CVS commit: src/external/mpl/bind/dist/lib/ns
Module Name:src Committed By: christos Date: Fri Apr 19 12:35:28 UTC 2024 Modified Files: src/external/mpl/bind/dist/lib/ns: query.c Log Message: PR/58170: Yoshitaka Tokugawa: Remove blocking statement when the requestor asks for for an address that is in the cache and that access is prevented by a cache acl because the querier has no way to know that this access is denied, so it is not an abuse. To generate a diff of this commit: cvs rdiff -u -r1.20 -r1.21 src/external/mpl/bind/dist/lib/ns/query.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: src/external/mpl/bind/dist/lib/ns
Module Name:src Committed By: christos Date: Fri Apr 19 12:35:28 UTC 2024 Modified Files: src/external/mpl/bind/dist/lib/ns: query.c Log Message: PR/58170: Yoshitaka Tokugawa: Remove blocking statement when the requestor asks for for an address that is in the cache and that access is prevented by a cache acl because the querier has no way to know that this access is denied, so it is not an abuse. To generate a diff of this commit: cvs rdiff -u -r1.20 -r1.21 src/external/mpl/bind/dist/lib/ns/query.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/external/mpl/bind/dist/lib/ns/query.c diff -u src/external/mpl/bind/dist/lib/ns/query.c:1.20 src/external/mpl/bind/dist/lib/ns/query.c:1.21 --- src/external/mpl/bind/dist/lib/ns/query.c:1.20 Wed Feb 21 17:52:46 2024 +++ src/external/mpl/bind/dist/lib/ns/query.c Fri Apr 19 08:35:28 2024 @@ -1,4 +1,4 @@ -/* $NetBSD: query.c,v 1.20 2024/02/21 22:52:46 christos Exp $ */ +/* $NetBSD: query.c,v 1.21 2024/04/19 12:35:28 christos Exp $ */ /* * Copyright (C) Internet Systems Consortium, Inc. ("ISC") @@ -909,7 +909,6 @@ query_checkcacheaccess(ns_client_t *clie msg); } } else { - pfilter_notify(result, client, "checkcacheaccess"); /* * We were denied by the "allow-query-cache" ACL. * There is no need to clear NS_QUERYATTR_CACHEACLOK
CVS commit: src/external/mpl/bind/dist/lib/ns
Module Name:src Committed By: christos Date: Fri Feb 23 21:09:49 UTC 2024 Modified Files: src/external/mpl/bind/dist/lib/ns: client.c src/external/mpl/bind/dist/lib/ns/include/ns: client.h Log Message: fix 32 bit build (no atomic_*_8) To generate a diff of this commit: cvs rdiff -u -r1.19 -r1.20 src/external/mpl/bind/dist/lib/ns/client.c cvs rdiff -u -r1.15 -r1.16 \ src/external/mpl/bind/dist/lib/ns/include/ns/client.h Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/external/mpl/bind/dist/lib/ns/client.c diff -u src/external/mpl/bind/dist/lib/ns/client.c:1.19 src/external/mpl/bind/dist/lib/ns/client.c:1.20 --- src/external/mpl/bind/dist/lib/ns/client.c:1.19 Wed Feb 21 17:52:46 2024 +++ src/external/mpl/bind/dist/lib/ns/client.c Fri Feb 23 16:09:49 2024 @@ -1,4 +1,4 @@ -/* $NetBSD: client.c,v 1.19 2024/02/21 22:52:46 christos Exp $ */ +/* $NetBSD: client.c,v 1.20 2024/02/23 21:09:49 christos Exp $ */ /* * Copyright (C) Internet Systems Consortium, Inc. ("ISC") @@ -118,7 +118,11 @@ #define NS_CLIENT_DROPPORT 1 #endif /* ifndef NS_CLIENT_DROPPORT */ +#ifdef _LP64 atomic_uint_fast64_t ns_client_requests = 0; +#else +atomic_uint_fast32_t ns_client_requests = 0; +#endif static void clientmgr_attach(ns_clientmgr_t *source, ns_clientmgr_t **targetp); Index: src/external/mpl/bind/dist/lib/ns/include/ns/client.h diff -u src/external/mpl/bind/dist/lib/ns/include/ns/client.h:1.15 src/external/mpl/bind/dist/lib/ns/include/ns/client.h:1.16 --- src/external/mpl/bind/dist/lib/ns/include/ns/client.h:1.15 Wed Feb 21 17:52:46 2024 +++ src/external/mpl/bind/dist/lib/ns/include/ns/client.h Fri Feb 23 16:09:49 2024 @@ -1,4 +1,4 @@ -/* $NetBSD: client.h,v 1.15 2024/02/21 22:52:46 christos Exp $ */ +/* $NetBSD: client.h,v 1.16 2024/02/23 21:09:49 christos Exp $ */ /* * Copyright (C) Internet Systems Consortium, Inc. ("ISC") @@ -273,7 +273,11 @@ struct ns_client { */ #define NS_FAILCACHE_CD 0x01 +#ifdef _LP64 extern atomic_uint_fast64_t ns_client_requests; +#else +extern atomic_uint_fast32_t ns_client_requests; +#endif /*** *** Functions
CVS commit: src/external/mpl/bind/dist/lib/ns
Module Name:src Committed By: christos Date: Fri Feb 23 21:09:49 UTC 2024 Modified Files: src/external/mpl/bind/dist/lib/ns: client.c src/external/mpl/bind/dist/lib/ns/include/ns: client.h Log Message: fix 32 bit build (no atomic_*_8) To generate a diff of this commit: cvs rdiff -u -r1.19 -r1.20 src/external/mpl/bind/dist/lib/ns/client.c cvs rdiff -u -r1.15 -r1.16 \ src/external/mpl/bind/dist/lib/ns/include/ns/client.h Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: src/external/mpl/bind/dist/lib/ns
Module Name:src Committed By: christos Date: Tue Feb 13 15:23:16 UTC 2024 Modified Files: src/external/mpl/bind/dist/lib/ns: query.c Log Message: Apply patch for CVE-2023-5679: A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. To generate a diff of this commit: cvs rdiff -u -r1.18 -r1.19 src/external/mpl/bind/dist/lib/ns/query.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
CVS commit: src/external/mpl/bind/dist/lib/ns
Module Name:src Committed By: christos Date: Tue Feb 13 15:23:16 UTC 2024 Modified Files: src/external/mpl/bind/dist/lib/ns: query.c Log Message: Apply patch for CVE-2023-5679: A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. To generate a diff of this commit: cvs rdiff -u -r1.18 -r1.19 src/external/mpl/bind/dist/lib/ns/query.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/external/mpl/bind/dist/lib/ns/query.c diff -u src/external/mpl/bind/dist/lib/ns/query.c:1.18 src/external/mpl/bind/dist/lib/ns/query.c:1.19 --- src/external/mpl/bind/dist/lib/ns/query.c:1.18 Tue Feb 13 10:22:03 2024 +++ src/external/mpl/bind/dist/lib/ns/query.c Tue Feb 13 10:23:15 2024 @@ -1,4 +1,4 @@ -/* $NetBSD: query.c,v 1.18 2024/02/13 15:22:03 christos Exp $ */ +/* $NetBSD: query.c,v 1.19 2024/02/13 15:23:15 christos Exp $ */ /* * Copyright (C) Internet Systems Consortium, Inc. ("ISC") @@ -6102,6 +6102,13 @@ query_lookup_stale(ns_client_t *client) query_ctx_t qctx; qctx_init(client, NULL, client->query.qtype, ); + if (DNS64(client)) { + qctx.qtype = qctx.type = dns_rdatatype_a; + qctx.dns64 = true; + } + if (DNS64EXCLUDE(client)) { + qctx.dns64_exclude = true; + } dns_db_attach(client->view->cachedb, ); client->query.attributes &= ~NS_QUERYATTR_RECURSIONOK; client->query.dboptions |= DNS_DBFIND_STALETIMEOUT;
CVS commit: src/external/mpl/bind/dist/lib/ns
Module Name:src Committed By: christos Date: Tue Feb 13 15:22:03 UTC 2024 Modified Files: src/external/mpl/bind/dist/lib/ns: query.c Log Message: Apply patch for CVE-2023-5517: A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect ;` is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. To generate a diff of this commit: cvs rdiff -u -r1.17 -r1.18 src/external/mpl/bind/dist/lib/ns/query.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. Modified files: Index: src/external/mpl/bind/dist/lib/ns/query.c diff -u src/external/mpl/bind/dist/lib/ns/query.c:1.17 src/external/mpl/bind/dist/lib/ns/query.c:1.18 --- src/external/mpl/bind/dist/lib/ns/query.c:1.17 Mon Jun 26 18:03:01 2023 +++ src/external/mpl/bind/dist/lib/ns/query.c Tue Feb 13 10:22:03 2024 @@ -1,4 +1,4 @@ -/* $NetBSD: query.c,v 1.17 2023/06/26 22:03:01 christos Exp $ */ +/* $NetBSD: query.c,v 1.18 2024/02/13 15:22:03 christos Exp $ */ /* * Copyright (C) Internet Systems Consortium, Inc. ("ISC") @@ -459,10 +459,10 @@ static void query_addnxrrsetnsec(query_ctx_t *qctx); static isc_result_t -query_nxdomain(query_ctx_t *qctx, bool empty_wild); +query_nxdomain(query_ctx_t *qctx, isc_result_t result); static isc_result_t -query_redirect(query_ctx_t *qctx); +query_redirect(query_ctx_t *qctx, isc_result_t result); static isc_result_t query_ncache(query_ctx_t *qctx, isc_result_t result); @@ -7352,8 +7352,7 @@ query_usestale(query_ctx_t *qctx, isc_re * result from the search. */ static isc_result_t -query_gotanswer(query_ctx_t *qctx, isc_result_t res) { - isc_result_t result = res; +query_gotanswer(query_ctx_t *qctx, isc_result_t result) { char errmsg[256]; CCTRACE(ISC_LOG_DEBUG(3), "query_gotanswer"); @@ -7423,16 +7422,16 @@ root_key_sentinel: return (query_nodata(qctx, DNS_R_NXRRSET)); case DNS_R_EMPTYWILD: - return (query_nxdomain(qctx, true)); + return (query_nxdomain(qctx, DNS_R_EMPTYWILD)); case DNS_R_NXDOMAIN: - return (query_nxdomain(qctx, false)); + return (query_nxdomain(qctx, DNS_R_NXDOMAIN)); case DNS_R_COVERINGNSEC: return (query_coveringnsec(qctx)); case DNS_R_NCACHENXDOMAIN: - result = query_redirect(qctx); + result = query_redirect(qctx, result); if (result != ISC_R_COMPLETE) { return (result); } @@ -9250,10 +9249,10 @@ query_addnxrrsetnsec(query_ctx_t *qctx) * Handle NXDOMAIN and empty wildcard responses. */ static isc_result_t -query_nxdomain(query_ctx_t *qctx, bool empty_wild) { +query_nxdomain(query_ctx_t *qctx, isc_result_t result) { dns_section_t section; uint32_t ttl; - isc_result_t result; + bool empty_wild = (result == DNS_R_EMPTYWILD); CCTRACE(ISC_LOG_DEBUG(3), "query_nxdomain"); @@ -9262,7 +9261,7 @@ query_nxdomain(query_ctx_t *qctx, bool e INSIST(qctx->is_zone || REDIRECT(qctx->client)); if (!empty_wild) { - result = query_redirect(qctx); + result = query_redirect(qctx, result); if (result != ISC_R_COMPLETE) { return (result); } @@ -9350,7 +9349,7 @@ cleanup: * redirecting, so query processing should continue past it. */ static isc_result_t -query_redirect(query_ctx_t *qctx) { +query_redirect(query_ctx_t *qctx, isc_result_t saved_result) { isc_result_t result; CCTRACE(ISC_LOG_DEBUG(3), "query_redirect"); @@ -9391,7 +9390,7 @@ query_redirect(query_ctx_t *qctx) { SAVE(qctx->client->query.redirect.rdataset, qctx->rdataset); SAVE(qctx->client->query.redirect.sigrdataset, qctx->sigrdataset); - qctx->client->query.redirect.result = DNS_R_NCACHENXDOMAIN; + qctx->client->query.redirect.result = saved_result; dns_name_copynf(qctx->fname, qctx->client->query.redirect.fname); qctx->client->query.redirect.authoritative = @@ -10006,7 +10005,7 @@ query_coveringnsec(query_ctx_t *qctx) { * We now have the proof that we have an NXDOMAIN. Apply * NXDOMAIN redirection if configured. */ - result = query_redirect(qctx); + result = query_redirect(qctx, DNS_R_COVERINGNSEC); if (result != ISC_R_COMPLETE) { redirected = true; goto cleanup;
CVS commit: src/external/mpl/bind/dist/lib/ns
Module Name:src Committed By: christos Date: Tue Feb 13 15:22:03 UTC 2024 Modified Files: src/external/mpl/bind/dist/lib/ns: query.c Log Message: Apply patch for CVE-2023-5517: A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect ;` is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1. To generate a diff of this commit: cvs rdiff -u -r1.17 -r1.18 src/external/mpl/bind/dist/lib/ns/query.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.