From nobody Wed Nov 26 16:01:01 2025 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dGknB08vQz6JFpY for ; Wed, 26 Nov 2025 16:01:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dGkn96Qcvz3WBX for ; Wed, 26 Nov 2025 16:01:01 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1764172861; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+TOpj84N8Bb1AXhXEZstvenVr4PbhLMRpkGaT48+sEo=; b=IdUbg1aHjxLkuPZriikDq+dhz63nuFTgnJX8qUck8LcjnIHVO870gmnWnBlzHLm1SPCetA BoBhYV+zEMou2ranEptQ1nFM7HhAzOyIgt6dkQWQzMFRJasQPmPiWdPowfZ+/t3xqcDqDn 0VFRzNnfw19H5tKTt2zVz685rIm2rT/iYOtN+c11S6IRFIrGc3vO10VuMSEOoKFtL1YROm KwhhGWknI3Fs9gHBt0yRkya1TEsMc12sRfqzAgm/q+B0xnTgOm4X1fX/4vlU+9VSdIRPya olLq9ib9UXy1Wj8Ww2giBksFc6rGr6xV3wypy3t+/3pInGnYDneLrvu37libzA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1764172861; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+TOpj84N8Bb1AXhXEZstvenVr4PbhLMRpkGaT48+sEo=; b=XOIRMnRFHbV0TOUMhhjWPVeHw4RQmk7PgHdow8TmQn4n/li1yg2kJGOprp1Dapy94HnDzd bq6NuJuykoZvfxhvHJMrPsC2L13brsJ3ZfKyW0IgI66VLhQM5DvE62TXdHg1m/UnReWLEB 4Jfyx0cRUvEQ0sEFL5H3oKbvwMmc5TYYGkxhNKYDFdRd2R6QDf+Yde74qaworO5/EzWXjx 8aCjn2QE8TSRJrxR9tdJdLibrVj2vSDxz6Mm+9rBCIic5RE20ZI/Nl4PJfLInVS4xuO5dk 2y7xYtGDcVIeZIfAzn0mSa7VNAQ+l2emuVDzlTFxhA2yRj+4HuDSQTXsgpwRoA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1764172861; a=rsa-sha256; cv=none; b=Wy8tdObWzwC7kd2jJHKyPZ6VKPjJFS4TKiIbkgWpp7+4BBnD17svTCmDRj/DMSb1wnXeEE 5bH9bDkaA4q6bAA5+G4Ps9FNvEdIWmYcMuaUsjrhlZySdTZzaKi+20+oD8ihgFd1x0+xUY xVBjWOt1q0K8oqVPx+Zpax/wA7CIR/d6/SUv2kT36f/e0gmXshK/XITNoHNInVoU5+2esG Bw1KSjYeYwtL1u46kIvG/ZJ4wfg15Qt499URL8PIp0RhSi8iyeMlaGD/w1cgOeZoZpBOC1 PVjjs9+Kr/C29gs75M+7RObuv/qrXcjMMzqHL9UGXXpVNW8oiy9shxrFkaBz/Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dGkn95yTyztJL for ; Wed, 26 Nov 2025 16:01:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 33e2b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 26 Nov 2025 16:01:01 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Tetlow Subject: git: cd40a23fb249 - stable/14 - Mitigate YXDOMAIN and nodata non-referral answer poisoning. List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gordon X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: cd40a23fb249bba461e38ca0c3d243a20a12eef4 Auto-Submitted: auto-generated Date: Wed, 26 Nov 2025 16:01:01 +0000 Message-Id: <6927243d.33e2b.2163aabb@gitrepo.freebsd.org> The branch stable/14 has been updated by gordon: URL: https://cgit.FreeBSD.org/src/commit/?id=cd40a23fb249bba461e38ca0c3d243a20a12eef4 commit cd40a23fb249bba461e38ca0c3d243a20a12eef4 Author: Gordon Tetlow AuthorDate: 2025-11-21 21:24:58 +0000 Commit: Gordon Tetlow CommitDate: 2025-11-26 16:00:45 +0000 Mitigate YXDOMAIN and nodata non-referral answer poisoning. Add a fix to apply scrubbing of unsolicited NS RRSets (and their respective address records) for YXDOMAIN and nodata non-referral answers. This prevents a malicious actor from exploiting a possible cache poison attack. Obtained from: NLnet Labs Security: FreeBSD-SA-25:10.unbound Security: CVE-2025-11411 (cherry picked from commit 2a3a6a1771148a709c2d9694c1d66c41ce8dee79) --- contrib/unbound/iterator/iter_scrub.c | 39 +++++++++++++++++++++++++++++++---- 1 file changed, 35 insertions(+), 4 deletions(-) diff --git a/contrib/unbound/iterator/iter_scrub.c b/contrib/unbound/iterator/iter_scrub.c index 553d3655f0e3..8507a3fb65ac 100644 --- a/contrib/unbound/iterator/iter_scrub.c +++ b/contrib/unbound/iterator/iter_scrub.c @@ -418,12 +418,13 @@ shorten_rrset(sldns_buffer* pkt, struct rrset_parse* rrset, int count) * @param qinfo: original query. * @param region: where to allocate synthesized CNAMEs. * @param env: module env with config options. + * @param zonename: name of server zone. * @return 0 on error. */ static int scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, struct query_info* qinfo, struct regional* region, - struct module_env* env) + struct module_env* env, uint8_t* zonename) { uint8_t* sname = qinfo->qname; size_t snamelen = qinfo->qname_len; @@ -431,7 +432,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, int cname_length = 0; /* number of CNAMEs, or DNAMEs */ if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR && - FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN) + FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN && + FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_YXDOMAIN) return 1; /* For the ANSWER section, remove all "irrelevant" records and add @@ -470,6 +472,11 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, &aliaslen, pkt)) { verbose(VERB_ALGO, "synthesized CNAME " "too long"); + if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_YXDOMAIN) { + prev = rrset; + rrset = rrset->rrset_all_next; + continue; + } return 0; } cname_length++; @@ -650,6 +657,29 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, "RRset:", pkt, msg, prev, &rrset); continue; } + /* Also delete promiscuous NS for other RCODEs */ + if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR + && env->cfg->iter_scrub_promiscuous) { + remove_rrset("normalize: removing promiscuous " + "RRset:", pkt, msg, prev, &rrset); + continue; + } + /* Also delete promiscuous NS for NOERROR with nodata + * for authoritative answers, not for delegations. + * NOERROR with an_rrsets!=0 already handled. + * Also NOERROR and soa_in_auth already handled. + * NOERROR with an_rrsets==0, and not a referral. + * referral is (NS not the zonename, noSOA). + */ + if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR + && msg->an_rrsets == 0 + && !(dname_pkt_compare(pkt, rrset->dname, + zonename) != 0 && !soa_in_auth(msg)) + && env->cfg->iter_scrub_promiscuous) { + remove_rrset("normalize: removing promiscuous " + "RRset:", pkt, msg, prev, &rrset); + continue; + } if(nsset == NULL) { nsset = rrset; } else { @@ -1060,7 +1090,8 @@ scrub_message(sldns_buffer* pkt, struct msg_parse* msg, /* this is not required for basic operation but is a forgery * resistance (security) feature */ if((FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR || - FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN) && + FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN || + FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_YXDOMAIN) && msg->qdcount == 0) return 0; @@ -1074,7 +1105,7 @@ scrub_message(sldns_buffer* pkt, struct msg_parse* msg, } /* normalize the response, this cleans up the additional. */ - if(!scrub_normalize(pkt, msg, qinfo, region, env)) + if(!scrub_normalize(pkt, msg, qinfo, region, env, zonename)) return 0; /* delete all out-of-zone information */ if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie, qstate))