Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 22 Nov 2012 23:15:39 +0000 (UTC)
From:      "Simon L. Nielsen" <simon@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org
Subject:   svn commit: r243418 - in stable/7: contrib/bind9/bin/named contrib/bind9/lib/dns contrib/bind9/lib/dns/include/dns sys/compat/linux
Message-ID:  <201211222315.qAMNFdcO088458@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: simon
Date: Thu Nov 22 23:15:38 2012
New Revision: 243418
URL: http://svnweb.freebsd.org/changeset/base/243418

Log:
  Fix multiple Denial of Service vulnerabilities with named(8).
  
  Fix insufficient message length validation for EAP-TLS messages.
  
  Fix Linux compatibility layer input validation error.
  
  This commit includes stable/7 which was missed in r243417.
  
  Security:	FreeBSD-SA-12:06.bind
  Security:	FreeBSD-SA-12:07.hostapd
  Security:	FreeBSD-SA-12:08.linux
  Security:	CVE-2012-4244, CVE-2012-5166, CVE-2012-4445, CVE-2012-4576
  Approved by:	re
  Approved by:	security-officer

Modified:
  stable/7/contrib/bind9/bin/named/query.c
  stable/7/contrib/bind9/lib/dns/include/dns/rdata.h
  stable/7/contrib/bind9/lib/dns/master.c
  stable/7/contrib/bind9/lib/dns/rdata.c
  stable/7/sys/compat/linux/linux_ioctl.c

Modified: stable/7/contrib/bind9/bin/named/query.c
==============================================================================
--- stable/7/contrib/bind9/bin/named/query.c	Thu Nov 22 22:52:15 2012	(r243417)
+++ stable/7/contrib/bind9/bin/named/query.c	Thu Nov 22 23:15:38 2012	(r243418)
@@ -999,13 +999,6 @@ query_isduplicate(ns_client_t *client, d
 		mname = NULL;
 	}
 
-	/*
-	 * If the dns_name_t we're looking up is already in the message,
-	 * we don't want to trigger the caller's name replacement logic.
-	 */
-	if (name == mname)
-		mname = NULL;
-
 	*mnamep = mname;
 
 	CTRACE("query_isduplicate: false: done");
@@ -1199,6 +1192,7 @@ query_addadditional(void *arg, dns_name_
 	if (dns_rdataset_isassociated(rdataset) &&
 	    !query_isduplicate(client, fname, type, &mname)) {
 		if (mname != NULL) {
+			INSIST(mname != fname);
 			query_releasename(client, &fname);
 			fname = mname;
 		} else
@@ -1259,11 +1253,13 @@ query_addadditional(void *arg, dns_name_
 			mname = NULL;
 			if (!query_isduplicate(client, fname,
 					       dns_rdatatype_a, &mname)) {
+				if (mname != fname) {
 				if (mname != NULL) {
 					query_releasename(client, &fname);
 					fname = mname;
 				} else
 					need_addname = ISC_TRUE;
+				}
 				ISC_LIST_APPEND(fname->list, rdataset, link);
 				added_something = ISC_TRUE;
 				if (sigrdataset != NULL &&
@@ -1302,11 +1298,13 @@ query_addadditional(void *arg, dns_name_
 			mname = NULL;
 			if (!query_isduplicate(client, fname,
 					       dns_rdatatype_aaaa, &mname)) {
+				if (mname != fname) {
 				if (mname != NULL) {
 					query_releasename(client, &fname);
 					fname = mname;
 				} else
 					need_addname = ISC_TRUE;
+				}
 				ISC_LIST_APPEND(fname->list, rdataset, link);
 				added_something = ISC_TRUE;
 				if (sigrdataset != NULL &&
@@ -1817,6 +1815,7 @@ query_addadditional2(void *arg, dns_name
 		    crdataset->type == dns_rdatatype_aaaa) {
 			if (!query_isduplicate(client, fname, crdataset->type,
 					       &mname)) {
+				if (mname != fname) {
 				if (mname != NULL) {
 					/*
 					 * A different type of this name is
@@ -1833,6 +1832,7 @@ query_addadditional2(void *arg, dns_name
 					mname0 = mname;
 				} else
 					need_addname = ISC_TRUE;
+				}
 				ISC_LIST_UNLINK(cfname.list, crdataset, link);
 				ISC_LIST_APPEND(fname->list, crdataset, link);
 				added_something = ISC_TRUE;

Modified: stable/7/contrib/bind9/lib/dns/include/dns/rdata.h
==============================================================================
--- stable/7/contrib/bind9/lib/dns/include/dns/rdata.h	Thu Nov 22 22:52:15 2012	(r243417)
+++ stable/7/contrib/bind9/lib/dns/include/dns/rdata.h	Thu Nov 22 23:15:38 2012	(r243418)
@@ -127,6 +127,17 @@ struct dns_rdata {
 #define DNS_RDATA_UPDATE	0x0001		/*%< update pseudo record */
 
 /*
+ * The maximum length of a RDATA that can be sent on the wire.
+ * Max packet size (65535) less header (12), less name (1), type (2),
+ * class (2), ttl(4), length (2).
+ *
+ * None of the defined types that support name compression can exceed
+ * this and all new types are to be sent uncompressed.
+ */
+
+#define DNS_RDATA_MAXLENGTH	65512U
+
+/*
  * Flags affecting rdata formatting style.  Flags 0xFFFF0000
  * are used by masterfile-level formatting and defined elsewhere.
  * See additional comments at dns_rdata_tofmttext().

Modified: stable/7/contrib/bind9/lib/dns/master.c
==============================================================================
--- stable/7/contrib/bind9/lib/dns/master.c	Thu Nov 22 22:52:15 2012	(r243417)
+++ stable/7/contrib/bind9/lib/dns/master.c	Thu Nov 22 23:15:38 2012	(r243418)
@@ -75,7 +75,7 @@
 /*%
  * max message size - header - root - type - class - ttl - rdlen
  */
-#define MINTSIZ (65535 - 12 - 1 - 2 - 2 - 4 - 2)
+#define MINTSIZ DNS_RDATA_MAXLENGTH
 /*%
  * Size for tokens in the presentation format,
  * The largest tokens are the base64 blocks in KEY and CERT records,

Modified: stable/7/contrib/bind9/lib/dns/rdata.c
==============================================================================
--- stable/7/contrib/bind9/lib/dns/rdata.c	Thu Nov 22 22:52:15 2012	(r243417)
+++ stable/7/contrib/bind9/lib/dns/rdata.c	Thu Nov 22 23:15:38 2012	(r243418)
@@ -403,6 +403,7 @@ dns_rdata_fromwire(dns_rdata_t *rdata, d
 	isc_buffer_t st;
 	isc_boolean_t use_default = ISC_FALSE;
 	isc_uint32_t activelength;
+	size_t length;
 
 	REQUIRE(dctx != NULL);
 	if (rdata != NULL) {
@@ -433,6 +434,14 @@ dns_rdata_fromwire(dns_rdata_t *rdata, d
 	}
 
 	/*
+	 * Reject any rdata that expands out to more than DNS_RDATA_MAXLENGTH
+	 * as we cannot transmit it.
+	 */
+	length = isc_buffer_usedlength(target) - isc_buffer_usedlength(&st);
+	if (result == ISC_R_SUCCESS && length > DNS_RDATA_MAXLENGTH)
+		result = DNS_R_FORMERR;
+
+	/*
 	 * We should have consumed all of our buffer.
 	 */
 	if (result == ISC_R_SUCCESS && !buffer_empty(source))
@@ -440,8 +449,7 @@ dns_rdata_fromwire(dns_rdata_t *rdata, d
 
 	if (rdata != NULL && result == ISC_R_SUCCESS) {
 		region.base = isc_buffer_used(&st);
-		region.length = isc_buffer_usedlength(target) -
-				isc_buffer_usedlength(&st);
+		region.length = length;
 		dns_rdata_fromregion(rdata, rdclass, type, &region);
 	}
 
@@ -576,6 +584,7 @@ dns_rdata_fromtext(dns_rdata_t *rdata, d
 	unsigned long line;
 	void (*callback)(dns_rdatacallbacks_t *, const char *, ...);
 	isc_result_t tresult;
+	size_t length;
 
 	REQUIRE(origin == NULL || dns_name_isabsolute(origin) == ISC_TRUE);
 	if (rdata != NULL) {
@@ -648,10 +657,13 @@ dns_rdata_fromtext(dns_rdata_t *rdata, d
 		}
 	} while (1);
 
+	length = isc_buffer_usedlength(target) - isc_buffer_usedlength(&st);
+	if (result == ISC_R_SUCCESS && length > DNS_RDATA_MAXLENGTH)
+		result = ISC_R_NOSPACE;
+
 	if (rdata != NULL && result == ISC_R_SUCCESS) {
 		region.base = isc_buffer_used(&st);
-		region.length = isc_buffer_usedlength(target) -
-				isc_buffer_usedlength(&st);
+		region.length = length;
 		dns_rdata_fromregion(rdata, rdclass, type, &region);
 	}
 	if (result != ISC_R_SUCCESS) {
@@ -758,6 +770,7 @@ dns_rdata_fromstruct(dns_rdata_t *rdata,
 	isc_buffer_t st;
 	isc_region_t region;
 	isc_boolean_t use_default = ISC_FALSE;
+	size_t length;
 
 	REQUIRE(source != NULL);
 	if (rdata != NULL) {
@@ -772,10 +785,13 @@ dns_rdata_fromstruct(dns_rdata_t *rdata,
 	if (use_default)
 		(void)NULL;
 
+	length = isc_buffer_usedlength(target) - isc_buffer_usedlength(&st);
+	if (result == ISC_R_SUCCESS && length > DNS_RDATA_MAXLENGTH)
+		result = ISC_R_NOSPACE;
+
 	if (rdata != NULL && result == ISC_R_SUCCESS) {
 		region.base = isc_buffer_used(&st);
-		region.length = isc_buffer_usedlength(target) -
-				isc_buffer_usedlength(&st);
+		region.length = length;
 		dns_rdata_fromregion(rdata, rdclass, type, &region);
 	}
 	if (result != ISC_R_SUCCESS)

Modified: stable/7/sys/compat/linux/linux_ioctl.c
==============================================================================
--- stable/7/sys/compat/linux/linux_ioctl.c	Thu Nov 22 22:52:15 2012	(r243417)
+++ stable/7/sys/compat/linux/linux_ioctl.c	Thu Nov 22 23:15:38 2012	(r243418)
@@ -2207,8 +2207,9 @@ again:
 
 	ifc.ifc_len = valid_len; 
 	sbuf_finish(sb);
-	memcpy(PTRIN(ifc.ifc_buf), sbuf_data(sb), ifc.ifc_len);
-	error = copyout(&ifc, uifc, sizeof(ifc));
+	error = copyout(sbuf_data(sb), PTRIN(ifc.ifc_buf), ifc.ifc_len);
+	if (error == 0)
+		error = copyout(&ifc, uifc, sizeof(ifc));
 	sbuf_delete(sb);
 
 	return (error);



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201211222315.qAMNFdcO088458>