118 lines
3.9 KiB
Diff
118 lines
3.9 KiB
Diff
From c73262493658cb8623927ef6cc2f023501f7e809 Mon Sep 17 00:00:00 2001
|
|
From: Mark Andrews <marka@isc.org>
|
|
Date: Tue, 10 Oct 2023 10:58:18 +1100
|
|
Subject: [PATCH] Save the correct result value to resume with
|
|
nxdomain-redirect
|
|
|
|
The wrong result value was being saved for resumption with
|
|
nxdomain-redirect when performing the fetch. This lead to an assert
|
|
when checking that RFC 1918 reverse queries where not leaking to
|
|
the global internet.
|
|
|
|
Conflict:NA
|
|
Reference:https://downloads.isc.org/isc/bind/9.16.48/patches/0002-CVE-2023-5517.patch
|
|
|
|
(cherry picked from commit 9d0fa07c5e7a39db89862a4f843d2190059afb4b)
|
|
---
|
|
lib/ns/query.c | 25 ++++++++++++-------------
|
|
1 file changed, 12 insertions(+), 13 deletions(-)
|
|
|
|
diff --git a/lib/ns/query.c b/lib/ns/query.c
|
|
index 62b5ea8463..55d815e6c0 100644
|
|
--- a/lib/ns/query.c
|
|
+++ b/lib/ns/query.c
|
|
@@ -455,10 +455,10 @@ static void
|
|
query_addnxrrsetnsec(query_ctx_t *qctx);
|
|
|
|
static isc_result_t
|
|
-query_nxdomain(query_ctx_t *qctx, bool empty_wild);
|
|
+query_nxdomain(query_ctx_t *qctx, isc_result_t result);
|
|
|
|
static isc_result_t
|
|
-query_redirect(query_ctx_t *qctx);
|
|
+query_redirect(query_ctx_t *qctx, isc_result_t result);
|
|
|
|
static isc_result_t
|
|
query_ncache(query_ctx_t *qctx, isc_result_t result);
|
|
@@ -7345,8 +7345,7 @@ query_usestale(query_ctx_t *qctx, isc_result_t result) {
|
|
* result from the search.
|
|
*/
|
|
static isc_result_t
|
|
-query_gotanswer(query_ctx_t *qctx, isc_result_t res) {
|
|
- isc_result_t result = res;
|
|
+query_gotanswer(query_ctx_t *qctx, isc_result_t result) {
|
|
char errmsg[256];
|
|
|
|
CCTRACE(ISC_LOG_DEBUG(3), "query_gotanswer");
|
|
@@ -7416,16 +7415,16 @@ query_gotanswer(query_ctx_t *qctx, isc_result_t res) {
|
|
return (query_nodata(qctx, DNS_R_NXRRSET));
|
|
|
|
case DNS_R_EMPTYWILD:
|
|
- return (query_nxdomain(qctx, true));
|
|
+ return (query_nxdomain(qctx, DNS_R_EMPTYWILD));
|
|
|
|
case DNS_R_NXDOMAIN:
|
|
- return (query_nxdomain(qctx, false));
|
|
+ return (query_nxdomain(qctx, DNS_R_NXDOMAIN));
|
|
|
|
case DNS_R_COVERINGNSEC:
|
|
return (query_coveringnsec(qctx));
|
|
|
|
case DNS_R_NCACHENXDOMAIN:
|
|
- result = query_redirect(qctx);
|
|
+ result = query_redirect(qctx, result);
|
|
if (result != ISC_R_COMPLETE) {
|
|
return (result);
|
|
}
|
|
@@ -9243,10 +9242,10 @@ query_addnxrrsetnsec(query_ctx_t *qctx) {
|
|
* Handle NXDOMAIN and empty wildcard responses.
|
|
*/
|
|
static isc_result_t
|
|
-query_nxdomain(query_ctx_t *qctx, bool empty_wild) {
|
|
+query_nxdomain(query_ctx_t *qctx, isc_result_t result) {
|
|
dns_section_t section;
|
|
uint32_t ttl;
|
|
- isc_result_t result;
|
|
+ bool empty_wild = (result == DNS_R_EMPTYWILD);
|
|
|
|
CCTRACE(ISC_LOG_DEBUG(3), "query_nxdomain");
|
|
|
|
@@ -9255,7 +9254,7 @@ query_nxdomain(query_ctx_t *qctx, bool empty_wild) {
|
|
INSIST(qctx->is_zone || REDIRECT(qctx->client));
|
|
|
|
if (!empty_wild) {
|
|
- result = query_redirect(qctx);
|
|
+ result = query_redirect(qctx, result);
|
|
if (result != ISC_R_COMPLETE) {
|
|
return (result);
|
|
}
|
|
@@ -9343,7 +9342,7 @@ query_nxdomain(query_ctx_t *qctx, bool empty_wild) {
|
|
* redirecting, so query processing should continue past it.
|
|
*/
|
|
static isc_result_t
|
|
-query_redirect(query_ctx_t *qctx) {
|
|
+query_redirect(query_ctx_t *qctx, isc_result_t saved_result) {
|
|
isc_result_t result;
|
|
|
|
CCTRACE(ISC_LOG_DEBUG(3), "query_redirect");
|
|
@@ -9384,7 +9383,7 @@ query_redirect(query_ctx_t *qctx) {
|
|
SAVE(qctx->client->query.redirect.rdataset, qctx->rdataset);
|
|
SAVE(qctx->client->query.redirect.sigrdataset,
|
|
qctx->sigrdataset);
|
|
- qctx->client->query.redirect.result = DNS_R_NCACHENXDOMAIN;
|
|
+ qctx->client->query.redirect.result = saved_result;
|
|
dns_name_copynf(qctx->fname,
|
|
qctx->client->query.redirect.fname);
|
|
qctx->client->query.redirect.authoritative =
|
|
@@ -10005,7 +10004,7 @@ query_coveringnsec(query_ctx_t *qctx) {
|
|
* We now have the proof that we have an NXDOMAIN. Apply
|
|
* NXDOMAIN redirection if configured.
|
|
*/
|
|
- result = query_redirect(qctx);
|
|
+ result = query_redirect(qctx, DNS_R_COVERINGNSEC);
|
|
if (result != ISC_R_COMPLETE) {
|
|
redirected = true;
|
|
goto cleanup;
|
|
--
|
|
GitLab
|