Skip site navigation (1)Skip section navigation (2) 
Date:      Thu, 17 Nov 2011 00:36:11 +0000 (UTC)
From:      Doug Barton <dougb@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org
Subject:   svn commit: r227599 - in stable/8/contrib/bind9: . bin/named lib/dns
Message-ID:  <201111170036.pAH0aBRi073835@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: dougb
Date: Thu Nov 17 00:36:10 2011
New Revision: 227599
URL: http://svn.freebsd.org/changeset/base/227599

Log:
  Upgrade to BIND 9.6-ESV-R5-P1 to address the following DDOS bug:
  
  Recursive name servers are failing with an assertion:
  INSIST(! dns_rdataset_isassociated(sigrdataset))
  
  At this time it is not thought that authoritative-only servers
  are affected, but information about this bug is evolving rapidly.
  
  Because it may be possible to trigger this bug even on networks
  that do not allow untrusted users to access the recursive name
  servers (perhaps via specially crafted e-mail messages, and/or
  malicious web sites) it is recommended that ALL operators of
  recursive name servers upgrade immediately.
  
  For more information see:
  https://www.isc.org/software/bind/advisories/cve-2011-tbd
  which will be updated as more information becomes available.
  
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313

Modified:
  stable/8/contrib/bind9/CHANGES
  stable/8/contrib/bind9/bin/named/query.c
  stable/8/contrib/bind9/lib/dns/rbtdb.c
  stable/8/contrib/bind9/version
Directory Properties:
  stable/8/contrib/bind9/   (props changed)

Modified: stable/8/contrib/bind9/CHANGES
==============================================================================
--- stable/8/contrib/bind9/CHANGES	Thu Nov 17 00:34:31 2011	(r227598)
+++ stable/8/contrib/bind9/CHANGES	Thu Nov 17 00:36:10 2011	(r227599)
@@ -1,3 +1,9 @@
+	--- 9.6-ESV-R5-P1 released ---
+
+3218.	[security]	Cache lookup could return RRSIG data associated with
+			nonexistent records, leading to an assertion
+			failure. [RT #26590]
+
 	--- 9.6-ESV-R5 released ---
 
 3135.	[port]		FreeBSD: workaround broken IPV6_USE_MIN_MTU processing.

Modified: stable/8/contrib/bind9/bin/named/query.c
==============================================================================
--- stable/8/contrib/bind9/bin/named/query.c	Thu Nov 17 00:34:31 2011	(r227598)
+++ stable/8/contrib/bind9/bin/named/query.c	Thu Nov 17 00:36:10 2011	(r227599)
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.313.20.27 2011-03-19 09:47:54 marka Exp $ */
+/* $Id: query.c,v 1.313.20.27.8.1 2011-11-16 09:11:42 marka Exp $ */
 
 /*! \file */
 
@@ -1280,11 +1280,9 @@ query_addadditional(void *arg, dns_name_
 			goto addname;
 		if (result == DNS_R_NCACHENXRRSET) {
 			dns_rdataset_disassociate(rdataset);
-			/*
-			 * Negative cache entries don't have sigrdatasets.
-			 */
-			INSIST(sigrdataset == NULL ||
-			       ! dns_rdataset_isassociated(sigrdataset));
+			if (sigrdataset != NULL &&
+			    dns_rdataset_isassociated(sigrdataset))
+				dns_rdataset_disassociate(sigrdataset);
 		}
 		if (result == ISC_R_SUCCESS) {
 			mname = NULL;
@@ -1325,8 +1323,9 @@ query_addadditional(void *arg, dns_name_
 			goto addname;
 		if (result == DNS_R_NCACHENXRRSET) {
 			dns_rdataset_disassociate(rdataset);
-			INSIST(sigrdataset == NULL ||
-			       ! dns_rdataset_isassociated(sigrdataset));
+			if (sigrdataset != NULL &&
+			    dns_rdataset_isassociated(sigrdataset))
+				dns_rdataset_disassociate(sigrdataset);
 		}
 		if (result == ISC_R_SUCCESS) {
 			mname = NULL;
@@ -1776,10 +1775,8 @@ query_addadditional2(void *arg, dns_name
 		goto setcache;
 	if (result == DNS_R_NCACHENXRRSET) {
 		dns_rdataset_disassociate(rdataset);
-		/*
-		 * Negative cache entries don't have sigrdatasets.
-		 */
-		INSIST(! dns_rdataset_isassociated(sigrdataset));
+		if (dns_rdataset_isassociated(sigrdataset))
+			dns_rdataset_disassociate(sigrdataset);
 	}
 	if (result == ISC_R_SUCCESS) {
 		/* Remember the result as a cache */

Modified: stable/8/contrib/bind9/lib/dns/rbtdb.c
==============================================================================
--- stable/8/contrib/bind9/lib/dns/rbtdb.c	Thu Nov 17 00:34:31 2011	(r227598)
+++ stable/8/contrib/bind9/lib/dns/rbtdb.c	Thu Nov 17 00:36:10 2011	(r227599)
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbtdb.c,v 1.270.12.32 2011-06-09 00:16:35 each Exp $ */
+/* $Id: rbtdb.c,v 1.270.12.32.8.1 2011-11-16 09:11:42 marka Exp $ */
 
 /*! \file */
 
@@ -4681,7 +4681,7 @@ cache_find(dns_db_t *db, dns_name_t *nam
 			      rdataset);
 		if (need_headerupdate(found, search.now))
 			update = found;
-		if (foundsig != NULL) {
+		if (!NEGATIVE(found) && foundsig != NULL) {
 			bind_rdataset(search.rbtdb, node, foundsig, search.now,
 				      sigrdataset);
 			if (need_headerupdate(foundsig, search.now))
@@ -5313,7 +5313,7 @@ cache_findrdataset(dns_db_t *db, dns_dbn
 	}
 	if (found != NULL) {
 		bind_rdataset(rbtdb, rbtnode, found, now, rdataset);
-		if (foundsig != NULL)
+		if (!NEGATIVE(found) && foundsig != NULL)
 			bind_rdataset(rbtdb, rbtnode, foundsig, now,
 				      sigrdataset);
 	}

Modified: stable/8/contrib/bind9/version
==============================================================================
--- stable/8/contrib/bind9/version	Thu Nov 17 00:34:31 2011	(r227598)
+++ stable/8/contrib/bind9/version	Thu Nov 17 00:36:10 2011	(r227599)
@@ -1,4 +1,4 @@
-# $Id: version,v 1.43.12.14 2011-07-21 02:48:13 marka Exp $
+# $Id: version,v 1.43.12.14.10.1 2011-11-16 09:18:28 marka Exp $
 # 
 # This file must follow /bin/sh rules.  It is imported directly via
 # configure.
@@ -7,4 +7,4 @@ MAJORVER=9
 MINORVER=6
 PATCHVER=
 RELEASETYPE=-ESV
-RELEASEVER=-R5
+RELEASEVER=-R5-P1

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201111170036.pAH0aBRi073835>