From 218ea97b9e01d8e16190789f89493723232ae1f0 Mon Sep 17 00:00:00 2001
From: Doug Barton
Date: Sat, 12 Jul 2008 08:28:36 +0000
Subject: Vendor import of BIND 9.3.5-P1
---
CHANGES | 5 +
bin/named/client.c | 10 +-
bin/named/server.c | 34 +-
doc/arm/Bv9ARM-book.xml | 12 +-
doc/arm/Bv9ARM.ch06.html | 12 +-
doc/arm/Bv9ARM.pdf | 1700 ++++++++++++++++++++--------------------
lib/dns/api | 6 +-
lib/dns/dispatch.c | 707 ++++++-----------
lib/dns/include/dns/dispatch.h | 13 +-
lib/dns/resolver.c | 43 +-
version | 6 +-
11 files changed, 1176 insertions(+), 1372 deletions(-)
diff --git a/CHANGES b/CHANGES
index d76e389248c5b..a44e20337bb5b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+ --- 9.3.5-P1 released ---
+
+2375. [security] Fully randomize UDP query ports to improve
+ forgery resilience. [RT #17949]
+
--- 9.3.5 released ---
--- 9.3.5rc2 released ---
diff --git a/bin/named/client.c b/bin/named/client.c
index 6d4cc91a4e4ca..3215c6e637329 100644
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: client.c,v 1.176.2.13.4.38 2007/08/28 07:19:08 tbox Exp $ */
+/* $Id: client.c,v 1.176.2.13.4.38.4.1 2008/05/22 21:11:13 each Exp $ */
#include
@@ -1348,14 +1348,6 @@ client_request(isc_task_t *task, isc_event_t *event) {
}
}
- /*
- * Hash the incoming request here as it is after
- * dns_dispatch_importrecv().
- */
- dns_dispatch_hash(&client->now, sizeof(client->now));
- dns_dispatch_hash(isc_buffer_base(buffer),
- isc_buffer_usedlength(buffer));
-
/*
* It's a request. Parse it.
*/
diff --git a/bin/named/server.c b/bin/named/server.c
index a01e5e79cfe3a..c705af0ddcb15 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: server.c,v 1.339.2.15.2.78 2008/01/17 23:45:27 tbox Exp $ */
+/* $Id: server.c,v 1.339.2.15.2.78.4.1 2008/05/22 21:11:14 each Exp $ */
#include
@@ -485,6 +485,14 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,
attrs |= DNS_DISPATCHATTR_IPV6;
break;
}
+
+ if (isc_sockaddr_getport(&sa) != 0) {
+ INSIST(obj != NULL);
+ cfg_obj_log(obj, ns_g_lctx, ISC_LOG_INFO,
+ "using specific query-source port suppresses port "
+ "randomization and can be insecure.");
+ }
+
attrmask = 0;
attrmask |= DNS_DISPATCHATTR_UDP;
attrmask |= DNS_DISPATCHATTR_TCP;
@@ -494,7 +502,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,
disp = NULL;
result = dns_dispatch_getudp(ns_g_dispatchmgr, ns_g_socketmgr,
ns_g_taskmgr, &sa, 4096,
- 1000, 32768, 16411, 16433,
+ 1024, 32768, 16411, 16433,
attrs, attrmask, &disp);
if (result != ISC_R_SUCCESS) {
isc_sockaddr_t any;
@@ -1866,7 +1874,9 @@ scan_interfaces(ns_server_t *server, isc_boolean_t verbose) {
}
static isc_result_t
-add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr) {
+add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr,
+ isc_boolean_t wcardport_ok)
+{
ns_listenelt_t *lelt = NULL;
dns_acl_t *src_acl = NULL;
dns_aclelement_t aelt;
@@ -1876,7 +1886,8 @@ add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr) {
REQUIRE(isc_sockaddr_pf(addr) == AF_INET6);
isc_sockaddr_any6(&any_sa6);
- if (!isc_sockaddr_equal(&any_sa6, addr)) {
+ if (!isc_sockaddr_equal(&any_sa6, addr) &&
+ (wcardport_ok || isc_sockaddr_getport(addr) != 0)) {
aelt.type = dns_aclelementtype_ipprefix;
aelt.negative = ISC_FALSE;
aelt.u.ip_prefix.prefixlen = 128;
@@ -1935,7 +1946,16 @@ adjust_interfaces(ns_server_t *server, isc_mem_t *mctx) {
result = dns_dispatch_getlocaladdress(dispatch6, &addr);
if (result != ISC_R_SUCCESS)
goto fail;
- result = add_listenelt(mctx, list, &addr);
+
+ /*
+ * We always add non-wildcard address regardless of whether
+ * the port is 'any' (the fourth arg is TRUE): if the port is
+ * specific, we need to add it since it may conflict with a
+ * listening interface; if it's zero, we'll dynamically open
+ * query ports, and some of them may override an existing
+ * wildcard IPv6 port.
+ */
+ result = add_listenelt(mctx, list, &addr, ISC_TRUE);
if (result != ISC_R_SUCCESS)
goto fail;
}
@@ -1965,12 +1985,12 @@ adjust_interfaces(ns_server_t *server, isc_mem_t *mctx) {
continue;
addrp = dns_zone_getnotifysrc6(zone);
- result = add_listenelt(mctx, list, addrp);
+ result = add_listenelt(mctx, list, addrp, ISC_FALSE);
if (result != ISC_R_SUCCESS)
goto fail;
addrp = dns_zone_getxfrsource6(zone);
- result = add_listenelt(mctx, list, addrp);
+ result = add_listenelt(mctx, list, addrp, ISC_FALSE);
if (result != ISC_R_SUCCESS)
goto fail;
}
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 67f8c8973624e..710cd36c1d1dc 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -18,7 +18,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
BIND 9 Administrator Reference Manual
@@ -3732,7 +3732,15 @@ IPv6, there is a separate query-source-v6 option.
If address is * (asterisk) or is omitted,
a wildcard IP address (INADDR_ANY) will be used.
If port is * or is omitted,
-a random unprivileged port will be used. The avoid-v4-udp-ports
+a random unprivileged port number is picked up and will be
+used for each query.
+It is generally strongly discouraged to
+specify a particular port for the
+query-source or
+query-source-v6 options;
+it implicitly disables the use of randomized port numbers
+and leads to insecure operation.
+The avoid-v4-udp-ports
and avoid-v6-udp-ports options can be used to prevent named
from selecting certain ports. The defaults are:
query-source address * port *;
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index dd8d8ca33f670..d59d9d198b61c 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -1892,7 +1892,15 @@ IPv6, there is a separate query-source-v6
If address is * (asterisk) or is omitted,
a wildcard IP address (INADDR_ANY) will be used.
If port is * or is omitted,
-a random unprivileged port will be used. The avoid-v4-udp-ports
+a random unprivileged port number is picked up and will be
+used for each query.
+It is generally strongly discouraged to
+specify a particular port for the
+query-source or
+query-source-v6 options;
+it implicitly disables the use of randomized port numbers
+and leads to insecure operation.
+The avoid-v4-udp-ports
and avoid-v6-udp-ports options can be used to prevent named
from selecting certain ports. The defaults are:
query-source address * port *;
diff --git a/doc/arm/Bv9ARM.pdf b/doc/arm/Bv9ARM.pdf
index 7c74c3935bc05..7b599bab06e60 100644
--- a/doc/arm/Bv9ARM.pdf
+++ b/doc/arm/Bv9ARM.pdf
@@ -889,8 +889,8 @@ endobj
/Filter /FlateDecode
>>
stream
-xڍ=O1[IV|$P6^I큎5P!:1qQUendstream
+xڍ=O1[3l(pjR{HGzBeHl?TCt$M!:P}g\MTkM4B-1L~bp6à1A_8-%B
+.o^&i-N4^aޏ}s|sm[clf?]"]N0P(GY?I,ϱQA6_>:۷/kPendstream
endobj
594 0 obj <<
/Type /Page
@@ -3225,22 +3225,19 @@ endobj
/ProcSet [ /PDF /Text ]
>> endobj
977 0 obj <<
-/Length 2580
+/Length 2662
/Filter /FlateDecode
>>
stream
-xڵY_s8ϧ=}S+S6M{٦lvnnvAZS[r-9}Rl%]zәA F8#kWNR3>sDFi뇛o9r%2,;,֊?\^Oq&S7DqpvI7WD|{y}yuq9
-kA#~ѻϯ'xvyҵWp|9>Z?q5{pN6g(fR>V`g/Q+j5@XYhv}- ,g]M^Nrz\D(mST%xIqQWDi*|^,t wluYr e[횚hqU1HV/k)D]V;fX?!3Fz;r^m}+ZE
u1x8̪
-N3ii84~xM8/;90ģm,چ]^q,9
-[ D7dZ;(pڕCxacTr5Չ}Oį)U}%1L$C6SA։oN; i$$FLE(H$N&.f)5d☖(ܨe(2ڎlf|lu +#r A2l
-mRܵ*r
-zqMVoP熷96!yUMMT^_XihO_E-a'xV1 EDMK=N=zѷRYk]a &T+]M`'DlYU9$\y;pWpX~067kVY@fښpYq9@9X.$-ĸZ)58&"Go89Jd"ۜ(`Ksxe:eH.$mΟW0n:Ю+B
ֻ3бQEkY{A .heLaY qHM~n
- Uh 8r4ZyuuRHo).JEr.^-nW/|=iEwNIvuL >Ԇ(P}TTCQDЂ!`8`hVX`EEzF>71À5h5PQ8'
GG!N/QO(݄3[Z'MNHcqI~
-x'"Gʿ!໙89(78c cLn61N5$ot~U;[F BJfzB#z54v괝<RWK1oC1M4Tgtjh