From owner-svn-src-stable-9@FreeBSD.ORG Tue Jul 24 22:32:04 2012 Return-Path: Delivered-To: svn-src-stable-9@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 276611065689; Tue, 24 Jul 2012 22:32:04 +0000 (UTC) (envelope-from dougb@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 07A648FC17; Tue, 24 Jul 2012 22:32:03 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q6OMW3pc081509; Tue, 24 Jul 2012 22:32:03 GMT (envelope-from dougb@svn.freebsd.org) Received: (from dougb@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id q6OMW3Ch081504; Tue, 24 Jul 2012 22:32:03 GMT (envelope-from dougb@svn.freebsd.org) Message-Id: <201207242232.q6OMW3Ch081504@svn.freebsd.org> From: Doug Barton Date: Tue, 24 Jul 2012 22:32:03 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org X-SVN-Group: stable-9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r238756 - in stable/9/contrib/bind9: . lib/dns X-BeenThere: svn-src-stable-9@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for only the 9-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jul 2012 22:32:04 -0000 Author: dougb Date: Tue Jul 24 22:32:03 2012 New Revision: 238756 URL: http://svn.freebsd.org/changeset/base/238756 Log: MFV r238744: Heavy DNSSEC Validation Load Can Cause a "Bad Cache" Assertion Failure in BIND9 High numbers of queries with DNSSEC validation enabled can cause an assertion failure in named, caused by using a "bad cache" data structure before it has been initialized. CVE: CVE-2012-3817 Posting date: 24 July, 2012 Approved by: re (kib) Modified: stable/9/contrib/bind9/CHANGES stable/9/contrib/bind9/lib/dns/resolver.c stable/9/contrib/bind9/lib/dns/zone.c stable/9/contrib/bind9/version Directory Properties: stable/9/contrib/bind9/ (props changed) Modified: stable/9/contrib/bind9/CHANGES ============================================================================== --- stable/9/contrib/bind9/CHANGES Tue Jul 24 22:10:11 2012 (r238755) +++ stable/9/contrib/bind9/CHANGES Tue Jul 24 22:32:03 2012 (r238756) @@ -1,3 +1,12 @@ + --- 9.8.3-P2 released --- + +3346. [security] Bad-cache data could be used before it was + initialized, causing an assert. [RT #30025] + +3342. [bug] Change #3314 broke saving of stub zones to disk + resulting in excessive cpu usage in some cases. + [RT #29952] + --- 9.8.3-P1 released --- 3331. [security] dns_rdataslab_fromrdataset could produce bad Modified: stable/9/contrib/bind9/lib/dns/resolver.c ============================================================================== --- stable/9/contrib/bind9/lib/dns/resolver.c Tue Jul 24 22:10:11 2012 (r238755) +++ stable/9/contrib/bind9/lib/dns/resolver.c Tue Jul 24 22:32:03 2012 (r238756) @@ -8448,6 +8448,7 @@ dns_resolver_addbadcache(dns_resolver_t goto cleanup; bad->type = type; bad->hashval = hashval; + bad->expire = *expire; isc_buffer_init(&buffer, bad + 1, name->length); dns_name_init(&bad->name, NULL); dns_name_copy(name, &bad->name, &buffer); @@ -8459,8 +8460,8 @@ dns_resolver_addbadcache(dns_resolver_t if (resolver->badcount < resolver->badhash * 2 && resolver->badhash > DNS_BADCACHE_SIZE) resizehash(resolver, &now, ISC_FALSE); - } - bad->expire = *expire; + } else + bad->expire = *expire; cleanup: UNLOCK(&resolver->lock); } Modified: stable/9/contrib/bind9/lib/dns/zone.c ============================================================================== --- stable/9/contrib/bind9/lib/dns/zone.c Tue Jul 24 22:10:11 2012 (r238755) +++ stable/9/contrib/bind9/lib/dns/zone.c Tue Jul 24 22:32:03 2012 (r238756) @@ -8027,13 +8027,14 @@ zone_maintenance(dns_zone_t *zone) { case dns_zone_master: case dns_zone_slave: case dns_zone_key: + case dns_zone_stub: LOCK_ZONE(zone); if (zone->masterfile != NULL && isc_time_compare(&now, &zone->dumptime) >= 0 && DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED) && DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDDUMP)) { dumping = was_dumping(zone); - } else + } else dumping = ISC_TRUE; UNLOCK_ZONE(zone); if (!dumping) { @@ -8386,7 +8387,7 @@ zone_dump(dns_zone_t *zone, isc_boolean_ goto fail; } - if (compact) { + if (compact && zone->type != dns_zone_stub) { dns_zone_t *dummy = NULL; LOCK_ZONE(zone); zone_iattach(zone, &dummy); @@ -9242,7 +9243,7 @@ stub_callback(isc_task_t *task, isc_even dns_zone_t *zone = NULL; char master[ISC_SOCKADDR_FORMATSIZE]; char source[ISC_SOCKADDR_FORMATSIZE]; - isc_uint32_t nscnt, cnamecnt; + isc_uint32_t nscnt, cnamecnt, refresh, retry, expire; isc_result_t result; isc_time_t now; isc_boolean_t exiting = ISC_FALSE; @@ -9390,19 +9391,32 @@ stub_callback(isc_task_t *task, isc_even ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_write); if (zone->db == NULL) zone_attachdb(zone, stub->db); + result = zone_get_from_db(zone, zone->db, NULL, NULL, NULL, &refresh, + &retry, &expire, NULL, NULL); + if (result == ISC_R_SUCCESS) { + zone->refresh = RANGE(refresh, zone->minrefresh, + zone->maxrefresh); + zone->retry = RANGE(retry, zone->minretry, zone->maxretry); + zone->expire = RANGE(expire, zone->refresh + zone->retry, + DNS_MAX_EXPIRE); + DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_HAVETIMERS); + } ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_write); dns_db_detach(&stub->db); - if (zone->masterfile != NULL) - zone_needdump(zone, 0); - dns_message_destroy(&msg); isc_event_free(&event); dns_request_destroy(&zone->request); + DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_REFRESH); + DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED); DNS_ZONE_JITTER_ADD(&now, zone->refresh, &zone->refreshtime); isc_interval_set(&i, zone->expire, 0); DNS_ZONE_TIME_ADD(&now, zone->expire, &zone->expiretime); + + if (zone->masterfile != NULL) + zone_needdump(zone, 0); + zone_settimer(zone, &now); goto free_stub; Modified: stable/9/contrib/bind9/version ============================================================================== --- stable/9/contrib/bind9/version Tue Jul 24 22:10:11 2012 (r238755) +++ stable/9/contrib/bind9/version Tue Jul 24 22:32:03 2012 (r238756) @@ -7,4 +7,4 @@ MAJORVER=9 MINORVER=8 PATCHVER=3 RELEASETYPE=-P -RELEASEVER=1 +RELEASEVER=2