||
|
|
||||||
|
Previously, the number of RRs in the RRSets were internally unlimited.
|
||||||
|
As the data structure that holds the RRs is just a linked list, and
|
||||||
|
there are places where we just walk through all of the RRs, adding an
|
||||||
|
RRSet with huge number of RRs inside would slow down processing of said
|
||||||
|
RRSets.
|
||||||
|
|
||||||
|
The fix for end-of-life branches make the limit compile-time only for
|
||||||
|
simplicity and the limit can be changed at the compile time by adding
|
||||||
|
following define to CFLAGS:
|
||||||
|
|
||||||
|
-DDNS_RDATASET_MAX_RECORDS=<limit>
|
||||||
|
|
||||||
|
(cherry picked from commit c5c4d00c38530390c9e1ae4c98b65fbbadfe9e5e)
|
||||||
|
|
||||||
|
Conflict:NA
|
||||||
|
Reference:https://gitlab.isc.org/isc-projects/bind9/-/commit/5360c90612abf51deb4a80b30e1da84fd61212a5
|
||||||
|
|
||||||
|
---
|
||||||
|
configure | 2 +-
|
||||||
|
configure.ac | 2 +-
|
||||||
|
lib/dns/rdataslab.c | 12 ++++++++++++
|
||||||
|
3 files changed, 14 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/configure b/configure
|
||||||
|
index 4bbcaa3..9151d64 100755
|
||||||
|
--- a/configure
|
||||||
|
+++ b/configure
|
||||||
|
@@ -12173,7 +12173,7 @@ fi
|
||||||
|
XTARGETS=
|
||||||
|
case "$enable_developer" in
|
||||||
|
yes)
|
||||||
|
- STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1"
|
||||||
|
+ STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000"
|
||||||
|
test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
|
||||||
|
test "${enable_querytrace+set}" = set || enable_querytrace=yes
|
||||||
|
test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
|
||||||
|
diff --git a/configure.ac b/configure.ac
|
||||||
|
index 285dfab..77c9b48 100644
|
||||||
|
--- a/configure.ac
|
||||||
|
+++ b/configure.ac
|
||||||
|
@@ -94,7 +94,7 @@ AC_ARG_ENABLE(developer,
|
||||||
|
XTARGETS=
|
||||||
|
case "$enable_developer" in
|
||||||
|
yes)
|
||||||
|
- STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1"
|
||||||
|
+ STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000"
|
||||||
|
test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
|
||||||
|
test "${enable_querytrace+set}" = set || enable_querytrace=yes
|
||||||
|
test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
|
||||||
|
diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
|
||||||
|
index 7cd3855..22fe63e 100644
|
||||||
|
--- a/lib/dns/rdataslab.c
|
||||||
|
+++ b/lib/dns/rdataslab.c
|
||||||
|
@@ -115,6 +115,10 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
|
+#ifndef DNS_RDATASET_MAX_RECORDS
|
||||||
|
+#define DNS_RDATASET_MAX_RECORDS 100
|
||||||
|
+#endif /* DNS_RDATASET_MAX_RECORDS */
|
||||||
|
+
|
||||||
|
isc_result_t
|
||||||
|
dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
|
||||||
|
isc_region_t *region, unsigned int reservelen)
|
||||||
|
@@ -161,6 +165,10 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
|
||||||
|
return (ISC_R_SUCCESS);
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if (nitems > DNS_RDATASET_MAX_RECORDS) {
|
||||||
|
+ return (DNS_R_TOOMANYRECORDS);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (nitems > 0xffff)
|
||||||
|
return (ISC_R_NOSPACE);
|
||||||
|
|
||||||
|
@@ -654,6 +662,10 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
|
||||||
|
#endif
|
||||||
|
INSIST(ocount > 0 && ncount > 0);
|
||||||
|
|
||||||
|
+ if (ocount + ncount > DNS_RDATASET_MAX_RECORDS) {
|
||||||
|
+ return (DNS_R_TOOMANYRECORDS);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
#if DNS_RDATASET_FIXED
|
||||||
|
oncount = ncount;
|
||||||
|
#endif
|
||||||
|
--
|
||||||
|
2.33.0
|
||||||
|
|
||||||
125
backport-0002-CVE-2024-1737.patch
Normal file
125
backport-0002-CVE-2024-1737.patch
Normal file
@ -0,0 +1,125 @@
|
|||||||
|
From dfcadc2085c8844b5836aff2b5ea51fb60c34868 Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
|
||||||
|
Date: Wed, 29 May 2024 08:43:39 +0200
|
||||||
|
Subject: [PATCH 2/3] Add a limit to the number of RR types for single name
|
||||||
|
|
||||||
|
Previously, the number of RR types for a single owner name was limited
|
||||||
|
only by the maximum number of the types (64k). As the data structure
|
||||||
|
that holds the RR types for the database node is just a linked list, and
|
||||||
|
there are places where we just walk through the whole list (again and
|
||||||
|
again), adding a large number of RR types for a single owner named with
|
||||||
|
would slow down processing of such name (database node).
|
||||||
|
|
||||||
|
Add a hard-coded limit (100) to cap the number of the RR types for a single
|
||||||
|
owner. The limit can be changed at the compile time by adding following
|
||||||
|
define to CFLAGS:
|
||||||
|
|
||||||
|
-DDNS_RBTDB_MAX_RTYPES=<limit>
|
||||||
|
|
||||||
|
Conflict:Context Adaptation
|
||||||
|
Reference:https://gitlab.isc.org/isc-projects/bind9/-/commit/5360c90612abf51deb4a80b30e1da84fd61212a5
|
||||||
|
|
||||||
|
---
|
||||||
|
configure | 2 +-
|
||||||
|
configure.ac | 2 +-
|
||||||
|
lib/dns/rbtdb.c | 17 +++++++++++++++++
|
||||||
|
3 files changed, 19 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/configure b/configure
|
||||||
|
index 9151d64..3e1c868 100755
|
||||||
|
--- a/configure
|
||||||
|
+++ b/configure
|
||||||
|
@@ -12173,7 +12173,7 @@ fi
|
||||||
|
XTARGETS=
|
||||||
|
case "$enable_developer" in
|
||||||
|
yes)
|
||||||
|
- STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000"
|
||||||
|
+ STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
|
||||||
|
test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
|
||||||
|
test "${enable_querytrace+set}" = set || enable_querytrace=yes
|
||||||
|
test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
|
||||||
|
diff --git a/configure.ac b/configure.ac
|
||||||
|
index 77c9b48..6844934 100644
|
||||||
|
--- a/configure.ac
|
||||||
|
+++ b/configure.ac
|
||||||
|
@@ -94,7 +94,7 @@ AC_ARG_ENABLE(developer,
|
||||||
|
XTARGETS=
|
||||||
|
case "$enable_developer" in
|
||||||
|
yes)
|
||||||
|
- STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000"
|
||||||
|
+ STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
|
||||||
|
test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
|
||||||
|
test "${enable_querytrace+set}" = set || enable_querytrace=yes
|
||||||
|
test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
|
||||||
|
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
|
||||||
|
index cd5cd9b..5e44653 100644
|
||||||
|
--- a/lib/dns/rbtdb.c
|
||||||
|
+++ b/lib/dns/rbtdb.c
|
||||||
|
@@ -6289,6 +6289,10 @@ update_recordsandbytes(bool add, rbtdb_version_t *rbtversion,
|
||||||
|
RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
|
||||||
|
}
|
||||||
|
|
||||||
|
+#ifndef DNS_RBTDB_MAX_RTYPES
|
||||||
|
+#define DNS_RBTDB_MAX_RTYPES 100
|
||||||
|
+#endif /* DNS_RBTDB_MAX_RTYPES */
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* write lock on rbtnode must be held.
|
||||||
|
*/
|
||||||
|
@@ -6309,6 +6313,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
rbtdb_rdatatype_t negtype, sigtype;
|
||||||
|
dns_trust_t trust;
|
||||||
|
int idx;
|
||||||
|
+ uint32_t ntypes;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Add an rdatasetheader_t to a node.
|
||||||
|
@@ -6371,6 +6376,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
set_ttl(rbtdb, topheader, 0);
|
||||||
|
mark_header_ancient(rbtdb, topheader);
|
||||||
|
}
|
||||||
|
+ ntypes = 0;
|
||||||
|
goto find_header;
|
||||||
|
}
|
||||||
|
/*
|
||||||
|
@@ -6392,9 +6398,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
* check for an extant non-stale NODATA ncache
|
||||||
|
* entry which covers the same type as the RRSIG.
|
||||||
|
*/
|
||||||
|
+ ntypes = 0;
|
||||||
|
for (topheader = rbtnode->data;
|
||||||
|
topheader != NULL;
|
||||||
|
topheader = topheader->next) {
|
||||||
|
+ ntypes++;
|
||||||
|
if ((topheader->type ==
|
||||||
|
RBTDB_RDATATYPE_NCACHEANY) ||
|
||||||
|
(newheader->type == sigtype &&
|
||||||
|
@@ -6438,9 +6446,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
+ ntypes = 0;
|
||||||
|
for (topheader = rbtnode->data;
|
||||||
|
topheader != NULL;
|
||||||
|
topheader = topheader->next) {
|
||||||
|
+ ntypes++;
|
||||||
|
if (prio_type(topheader->type)) {
|
||||||
|
prioheader = topheader;
|
||||||
|
}
|
||||||
|
@@ -6807,6 +6817,13 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
/*
|
||||||
|
* No rdatasets of the given type exist at the node.
|
||||||
|
*/
|
||||||
|
+
|
||||||
|
+ if (ntypes > DNS_RBTDB_MAX_RTYPES) {
|
||||||
|
+ free_rdataset(rbtdb, rbtdb->common.mctx,
|
||||||
|
+ newheader);
|
||||||
|
+ return (ISC_R_QUOTA);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
newheader->down = NULL;
|
||||||
|
|
||||||
|
if (prio_type(newheader->type)) {
|
||||||
|
--
|
||||||
|
2.33.0
|
||||||
|
|
||||||
56
backport-0003-CVE-2024-1737.patch
Normal file
56
backport-0003-CVE-2024-1737.patch
Normal file
@ -0,0 +1,56 @@
|
|||||||
|
From b27c6bcce894786a8e082eafd59eccbf6f2731cb Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
|
||||||
|
Date: Mon, 17 Jun 2024 11:40:40 +0200
|
||||||
|
Subject: [PATCH] Expand the list of the priority types and move it to db_p.h
|
||||||
|
|
||||||
|
Add HTTPS, SVCB, SRV, PTR, NAPTR, DNSKEY and TXT records to the list of
|
||||||
|
the priority types that are put at the beginning of the slabheader list
|
||||||
|
for faster access and to avoid eviction when there are more types than
|
||||||
|
the max-types-per-name limit.
|
||||||
|
|
||||||
|
Conflict:NA
|
||||||
|
Reference:https://gitlab.isc.org/isc-projects/bind9/-/commit/b27c6bcce894786a8e082eafd59eccbf6f2731cb
|
||||||
|
|
||||||
|
---
|
||||||
|
lib/dns/rbtdb.c | 18 ++++++++++++++++++
|
||||||
|
1 file changed, 18 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
|
||||||
|
index 5e44653..9babac2 100644
|
||||||
|
--- a/lib/dns/rbtdb.c
|
||||||
|
+++ b/lib/dns/rbtdb.c
|
||||||
|
@@ -1178,6 +1178,8 @@ prio_type(rbtdb_rdatatype_t type) {
|
||||||
|
case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_soa):
|
||||||
|
case dns_rdatatype_a:
|
||||||
|
case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_a):
|
||||||
|
+ case dns_rdatatype_mx:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_mx):
|
||||||
|
case dns_rdatatype_aaaa:
|
||||||
|
case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_aaaa):
|
||||||
|
case dns_rdatatype_nsec:
|
||||||
|
@@ -1190,6 +1192,22 @@ prio_type(rbtdb_rdatatype_t type) {
|
||||||
|
case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ds):
|
||||||
|
case dns_rdatatype_cname:
|
||||||
|
case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname):
|
||||||
|
+ case dns_rdatatype_dname:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dname):
|
||||||
|
+ case dns_rdatatype_avc:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_avc):
|
||||||
|
+ case dns_rdatatype_hip:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_hip):
|
||||||
|
+ case dns_rdatatype_dnskey:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dnskey):
|
||||||
|
+ case dns_rdatatype_srv:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_srv):
|
||||||
|
+ case dns_rdatatype_txt:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_txt):
|
||||||
|
+ case dns_rdatatype_ptr:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ptr):
|
||||||
|
+ case dns_rdatatype_naptr:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_naptr):
|
||||||
|
return (true);
|
||||||
|
}
|
||||||
|
return (false);
|
||||||
|
--
|
||||||
|
2.33.0
|
||||||
|
|
||||||
185
backport-0004-CVE-2024-1737.patch
Normal file
185
backport-0004-CVE-2024-1737.patch
Normal file
@ -0,0 +1,185 @@
|
|||||||
|
From 57cd34441a1b4ecc9874a4a106c2c95b8d7a3120 Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?utf-8?b?T25kxZllaiBTdXLDvQ==?= <ondrej@isc.org>
|
||||||
|
Date: Mon, 17 Jun 2024 11:40:40 +0200
|
||||||
|
Subject: Be smarter about refusing to add many RR types to the database
|
||||||
|
|
||||||
|
Instead of outright refusing to add new RR types to the cache, be a bit
|
||||||
|
smarter:
|
||||||
|
|
||||||
|
1. If the new header type is in our priority list, we always add either
|
||||||
|
positive or negative entry at the beginning of the list.
|
||||||
|
|
||||||
|
2. If the new header type is negative entry, and we are over the limit,
|
||||||
|
we mark it as ancient immediately, so it gets evicted from the cache
|
||||||
|
as soon as possible.
|
||||||
|
|
||||||
|
3. Otherwise add the new header after the priority headers (or at the
|
||||||
|
head of the list).
|
||||||
|
|
||||||
|
4. If we are over the limit, evict the last entry on the normal header
|
||||||
|
list.
|
||||||
|
|
||||||
|
(cherry picked from commit 57cd34441a1b4ecc9874a4a106c2c95b8d7a3120)
|
||||||
|
|
||||||
|
Conflict:NA
|
||||||
|
Reference:https://gitlab.isc.org/isc-projects/bind9/-/commit/57cd34441a1b4ecc9874a4a106c2c95b8d7a3120
|
||||||
|
|
||||||
|
---
|
||||||
|
lib/dns/rbtdb.c | 71 ++++++++++++++++++++++++++++++++++++++++---------
|
||||||
|
1 file changed, 59 insertions(+), 12 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
|
||||||
|
index 9babac2..4d4b971 100644
|
||||||
|
--- a/lib/dns/rbtdb.c
|
||||||
|
+++ b/lib/dns/rbtdb.c
|
||||||
|
@@ -6311,6 +6311,26 @@ update_recordsandbytes(bool add, rbtdb_version_t *rbtversion,
|
||||||
|
#define DNS_RBTDB_MAX_RTYPES 100
|
||||||
|
#endif /* DNS_RBTDB_MAX_RTYPES */
|
||||||
|
|
||||||
|
+static bool
|
||||||
|
+overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
|
||||||
|
+ UNUSED(rbtdb);
|
||||||
|
+
|
||||||
|
+ if (DNS_RBTDB_MAX_RTYPES == 0) {
|
||||||
|
+ return (false);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return (ntypes >= DNS_RBTDB_MAX_RTYPES);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static bool
|
||||||
|
+prio_header(rdatasetheader_t *header) {
|
||||||
|
+ if (NEGATIVE(header) && prio_type(RBTDB_RDATATYPE_EXT(header->type))) {
|
||||||
|
+ return (true);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return (prio_type(header->type));
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* write lock on rbtnode must be held.
|
||||||
|
*/
|
||||||
|
@@ -6321,7 +6341,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
{
|
||||||
|
rbtdb_changed_t *changed = NULL;
|
||||||
|
rdatasetheader_t *topheader, *topheader_prev, *header, *sigheader;
|
||||||
|
- rdatasetheader_t *prioheader = NULL;
|
||||||
|
+ rdatasetheader_t *prioheader = NULL, *expireheader = NULL;
|
||||||
|
unsigned char *merged;
|
||||||
|
isc_result_t result;
|
||||||
|
bool header_nx;
|
||||||
|
@@ -6331,7 +6351,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
rbtdb_rdatatype_t negtype, sigtype;
|
||||||
|
dns_trust_t trust;
|
||||||
|
int idx;
|
||||||
|
- uint32_t ntypes;
|
||||||
|
+ uint32_t ntypes = 0;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Add an rdatasetheader_t to a node.
|
||||||
|
@@ -6394,7 +6414,6 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
set_ttl(rbtdb, topheader, 0);
|
||||||
|
mark_header_ancient(rbtdb, topheader);
|
||||||
|
}
|
||||||
|
- ntypes = 0;
|
||||||
|
goto find_header;
|
||||||
|
}
|
||||||
|
/*
|
||||||
|
@@ -6404,8 +6423,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
for (topheader = rbtnode->data;
|
||||||
|
topheader != NULL;
|
||||||
|
topheader = topheader->next)
|
||||||
|
- if (topheader->type == sigtype)
|
||||||
|
+ if (topheader->type == sigtype) {
|
||||||
|
sigheader = topheader;
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
negtype = RBTDB_RDATATYPE_VALUE(covers, 0);
|
||||||
|
} else {
|
||||||
|
/*
|
||||||
|
@@ -6416,11 +6437,9 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
* check for an extant non-stale NODATA ncache
|
||||||
|
* entry which covers the same type as the RRSIG.
|
||||||
|
*/
|
||||||
|
- ntypes = 0;
|
||||||
|
for (topheader = rbtnode->data;
|
||||||
|
topheader != NULL;
|
||||||
|
topheader = topheader->next) {
|
||||||
|
- ntypes++;
|
||||||
|
if ((topheader->type ==
|
||||||
|
RBTDB_RDATATYPE_NCACHEANY) ||
|
||||||
|
(newheader->type == sigtype &&
|
||||||
|
@@ -6464,12 +6483,16 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
- ntypes = 0;
|
||||||
|
for (topheader = rbtnode->data;
|
||||||
|
topheader != NULL;
|
||||||
|
topheader = topheader->next) {
|
||||||
|
- ntypes++;
|
||||||
|
- if (prio_type(topheader->type)) {
|
||||||
|
+ if (IS_CACHE(rbtdb) && ACTIVE(topheader, now)) {
|
||||||
|
+ ++ntypes;
|
||||||
|
+ expireheader = topheader;
|
||||||
|
+ } else if (!IS_CACHE(rbtdb)) {
|
||||||
|
+ ++ntypes;
|
||||||
|
+ }
|
||||||
|
+ if (prio_header(topheader)) {
|
||||||
|
prioheader = topheader;
|
||||||
|
}
|
||||||
|
if (topheader->type == newheader->type ||
|
||||||
|
@@ -6835,8 +6858,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
/*
|
||||||
|
* No rdatasets of the given type exist at the node.
|
||||||
|
*/
|
||||||
|
-
|
||||||
|
- if (ntypes > DNS_RBTDB_MAX_RTYPES) {
|
||||||
|
+ if (!IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
|
||||||
|
free_rdataset(rbtdb, rbtdb->common.mctx,
|
||||||
|
newheader);
|
||||||
|
return (ISC_R_QUOTA);
|
||||||
|
@@ -6844,7 +6866,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
|
||||||
|
newheader->down = NULL;
|
||||||
|
|
||||||
|
- if (prio_type(newheader->type)) {
|
||||||
|
+ if (prio_header(newheader)) {
|
||||||
|
/* This is a priority type, prepend it */
|
||||||
|
newheader->next = rbtnode->data;
|
||||||
|
rbtnode->data = newheader;
|
||||||
|
@@ -6857,6 +6879,31 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
newheader->next = rbtnode->data;
|
||||||
|
rbtnode->data = newheader;
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+ if (IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
|
||||||
|
+ if (expireheader == NULL) {
|
||||||
|
+ expireheader = newheader;
|
||||||
|
+ }
|
||||||
|
+ if (NEGATIVE(newheader) &&
|
||||||
|
+ !prio_header(newheader))
|
||||||
|
+ {
|
||||||
|
+ /*
|
||||||
|
+ * Add the new non-priority negative
|
||||||
|
+ * header to the database only
|
||||||
|
+ * temporarily.
|
||||||
|
+ */
|
||||||
|
+ expireheader = newheader;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ set_ttl(rbtdb, expireheader, 0);
|
||||||
|
+ mark_header_ancient(rbtdb, expireheader);
|
||||||
|
+ /*
|
||||||
|
+ * FIXME: In theory, we should mark the RRSIG
|
||||||
|
+ * and the header at the same time, but there is
|
||||||
|
+ * no direct link between those two header, so
|
||||||
|
+ * we would have to check the whole list again.
|
||||||
|
+ */
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
--
|
||||||
|
2.33.0
|
||||||
|
|
||||||
220
backport-CVE-2024-1975.patch
Normal file
220
backport-CVE-2024-1975.patch
Normal file
@ -0,0 +1,220 @@
|
|||||||
|
From bef3d2cca3552100bbe44790c8c1a4f5bef06798 Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= <pspacek@isc.org>
|
||||||
|
Date: Thu, 16 May 2024 12:10:41 +0200
|
||||||
|
Subject: [PATCH] Remove support for SIG(0) message verification
|
||||||
|
|
||||||
|
Conflict:Case adaptation and some documents are not incorporated.
|
||||||
|
Reference:https://downloads.isc.org/isc/bind9/9.18.28/patches/0003-CVE-2024-1975.patch
|
||||||
|
|
||||||
|
---
|
||||||
|
bin/tests/system/tsiggss/authsock.pl | 5 ++
|
||||||
|
bin/tests/system/tsiggss/tests.sh | 12 ++--
|
||||||
|
bin/tests/system/upforwd/tests.sh | 9 ++-
|
||||||
|
lib/dns/message.c | 91 ++--------------------------
|
||||||
|
4 files changed, 24 insertions(+), 93 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/bin/tests/system/tsiggss/authsock.pl b/bin/tests/system/tsiggss/authsock.pl
|
||||||
|
index 57a72b2..3afaa83 100644
|
||||||
|
--- a/bin/tests/system/tsiggss/authsock.pl
|
||||||
|
+++ b/bin/tests/system/tsiggss/authsock.pl
|
||||||
|
@@ -31,6 +31,10 @@ if (!defined($path)) {
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
+# Enable output autoflush so that it's not lost when the parent sends TERM.
|
||||||
|
+select STDOUT;
|
||||||
|
+$| = 1;
|
||||||
|
+
|
||||||
|
unlink($path);
|
||||||
|
my $server = IO::Socket::UNIX->new(Local => $path, Type => SOCK_STREAM, Listen => 8) or
|
||||||
|
die "unable to create socket $path";
|
||||||
|
@@ -48,6 +52,7 @@ if ($timeout != 0) {
|
||||||
|
}
|
||||||
|
|
||||||
|
while (my $client = $server->accept()) {
|
||||||
|
+ printf("accept()\n");
|
||||||
|
$client->recv(my $buf, 8, 0);
|
||||||
|
my ($version, $req_len) = unpack('N N', $buf);
|
||||||
|
|
||||||
|
diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh
|
||||||
|
index e4c32dc..2d67533 100644
|
||||||
|
--- a/bin/tests/system/tsiggss/tests.sh
|
||||||
|
+++ b/bin/tests/system/tsiggss/tests.sh
|
||||||
|
@@ -116,7 +116,7 @@ status=$((status+ret))
|
||||||
|
|
||||||
|
echo "I:testing external update policy (CNAME) with auth sock ($n)"
|
||||||
|
ret=0
|
||||||
|
-$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 > /dev/null 2>&1 &
|
||||||
|
+$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 > authsock.log 2>&1 &
|
||||||
|
sleep 1
|
||||||
|
test_update $n testcname.example.nil. CNAME "86400 CNAME testdenied.example.nil" "testdenied" || ret=1
|
||||||
|
n=$((n+1))
|
||||||
|
@@ -130,17 +130,19 @@ n=$((n+1))
|
||||||
|
if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
|
||||||
|
status=$((status+ret))
|
||||||
|
|
||||||
|
-echo "I:testing external policy with SIG(0) key ($n)"
|
||||||
|
+echo "I:testing external policy with unsupported SIG(0) key ($n)"
|
||||||
|
ret=0
|
||||||
|
-$NSUPDATE -R $RANDFILE -k ns1/Kkey.example.nil.*.private <<END > /dev/null 2>&1 || ret=1
|
||||||
|
+$NSUPDATE -R $RANDFILE -d -k ns1/Kkey.example.nil.*.private <<END > nsupdate.out${n} 2>&1 || true
|
||||||
|
+debug
|
||||||
|
server 10.53.0.1 ${PORT}
|
||||||
|
zone example.nil
|
||||||
|
update add fred.example.nil 120 cname foo.bar.
|
||||||
|
send
|
||||||
|
END
|
||||||
|
output=`$DIG $DIGOPTS +short cname fred.example.nil.`
|
||||||
|
-[ -n "$output" ] || ret=1
|
||||||
|
-[ $ret -eq 0 ] || echo "I:failed"
|
||||||
|
+# update must have failed - SIG(0) signer is not supported
|
||||||
|
+[ -n "$output" ] && ret=1
|
||||||
|
+grep -F "signer=key.example.nil" authsock.log >/dev/null && ret=1
|
||||||
|
n=$((n+1))
|
||||||
|
if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
|
||||||
|
status=$((status+ret))
|
||||||
|
diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
|
||||||
|
index 9adae82..2baff04 100644
|
||||||
|
--- a/bin/tests/system/upforwd/tests.sh
|
||||||
|
+++ b/bin/tests/system/upforwd/tests.sh
|
||||||
|
@@ -177,18 +177,21 @@ n=`expr $n + 1`
|
||||||
|
|
||||||
|
if test -f keyname
|
||||||
|
then
|
||||||
|
- echo_i "checking update forwarding to with sig0 ($n)"
|
||||||
|
+ echo_i "checking update forwarding to with sig0 (expected to fail) ($n)"
|
||||||
|
ret=0
|
||||||
|
keyname=`cat keyname`
|
||||||
|
- $NSUPDATE -k $keyname.private -- - <<EOF
|
||||||
|
+ # SIG(0) is removed, update is expected to fail.
|
||||||
|
+ {
|
||||||
|
+ $NSUPDATE -k $keyname.private -- - <<EOF
|
||||||
|
server 10.53.0.3 ${PORT}
|
||||||
|
zone example2
|
||||||
|
update add unsigned.example2. 600 A 10.10.10.1
|
||||||
|
update add unsigned.example2. 600 TXT Foo
|
||||||
|
send
|
||||||
|
EOF
|
||||||
|
+ } >nsupdate.out.$n 2>&1 && ret=1
|
||||||
|
$DIG -p ${PORT} unsigned.example2 A @10.53.0.1 > dig.out.ns1.test$n
|
||||||
|
- grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
|
||||||
|
+ grep "status: NOERROR" dig.out.ns1.test$n > /dev/null && ret=1
|
||||||
|
if [ $ret != 0 ] ; then echo_i "failed"; fi
|
||||||
|
status=`expr $status + $ret`
|
||||||
|
n=`expr $n + 1`
|
||||||
|
diff --git a/lib/dns/message.c b/lib/dns/message.c
|
||||||
|
index 0d94250..5568202 100644
|
||||||
|
--- a/lib/dns/message.c
|
||||||
|
+++ b/lib/dns/message.c
|
||||||
|
@@ -3214,102 +3214,23 @@ dns_message_dumpsig(dns_message_t *msg, char *txt1) {
|
||||||
|
|
||||||
|
isc_result_t
|
||||||
|
dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
|
||||||
|
- isc_buffer_t b, msgb;
|
||||||
|
+ isc_buffer_t msgb;
|
||||||
|
|
||||||
|
REQUIRE(DNS_MESSAGE_VALID(msg));
|
||||||
|
|
||||||
|
- if (msg->tsigkey == NULL && msg->tsig == NULL && msg->sig0 == NULL)
|
||||||
|
+ if (msg->tsigkey == NULL && msg->tsig == NULL)
|
||||||
|
return (ISC_R_SUCCESS);
|
||||||
|
|
||||||
|
INSIST(msg->saved.base != NULL);
|
||||||
|
isc_buffer_init(&msgb, msg->saved.base, msg->saved.length);
|
||||||
|
isc_buffer_add(&msgb, msg->saved.length);
|
||||||
|
- if (msg->tsigkey != NULL || msg->tsig != NULL) {
|
||||||
|
#ifdef SKAN_MSG_DEBUG
|
||||||
|
- dns_message_dumpsig(msg, "dns_message_checksig#1");
|
||||||
|
+ dns_message_dumpsig(msg, "dns_message_checksig#1");
|
||||||
|
#endif
|
||||||
|
- if (view != NULL)
|
||||||
|
- return (dns_view_checksig(view, &msgb, msg));
|
||||||
|
- else
|
||||||
|
- return (dns_tsig_verify(&msgb, msg, NULL, NULL));
|
||||||
|
+ if (view != NULL) {
|
||||||
|
+ return (dns_view_checksig(view, &msgb, msg));
|
||||||
|
} else {
|
||||||
|
- dns_rdata_t rdata = DNS_RDATA_INIT;
|
||||||
|
- dns_rdata_sig_t sig;
|
||||||
|
- dns_rdataset_t keyset;
|
||||||
|
- isc_result_t result;
|
||||||
|
-
|
||||||
|
- result = dns_rdataset_first(msg->sig0);
|
||||||
|
- INSIST(result == ISC_R_SUCCESS);
|
||||||
|
- dns_rdataset_current(msg->sig0, &rdata);
|
||||||
|
-
|
||||||
|
- /*
|
||||||
|
- * This can occur when the message is a dynamic update, since
|
||||||
|
- * the rdata length checking is relaxed. This should not
|
||||||
|
- * happen in a well-formed message, since the SIG(0) is only
|
||||||
|
- * looked for in the additional section, and the dynamic update
|
||||||
|
- * meta-records are in the prerequisite and update sections.
|
||||||
|
- */
|
||||||
|
- if (rdata.length == 0)
|
||||||
|
- return (ISC_R_UNEXPECTEDEND);
|
||||||
|
-
|
||||||
|
- result = dns_rdata_tostruct(&rdata, &sig, msg->mctx);
|
||||||
|
- if (result != ISC_R_SUCCESS)
|
||||||
|
- return (result);
|
||||||
|
-
|
||||||
|
- dns_rdataset_init(&keyset);
|
||||||
|
- if (view == NULL)
|
||||||
|
- return (DNS_R_KEYUNAUTHORIZED);
|
||||||
|
- result = dns_view_simplefind(view, &sig.signer,
|
||||||
|
- dns_rdatatype_key /* SIG(0) */,
|
||||||
|
- 0, 0, false, &keyset, NULL);
|
||||||
|
-
|
||||||
|
- if (result != ISC_R_SUCCESS) {
|
||||||
|
- /* XXXBEW Should possibly create a fetch here */
|
||||||
|
- result = DNS_R_KEYUNAUTHORIZED;
|
||||||
|
- goto freesig;
|
||||||
|
- } else if (keyset.trust < dns_trust_secure) {
|
||||||
|
- /* XXXBEW Should call a validator here */
|
||||||
|
- result = DNS_R_KEYUNAUTHORIZED;
|
||||||
|
- goto freesig;
|
||||||
|
- }
|
||||||
|
- result = dns_rdataset_first(&keyset);
|
||||||
|
- INSIST(result == ISC_R_SUCCESS);
|
||||||
|
- for (;
|
||||||
|
- result == ISC_R_SUCCESS;
|
||||||
|
- result = dns_rdataset_next(&keyset))
|
||||||
|
- {
|
||||||
|
- dst_key_t *key = NULL;
|
||||||
|
-
|
||||||
|
- dns_rdata_reset(&rdata);
|
||||||
|
- dns_rdataset_current(&keyset, &rdata);
|
||||||
|
- isc_buffer_init(&b, rdata.data, rdata.length);
|
||||||
|
- isc_buffer_add(&b, rdata.length);
|
||||||
|
-
|
||||||
|
- result = dst_key_fromdns(&sig.signer, rdata.rdclass,
|
||||||
|
- &b, view->mctx, &key);
|
||||||
|
- if (result != ISC_R_SUCCESS)
|
||||||
|
- continue;
|
||||||
|
- if (dst_key_alg(key) != sig.algorithm ||
|
||||||
|
- dst_key_id(key) != sig.keyid ||
|
||||||
|
- !(dst_key_proto(key) == DNS_KEYPROTO_DNSSEC ||
|
||||||
|
- dst_key_proto(key) == DNS_KEYPROTO_ANY))
|
||||||
|
- {
|
||||||
|
- dst_key_free(&key);
|
||||||
|
- continue;
|
||||||
|
- }
|
||||||
|
- result = dns_dnssec_verifymessage(&msgb, msg, key);
|
||||||
|
- dst_key_free(&key);
|
||||||
|
- if (result == ISC_R_SUCCESS)
|
||||||
|
- break;
|
||||||
|
- }
|
||||||
|
- if (result == ISC_R_NOMORE)
|
||||||
|
- result = DNS_R_KEYUNAUTHORIZED;
|
||||||
|
-
|
||||||
|
- freesig:
|
||||||
|
- if (dns_rdataset_isassociated(&keyset))
|
||||||
|
- dns_rdataset_disassociate(&keyset);
|
||||||
|
- dns_rdata_freestruct(&sig);
|
||||||
|
- return (result);
|
||||||
|
+ return (dns_tsig_verify(&msgb, msg, NULL, NULL));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
--
|
||||||
|
2.33.0
|
||||||
|
|
||||||
@ -0,0 +1,98 @@
|
|||||||
|
From 8ef414a7f38a04cfc11df44adaedaf3126fa3878 Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
|
||||||
|
Date: Mon, 29 Jan 2024 16:36:30 +0100
|
||||||
|
Subject: [PATCH] Optimize the slabheader placement for certain RRTypes
|
||||||
|
|
||||||
|
Mark the infrastructure RRTypes as "priority" types and place them at
|
||||||
|
the beginning of the rdataslab header data graph. The non-priority
|
||||||
|
types either go right after the priority types (if any).
|
||||||
|
|
||||||
|
(cherry picked from commit 3ac482be7fd058d284e89873021339579fad0615)
|
||||||
|
|
||||||
|
Conflict:NA
|
||||||
|
Reference:https://gitlab.isc.org/isc-projects/bind9/-/commit/8ef414a7f38a04cfc11df44adaedaf3126fa3878
|
||||||
|
|
||||||
|
---
|
||||||
|
lib/dns/rbtdb.c | 44 ++++++++++++++++++++++++++++++++++++++++++--
|
||||||
|
1 file changed, 42 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
|
||||||
|
index 6606769..cd5cd9b 100644
|
||||||
|
--- a/lib/dns/rbtdb.c
|
||||||
|
+++ b/lib/dns/rbtdb.c
|
||||||
|
@@ -1171,6 +1171,30 @@ set_ttl(dns_rbtdb_t *rbtdb, rdatasetheader_t *header, dns_ttl_t newttl) {
|
||||||
|
isc_heap_decreased(heap, header->heap_index);
|
||||||
|
}
|
||||||
|
|
||||||
|
+static bool
|
||||||
|
+prio_type(rbtdb_rdatatype_t type) {
|
||||||
|
+ switch (type) {
|
||||||
|
+ case dns_rdatatype_soa:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_soa):
|
||||||
|
+ case dns_rdatatype_a:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_a):
|
||||||
|
+ case dns_rdatatype_aaaa:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_aaaa):
|
||||||
|
+ case dns_rdatatype_nsec:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec):
|
||||||
|
+ case dns_rdatatype_nsec3:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec3):
|
||||||
|
+ case dns_rdatatype_ns:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ns):
|
||||||
|
+ case dns_rdatatype_ds:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ds):
|
||||||
|
+ case dns_rdatatype_cname:
|
||||||
|
+ case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname):
|
||||||
|
+ return (true);
|
||||||
|
+ }
|
||||||
|
+ return (false);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/*%
|
||||||
|
* These functions allow the heap code to rank the priority of each
|
||||||
|
* element. It returns true if v1 happens "sooner" than v2.
|
||||||
|
@@ -6275,6 +6299,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
{
|
||||||
|
rbtdb_changed_t *changed = NULL;
|
||||||
|
rdatasetheader_t *topheader, *topheader_prev, *header, *sigheader;
|
||||||
|
+ rdatasetheader_t *prioheader = NULL;
|
||||||
|
unsigned char *merged;
|
||||||
|
isc_result_t result;
|
||||||
|
bool header_nx;
|
||||||
|
@@ -6416,6 +6441,9 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
for (topheader = rbtnode->data;
|
||||||
|
topheader != NULL;
|
||||||
|
topheader = topheader->next) {
|
||||||
|
+ if (prio_type(topheader->type)) {
|
||||||
|
+ prioheader = topheader;
|
||||||
|
+ }
|
||||||
|
if (topheader->type == newheader->type ||
|
||||||
|
topheader->type == negtype)
|
||||||
|
break;
|
||||||
|
@@ -6779,9 +6807,21 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
|
||||||
|
/*
|
||||||
|
* No rdatasets of the given type exist at the node.
|
||||||
|
*/
|
||||||
|
- newheader->next = rbtnode->data;
|
||||||
|
newheader->down = NULL;
|
||||||
|
- rbtnode->data = newheader;
|
||||||
|
+
|
||||||
|
+ if (prio_type(newheader->type)) {
|
||||||
|
+ /* This is a priority type, prepend it */
|
||||||
|
+ newheader->next = rbtnode->data;
|
||||||
|
+ rbtnode->data = newheader;
|
||||||
|
+ } else if (prioheader != NULL) {
|
||||||
|
+ /* Append after the priority headers */
|
||||||
|
+ newheader->next = prioheader->next;
|
||||||
|
+ prioheader->next = newheader;
|
||||||
|
+ } else {
|
||||||
|
+ /* There were no priority headers */
|
||||||
|
+ newheader->next = rbtnode->data;
|
||||||
|
+ rbtnode->data = newheader;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
--
|
||||||
|
2.33.0
|
||||||
|
|
||||||
20
bind.spec
20
bind.spec
@ -19,7 +19,7 @@ Name: bind
|
|||||||
Summary: Domain Name System (DNS) Server (named)
|
Summary: Domain Name System (DNS) Server (named)
|
||||||
License: MPLv2.0
|
License: MPLv2.0
|
||||||
Version: 9.11.21
|
Version: 9.11.21
|
||||||
Release: 18
|
Release: 19
|
||||||
Epoch: 32
|
Epoch: 32
|
||||||
Url: http://www.isc.org/products/BIND/
|
Url: http://www.isc.org/products/BIND/
|
||||||
Source0: https://ftp.isc.org/isc/bind9/9.11.21/bind-%{version}.tar.gz
|
Source0: https://ftp.isc.org/isc/bind9/9.11.21/bind-%{version}.tar.gz
|
||||||
@ -244,6 +244,12 @@ Patch6068: backport-CVE-2022-38178.patch
|
|||||||
Patch6069: backport-CVE-2023-2828.patch
|
Patch6069: backport-CVE-2023-2828.patch
|
||||||
|
|
||||||
Patch6070: backport-CVE-2023-3341.patch
|
Patch6070: backport-CVE-2023-3341.patch
|
||||||
|
Patch6071:backport-CVE-2024-1975.patch
|
||||||
|
Patch6072:backport-optimize-the-slabheader-placement-for-certain-RRtype.patch
|
||||||
|
Patch6073:backport-0001-CVE-2024-1737.patch
|
||||||
|
Patch6074:backport-0002-CVE-2024-1737.patch
|
||||||
|
Patch6075:backport-0003-CVE-2024-1737.patch
|
||||||
|
Patch6076:backport-0004-CVE-2024-1737.patch
|
||||||
|
|
||||||
%description
|
%description
|
||||||
Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name
|
Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name
|
||||||
@ -527,6 +533,12 @@ cp -a %{SOURCE29} lib/dns/tests/testdata/dstrandom/random.data
|
|||||||
|
|
||||||
%patch6069 -p1
|
%patch6069 -p1
|
||||||
%patch6070 -p1
|
%patch6070 -p1
|
||||||
|
%patch6071 -p1
|
||||||
|
%patch6072 -p1
|
||||||
|
%patch6073 -p1
|
||||||
|
%patch6074 -p1
|
||||||
|
%patch6075 -p1
|
||||||
|
%patch6076 -p1
|
||||||
|
|
||||||
%patch199 -p1
|
%patch199 -p1
|
||||||
|
|
||||||
@ -1308,6 +1320,12 @@ rm -rf ${RPM_BUILD_ROOT}
|
|||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Aug 02 2024 chengyechun <chengyechun1@huawei.com> - 32:9.11.21-19
|
||||||
|
- Type:CVE
|
||||||
|
- CVE:CVE-2024-1975,CVE-2024-1737
|
||||||
|
- SUG:NA
|
||||||
|
- DESC:fix CVE-2024-1975 CVE-2024-1737
|
||||||
|
|
||||||
* Thu Sep 28 2023 sunhai <sunhai10@huawei.com> - 32:9.11.21-18
|
* Thu Sep 28 2023 sunhai <sunhai10@huawei.com> - 32:9.11.21-18
|
||||||
- Type:bugfix
|
- Type:bugfix
|
||||||
- ID:NA
|
- ID:NA
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user