From owner-svn-src-stable-8@FreeBSD.ORG Thu Sep 20 04:35:21 2012 Return-Path: Delivered-To: svn-src-stable-8@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9E532106564A; Thu, 20 Sep 2012 04:35:21 +0000 (UTC) (envelope-from dougb@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 878F08FC08; Thu, 20 Sep 2012 04:35:21 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q8K4ZLfC041316; Thu, 20 Sep 2012 04:35:21 GMT (envelope-from dougb@svn.freebsd.org) Received: (from dougb@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id q8K4ZLRI041307; Thu, 20 Sep 2012 04:35:21 GMT (envelope-from dougb@svn.freebsd.org) Message-Id: <201209200435.q8K4ZLRI041307@svn.freebsd.org> From: Doug Barton Date: Thu, 20 Sep 2012 04:35:21 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org X-SVN-Group: stable-8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r240732 - in stable/8/contrib/bind9: . bin/named bin/nsupdate lib/dns lib/dns/include/dns X-BeenThere: svn-src-stable-8@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for only the 8-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Sep 2012 04:35:21 -0000 Author: dougb Date: Thu Sep 20 04:35:20 2012 New Revision: 240732 URL: http://svn.freebsd.org/changeset/base/240732 Log: Upgrade to 9.6-ESV-R7-P3: Prevents a crash when queried for a record whose RDATA exceeds 65535 bytes. Prevents a crash when validating caused by using "Bad cache" data before it has been initialized. ISC_QUEUE handling for recursive clients was updated to address a race condition that could cause a memory leak. This rarely occurred with UDP clients, but could be a significant problem for a server handling a steady rate of TCP queries. A condition has been corrected where improper handling of zero-length RDATA could cause undesirable behavior, including termination of the named process. For more information: https://kb.isc.org/article/AA-00788 Modified: stable/8/contrib/bind9/CHANGES stable/8/contrib/bind9/bin/named/server.c stable/8/contrib/bind9/bin/nsupdate/nsupdate.c stable/8/contrib/bind9/lib/dns/include/dns/rdata.h stable/8/contrib/bind9/lib/dns/master.c stable/8/contrib/bind9/lib/dns/rdata.c stable/8/contrib/bind9/lib/dns/rdataslab.c stable/8/contrib/bind9/version Directory Properties: stable/8/contrib/bind9/ (props changed) Modified: stable/8/contrib/bind9/CHANGES ============================================================================== --- stable/8/contrib/bind9/CHANGES Thu Sep 20 04:21:29 2012 (r240731) +++ stable/8/contrib/bind9/CHANGES Thu Sep 20 04:35:20 2012 (r240732) @@ -1,3 +1,11 @@ + --- 9.6-ESV-R7-P3 released --- + +3364. [security] Named could die on specially crafted record. + [RT #30416] + +3358 [bug] Fix declaration of fatal in bin/named/server.c + and bin/nsupdate/main.c. [RT #30522] + --- 9.6-ESV-R7-P2 released --- 3346. [security] Bad-cache data could be used before it was Modified: stable/8/contrib/bind9/bin/named/server.c ============================================================================== --- stable/8/contrib/bind9/bin/named/server.c Thu Sep 20 04:21:29 2012 (r240731) +++ stable/8/contrib/bind9/bin/named/server.c Thu Sep 20 04:35:20 2012 (r240732) @@ -228,7 +228,7 @@ static const struct { { NULL, ISC_FALSE } }; -ISC_PLATFORM_NORETURN_POST static void +ISC_PLATFORM_NORETURN_PRE static void fatal(const char *msg, isc_result_t result) ISC_PLATFORM_NORETURN_POST; static void Modified: stable/8/contrib/bind9/bin/nsupdate/nsupdate.c ============================================================================== --- stable/8/contrib/bind9/bin/nsupdate/nsupdate.c Thu Sep 20 04:21:29 2012 (r240731) +++ stable/8/contrib/bind9/bin/nsupdate/nsupdate.c Thu Sep 20 04:35:20 2012 (r240732) @@ -174,7 +174,7 @@ typedef struct nsu_requestinfo { static void sendrequest(isc_sockaddr_t *srcaddr, isc_sockaddr_t *destaddr, dns_message_t *msg, dns_request_t **request); -ISC_PLATFORM_NORETURN_POST static void +ISC_PLATFORM_NORETURN_PRE static void fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2) ISC_PLATFORM_NORETURN_POST; Modified: stable/8/contrib/bind9/lib/dns/include/dns/rdata.h ============================================================================== --- stable/8/contrib/bind9/lib/dns/include/dns/rdata.h Thu Sep 20 04:21:29 2012 (r240731) +++ stable/8/contrib/bind9/lib/dns/include/dns/rdata.h Thu Sep 20 04:35:20 2012 (r240732) @@ -128,6 +128,17 @@ struct dns_rdata { #define DNS_RDATA_OFFLINE 0x0002 /*%< RRSIG has a offline key. */ /* + * The maximum length of a RDATA that can be sent on the wire. + * Max packet size (65535) less header (12), less name (1), type (2), + * class (2), ttl(4), length (2). + * + * None of the defined types that support name compression can exceed + * this and all new types are to be sent uncompressed. + */ + +#define DNS_RDATA_MAXLENGTH 65512U + +/* * Flags affecting rdata formatting style. Flags 0xFFFF0000 * are used by masterfile-level formatting and defined elsewhere. * See additional comments at dns_rdata_tofmttext(). Modified: stable/8/contrib/bind9/lib/dns/master.c ============================================================================== --- stable/8/contrib/bind9/lib/dns/master.c Thu Sep 20 04:21:29 2012 (r240731) +++ stable/8/contrib/bind9/lib/dns/master.c Thu Sep 20 04:35:20 2012 (r240732) @@ -75,7 +75,7 @@ /*% * max message size - header - root - type - class - ttl - rdlen */ -#define MINTSIZ (65535 - 12 - 1 - 2 - 2 - 4 - 2) +#define MINTSIZ DNS_RDATA_MAXLENGTH /*% * Size for tokens in the presentation format, * The largest tokens are the base64 blocks in KEY and CERT records, Modified: stable/8/contrib/bind9/lib/dns/rdata.c ============================================================================== --- stable/8/contrib/bind9/lib/dns/rdata.c Thu Sep 20 04:21:29 2012 (r240731) +++ stable/8/contrib/bind9/lib/dns/rdata.c Thu Sep 20 04:35:20 2012 (r240732) @@ -414,6 +414,7 @@ dns_rdata_fromwire(dns_rdata_t *rdata, d isc_buffer_t st; isc_boolean_t use_default = ISC_FALSE; isc_uint32_t activelength; + size_t length; REQUIRE(dctx != NULL); if (rdata != NULL) { @@ -444,6 +445,14 @@ dns_rdata_fromwire(dns_rdata_t *rdata, d } /* + * Reject any rdata that expands out to more than DNS_RDATA_MAXLENGTH + * as we cannot transmit it. + */ + length = isc_buffer_usedlength(target) - isc_buffer_usedlength(&st); + if (result == ISC_R_SUCCESS && length > DNS_RDATA_MAXLENGTH) + result = DNS_R_FORMERR; + + /* * We should have consumed all of our buffer. */ if (result == ISC_R_SUCCESS && !buffer_empty(source)) @@ -451,8 +460,7 @@ dns_rdata_fromwire(dns_rdata_t *rdata, d if (rdata != NULL && result == ISC_R_SUCCESS) { region.base = isc_buffer_used(&st); - region.length = isc_buffer_usedlength(target) - - isc_buffer_usedlength(&st); + region.length = length; dns_rdata_fromregion(rdata, rdclass, type, ®ion); } @@ -587,6 +595,7 @@ dns_rdata_fromtext(dns_rdata_t *rdata, d unsigned long line; void (*callback)(dns_rdatacallbacks_t *, const char *, ...); isc_result_t tresult; + size_t length; REQUIRE(origin == NULL || dns_name_isabsolute(origin) == ISC_TRUE); if (rdata != NULL) { @@ -658,10 +667,13 @@ dns_rdata_fromtext(dns_rdata_t *rdata, d } } while (1); + length = isc_buffer_usedlength(target) - isc_buffer_usedlength(&st); + if (result == ISC_R_SUCCESS && length > DNS_RDATA_MAXLENGTH) + result = ISC_R_NOSPACE; + if (rdata != NULL && result == ISC_R_SUCCESS) { region.base = isc_buffer_used(&st); - region.length = isc_buffer_usedlength(target) - - isc_buffer_usedlength(&st); + region.length = length; dns_rdata_fromregion(rdata, rdclass, type, ®ion); } if (result != ISC_R_SUCCESS) { @@ -789,6 +801,7 @@ dns_rdata_fromstruct(dns_rdata_t *rdata, isc_buffer_t st; isc_region_t region; isc_boolean_t use_default = ISC_FALSE; + size_t length; REQUIRE(source != NULL); if (rdata != NULL) { @@ -803,10 +816,13 @@ dns_rdata_fromstruct(dns_rdata_t *rdata, if (use_default) (void)NULL; + length = isc_buffer_usedlength(target) - isc_buffer_usedlength(&st); + if (result == ISC_R_SUCCESS && length > DNS_RDATA_MAXLENGTH) + result = ISC_R_NOSPACE; + if (rdata != NULL && result == ISC_R_SUCCESS) { region.base = isc_buffer_used(&st); - region.length = isc_buffer_usedlength(target) - - isc_buffer_usedlength(&st); + region.length = length; dns_rdata_fromregion(rdata, rdclass, type, ®ion); } if (result != ISC_R_SUCCESS) Modified: stable/8/contrib/bind9/lib/dns/rdataslab.c ============================================================================== --- stable/8/contrib/bind9/lib/dns/rdataslab.c Thu Sep 20 04:21:29 2012 (r240731) +++ stable/8/contrib/bind9/lib/dns/rdataslab.c Thu Sep 20 04:35:20 2012 (r240732) @@ -298,6 +298,7 @@ dns_rdataslab_fromrdataset(dns_rdataset_ length = x[i].rdata.length; if (rdataset->type == dns_rdatatype_rrsig) length++; + INSIST(length <= 0xffff); *rawbuf++ = (length & 0xff00) >> 8; *rawbuf++ = (length & 0x00ff); #if DNS_RDATASET_FIXED Modified: stable/8/contrib/bind9/version ============================================================================== --- stable/8/contrib/bind9/version Thu Sep 20 04:21:29 2012 (r240731) +++ stable/8/contrib/bind9/version Thu Sep 20 04:35:20 2012 (r240732) @@ -7,4 +7,4 @@ MAJORVER=9 MINORVER=6 PATCHVER= RELEASETYPE=-ESV -RELEASEVER=-R7-P2 +RELEASEVER=-R7-P3