From 0fed85ef271718750eec109730bcc3ca72452608 Mon Sep 17 00:00:00 2001
From: Doug Barton
Date: Sat, 12 Jul 2008 06:31:08 +0000
Subject: Vendor import of BIND 9.4.2-P1
---
CHANGES | 4 +
bin/named/client.c | 10 +-
bin/named/server.c | 34 +-
doc/arm/Bv9ARM-book.xml | 12 +-
doc/arm/Bv9ARM.ch06.html | 18 +-
doc/arm/Bv9ARM.pdf | 4436 ++++++++++++++++++++--------------------
lib/dns/api | 6 +-
lib/dns/dispatch.c | 708 +++----
lib/dns/include/dns/dispatch.h | 13 +-
lib/dns/resolver.c | 48 +-
version | 6 +-
11 files changed, 2565 insertions(+), 2730 deletions(-)
mode change 100755 => 100644 doc/arm/Bv9ARM.pdf
diff --git a/CHANGES b/CHANGES
index 06b6052b9db3..43d2bd7af22d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+ --- 9.4.2-P1 released ---
+
+2375. [security] Fully randomize UDP query ports to improve
+ forgery resilience. [RT #17949]
--- 9.4.2 released ---
--- 9.4.2rc2 released ---
diff --git a/bin/named/client.c b/bin/named/client.c
index b0e9cdda60e5..87dbdb859ce2 100644
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: client.c,v 1.219.18.28 2007/08/28 07:20:00 tbox Exp $ */
+/* $Id: client.c,v 1.219.18.28.10.1 2008/05/22 21:28:04 each Exp $ */
#include
@@ -1439,14 +1439,6 @@ client_request(isc_task_t *task, isc_event_t *event) {
}
}
- /*
- * Hash the incoming request here as it is after
- * dns_dispatch_importrecv().
- */
- dns_dispatch_hash(&client->now, sizeof(client->now));
- dns_dispatch_hash(isc_buffer_base(buffer),
- isc_buffer_usedlength(buffer));
-
/*
* It's a request. Parse it.
*/
diff --git a/bin/named/server.c b/bin/named/server.c
index cd8bff1a4f02..8e0c66cca4d9 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: server.c,v 1.419.18.57 2007/08/28 07:20:01 tbox Exp $ */
+/* $Id: server.c,v 1.419.18.57.10.1 2008/05/22 21:28:04 each Exp $ */
/*! \file */
@@ -540,6 +540,14 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,
attrs |= DNS_DISPATCHATTR_IPV6;
break;
}
+
+ if (isc_sockaddr_getport(&sa) != 0) {
+ INSIST(obj != NULL);
+ cfg_obj_log(obj, ns_g_lctx, ISC_LOG_INFO,
+ "using specific query-source port suppresses port "
+ "randomization and can be insecure.");
+ }
+
attrmask = 0;
attrmask |= DNS_DISPATCHATTR_UDP;
attrmask |= DNS_DISPATCHATTR_TCP;
@@ -549,7 +557,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,
disp = NULL;
result = dns_dispatch_getudp(ns_g_dispatchmgr, ns_g_socketmgr,
ns_g_taskmgr, &sa, 4096,
- 1000, 32768, 16411, 16433,
+ 1024, 32768, 16411, 16433,
attrs, attrmask, &disp);
if (result != ISC_R_SUCCESS) {
isc_sockaddr_t any;
@@ -2369,7 +2377,9 @@ scan_interfaces(ns_server_t *server, isc_boolean_t verbose) {
}
static isc_result_t
-add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr) {
+add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr,
+ isc_boolean_t wcardport_ok)
+{
ns_listenelt_t *lelt = NULL;
dns_acl_t *src_acl = NULL;
dns_aclelement_t aelt;
@@ -2379,7 +2389,8 @@ add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr) {
REQUIRE(isc_sockaddr_pf(addr) == AF_INET6);
isc_sockaddr_any6(&any_sa6);
- if (!isc_sockaddr_equal(&any_sa6, addr)) {
+ if (!isc_sockaddr_equal(&any_sa6, addr) &&
+ (wcardport_ok || isc_sockaddr_getport(addr) != 0)) {
aelt.type = dns_aclelementtype_ipprefix;
aelt.negative = ISC_FALSE;
aelt.u.ip_prefix.prefixlen = 128;
@@ -2438,7 +2449,16 @@ adjust_interfaces(ns_server_t *server, isc_mem_t *mctx) {
result = dns_dispatch_getlocaladdress(dispatch6, &addr);
if (result != ISC_R_SUCCESS)
goto fail;
- result = add_listenelt(mctx, list, &addr);
+
+ /*
+ * We always add non-wildcard address regardless of whether
+ * the port is 'any' (the fourth arg is TRUE): if the port is
+ * specific, we need to add it since it may conflict with a
+ * listening interface; if it's zero, we'll dynamically open
+ * query ports, and some of them may override an existing
+ * wildcard IPv6 port.
+ */
+ result = add_listenelt(mctx, list, &addr, ISC_TRUE);
if (result != ISC_R_SUCCESS)
goto fail;
}
@@ -2468,12 +2488,12 @@ adjust_interfaces(ns_server_t *server, isc_mem_t *mctx) {
continue;
addrp = dns_zone_getnotifysrc6(zone);
- result = add_listenelt(mctx, list, addrp);
+ result = add_listenelt(mctx, list, addrp, ISC_FALSE);
if (result != ISC_R_SUCCESS)
goto fail;
addrp = dns_zone_getxfrsource6(zone);
- result = add_listenelt(mctx, list, addrp);
+ result = add_listenelt(mctx, list, addrp, ISC_FALSE);
if (result != ISC_R_SUCCESS)
goto fail;
}
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index e30ca3f490f7..a3f61c7c9f3e 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -18,7 +18,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
BIND 9 Administrator Reference Manual
@@ -6067,7 +6067,15 @@ listen-on-v6 port 1234 { !2001:db8::/32; any; };
a wildcard IP address (INADDR_ANY)
will be used.
If port is * or is omitted,
- a random unprivileged port will be used. The avoid-v4-udp-ports
+ a random unprivileged port number is picked up and will be
+ used for each query.
+ It is generally strongly discouraged to
+ specify a particular port for the
+ query-source or
+ query-source-v6 options;
+ it implicitly disables the use of randomized port numbers
+ and leads to insecure operation.
+ The avoid-v4-udp-ports
and avoid-v6-udp-ports options can be used
to prevent named
from selecting certain ports. The defaults are:
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index d829a177a3d9..59b9cf59a2cd 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -14,7 +14,7 @@
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
@@ -3078,10 +3078,18 @@ listen-on-v6 port 1234 { !2001:db8::/32; any; };
a wildcard IP address (INADDR_ANY)
will be used.
If port is * or is omitted,
- a random unprivileged port will be used. The avoid-v4-udp-ports
- and avoid-v6-udp-ports options can be used
- to prevent named
- from selecting certain ports. The defaults are:
+ a random unprivileged port number is picked up and will be
+ used for each query.
+ It is generally strongly discouraged to
+ specify a particular port for the
+ query-source or
+ query-source-v6
+ options; it implicitly disables the use of randomized port numbers
+ and leads to insecure operation.
+ The avoid-v4-udp-ports
+ and avoid-v6-udp-ports options can be used
+ to prevent named
+ from selecting certain ports. The defaults are:
query-source address * port *;
query-source-v6 address * port *;
diff --git a/doc/arm/Bv9ARM.pdf b/doc/arm/Bv9ARM.pdf
old mode 100755
new mode 100644
index be27aa1fb0d7..586aaafd0e72
--- a/doc/arm/Bv9ARM.pdf
+++ b/doc/arm/Bv9ARM.pdf
@@ -1583,19 +1583,26 @@ endobj
/ProcSet [ /PDF /Text ]
>> endobj
743 0 obj <<
-/Length 3152
+/Length 3153
/Filter /FlateDecode
>>
stream
-x[w)(=pˣ9I[۱y)X I$]݁jȵD&'la0X lBl4юq(d(ΪJs|