!223 fix some CVEs

From: @chengyechun Reviewed-by: @jiangheng12 Signed-off-by: @jiangheng12
fix CVEs
2024-08-05 02:15:27 +00:00 · 2024-08-03 17:17:01 +08:00 · 2023-09-28 04:48:47 +00:00 · 2023-09-28 11:17:15 +08:00 · 2023-09-26 11:40:39 +00:00 · 2023-09-26 10:53:43 +08:00
9 changed files with 1173 additions and 2 deletions
--- a/backport-0001-CVE-2024-1737.patch
+++ b/backport-0001-CVE-2024-1737.patch
@ -0,0 +1,94 @@
+From fdabf4b9570a60688f9f7d1e88d885f7a3718bca Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Fri, 1 Mar 2024 08:26:07 +0100
+Subject: [PATCH 1/3] Add a limit to the number of RRs in RRSets
+ 
+Previously, the number of RRs in the RRSets were internally unlimited.
+As the data structure that holds the RRs is just a linked list, and
+there are places where we just walk through all of the RRs, adding an
+RRSet with huge number of RRs inside would slow down processing of said
+RRSets.
+ 
+The fix for end-of-life branches make the limit compile-time only for
+simplicity and the limit can be changed at the compile time by adding
+following define to CFLAGS:
+ 
+    -DDNS_RDATASET_MAX_RECORDS=<limit>
+ 
+(cherry picked from commit c5c4d00c38530390c9e1ae4c98b65fbbadfe9e5e)
+ 
+Conflict:NA
+Reference:https://gitlab.isc.org/isc-projects/bind9/-/commit/5360c90612abf51deb4a80b30e1da84fd61212a5
+
+---
+ configure           |  2 +-
+ configure.ac        |  2 +-
+ lib/dns/rdataslab.c | 12 ++++++++++++
+ 3 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/configure b/configure
+index 4bbcaa3..9151d64 100755
+--- a/configure
+++ b/configure
+@@ -12173,7 +12173,7 @@ fi
+ XTARGETS=
+ case "$enable_developer" in
+ yes)
+-	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1"
+	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000"
+ 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
+ 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
+ 	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
+diff --git a/configure.ac b/configure.ac
+index 285dfab..77c9b48 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -94,7 +94,7 @@ AC_ARG_ENABLE(developer,
+ XTARGETS=
+ case "$enable_developer" in
+ yes)
+-	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1"
+	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000"
+ 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
+ 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
+ 	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
+diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
+index 7cd3855..22fe63e 100644
+--- a/lib/dns/rdataslab.c
+++ b/lib/dns/rdataslab.c
+@@ -115,6 +115,10 @@ fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
+ }
+ #endif
+ 
+#ifndef DNS_RDATASET_MAX_RECORDS
+#define DNS_RDATASET_MAX_RECORDS 100
+#endif /* DNS_RDATASET_MAX_RECORDS */
+
+ isc_result_t
+ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
+ 			   isc_region_t *region, unsigned int reservelen)
+@@ -161,6 +165,10 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
+ 		return (ISC_R_SUCCESS);
+ 	}
+ 
+	if (nitems > DNS_RDATASET_MAX_RECORDS) {
+		return (DNS_R_TOOMANYRECORDS);
+	}
+
+ 	if (nitems > 0xffff)
+ 		return (ISC_R_NOSPACE);
+ 
+@@ -654,6 +662,10 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
+ #endif
+ 	INSIST(ocount > 0 && ncount > 0);
+ 
+	if (ocount + ncount > DNS_RDATASET_MAX_RECORDS) {
+		return (DNS_R_TOOMANYRECORDS);
+	}
+
+ #if DNS_RDATASET_FIXED
+ 	oncount = ncount;
+ #endif
+-- 
+2.33.0
+
--- a/backport-0002-CVE-2024-1737.patch
+++ b/backport-0002-CVE-2024-1737.patch
@ -0,0 +1,125 @@
+From dfcadc2085c8844b5836aff2b5ea51fb60c34868 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Wed, 29 May 2024 08:43:39 +0200
+Subject: [PATCH 2/3] Add a limit to the number of RR types for single name
+ 
+Previously, the number of RR types for a single owner name was limited
+only by the maximum number of the types (64k).  As the data structure
+that holds the RR types for the database node is just a linked list, and
+there are places where we just walk through the whole list (again and
+again), adding a large number of RR types for a single owner named with
+would slow down processing of such name (database node).
+ 
+Add a hard-coded limit (100) to cap the number of the RR types for a single
+owner.  The limit can be changed at the compile time by adding following
+define to CFLAGS:
+ 
+    -DDNS_RBTDB_MAX_RTYPES=<limit>
+ 
+Conflict:Context Adaptation
+Reference:https://gitlab.isc.org/isc-projects/bind9/-/commit/5360c90612abf51deb4a80b30e1da84fd61212a5
+
+---
+ configure       |  2 +-
+ configure.ac    |  2 +-
+ lib/dns/rbtdb.c | 17 +++++++++++++++++
+ 3 files changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/configure b/configure
+index 9151d64..3e1c868 100755
+--- a/configure
+++ b/configure
+@@ -12173,7 +12173,7 @@ fi
+ XTARGETS=
+ case "$enable_developer" in
+ yes)
+-	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000"
+	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
+ 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
+ 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
+ 	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
+diff --git a/configure.ac b/configure.ac
+index 77c9b48..6844934 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -94,7 +94,7 @@ AC_ARG_ENABLE(developer,
+ XTARGETS=
+ case "$enable_developer" in
+ yes)
+-	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000"
+	STD_CDEFINES="$STD_CDEFINES -DISC_LIST_CHECKINIT=1 -DDNS_RDATASET_MAX_RECORDS=5000 -DDNS_RBTDB_MAX_RTYPES=5000"
+ 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
+ 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
+ 	test "${enable_filter_aaaa+set}" = set || enable_filter_aaaa=yes
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index cd5cd9b..5e44653 100644
+--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
+@@ -6289,6 +6289,10 @@ update_recordsandbytes(bool add, rbtdb_version_t *rbtversion,
+ 	RWUNLOCK(&rbtversion->rwlock, isc_rwlocktype_write);
+ }
+ 
+#ifndef DNS_RBTDB_MAX_RTYPES
+#define DNS_RBTDB_MAX_RTYPES 100
+#endif /* DNS_RBTDB_MAX_RTYPES */
+
+ /*
+  * write lock on rbtnode must be held.
+  */
+@@ -6309,6 +6313,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 	rbtdb_rdatatype_t negtype, sigtype;
+ 	dns_trust_t trust;
+ 	int idx;
+	uint32_t ntypes;
+ 
+ 	/*
+ 	 * Add an rdatasetheader_t to a node.
+@@ -6371,6 +6376,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 					set_ttl(rbtdb, topheader, 0);
+ 					mark_header_ancient(rbtdb, topheader);
+ 				}
+				ntypes = 0;
+ 				goto find_header;
+ 			}
+ 			/*
+@@ -6392,9 +6398,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 			 * check for an extant non-stale NODATA ncache
+ 			 * entry which covers the same type as the RRSIG.
+ 			 */
+			ntypes = 0;
+ 			for (topheader = rbtnode->data;
+ 			     topheader != NULL;
+ 			     topheader = topheader->next) {
+				ntypes++;
+ 				if ((topheader->type ==
+ 					RBTDB_RDATATYPE_NCACHEANY) ||
+ 					(newheader->type == sigtype &&
+@@ -6438,9 +6446,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 		}
+ 	}
+ 
+	ntypes = 0;
+ 	for (topheader = rbtnode->data;
+ 	     topheader != NULL;
+ 	     topheader = topheader->next) {
+		ntypes++;
+ 		if (prio_type(topheader->type)) {
+ 			prioheader = topheader;
+ 		}
+@@ -6807,6 +6817,13 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 			/*
+ 			 * No rdatasets of the given type exist at the node.
+ 			 */
+
+			if (ntypes > DNS_RBTDB_MAX_RTYPES) {
+				free_rdataset(rbtdb, rbtdb->common.mctx,
+					      newheader);
+				return (ISC_R_QUOTA);
+			}
+
+ 			newheader->down = NULL;
+ 
+ 			if (prio_type(newheader->type)) {
+-- 
+2.33.0
+
--- a/backport-0003-CVE-2024-1737.patch
+++ b/backport-0003-CVE-2024-1737.patch
@ -0,0 +1,56 @@
+From b27c6bcce894786a8e082eafd59eccbf6f2731cb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Mon, 17 Jun 2024 11:40:40 +0200
+Subject: [PATCH] Expand the list of the priority types and move it to db_p.h
+ 
+Add HTTPS, SVCB, SRV, PTR, NAPTR, DNSKEY and TXT records to the list of
+the priority types that are put at the beginning of the slabheader list
+for faster access and to avoid eviction when there are more types than
+the max-types-per-name limit.
+ 
+Conflict:NA
+Reference:https://gitlab.isc.org/isc-projects/bind9/-/commit/b27c6bcce894786a8e082eafd59eccbf6f2731cb
+
+---
+ lib/dns/rbtdb.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 5e44653..9babac2 100644
+--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
+@@ -1178,6 +1178,8 @@ prio_type(rbtdb_rdatatype_t type) {
+ 	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_soa):
+ 	case dns_rdatatype_a:
+ 	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_a):
+	case dns_rdatatype_mx:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_mx):
+ 	case dns_rdatatype_aaaa:
+ 	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_aaaa):
+ 	case dns_rdatatype_nsec:
+@@ -1190,6 +1192,22 @@ prio_type(rbtdb_rdatatype_t type) {
+ 	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ds):
+ 	case dns_rdatatype_cname:
+ 	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname):
+	case dns_rdatatype_dname:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dname):
+	case dns_rdatatype_avc:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_avc):
+	case dns_rdatatype_hip:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_hip):
+	case dns_rdatatype_dnskey:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_dnskey):
+	case dns_rdatatype_srv:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_srv):
+	case dns_rdatatype_txt:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_txt):
+	case dns_rdatatype_ptr:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ptr):
+	case dns_rdatatype_naptr:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_naptr):
+ 		return (true);
+ 	}
+ 	return (false);
+-- 
+2.33.0
+
--- a/backport-0004-CVE-2024-1737.patch
+++ b/backport-0004-CVE-2024-1737.patch
@ -0,0 +1,185 @@
+From 57cd34441a1b4ecc9874a4a106c2c95b8d7a3120 Mon Sep 17 00:00:00 2001
+From: =?utf-8?b?T25kxZllaiBTdXLDvQ==?= <ondrej@isc.org>
+Date: Mon, 17 Jun 2024 11:40:40 +0200
+Subject: Be smarter about refusing to add many RR types to the database
+ 
+Instead of outright refusing to add new RR types to the cache, be a bit
+smarter:
+ 
+1. If the new header type is in our priority list, we always add either
+   positive or negative entry at the beginning of the list.
+ 
+2. If the new header type is negative entry, and we are over the limit,
+   we mark it as ancient immediately, so it gets evicted from the cache
+   as soon as possible.
+ 
+3. Otherwise add the new header after the priority headers (or at the
+   head of the list).
+ 
+4. If we are over the limit, evict the last entry on the normal header
+   list.
+ 
+(cherry picked from commit 57cd34441a1b4ecc9874a4a106c2c95b8d7a3120)
+ 
+Conflict:NA
+Reference:https://gitlab.isc.org/isc-projects/bind9/-/commit/57cd34441a1b4ecc9874a4a106c2c95b8d7a3120
+
+---
+ lib/dns/rbtdb.c | 71 ++++++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 59 insertions(+), 12 deletions(-)
+
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 9babac2..4d4b971 100644
+--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
+@@ -6311,6 +6311,26 @@ update_recordsandbytes(bool add, rbtdb_version_t *rbtversion,
+ #define DNS_RBTDB_MAX_RTYPES 100
+ #endif /* DNS_RBTDB_MAX_RTYPES */
+ 
+static bool
+overmaxtype(dns_rbtdb_t *rbtdb, uint32_t ntypes) {
+	UNUSED(rbtdb);
+
+	if (DNS_RBTDB_MAX_RTYPES == 0) {
+		return (false);
+	}
+
+	return (ntypes >= DNS_RBTDB_MAX_RTYPES);
+}
+
+static bool
+prio_header(rdatasetheader_t *header) {
+	if (NEGATIVE(header) && prio_type(RBTDB_RDATATYPE_EXT(header->type))) {
+		return (true);
+	}
+
+	return (prio_type(header->type));
+}
+
+ /*
+  * write lock on rbtnode must be held.
+  */
+@@ -6321,7 +6341,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ {
+ 	rbtdb_changed_t *changed = NULL;
+ 	rdatasetheader_t *topheader, *topheader_prev, *header, *sigheader;
+-	rdatasetheader_t *prioheader = NULL;
+	rdatasetheader_t *prioheader = NULL, *expireheader = NULL;
+ 	unsigned char *merged;
+ 	isc_result_t result;
+ 	bool header_nx;
+@@ -6331,7 +6351,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 	rbtdb_rdatatype_t negtype, sigtype;
+ 	dns_trust_t trust;
+ 	int idx;
+-	uint32_t ntypes;
+	uint32_t ntypes = 0;
+ 
+ 	/*
+ 	 * Add an rdatasetheader_t to a node.
+@@ -6394,7 +6414,6 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 					set_ttl(rbtdb, topheader, 0);
+ 					mark_header_ancient(rbtdb, topheader);
+ 				}
+-				ntypes = 0;
+ 				goto find_header;
+ 			}
+ 			/*
+@@ -6404,8 +6423,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 			for (topheader = rbtnode->data;
+ 			     topheader != NULL;
+ 			     topheader = topheader->next)
+-				if (topheader->type == sigtype)
+				if (topheader->type == sigtype) {
+ 					sigheader = topheader;
+					break;
+				}
+ 			negtype = RBTDB_RDATATYPE_VALUE(covers, 0);
+ 		} else {
+ 			/*
+@@ -6416,11 +6437,9 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 			 * check for an extant non-stale NODATA ncache
+ 			 * entry which covers the same type as the RRSIG.
+ 			 */
+-			ntypes = 0;
+ 			for (topheader = rbtnode->data;
+ 			     topheader != NULL;
+ 			     topheader = topheader->next) {
+-				ntypes++;
+ 				if ((topheader->type ==
+ 					RBTDB_RDATATYPE_NCACHEANY) ||
+ 					(newheader->type == sigtype &&
+@@ -6464,12 +6483,16 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 		}
+ 	}
+ 
+-	ntypes = 0;
+ 	for (topheader = rbtnode->data;
+ 	     topheader != NULL;
+ 	     topheader = topheader->next) {
+-		ntypes++;
+-		if (prio_type(topheader->type)) {
+		if (IS_CACHE(rbtdb) && ACTIVE(topheader, now)) {
+			++ntypes;
+			expireheader = topheader;
+		} else if (!IS_CACHE(rbtdb)) {
+			++ntypes;
+		}
+		if (prio_header(topheader)) {
+ 			prioheader = topheader;
+ 		}
+ 		if (topheader->type == newheader->type ||
+@@ -6835,8 +6858,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 			/*
+ 			 * No rdatasets of the given type exist at the node.
+ 			 */
+-
+-			if (ntypes > DNS_RBTDB_MAX_RTYPES) {
+			if (!IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
+ 				free_rdataset(rbtdb, rbtdb->common.mctx,
+ 					      newheader);
+ 				return (ISC_R_QUOTA);
+@@ -6844,7 +6866,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 
+ 			newheader->down = NULL;
+ 
+-			if (prio_type(newheader->type)) {
+			if (prio_header(newheader)) {
+ 				/* This is a priority type, prepend it */
+ 				newheader->next = rbtnode->data;
+ 				rbtnode->data = newheader;
+@@ -6857,6 +6879,31 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 				newheader->next = rbtnode->data;
+ 				rbtnode->data = newheader;
+ 			}
+
+			if (IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
+				if (expireheader == NULL) {
+					expireheader = newheader;
+				}
+				if (NEGATIVE(newheader) &&
+				    !prio_header(newheader))
+				{
+					/*
+					 * Add the new non-priority negative
+					 * header to the database only
+					 * temporarily.
+					 */
+					expireheader = newheader;
+				}
+
+				set_ttl(rbtdb, expireheader, 0);
+				mark_header_ancient(rbtdb, expireheader);
+				/*
+				 * FIXME: In theory, we should mark the RRSIG
+				 * and the header at the same time, but there is
+				 * no direct link between those two header, so
+				 * we would have to check the whole list again.
+				 */
+			}
+ 		}
+ 	}
+ 
+-- 
+2.33.0
+
--- a/backport-CVE-2023-2828.patch
+++ b/backport-CVE-2023-2828.patch
@ -0,0 +1,171 @@
+From da0eafcdee52147e72d407cc3b9f179378ee1d3a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 30 May 2023 08:46:17 +0200
+Subject: [PATCH] Improve RBT overmem cache cleaning
+ 
+When cache memory usage is over the configured cache size (overmem) and
+we are cleaning unused entries, it might not be enough to clean just two
+entries if the entries to be expired are smaller than the newly added
+rdata.  This could be abused by an attacker to cause a remote Denial of
+Service by possibly running out of the operating system memory.
+ 
+Currently, the addrdataset() tries to do a single TTL-based cleaning
+considering the serve-stale TTL and then optionally moves to overmem
+cleaning if we are in that condition.  Then the overmem_purge() tries to
+do another single TTL based cleaning from the TTL heap and then continue
+with LRU-based cleaning up to 2 entries cleaned.
+ 
+Squash the TTL-cleaning mechanism into single call from addrdataset(),
+but ignore the serve-stale TTL if we are currently overmem.
+ 
+Then instead of having a fixed number of entries to clean, pass the size
+of newly added rdatasetheader to the overmem_purge() function and
+cleanup at least the size of the newly added data.  This prevents the
+cache going over the configured memory limit (`max-cache-size`).
+ 
+Additionally, refactor the overmem_purge() function to reduce for-loop
+nesting for readability
+ 
+---
+ lib/dns/rbtdb.c | 93 ++++++++++++++++++++++++++++---------------------
+ 1 file changed, 54 insertions(+), 39 deletions(-)
+ 
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 6de89bb..6606769 100644
+--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
+@@ -834,7 +834,7 @@ static void update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+ static void expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+ 			  bool tree_locked, expire_t reason);
+ static void overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start,
+-			  isc_stdtime_t now, bool tree_locked);
+			  size_t purgesize, bool tree_locked);
+ static isc_result_t resign_insert(dns_rbtdb_t *rbtdb, int idx,
+ 				  rdatasetheader_t *newheader);
+ static void resign_delete(dns_rbtdb_t *rbtdb, rbtdb_version_t *version,
+@@ -6924,6 +6924,16 @@ addclosest(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
+ 
+ static dns_dbmethods_t zone_methods;
+ 
+static size_t
+rdataset_size(rdatasetheader_t *header) {
+	if (!NONEXISTENT(header)) {
+		return (dns_rdataslab_size((unsigned char *)header,
+					   sizeof(*header)));
+	}
+
+	return (sizeof(*header));
+}
+
+ static isc_result_t
+ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 	    isc_stdtime_t now, dns_rdataset_t *rdataset, unsigned int options,
+@@ -7078,7 +7088,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+ 	}
+ 
+ 	if (cache_is_overmem)
+-		overmem_purge(rbtdb, rbtnode->locknum, now, tree_locked);
+		overmem_purge(rbtdb, rbtnode->locknum, rdataset_size(newheader),
+			      tree_locked);
+ 
+ 	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+ 		  isc_rwlocktype_write);
+@@ -10630,55 +10641,59 @@ update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+ 	ISC_LIST_PREPEND(rbtdb->rdatasets[header->node->locknum], header, link);
+ }
+ 
+static size_t
+expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum, size_t purgesize,
+		   bool tree_locked) {
+	rdatasetheader_t *header, *header_prev;
+	size_t purged = 0;
+
+	for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
+	     header != NULL && purged <= purgesize; header = header_prev)
+	{
+		header_prev = ISC_LIST_PREV(header, link);
+		/*
+		 * Unlink the entry at this point to avoid checking it
+		 * again even if it's currently used someone else and
+		 * cannot be purged at this moment.  This entry won't be
+		 * referenced any more (so unlinking is safe) since the
+		 * TTL was reset to 0.
+		 */
+		ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header, link);
+		size_t header_size = rdataset_size(header);
+		expire_header(rbtdb, header, tree_locked, expire_lru);
+		purged += header_size;
+	}
+
+	return (purged);
+}
+
+ /*%
+- * Purge some expired and/or stale (i.e. unused for some period) cache entries
+- * under an overmem condition.  To recover from this condition quickly, up to
+- * 2 entries will be purged.  This process is triggered while adding a new
+- * entry, and we specifically avoid purging entries in the same LRU bucket as
+- * the one to which the new entry will belong.  Otherwise, we might purge
+- * entries of the same name of different RR types while adding RRsets from a
+- * single response (consider the case where we're adding A and AAAA glue records
+- * of the same NS name).
+ * Purge some stale (i.e. unused for some period - LRU based cleaning) cache
+ * entries under the overmem condition.  To recover from this condition quickly,
+ * we cleanup entries up to the size of newly added rdata (passed as purgesize).
+ *
+ * This process is triggered while adding a new entry, and we specifically avoid
+ * purging entries in the same LRU bucket as the one to which the new entry will
+ * belong.  Otherwise, we might purge entries of the same name of different RR
+ * types while adding RRsets from a single response (consider the case where
+ * we're adding A and AAAA glue records of the same NS name).
+  */
+ static void
+ overmem_purge(dns_rbtdb_t *rbtdb, unsigned int locknum_start,
+-	      isc_stdtime_t now, bool tree_locked)
+	      size_t purgesize, bool tree_locked)
+ {
+-	rdatasetheader_t *header, *header_prev;
+ 	unsigned int locknum;
+-	int purgecount = 2;
+	size_t purged = 0;
+ 
+ 	for (locknum = (locknum_start + 1) % rbtdb->node_lock_count;
+-	     locknum != locknum_start && purgecount > 0;
+	     locknum != locknum_start && purged <= purgesize;
+ 	     locknum = (locknum + 1) % rbtdb->node_lock_count) {
+ 		NODE_LOCK(&rbtdb->node_locks[locknum].lock,
+ 			  isc_rwlocktype_write);
+ 
+-		header = isc_heap_element(rbtdb->heaps[locknum], 1);
+-		if (header && header->rdh_ttl < now - RBTDB_VIRTUAL) {
+-			expire_header(rbtdb, header, tree_locked,
+-				      expire_ttl);
+-			purgecount--;
+-		}
+-
+-		for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
+-		     header != NULL && purgecount > 0;
+-		     header = header_prev) {
+-			header_prev = ISC_LIST_PREV(header, link);
+-			/*
+-			 * Unlink the entry at this point to avoid checking it
+-			 * again even if it's currently used someone else and
+-			 * cannot be purged at this moment.  This entry won't be
+-			 * referenced any more (so unlinking is safe) since the
+-			 * TTL was reset to 0.
+-			 */
+-			ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header,
+-					link);
+-			expire_header(rbtdb, header, tree_locked,
+-				      expire_lru);
+-			purgecount--;
+-		}
+-
+		purged += expire_lru_headers(rbtdb, locknum, purgesize - purged,
+					     tree_locked);
+ 
+ 		NODE_UNLOCK(&rbtdb->node_locks[locknum].lock,
+ 				    isc_rwlocktype_write);
+ 	}
+-- 
+2.27.0
--- a/backport-CVE-2023-3341.patch
+++ b/backport-CVE-2023-3341.patch
@ -0,0 +1,172 @@
+From 820b0cceef0b67b041973da4041ea53d5e276363 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 20 Jun 2023 15:21:36 +1000
+Subject: [PATCH] Limit isccc_cc_fromwire recursion depth
+ 
+Named and rndc do not need a lot of recursion so the depth is
+set to 10.
+ 
+---
+ lib/isccc/cc.c                   | 41 +++++++++++++++++++++++---------
+ lib/isccc/include/isccc/result.h |  4 +++-
+ lib/isccc/result.c               |  4 +++-
+ 3 files changed, 36 insertions(+), 13 deletions(-)
+ 
+diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
+index c314d76..54ff3c6 100644
+--- a/lib/isccc/cc.c
+++ b/lib/isccc/cc.c
+@@ -54,6 +54,11 @@
+ #define MAX_TAGS		256
+ #define DUP_LIFETIME		900
+ 
+#ifndef ISCCC_MAXDEPTH
+#define ISCCC_MAXDEPTH \
+       10 /* Big enough for rndc which just sends a string each way. */
+#endif
+
+ typedef isccc_sexpr_t *sexpr_ptr;
+ 
+ #ifndef PK11_MD5_DISABLE
+@@ -573,19 +578,25 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
+ 
+ static isc_result_t
+ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
+-	       uint32_t algorithm, isccc_sexpr_t **alistp);
+	       uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp);
+ 
+ static isc_result_t
+-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp);
+list_fromwire(isccc_region_t *source, unsigned int depth,
+             isccc_sexpr_t **listp);
+ 
+ static isc_result_t
+-value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
+value_fromwire(isccc_region_t *source, unsigned int depth,
+              isccc_sexpr_t **valuep) {
+ 	unsigned int msgtype;
+ 	uint32_t len;
+ 	isccc_sexpr_t *value;
+ 	isccc_region_t active;
+ 	isc_result_t result;
+ 
+	if (depth > ISCCC_MAXDEPTH) {
+                return (ISCCC_R_MAXDEPTH);
+        }
+
+ 	if (REGION_SIZE(*source) < 1 + 4)
+ 		return (ISC_R_UNEXPECTEDEND);
+ 	GET8(msgtype, source->rstart);
+@@ -603,9 +614,9 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
+ 		} else
+ 			result = ISC_R_NOMEMORY;
+ 	} else if (msgtype == ISCCC_CCMSGTYPE_TABLE)
+-		result = table_fromwire(&active, NULL, 0, valuep);
+		result = table_fromwire(&active, NULL, 0, depth + 1, valuep);
+ 	else if (msgtype == ISCCC_CCMSGTYPE_LIST)
+-		result = list_fromwire(&active, valuep);
+		result = list_fromwire(&active, depth + 1, valuep);
+ 	else
+ 		result = ISCCC_R_SYNTAX;
+ 
+@@ -614,8 +625,7 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
+ 
+ static isc_result_t
+ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
+-	       uint32_t algorithm, isccc_sexpr_t **alistp)
+-{
+	       uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp) {
+ 	char key[256];
+ 	uint32_t len;
+ 	isc_result_t result;
+@@ -625,6 +635,10 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
+ 
+ 	REQUIRE(alistp != NULL && *alistp == NULL);
+ 
+	if (depth > ISCCC_MAXDEPTH) {
+		return (ISCCC_R_MAXDEPTH);
+	}
+
+ 	checksum_rstart = NULL;
+ 	first_tag = true;
+ 	alist = isccc_alist_create();
+@@ -640,7 +654,7 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
+ 		GET_MEM(key, len, source->rstart);
+ 		key[len] = '\0';	/* Ensure NUL termination. */
+ 		value = NULL;
+-		result = value_fromwire(source, &value);
+		result = value_fromwire(source, depth + 1, &value);
+ 		if (result != ISC_R_SUCCESS)
+ 			goto bad;
+ 		if (isccc_alist_define(alist, key, value) == NULL) {
+@@ -673,14 +687,19 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
+ }
+ 
+ static isc_result_t
+-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp) {
+list_fromwire(isccc_region_t *source, unsigned int depth,
+		isccc_sexpr_t **listp) {
+ 	isccc_sexpr_t *list, *value;
+ 	isc_result_t result;
+ 
+	if (depth > ISCCC_MAXDEPTH) {
+                return (ISCCC_R_MAXDEPTH);
+        }
+
+ 	list = NULL;
+ 	while (!REGION_EMPTY(*source)) {
+ 		value = NULL;
+-		result = value_fromwire(source, &value);
+		result = value_fromwire(source, depth + 1, &value);
+ 		if (result != ISC_R_SUCCESS) {
+ 			isccc_sexpr_free(&list);
+ 			return (result);
+@@ -711,7 +730,7 @@ isccc_cc_fromwire(isccc_region_t *source, isccc_sexpr_t **alistp,
+ 	if (version != 1)
+ 		return (ISCCC_R_UNKNOWNVERSION);
+ 
+-	return (table_fromwire(source, secret, algorithm, alistp));
+	return (table_fromwire(source, secret, algorithm, 0, alistp));
+ }
+ 
+ static isc_result_t
+diff --git a/lib/isccc/include/isccc/result.h b/lib/isccc/include/isccc/result.h
+index 6ff81ad..ef2cfe0 100644
+--- a/lib/isccc/include/isccc/result.h
+++ b/lib/isccc/include/isccc/result.h
+@@ -47,8 +47,10 @@
+ #define ISCCC_R_CLOCKSKEW		(ISC_RESULTCLASS_ISCCC + 4)
+ /*% Duplicate */
+ #define ISCCC_R_DUPLICATE		(ISC_RESULTCLASS_ISCCC + 5)
+/*% Maximum recursion depth */
+#define ISCCC_R_MAXDEPTH (ISC_RESULTCLASS_ISCCC + 6)
+ 
+-#define ISCCC_R_NRESULTS 		6	/*%< Number of results */
+#define ISCCC_R_NRESULTS 7 /*%< Number of results */
+ 
+ ISC_LANG_BEGINDECLS
+ 
+diff --git a/lib/isccc/result.c b/lib/isccc/result.c
+index 75f5ade..7d88fbc 100644
+--- a/lib/isccc/result.c
+++ b/lib/isccc/result.c
+@@ -40,7 +40,8 @@ static const char *text[ISCCC_R_NRESULTS] = {
+ 	"bad auth",				/* 3 */
+ 	"expired",				/* 4 */
+ 	"clock skew",				/* 5 */
+-	"duplicate"				/* 6 */
+	"duplicate",				/* 6 */
+	"max depth"        			/* 7 */
+ };
+ 
+ static const char *ids[ISCCC_R_NRESULTS] = {
+@@ -50,6 +51,7 @@ static const char *ids[ISCCC_R_NRESULTS] = {
+ 	"ISCCC_R_EXPIRED",
+ 	"ISCCC_R_CLOCKSKEW",
+ 	"ISCCC_R_DUPLICATE",
+	"ISCCC_R_MAXDEPTH"
+ };
+ 
+ #define ISCCC_RESULT_RESULTSET			2
+-- 
+2.27.0
--- a/backport-CVE-2024-1975.patch
+++ b/backport-CVE-2024-1975.patch
@ -0,0 +1,220 @@
+From bef3d2cca3552100bbe44790c8c1a4f5bef06798 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= <pspacek@isc.org>
+Date: Thu, 16 May 2024 12:10:41 +0200
+Subject: [PATCH] Remove support for SIG(0) message verification
+ 
+Conflict:Case adaptation and some documents are not incorporated.
+Reference:https://downloads.isc.org/isc/bind9/9.18.28/patches/0003-CVE-2024-1975.patch
+
+---
+ bin/tests/system/tsiggss/authsock.pl |  5 ++
+ bin/tests/system/tsiggss/tests.sh    | 12 ++--
+ bin/tests/system/upforwd/tests.sh    |  9 ++-
+ lib/dns/message.c                    | 91 ++--------------------------
+ 4 files changed, 24 insertions(+), 93 deletions(-)
+
+diff --git a/bin/tests/system/tsiggss/authsock.pl b/bin/tests/system/tsiggss/authsock.pl
+index 57a72b2..3afaa83 100644
+--- a/bin/tests/system/tsiggss/authsock.pl
+++ b/bin/tests/system/tsiggss/authsock.pl
+@@ -31,6 +31,10 @@ if (!defined($path)) {
+ 	exit(1);
+ }
+ 
+# Enable output autoflush so that it's not lost when the parent sends TERM.
+select STDOUT;
+$| = 1;
+
+ unlink($path);
+ my $server = IO::Socket::UNIX->new(Local => $path, Type => SOCK_STREAM, Listen => 8) or
+     die "unable to create socket $path";
+@@ -48,6 +52,7 @@ if ($timeout != 0) {
+ }
+ 
+ while (my $client = $server->accept()) {
+	printf("accept()\n");
+ 	$client->recv(my $buf, 8, 0);
+ 	my ($version, $req_len) = unpack('N N', $buf);
+ 
+diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh
+index e4c32dc..2d67533 100644
+--- a/bin/tests/system/tsiggss/tests.sh
+++ b/bin/tests/system/tsiggss/tests.sh
+@@ -116,7 +116,7 @@ status=$((status+ret))
+ 
+ echo "I:testing external update policy (CNAME) with auth sock ($n)"
+ ret=0
+-$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 > /dev/null 2>&1 &
+$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 > authsock.log 2>&1 &
+ sleep 1
+ test_update $n testcname.example.nil. CNAME "86400 CNAME testdenied.example.nil" "testdenied" || ret=1
+ n=$((n+1))
+@@ -130,17 +130,19 @@ n=$((n+1))
+ if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+ status=$((status+ret))
+ 
+-echo "I:testing external policy with SIG(0) key ($n)"
+echo "I:testing external policy with unsupported SIG(0) key ($n)"
+ ret=0
+-$NSUPDATE -R $RANDFILE -k ns1/Kkey.example.nil.*.private <<END > /dev/null 2>&1 || ret=1
+$NSUPDATE -R $RANDFILE -d -k ns1/Kkey.example.nil.*.private <<END > nsupdate.out${n} 2>&1 || true
+debug
+ server 10.53.0.1 ${PORT}
+ zone example.nil
+ update add fred.example.nil 120 cname foo.bar.
+ send
+ END
+ output=`$DIG $DIGOPTS +short cname fred.example.nil.`
+-[ -n "$output" ] || ret=1
+-[ $ret -eq 0 ] || echo "I:failed"
+# update must have failed - SIG(0) signer is not supported
+[ -n "$output" ] && ret=1
+grep -F "signer=key.example.nil" authsock.log >/dev/null && ret=1
+ n=$((n+1))
+ if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+ status=$((status+ret))
+diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
+index 9adae82..2baff04 100644
+--- a/bin/tests/system/upforwd/tests.sh
+++ b/bin/tests/system/upforwd/tests.sh
+@@ -177,18 +177,21 @@ n=`expr $n + 1`
+ 
+ if test -f keyname
+ then
+-	echo_i "checking update forwarding to with sig0 ($n)"
+	echo_i "checking update forwarding to with sig0 (expected to fail) ($n)"
+ 	ret=0
+ 	keyname=`cat keyname`
+-	$NSUPDATE -k $keyname.private -- - <<EOF
+	# SIG(0) is removed, update is expected to fail.
+        {
+        $NSUPDATE -k $keyname.private -- - <<EOF
+ 	server 10.53.0.3 ${PORT}
+ 	zone example2
+ 	update add unsigned.example2. 600 A 10.10.10.1
+ 	update add unsigned.example2. 600 TXT Foo
+ 	send
+ EOF
+        } >nsupdate.out.$n 2>&1 && ret=1
+ 	$DIG -p ${PORT} unsigned.example2 A @10.53.0.1 > dig.out.ns1.test$n
+-	grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
+	grep "status: NOERROR" dig.out.ns1.test$n > /dev/null && ret=1
+ 	if [ $ret != 0 ] ; then echo_i "failed"; fi
+ 	status=`expr $status + $ret`
+ 	n=`expr $n + 1`
+diff --git a/lib/dns/message.c b/lib/dns/message.c
+index 0d94250..5568202 100644
+--- a/lib/dns/message.c
+++ b/lib/dns/message.c
+@@ -3214,102 +3214,23 @@ dns_message_dumpsig(dns_message_t *msg, char *txt1) {
+ 
+ isc_result_t
+ dns_message_checksig(dns_message_t *msg, dns_view_t *view) {
+-	isc_buffer_t b, msgb;
+	isc_buffer_t msgb;
+ 
+ 	REQUIRE(DNS_MESSAGE_VALID(msg));
+ 
+-	if (msg->tsigkey == NULL && msg->tsig == NULL && msg->sig0 == NULL)
+	if (msg->tsigkey == NULL && msg->tsig == NULL)
+ 		return (ISC_R_SUCCESS);
+ 
+ 	INSIST(msg->saved.base != NULL);
+ 	isc_buffer_init(&msgb, msg->saved.base, msg->saved.length);
+ 	isc_buffer_add(&msgb, msg->saved.length);
+-	if (msg->tsigkey != NULL || msg->tsig != NULL) {
+ #ifdef SKAN_MSG_DEBUG
+-		dns_message_dumpsig(msg, "dns_message_checksig#1");
+	dns_message_dumpsig(msg, "dns_message_checksig#1");
+ #endif
+-		if (view != NULL)
+-			return (dns_view_checksig(view, &msgb, msg));
+-		else
+-			return (dns_tsig_verify(&msgb, msg, NULL, NULL));
+	if (view != NULL) {
+		return (dns_view_checksig(view, &msgb, msg));
+ 	} else {
+-		dns_rdata_t rdata = DNS_RDATA_INIT;
+-		dns_rdata_sig_t sig;
+-		dns_rdataset_t keyset;
+-		isc_result_t result;
+-
+-		result = dns_rdataset_first(msg->sig0);
+-		INSIST(result == ISC_R_SUCCESS);
+-		dns_rdataset_current(msg->sig0, &rdata);
+-
+-		/*
+-		 * This can occur when the message is a dynamic update, since
+-		 * the rdata length checking is relaxed.  This should not
+-		 * happen in a well-formed message, since the SIG(0) is only
+-		 * looked for in the additional section, and the dynamic update
+-		 * meta-records are in the prerequisite and update sections.
+-		 */
+-		if (rdata.length == 0)
+-			return (ISC_R_UNEXPECTEDEND);
+-
+-		result = dns_rdata_tostruct(&rdata, &sig, msg->mctx);
+-		if (result != ISC_R_SUCCESS)
+-			return (result);
+-
+-		dns_rdataset_init(&keyset);
+-		if (view == NULL)
+-			return (DNS_R_KEYUNAUTHORIZED);
+-		result = dns_view_simplefind(view, &sig.signer,
+-					     dns_rdatatype_key /* SIG(0) */,
+-					     0, 0, false, &keyset, NULL);
+-
+-		if (result != ISC_R_SUCCESS) {
+-			/* XXXBEW Should possibly create a fetch here */
+-			result = DNS_R_KEYUNAUTHORIZED;
+-			goto freesig;
+-		} else if (keyset.trust < dns_trust_secure) {
+-			/* XXXBEW Should call a validator here */
+-			result = DNS_R_KEYUNAUTHORIZED;
+-			goto freesig;
+-		}
+-		result = dns_rdataset_first(&keyset);
+-		INSIST(result == ISC_R_SUCCESS);
+-		for (;
+-		     result == ISC_R_SUCCESS;
+-		     result = dns_rdataset_next(&keyset))
+-		{
+-			dst_key_t *key = NULL;
+-
+-			dns_rdata_reset(&rdata);
+-			dns_rdataset_current(&keyset, &rdata);
+-			isc_buffer_init(&b, rdata.data, rdata.length);
+-			isc_buffer_add(&b, rdata.length);
+-
+-			result = dst_key_fromdns(&sig.signer, rdata.rdclass,
+-						 &b, view->mctx, &key);
+-			if (result != ISC_R_SUCCESS)
+-				continue;
+-			if (dst_key_alg(key) != sig.algorithm ||
+-			    dst_key_id(key) != sig.keyid ||
+-			    !(dst_key_proto(key) == DNS_KEYPROTO_DNSSEC ||
+-			      dst_key_proto(key) == DNS_KEYPROTO_ANY))
+-			{
+-				dst_key_free(&key);
+-				continue;
+-			}
+-			result = dns_dnssec_verifymessage(&msgb, msg, key);
+-			dst_key_free(&key);
+-			if (result == ISC_R_SUCCESS)
+-				break;
+-		}
+-		if (result == ISC_R_NOMORE)
+-			result = DNS_R_KEYUNAUTHORIZED;
+-
+- freesig:
+-		if (dns_rdataset_isassociated(&keyset))
+-			dns_rdataset_disassociate(&keyset);
+-		dns_rdata_freestruct(&sig);
+-		return (result);
+		return (dns_tsig_verify(&msgb, msg, NULL, NULL));
+ 	}
+ }
+ 
+-- 
+2.33.0
+
--- a/backport-optimize-the-slabheader-placement-for-certain-RRtype.patch
+++ b/backport-optimize-the-slabheader-placement-for-certain-RRtype.patch
@ -0,0 +1,98 @@
+From 8ef414a7f38a04cfc11df44adaedaf3126fa3878 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Mon, 29 Jan 2024 16:36:30 +0100
+Subject: [PATCH] Optimize the slabheader placement for certain RRTypes
+ 
+Mark the infrastructure RRTypes as "priority" types and place them at
+the beginning of the rdataslab header data graph.  The non-priority
+types either go right after the priority types (if any).
+ 
+(cherry picked from commit 3ac482be7fd058d284e89873021339579fad0615)
+ 
+Conflict:NA
+Reference:https://gitlab.isc.org/isc-projects/bind9/-/commit/8ef414a7f38a04cfc11df44adaedaf3126fa3878
+
+---
+ lib/dns/rbtdb.c | 44 ++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 42 insertions(+), 2 deletions(-)
+
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 6606769..cd5cd9b 100644
+--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
+@@ -1171,6 +1171,30 @@ set_ttl(dns_rbtdb_t *rbtdb, rdatasetheader_t *header, dns_ttl_t newttl) {
+ 		isc_heap_decreased(heap, header->heap_index);
+ }
+ 
+static bool
+prio_type(rbtdb_rdatatype_t type) {
+	switch (type) {
+	case dns_rdatatype_soa:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_soa):
+	case dns_rdatatype_a:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_a):
+	case dns_rdatatype_aaaa:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_aaaa):
+	case dns_rdatatype_nsec:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec):
+	case dns_rdatatype_nsec3:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_nsec3):
+	case dns_rdatatype_ns:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ns):
+	case dns_rdatatype_ds:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_ds):
+	case dns_rdatatype_cname:
+	case RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, dns_rdatatype_cname):
+		return (true);
+	}
+	return (false);
+}
+
+ /*%
+  * These functions allow the heap code to rank the priority of each
+  * element.  It returns true if v1 happens "sooner" than v2.
+@@ -6275,6 +6299,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ {
+ 	rbtdb_changed_t *changed = NULL;
+ 	rdatasetheader_t *topheader, *topheader_prev, *header, *sigheader;
+	rdatasetheader_t *prioheader = NULL;
+ 	unsigned char *merged;
+ 	isc_result_t result;
+ 	bool header_nx;
+@@ -6416,6 +6441,9 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 	for (topheader = rbtnode->data;
+ 	     topheader != NULL;
+ 	     topheader = topheader->next) {
+		if (prio_type(topheader->type)) {
+			prioheader = topheader;
+		}
+ 		if (topheader->type == newheader->type ||
+ 		    topheader->type == negtype)
+ 			break;
+@@ -6779,9 +6807,21 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+ 			/*
+ 			 * No rdatasets of the given type exist at the node.
+ 			 */
+-			newheader->next = rbtnode->data;
+ 			newheader->down = NULL;
+-			rbtnode->data = newheader;
+
+			if (prio_type(newheader->type)) {
+				/* This is a priority type, prepend it */
+				newheader->next = rbtnode->data;
+				rbtnode->data = newheader;
+			} else if (prioheader != NULL) {
+				/* Append after the priority headers */
+				newheader->next = prioheader->next;
+				prioheader->next = newheader;
+			} else {
+				/* There were no priority headers */
+				newheader->next = rbtnode->data;
+				rbtnode->data = newheader;
+			}
+ 		}
+ 	}
+ 
+-- 
+2.33.0
+
--- a/bind.spec
+++ b/bind.spec
@ -19,7 +19,7 @@ Name:           bind
 Summary:        Domain Name System (DNS) Server (named)
 License:        MPLv2.0
 Version:        9.11.21
-Release:        14
+Release:        19
 Epoch:          32
 Url:            http://www.isc.org/products/BIND/
 Source0:        https://ftp.isc.org/isc/bind9/9.11.21/bind-%{version}.tar.gz
@ -240,6 +240,17 @@ Patch6065: backport-CVE-2022-2881.patch
 Patch6066: backport-CVE-2022-2906.patch
 Patch6067: backport-CVE-2022-38177.patch
 Patch6068: backport-CVE-2022-38178.patch
+
+Patch6069: backport-CVE-2023-2828.patch
+
+Patch6070: backport-CVE-2023-3341.patch
+Patch6071:backport-CVE-2024-1975.patch
+Patch6072:backport-optimize-the-slabheader-placement-for-certain-RRtype.patch
+Patch6073:backport-0001-CVE-2024-1737.patch
+Patch6074:backport-0002-CVE-2024-1737.patch
+Patch6075:backport-0003-CVE-2024-1737.patch
+Patch6076:backport-0004-CVE-2024-1737.patch
+
 %description
 Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name
 System (DNS) protocols and provides an openly redistributable reference
@ -520,6 +531,15 @@ cp -a %{SOURCE29} lib/dns/tests/testdata/dstrandom/random.data
 %patch6067 -p1
 %patch6068 -p1

+%patch6069 -p1
+%patch6070 -p1
+%patch6071 -p1
+%patch6072 -p1
+%patch6073 -p1
+%patch6074 -p1
+%patch6075 -p1
+%patch6076 -p1
+
 %patch199 -p1

 %if %{with PKCS11}
@ -972,7 +992,7 @@ fi
 %define chroot_fix_devices() \
 if [ $1 -gt 1 ]; then \
    for DEV in "%{1}/dev"/{null,random,zero}; do \
-        if [ -e "$DEV" -a "$(/bin/stat --printf="%G %a" "$DEV")" = "root 644" ]; then \
+        if [ -e "$DEV" ] && [ "$(/bin/stat --printf="%G %a" "$DEV")" = "root 644" ]; then \
            /bin/chmod 0664 "$DEV" \
            /bin/chgrp named "$DEV" \
        fi \
@ -1300,6 +1320,36 @@ rm -rf ${RPM_BUILD_ROOT}


 %changelog
+* Fri Aug 02 2024 chengyechun <chengyechun1@huawei.com> - 32:9.11.21-19
+- Type:CVE
+- CVE:CVE-2024-1975,CVE-2024-1737
+- SUG:NA
+- DESC:fix CVE-2024-1975 CVE-2024-1737
+
+* Thu Sep 28 2023 sunhai <sunhai10@huawei.com> - 32:9.11.21-18
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:fix update
+
+* Tue Sep 26 2023 zhanghao <zhanghao383@huawei.com> - 32:9.11.21-17
+- Type:CVE
+- ID:CVE-2023-3341
+- SUG:NA
+- DESC:FIX CVE-2023-3341
+
+* Mon Jun 26 2023 zhanghao <zhanghao383@huawei.com> - 32:9.11.21-16
+- Type:CVE
+- ID:CVE-2023-2828
+- SUG:NA
+- DESC:FIX CVE-2023-2828
+
+* Thu Feb 09 2023 zhanghao <zhanghao383@huawei.com> - 32:9.11.21-15
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:fix output expected information when install bing-sdborbind-sdb-chroot
+
 * Tue Oct 11 2022 huangyu <huangyu106@huawei.com> - 32:9.11.21-14
 - Type:CVE
 - ID:CVE-2022-2906 CVE-2022-38177 CVE-2022-38178 CVE-2022-2795 CVE-2022-2881
Author	SHA1	Message	Date
openeuler-ci-bot	a95016184c	!223 fix some CVEs From: @chengyechun Reviewed-by: @jiangheng12 Signed-off-by: @jiangheng12	2024-08-05 02:15:27 +00:00
chengyechun	8f711a28d9	fix CVEs	2024-08-03 17:17:01 +08:00
openeuler-ci-bot	c879ea9511	!199 fix update From: @sun_hai_10 Reviewed-by: @sunsuwan Signed-off-by: @sunsuwan	2023-09-28 04:48:47 +00:00
sun_hai_10	a1e91b9690	fix update	2023-09-28 11:17:15 +08:00
openeuler-ci-bot	514e8a9b3b	!198 fix:CVE-2023-3341 From: @zhang-hao-jon Reviewed-by: @robertxw Signed-off-by: @robertxw	2023-09-26 11:40:39 +00:00
zhanghao	a9e7ccccc5	fix:CVE-2023-3341	2023-09-26 10:53:43 +08:00
openeuler-ci-bot	477ce02583	!177 bind: CVE-2023-2828 From: @zhang-hao-jon Reviewed-by: @sunsuwan Signed-off-by: @sunsuwan	2023-06-26 09:43:33 +00:00
zhanghao	a2f00a7a1e	bind:CVE-2023-2828	2023-06-26 14:26:08 +08:00
openeuler-ci-bot	827e0e5d57	!156 fix output expected information when install bing-sdborbind-sdb-chroot From: @zhang-hao-jon Reviewed-by: @kircher Signed-off-by: @kircher	2023-02-10 01:11:58 +00:00
renmingshuai	37b82b9ba8	bind:fix output expected information when install bing-sdborbind-sdb-chroot	2023-02-09 21:33:46 +08:00