Module Name: src
Committed By: christos
Date: Fri Jun 30 11:32:34 UTC 2017
Modified Files:
src/external/bsd/bind/dist: CHANGES README srcid version
src/external/bsd/bind/dist/doc/arm: Bv9ARM.ch04.html Bv9ARM.ch06.html
Bv9ARM.ch07.html Bv9ARM.ch08.html Bv9ARM.ch09.html Bv9ARM.html
Bv9ARM.pdf man.arpaname.html man.ddns-confgen.html man.delv.html
man.dig.html man.dnssec-checkds.html man.dnssec-coverage.html
man.dnssec-dsfromkey.html man.dnssec-importkey.html
man.dnssec-keyfromlabel.html man.dnssec-keygen.html
man.dnssec-revoke.html man.dnssec-settime.html
man.dnssec-signzone.html man.dnssec-verify.html man.genrandom.html
man.host.html man.isc-hmac-fixup.html man.named-checkconf.html
man.named-checkzone.html man.named-journalprint.html
man.named-rrchecker.html man.named.html man.nsec3hash.html
man.nsupdate.html man.rndc-confgen.html man.rndc.conf.html
man.rndc.html
src/external/bsd/bind/dist/lib/dns: api dnssec.c message.c rootns.c
tsig.c
Log Message:
merge conflicts
To generate a diff of this commit:
cvs rdiff -u -r1.27 -r1.28 src/external/bsd/bind/dist/CHANGES
cvs rdiff -u -r1.15 -r1.16 src/external/bsd/bind/dist/README
cvs rdiff -u -r1.21 -r1.22 src/external/bsd/bind/dist/srcid
cvs rdiff -u -r1.25 -r1.26 src/external/bsd/bind/dist/version
cvs rdiff -u -r1.15 -r1.16 \
src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch04.html \
src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch06.html \
src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch07.html \
src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch08.html \
src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch09.html \
src/external/bsd/bind/dist/doc/arm/Bv9ARM.html \
src/external/bsd/bind/dist/doc/arm/man.arpaname.html \
src/external/bsd/bind/dist/doc/arm/man.ddns-confgen.html \
src/external/bsd/bind/dist/doc/arm/man.delv.html \
src/external/bsd/bind/dist/doc/arm/man.dig.html \
src/external/bsd/bind/dist/doc/arm/man.dnssec-checkds.html \
src/external/bsd/bind/dist/doc/arm/man.dnssec-coverage.html \
src/external/bsd/bind/dist/doc/arm/man.dnssec-dsfromkey.html \
src/external/bsd/bind/dist/doc/arm/man.dnssec-importkey.html \
src/external/bsd/bind/dist/doc/arm/man.dnssec-keyfromlabel.html \
src/external/bsd/bind/dist/doc/arm/man.dnssec-keygen.html \
src/external/bsd/bind/dist/doc/arm/man.dnssec-revoke.html \
src/external/bsd/bind/dist/doc/arm/man.dnssec-settime.html \
src/external/bsd/bind/dist/doc/arm/man.dnssec-signzone.html \
src/external/bsd/bind/dist/doc/arm/man.dnssec-verify.html \
src/external/bsd/bind/dist/doc/arm/man.genrandom.html \
src/external/bsd/bind/dist/doc/arm/man.host.html \
src/external/bsd/bind/dist/doc/arm/man.isc-hmac-fixup.html \
src/external/bsd/bind/dist/doc/arm/man.named-checkconf.html \
src/external/bsd/bind/dist/doc/arm/man.named-checkzone.html \
src/external/bsd/bind/dist/doc/arm/man.named-journalprint.html \
src/external/bsd/bind/dist/doc/arm/man.named-rrchecker.html \
src/external/bsd/bind/dist/doc/arm/man.named.html \
src/external/bsd/bind/dist/doc/arm/man.nsec3hash.html \
src/external/bsd/bind/dist/doc/arm/man.nsupdate.html \
src/external/bsd/bind/dist/doc/arm/man.rndc-confgen.html \
src/external/bsd/bind/dist/doc/arm/man.rndc.conf.html \
src/external/bsd/bind/dist/doc/arm/man.rndc.html
cvs rdiff -u -r1.20 -r1.21 src/external/bsd/bind/dist/doc/arm/Bv9ARM.pdf
cvs rdiff -u -r1.15 -r1.16 src/external/bsd/bind/dist/lib/dns/api
cvs rdiff -u -r1.13 -r1.14 src/external/bsd/bind/dist/lib/dns/dnssec.c
cvs rdiff -u -r1.23 -r1.24 src/external/bsd/bind/dist/lib/dns/message.c
cvs rdiff -u -r1.12 -r1.13 src/external/bsd/bind/dist/lib/dns/rootns.c
cvs rdiff -u -r1.10 -r1.11 src/external/bsd/bind/dist/lib/dns/tsig.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/external/bsd/bind/dist/CHANGES
diff -u src/external/bsd/bind/dist/CHANGES:1.27 src/external/bsd/bind/dist/CHANGES:1.28
--- src/external/bsd/bind/dist/CHANGES:1.27 Thu Jun 15 11:59:35 2017
+++ src/external/bsd/bind/dist/CHANGES Fri Jun 30 07:32:33 2017
@@ -1,3 +1,11 @@
+ --- 9.10.5-P2 released ---
+
+4643. [security] An error in TSIG handling could permit unauthorized
+ zone transfers or zone updates. (CVE-2017-3142)
+ (CVE-2017-3143) [RT #45383]
+
+4633. [maint] Updated AAAA (2001:500:200::b) for B.ROOT-SERVERS.NET.
+
--- 9.10.5-P1 released ---
4632. [security] The BIND installer on Windows used an unquoted
Index: src/external/bsd/bind/dist/README
diff -u src/external/bsd/bind/dist/README:1.15 src/external/bsd/bind/dist/README:1.16
--- src/external/bsd/bind/dist/README:1.15 Thu Jun 15 11:59:36 2017
+++ src/external/bsd/bind/dist/README Fri Jun 30 07:32:33 2017
@@ -51,6 +51,11 @@ BIND 9
For up-to-date release notes and errata, see
http://www.isc.org/software/bind9/releasenotes
+BIND 9.10.5-P2
+
+ This version contains a fix for the security flaws
+ disclosed in CVE-2017-3142 and CVE-2017-3143.
+
BIND 9.10.5-P1
This version contains a fix for the security flaws
Index: src/external/bsd/bind/dist/srcid
diff -u src/external/bsd/bind/dist/srcid:1.21 src/external/bsd/bind/dist/srcid:1.22
--- src/external/bsd/bind/dist/srcid:1.21 Thu Jun 15 11:59:36 2017
+++ src/external/bsd/bind/dist/srcid Fri Jun 30 07:32:33 2017
@@ -1 +1 @@
-SRCID=34fd9c6
+SRCID=a39c587
Index: src/external/bsd/bind/dist/version
diff -u src/external/bsd/bind/dist/version:1.25 src/external/bsd/bind/dist/version:1.26
--- src/external/bsd/bind/dist/version:1.25 Thu Jun 15 11:59:36 2017
+++ src/external/bsd/bind/dist/version Fri Jun 30 07:32:33 2017
@@ -7,5 +7,5 @@ MAJORVER=9
MINORVER=10
PATCHVER=5
RELEASETYPE=-P
-RELEASEVER=1
+RELEASEVER=2
EXTENSIONS=
Index: src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch04.html
diff -u src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch04.html:1.15 src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch04.html:1.16
--- src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch04.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch04.html Fri Jun 30 07:32:33 2017
@@ -2498,6 +2498,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch06.html
diff -u src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch06.html:1.15 src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch06.html:1.16
--- src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch06.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch06.html Fri Jun 30 07:32:33 2017
@@ -13790,6 +13790,6 @@ HOST-127.EXAMPLE. MX 0 .
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch07.html
diff -u src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch07.html:1.15 src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch07.html:1.16
--- src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch07.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch07.html Fri Jun 30 07:32:33 2017
@@ -262,6 +262,6 @@ zone "example.com" {
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch08.html
diff -u src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch08.html:1.15 src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch08.html:1.16
--- src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch08.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch08.html Fri Jun 30 07:32:33 2017
@@ -145,6 +145,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch09.html
diff -u src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch09.html:1.15 src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch09.html:1.16
--- src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch09.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/Bv9ARM.ch09.html Fri Jun 30 07:32:33 2017
@@ -45,7 +45,7 @@
<div class="toc">
<p><b>Table of Contents</b></p>
<dl class="toc">
-<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.10.5-P1</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.10.5-P2</a></span></dt>
<dd><dl>
<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
@@ -58,7 +58,7 @@
</div>
<div class="section">
<div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id-1.10.2"></a>Release Notes for BIND Version 9.10.5-P1</h2></div></div></div>
+<a name="id-1.10.2"></a>Release Notes for BIND Version 9.10.5-P2</h2></div></div></div>
<div class="section">
<div class="titlepage"><div><div><h3 class="title">
@@ -70,6 +70,11 @@
BIND 9.10.5-P1 addresses the security issues described in
CVE-2017-3140 and CVE-2017-3141.
</p>
+ <p>
+ BIND 9.11.1-P2 addresses the security issues described in
+ CVE-2017-3142 and CVE-2017-3143. It also includes an update
+ to the address of the B root server.
+ </p>
</div>
@@ -121,6 +126,13 @@
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
<li class="listitem">
<p>
+ An error in TSIG handling could permit unauthorized zone
+ transfers or zone updates. These flaws are disclosed in
+ CVE-2017-3142 and CVE-2017-3143. [RT #45383]
+ </p>
+ </li>
+<li class="listitem">
+ <p>
The BIND installer on Windows used an unquoted service path,
which can enable privilege escalation. This flaw is disclosed
in CVE-2017-3141. [RT #45229]
@@ -177,6 +189,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/Bv9ARM.html
diff -u src/external/bsd/bind/dist/doc/arm/Bv9ARM.html:1.15 src/external/bsd/bind/dist/doc/arm/Bv9ARM.html:1.16
--- src/external/bsd/bind/dist/doc/arm/Bv9ARM.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/Bv9ARM.html Fri Jun 30 07:32:33 2017
@@ -41,7 +41,7 @@
<div>
<div><h1 class="title">
<a name="id-1"></a>BIND 9 Administrator Reference Manual</h1></div>
-<div><p class="releaseinfo">BIND Version 9.10.5-P1</p></div>
+<div><p class="releaseinfo">BIND Version 9.10.5-P2</p></div>
<div><p class="copyright">Copyright © 2004-2016 Internet Systems Consortium, Inc. ("ISC")</p></div>
<div><p class="copyright">Copyright © 2000-2003 Internet Software Consortium.</p></div>
</div>
@@ -240,7 +240,7 @@
</dl></dd>
<dt><span class="appendix"><a href="Bv9ARM.ch09.html">A. Release Notes</a></span></dt>
<dd><dl>
-<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.10.5-P1</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.10.5-P2</a></span></dt>
<dd><dl>
<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
@@ -410,6 +410,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.arpaname.html
diff -u src/external/bsd/bind/dist/doc/arm/man.arpaname.html:1.15 src/external/bsd/bind/dist/doc/arm/man.arpaname.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.arpaname.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.arpaname.html Fri Jun 30 07:32:34 2017
@@ -100,6 +100,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.ddns-confgen.html
diff -u src/external/bsd/bind/dist/doc/arm/man.ddns-confgen.html:1.15 src/external/bsd/bind/dist/doc/arm/man.ddns-confgen.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.ddns-confgen.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.ddns-confgen.html Fri Jun 30 07:32:34 2017
@@ -245,6 +245,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.delv.html
diff -u src/external/bsd/bind/dist/doc/arm/man.delv.html:1.15 src/external/bsd/bind/dist/doc/arm/man.delv.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.delv.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.delv.html Fri Jun 30 07:32:34 2017
@@ -619,6 +619,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.dig.html
diff -u src/external/bsd/bind/dist/doc/arm/man.dig.html:1.15 src/external/bsd/bind/dist/doc/arm/man.dig.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.dig.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.dig.html Fri Jun 30 07:32:34 2017
@@ -1035,6 +1035,6 @@ dig +qr www.isc.org any -x 127.0.0.1 isc
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.dnssec-checkds.html
diff -u src/external/bsd/bind/dist/doc/arm/man.dnssec-checkds.html:1.15 src/external/bsd/bind/dist/doc/arm/man.dnssec-checkds.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.dnssec-checkds.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.dnssec-checkds.html Fri Jun 30 07:32:34 2017
@@ -160,6 +160,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.dnssec-coverage.html
diff -u src/external/bsd/bind/dist/doc/arm/man.dnssec-coverage.html:1.15 src/external/bsd/bind/dist/doc/arm/man.dnssec-coverage.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.dnssec-coverage.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.dnssec-coverage.html Fri Jun 30 07:32:34 2017
@@ -279,6 +279,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.dnssec-dsfromkey.html
diff -u src/external/bsd/bind/dist/doc/arm/man.dnssec-dsfromkey.html:1.15 src/external/bsd/bind/dist/doc/arm/man.dnssec-dsfromkey.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.dnssec-dsfromkey.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.dnssec-dsfromkey.html Fri Jun 30 07:32:34 2017
@@ -298,6 +298,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.dnssec-importkey.html
diff -u src/external/bsd/bind/dist/doc/arm/man.dnssec-importkey.html:1.15 src/external/bsd/bind/dist/doc/arm/man.dnssec-importkey.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.dnssec-importkey.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.dnssec-importkey.html Fri Jun 30 07:32:34 2017
@@ -241,6 +241,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.dnssec-keyfromlabel.html
diff -u src/external/bsd/bind/dist/doc/arm/man.dnssec-keyfromlabel.html:1.15 src/external/bsd/bind/dist/doc/arm/man.dnssec-keyfromlabel.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.dnssec-keyfromlabel.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.dnssec-keyfromlabel.html Fri Jun 30 07:32:34 2017
@@ -485,6 +485,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.dnssec-keygen.html
diff -u src/external/bsd/bind/dist/doc/arm/man.dnssec-keygen.html:1.15 src/external/bsd/bind/dist/doc/arm/man.dnssec-keygen.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.dnssec-keygen.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.dnssec-keygen.html Fri Jun 30 07:32:34 2017
@@ -572,6 +572,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.dnssec-revoke.html
diff -u src/external/bsd/bind/dist/doc/arm/man.dnssec-revoke.html:1.15 src/external/bsd/bind/dist/doc/arm/man.dnssec-revoke.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.dnssec-revoke.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.dnssec-revoke.html Fri Jun 30 07:32:34 2017
@@ -180,6 +180,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.dnssec-settime.html
diff -u src/external/bsd/bind/dist/doc/arm/man.dnssec-settime.html:1.15 src/external/bsd/bind/dist/doc/arm/man.dnssec-settime.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.dnssec-settime.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.dnssec-settime.html Fri Jun 30 07:32:34 2017
@@ -337,6 +337,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.dnssec-signzone.html
diff -u src/external/bsd/bind/dist/doc/arm/man.dnssec-signzone.html:1.15 src/external/bsd/bind/dist/doc/arm/man.dnssec-signzone.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.dnssec-signzone.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.dnssec-signzone.html Fri Jun 30 07:32:34 2017
@@ -711,6 +711,6 @@ db.example.com.signed
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.dnssec-verify.html
diff -u src/external/bsd/bind/dist/doc/arm/man.dnssec-verify.html:1.15 src/external/bsd/bind/dist/doc/arm/man.dnssec-verify.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.dnssec-verify.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.dnssec-verify.html Fri Jun 30 07:32:34 2017
@@ -211,6 +211,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.genrandom.html
diff -u src/external/bsd/bind/dist/doc/arm/man.genrandom.html:1.15 src/external/bsd/bind/dist/doc/arm/man.genrandom.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.genrandom.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.genrandom.html Fri Jun 30 07:32:34 2017
@@ -136,6 +136,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.host.html
diff -u src/external/bsd/bind/dist/doc/arm/man.host.html:1.15 src/external/bsd/bind/dist/doc/arm/man.host.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.host.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.host.html Fri Jun 30 07:32:34 2017
@@ -362,6 +362,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.isc-hmac-fixup.html
diff -u src/external/bsd/bind/dist/doc/arm/man.isc-hmac-fixup.html:1.15 src/external/bsd/bind/dist/doc/arm/man.isc-hmac-fixup.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.isc-hmac-fixup.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.isc-hmac-fixup.html Fri Jun 30 07:32:34 2017
@@ -135,6 +135,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.named-checkconf.html
diff -u src/external/bsd/bind/dist/doc/arm/man.named-checkconf.html:1.15 src/external/bsd/bind/dist/doc/arm/man.named-checkconf.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.named-checkconf.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.named-checkconf.html Fri Jun 30 07:32:34 2017
@@ -201,6 +201,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.named-checkzone.html
diff -u src/external/bsd/bind/dist/doc/arm/man.named-checkzone.html:1.15 src/external/bsd/bind/dist/doc/arm/man.named-checkzone.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.named-checkzone.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.named-checkzone.html Fri Jun 30 07:32:34 2017
@@ -472,6 +472,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.named-journalprint.html
diff -u src/external/bsd/bind/dist/doc/arm/man.named-journalprint.html:1.15 src/external/bsd/bind/dist/doc/arm/man.named-journalprint.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.named-journalprint.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.named-journalprint.html Fri Jun 30 07:32:34 2017
@@ -126,6 +126,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.named-rrchecker.html
diff -u src/external/bsd/bind/dist/doc/arm/man.named-rrchecker.html:1.15 src/external/bsd/bind/dist/doc/arm/man.named-rrchecker.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.named-rrchecker.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.named-rrchecker.html Fri Jun 30 07:32:34 2017
@@ -130,6 +130,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.named.html
diff -u src/external/bsd/bind/dist/doc/arm/man.named.html:1.15 src/external/bsd/bind/dist/doc/arm/man.named.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.named.html:1.15 Thu Jun 15 11:59:39 2017
+++ src/external/bsd/bind/dist/doc/arm/man.named.html Fri Jun 30 07:32:34 2017
@@ -476,6 +476,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.nsec3hash.html
diff -u src/external/bsd/bind/dist/doc/arm/man.nsec3hash.html:1.15 src/external/bsd/bind/dist/doc/arm/man.nsec3hash.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.nsec3hash.html:1.15 Thu Jun 15 11:59:40 2017
+++ src/external/bsd/bind/dist/doc/arm/man.nsec3hash.html Fri Jun 30 07:32:34 2017
@@ -136,6 +136,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.nsupdate.html
diff -u src/external/bsd/bind/dist/doc/arm/man.nsupdate.html:1.15 src/external/bsd/bind/dist/doc/arm/man.nsupdate.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.nsupdate.html:1.15 Thu Jun 15 11:59:40 2017
+++ src/external/bsd/bind/dist/doc/arm/man.nsupdate.html Fri Jun 30 07:32:34 2017
@@ -804,6 +804,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.rndc-confgen.html
diff -u src/external/bsd/bind/dist/doc/arm/man.rndc-confgen.html:1.15 src/external/bsd/bind/dist/doc/arm/man.rndc-confgen.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.rndc-confgen.html:1.15 Thu Jun 15 11:59:40 2017
+++ src/external/bsd/bind/dist/doc/arm/man.rndc-confgen.html Fri Jun 30 07:32:34 2017
@@ -286,6 +286,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.rndc.conf.html
diff -u src/external/bsd/bind/dist/doc/arm/man.rndc.conf.html:1.15 src/external/bsd/bind/dist/doc/arm/man.rndc.conf.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.rndc.conf.html:1.15 Thu Jun 15 11:59:40 2017
+++ src/external/bsd/bind/dist/doc/arm/man.rndc.conf.html Fri Jun 30 07:32:34 2017
@@ -277,6 +277,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/man.rndc.html
diff -u src/external/bsd/bind/dist/doc/arm/man.rndc.html:1.15 src/external/bsd/bind/dist/doc/arm/man.rndc.html:1.16
--- src/external/bsd/bind/dist/doc/arm/man.rndc.html:1.15 Thu Jun 15 11:59:40 2017
+++ src/external/bsd/bind/dist/doc/arm/man.rndc.html Fri Jun 30 07:32:34 2017
@@ -723,6 +723,6 @@
</tr>
</table>
</div>
-<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook"; style="text-align: center;">BIND 9.10.5-P2</p>
</body>
</html>
Index: src/external/bsd/bind/dist/doc/arm/Bv9ARM.pdf
Binary files are different
Index: src/external/bsd/bind/dist/lib/dns/api
diff -u src/external/bsd/bind/dist/lib/dns/api:1.15 src/external/bsd/bind/dist/lib/dns/api:1.16
--- src/external/bsd/bind/dist/lib/dns/api:1.15 Thu Jun 15 11:59:40 2017
+++ src/external/bsd/bind/dist/lib/dns/api Fri Jun 30 07:32:34 2017
@@ -7,5 +7,5 @@
# 9.10: 140-149, 170-179
# 9.11: 160-169
LIBINTERFACE = 170
-LIBREVISION = 2
+LIBREVISION = 3
LIBAGE = 0
Index: src/external/bsd/bind/dist/lib/dns/dnssec.c
diff -u src/external/bsd/bind/dist/lib/dns/dnssec.c:1.13 src/external/bsd/bind/dist/lib/dns/dnssec.c:1.14
--- src/external/bsd/bind/dist/lib/dns/dnssec.c:1.13 Thu Jun 15 11:59:40 2017
+++ src/external/bsd/bind/dist/lib/dns/dnssec.c Fri Jun 30 07:32:34 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: dnssec.c,v 1.13 2017/06/15 15:59:40 christos Exp $ */
+/* $NetBSD: dnssec.c,v 1.14 2017/06/30 11:32:34 christos Exp $ */
/*
* Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC")
@@ -982,6 +982,8 @@ dns_dnssec_verifymessage(isc_buffer_t *s
mctx = msg->mctx;
msg->verify_attempted = 1;
+ msg->verified_sig = 0;
+ msg->sig0status = dns_tsigerror_badsig;
if (is_response(msg)) {
if (msg->query.base == NULL)
@@ -1077,6 +1079,7 @@ dns_dnssec_verifymessage(isc_buffer_t *s
}
msg->verified_sig = 1;
+ msg->sig0status = dns_rcode_noerror;
dst_context_destroy(&ctx);
dns_rdata_freestruct(&sig);
Index: src/external/bsd/bind/dist/lib/dns/message.c
diff -u src/external/bsd/bind/dist/lib/dns/message.c:1.23 src/external/bsd/bind/dist/lib/dns/message.c:1.24
--- src/external/bsd/bind/dist/lib/dns/message.c:1.23 Thu Jun 15 11:59:40 2017
+++ src/external/bsd/bind/dist/lib/dns/message.c Fri Jun 30 07:32:34 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: message.c,v 1.23 2017/06/15 15:59:40 christos Exp $ */
+/* $NetBSD: message.c,v 1.24 2017/06/30 11:32:34 christos Exp $ */
/*
* Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC")
@@ -3060,12 +3060,19 @@ dns_message_signer(dns_message_t *msg, d
result = dns_rdata_tostruct(&rdata, &tsig, NULL);
INSIST(result == ISC_R_SUCCESS);
- if (msg->tsigstatus != dns_rcode_noerror)
+ if (msg->verified_sig &&
+ msg->tsigstatus == dns_rcode_noerror &&
+ tsig.error == dns_rcode_noerror)
+ {
+ result = ISC_R_SUCCESS;
+ } else if ((!msg->verified_sig) ||
+ (msg->tsigstatus != dns_rcode_noerror))
+ {
result = DNS_R_TSIGVERIFYFAILURE;
- else if (tsig.error != dns_rcode_noerror)
+ } else {
+ INSIST(tsig.error != dns_rcode_noerror);
result = DNS_R_TSIGERRORSET;
- else
- result = ISC_R_SUCCESS;
+ }
dns_rdata_freestruct(&tsig);
if (msg->tsigkey == NULL) {
Index: src/external/bsd/bind/dist/lib/dns/rootns.c
diff -u src/external/bsd/bind/dist/lib/dns/rootns.c:1.12 src/external/bsd/bind/dist/lib/dns/rootns.c:1.13
--- src/external/bsd/bind/dist/lib/dns/rootns.c:1.12 Thu Jun 15 11:59:40 2017
+++ src/external/bsd/bind/dist/lib/dns/rootns.c Fri Jun 30 07:32:34 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: rootns.c,v 1.12 2017/06/15 15:59:40 christos Exp $ */
+/* $NetBSD: rootns.c,v 1.13 2017/06/30 11:32:34 christos Exp $ */
/*
* Copyright (C) 2004, 2005, 2007, 2008, 2010, 2012-2016 Internet Systems Consortium, Inc. ("ISC")
@@ -64,7 +64,7 @@ static char root_ns[] =
"A.ROOT-SERVERS.NET. 3600000 IN A 198.41.0.4\n"
"A.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:503:BA3E::2:30\n"
"B.ROOT-SERVERS.NET. 3600000 IN A 192.228.79.201\n"
-"B.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:84::b\n"
+"B.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:200::b\n"
"C.ROOT-SERVERS.NET. 3600000 IN A 192.33.4.12\n"
"C.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:2::c\n"
"D.ROOT-SERVERS.NET. 3600000 IN A 199.7.91.13\n"
Index: src/external/bsd/bind/dist/lib/dns/tsig.c
diff -u src/external/bsd/bind/dist/lib/dns/tsig.c:1.10 src/external/bsd/bind/dist/lib/dns/tsig.c:1.11
--- src/external/bsd/bind/dist/lib/dns/tsig.c:1.10 Thu Jun 15 11:59:40 2017
+++ src/external/bsd/bind/dist/lib/dns/tsig.c Fri Jun 30 07:32:34 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: tsig.c,v 1.10 2017/06/15 15:59:40 christos Exp $ */
+/* $NetBSD: tsig.c,v 1.11 2017/06/30 11:32:34 christos Exp $ */
/*
* Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC")
@@ -969,11 +969,20 @@ dns_tsig_sign(dns_message_t *msg) {
isc_buffer_putuint48(&otherbuf, tsig.timesigned);
}
- if (key->key != NULL && tsig.error != dns_tsigerror_badsig) {
+ if ((key->key != NULL) &&
+ (tsig.error != dns_tsigerror_badsig) &&
+ (tsig.error != dns_tsigerror_badkey))
+ {
unsigned char header[DNS_MESSAGE_HEADERLEN];
isc_buffer_t headerbuf;
isc_uint16_t digestbits;
+ /*
+ * If it is a response, we assume that the request MAC
+ * has validated at this point. This is why we include a
+ * MAC length > 0 in the reply.
+ */
+
ret = dst_context_create3(key->key, mctx,
DNS_LOGCATEGORY_DNSSEC,
ISC_TRUE, &ctx);
@@ -981,7 +990,7 @@ dns_tsig_sign(dns_message_t *msg) {
return (ret);
/*
- * If this is a response, digest the query signature.
+ * If this is a response, digest the request's MAC.
*/
if (response) {
dns_rdata_t querytsigrdata = DNS_RDATA_INIT;
@@ -1111,6 +1120,17 @@ dns_tsig_sign(dns_message_t *msg) {
dst_context_destroy(&ctx);
digestbits = dst_key_getbits(key->key);
if (digestbits != 0) {
+ /*
+ * XXXRAY: Is this correct? What is the
+ * expected behavior when digestbits is not an
+ * integral multiple of 8? It looks like bytes
+ * should either be (digestbits/8) or
+ * (digestbits+7)/8.
+ *
+ * In any case, for current algorithms,
+ * digestbits are an integral multiple of 8, so
+ * it has the same effect as (digestbits/8).
+ */
unsigned int bytes = (digestbits + 1) / 8;
if (response && bytes < querytsig.siglen)
bytes = querytsig.siglen;
@@ -1220,6 +1240,8 @@ dns_tsig_verify(isc_buffer_t *source, dn
REQUIRE(tsigkey == NULL || VALID_TSIG_KEY(tsigkey));
msg->verify_attempted = 1;
+ msg->verified_sig = 0;
+ msg->tsigstatus = dns_tsigerror_badsig;
if (msg->tcp_continuation) {
if (tsigkey == NULL || msg->querytsig == NULL)
@@ -1318,19 +1340,6 @@ dns_tsig_verify(isc_buffer_t *source, dn
key = tsigkey->key;
/*
- * Is the time ok?
- */
- if (now + msg->timeadjust > tsig.timesigned + tsig.fudge) {
- msg->tsigstatus = dns_tsigerror_badtime;
- tsig_log(msg->tsigkey, 2, "signature has expired");
- return (DNS_R_CLOCKSKEW);
- } else if (now + msg->timeadjust < tsig.timesigned - tsig.fudge) {
- msg->tsigstatus = dns_tsigerror_badtime;
- tsig_log(msg->tsigkey, 2, "signature is in the future");
- return (DNS_R_CLOCKSKEW);
- }
-
- /*
* Check digest length.
*/
alg = dst_key_alg(key);
@@ -1343,31 +1352,19 @@ dns_tsig_verify(isc_buffer_t *source, dn
#endif
alg == DST_ALG_HMACSHA1 ||
alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
- alg == DST_ALG_HMACSHA384 || alg == DST_ALG_HMACSHA512) {
- isc_uint16_t digestbits = dst_key_getbits(key);
+ alg == DST_ALG_HMACSHA384 || alg == DST_ALG_HMACSHA512)
+ {
if (tsig.siglen > siglen) {
tsig_log(msg->tsigkey, 2, "signature length too big");
return (DNS_R_FORMERR);
}
if (tsig.siglen > 0 &&
- (tsig.siglen < 10 || tsig.siglen < ((siglen + 1) / 2))) {
+ (tsig.siglen < 10 || tsig.siglen < ((siglen + 1) / 2)))
+ {
tsig_log(msg->tsigkey, 2,
"signature length below minimum");
return (DNS_R_FORMERR);
}
- if (tsig.siglen > 0 && digestbits != 0 &&
- tsig.siglen < ((digestbits + 1) / 8)) {
- msg->tsigstatus = dns_tsigerror_badtrunc;
- tsig_log(msg->tsigkey, 2,
- "truncated signature length too small");
- return (DNS_R_TSIGVERIFYFAILURE);
- }
- if (tsig.siglen > 0 && digestbits == 0 &&
- tsig.siglen < siglen) {
- msg->tsigstatus = dns_tsigerror_badtrunc;
- tsig_log(msg->tsigkey, 2, "signature length too small");
- return (DNS_R_TSIGVERIFYFAILURE);
- }
}
if (tsig.siglen > 0) {
@@ -1482,34 +1479,92 @@ dns_tsig_verify(isc_buffer_t *source, dn
ret = dst_context_verify(ctx, &sig_r);
if (ret == DST_R_VERIFYFAILURE) {
- msg->tsigstatus = dns_tsigerror_badsig;
ret = DNS_R_TSIGVERIFYFAILURE;
tsig_log(msg->tsigkey, 2,
"signature failed to verify(1)");
goto cleanup_context;
- } else if (ret != ISC_R_SUCCESS)
+ } else if (ret != ISC_R_SUCCESS) {
goto cleanup_context;
-
- dst_context_destroy(&ctx);
+ }
} else if (tsig.error != dns_tsigerror_badsig &&
tsig.error != dns_tsigerror_badkey) {
- msg->tsigstatus = dns_tsigerror_badsig;
tsig_log(msg->tsigkey, 2, "signature was empty");
return (DNS_R_TSIGVERIFYFAILURE);
}
- msg->tsigstatus = dns_rcode_noerror;
+ /*
+ * Here at this point, the MAC has been verified. Even if any of
+ * the following code returns a TSIG error, the reply will be
+ * signed and WILL always include the request MAC in the digest
+ * computation.
+ */
+
+ /*
+ * Is the time ok?
+ */
+ if (now + msg->timeadjust > tsig.timesigned + tsig.fudge) {
+ msg->tsigstatus = dns_tsigerror_badtime;
+ tsig_log(msg->tsigkey, 2, "signature has expired");
+ ret = DNS_R_CLOCKSKEW;
+ goto cleanup_context;
+ } else if (now + msg->timeadjust < tsig.timesigned - tsig.fudge) {
+ msg->tsigstatus = dns_tsigerror_badtime;
+ tsig_log(msg->tsigkey, 2, "signature is in the future");
+ ret = DNS_R_CLOCKSKEW;
+ goto cleanup_context;
+ }
+
+ if (
+#ifndef PK11_MD5_DISABLE
+ alg == DST_ALG_HMACMD5 ||
+#endif
+ alg == DST_ALG_HMACSHA1 ||
+ alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
+ alg == DST_ALG_HMACSHA384 || alg == DST_ALG_HMACSHA512)
+ {
+ isc_uint16_t digestbits = dst_key_getbits(key);
+
+ /*
+ * XXXRAY: Is this correct? What is the expected
+ * behavior when digestbits is not an integral multiple
+ * of 8? It looks like bytes should either be
+ * (digestbits/8) or (digestbits+7)/8.
+ *
+ * In any case, for current algorithms, digestbits are
+ * an integral multiple of 8, so it has the same effect
+ * as (digestbits/8).
+ */
+ if (tsig.siglen > 0 && digestbits != 0 &&
+ tsig.siglen < ((digestbits + 1) / 8))
+ {
+ msg->tsigstatus = dns_tsigerror_badtrunc;
+ tsig_log(msg->tsigkey, 2,
+ "truncated signature length too small");
+ ret = DNS_R_TSIGVERIFYFAILURE;
+ goto cleanup_context;
+ }
+ if (tsig.siglen > 0 && digestbits == 0 &&
+ tsig.siglen < siglen)
+ {
+ msg->tsigstatus = dns_tsigerror_badtrunc;
+ tsig_log(msg->tsigkey, 2, "signature length too small");
+ ret = DNS_R_TSIGVERIFYFAILURE;
+ goto cleanup_context;
+ }
+ }
if (tsig.error != dns_rcode_noerror) {
+ msg->tsigstatus = tsig.error;
if (tsig.error == dns_tsigerror_badtime)
- return (DNS_R_CLOCKSKEW);
+ ret = DNS_R_CLOCKSKEW;
else
- return (DNS_R_TSIGERRORSET);
+ ret = DNS_R_TSIGERRORSET;
+ goto cleanup_context;
}
+ msg->tsigstatus = dns_rcode_noerror;
msg->verified_sig = 1;
-
- return (ISC_R_SUCCESS);
+ ret = ISC_R_SUCCESS;
cleanup_context:
if (ctx != NULL)
@@ -1534,6 +1589,8 @@ tsig_verify_tcp(isc_buffer_t *source, dn
isc_uint16_t addcount, id;
isc_boolean_t has_tsig = ISC_FALSE;
isc_mem_t *mctx;
+ unsigned int siglen;
+ unsigned int alg;
REQUIRE(source != NULL);
REQUIRE(msg != NULL);
@@ -1541,12 +1598,16 @@ tsig_verify_tcp(isc_buffer_t *source, dn
REQUIRE(msg->tcp_continuation == 1);
REQUIRE(msg->querytsig != NULL);
+ msg->verified_sig = 0;
+ msg->tsigstatus = dns_tsigerror_badsig;
+
if (!is_response(msg))
return (DNS_R_EXPECTEDRESPONSE);
mctx = msg->mctx;
tsigkey = dns_message_gettsigkey(msg);
+ key = tsigkey->key;
/*
* Extract and parse the previous TSIG
@@ -1579,7 +1640,8 @@ tsig_verify_tcp(isc_buffer_t *source, dn
* Do the key name and algorithm match that of the query?
*/
if (!dns_name_equal(keyname, &tsigkey->name) ||
- !dns_name_equal(&tsig.algorithm, &querytsig.algorithm)) {
+ !dns_name_equal(&tsig.algorithm, &querytsig.algorithm))
+ {
msg->tsigstatus = dns_tsigerror_badkey;
ret = DNS_R_TSIGVERIFYFAILURE;
tsig_log(msg->tsigkey, 2,
@@ -1588,27 +1650,40 @@ tsig_verify_tcp(isc_buffer_t *source, dn
}
/*
- * Is the time ok?
+ * Check digest length.
*/
- isc_stdtime_get(&now);
-
- if (now + msg->timeadjust > tsig.timesigned + tsig.fudge) {
- msg->tsigstatus = dns_tsigerror_badtime;
- tsig_log(msg->tsigkey, 2, "signature has expired");
- ret = DNS_R_CLOCKSKEW;
- goto cleanup_querystruct;
- } else if (now + msg->timeadjust <
- tsig.timesigned - tsig.fudge) {
- msg->tsigstatus = dns_tsigerror_badtime;
- tsig_log(msg->tsigkey, 2,
- "signature is in the future");
- ret = DNS_R_CLOCKSKEW;
+ alg = dst_key_alg(key);
+ ret = dst_key_sigsize(key, &siglen);
+ if (ret != ISC_R_SUCCESS)
goto cleanup_querystruct;
+ if (
+#ifndef PK11_MD5_DISABLE
+ alg == DST_ALG_HMACMD5 ||
+#endif
+ alg == DST_ALG_HMACSHA1 ||
+ alg == DST_ALG_HMACSHA224 ||
+ alg == DST_ALG_HMACSHA256 ||
+ alg == DST_ALG_HMACSHA384 ||
+ alg == DST_ALG_HMACSHA512)
+ {
+ if (tsig.siglen > siglen) {
+ tsig_log(tsigkey, 2,
+ "signature length too big");
+ ret = DNS_R_FORMERR;
+ goto cleanup_querystruct;
+ }
+ if (tsig.siglen > 0 &&
+ (tsig.siglen < 10 ||
+ tsig.siglen < ((siglen + 1) / 2)))
+ {
+ tsig_log(tsigkey, 2,
+ "signature length below minimum");
+ ret = DNS_R_FORMERR;
+ goto cleanup_querystruct;
+ }
}
}
- key = tsigkey->key;
-
if (msg->tsigctx == NULL) {
ret = dst_context_create3(key, mctx,
DNS_LOGCATEGORY_DNSSEC,
@@ -1704,10 +1779,12 @@ tsig_verify_tcp(isc_buffer_t *source, dn
sig_r.length = tsig.siglen;
if (tsig.siglen == 0) {
if (tsig.error != dns_rcode_noerror) {
- if (tsig.error == dns_tsigerror_badtime)
+ msg->tsigstatus = tsig.error;
+ if (tsig.error == dns_tsigerror_badtime) {
ret = DNS_R_CLOCKSKEW;
- else
+ } else {
ret = DNS_R_TSIGERRORSET;
+ }
} else {
tsig_log(msg->tsigkey, 2,
"signature is empty");
@@ -1718,29 +1795,111 @@ tsig_verify_tcp(isc_buffer_t *source, dn
ret = dst_context_verify(msg->tsigctx, &sig_r);
if (ret == DST_R_VERIFYFAILURE) {
- msg->tsigstatus = dns_tsigerror_badsig;
tsig_log(msg->tsigkey, 2,
"signature failed to verify(2)");
ret = DNS_R_TSIGVERIFYFAILURE;
goto cleanup_context;
+ } else if (ret != ISC_R_SUCCESS) {
+ goto cleanup_context;
+ }
+
+ /*
+ * Here at this point, the MAC has been verified. Even
+ * if any of the following code returns a TSIG error,
+ * the reply will be signed and WILL always include the
+ * request MAC in the digest computation.
+ */
+
+ /*
+ * Is the time ok?
+ */
+ isc_stdtime_get(&now);
+
+ if (now + msg->timeadjust > tsig.timesigned + tsig.fudge) {
+ msg->tsigstatus = dns_tsigerror_badtime;
+ tsig_log(msg->tsigkey, 2, "signature has expired");
+ ret = DNS_R_CLOCKSKEW;
+ goto cleanup_context;
+ } else if (now + msg->timeadjust <
+ tsig.timesigned - tsig.fudge)
+ {
+ msg->tsigstatus = dns_tsigerror_badtime;
+ tsig_log(msg->tsigkey, 2,
+ "signature is in the future");
+ ret = DNS_R_CLOCKSKEW;
+ goto cleanup_context;
}
- else if (ret != ISC_R_SUCCESS)
+
+ alg = dst_key_alg(key);
+ ret = dst_key_sigsize(key, &siglen);
+ if (ret != ISC_R_SUCCESS)
goto cleanup_context;
+ if (
+#ifndef PK11_MD5_DISABLE
+ alg == DST_ALG_HMACMD5 ||
+#endif
+ alg == DST_ALG_HMACSHA1 ||
+ alg == DST_ALG_HMACSHA224 ||
+ alg == DST_ALG_HMACSHA256 ||
+ alg == DST_ALG_HMACSHA384 ||
+ alg == DST_ALG_HMACSHA512)
+ {
+ isc_uint16_t digestbits = dst_key_getbits(key);
- dst_context_destroy(&msg->tsigctx);
+ /*
+ * XXXRAY: Is this correct? What is the
+ * expected behavior when digestbits is not an
+ * integral multiple of 8? It looks like bytes
+ * should either be (digestbits/8) or
+ * (digestbits+7)/8.
+ *
+ * In any case, for current algorithms,
+ * digestbits are an integral multiple of 8, so
+ * it has the same effect as (digestbits/8).
+ */
+ if (tsig.siglen > 0 && digestbits != 0 &&
+ tsig.siglen < ((digestbits + 1) / 8))
+ {
+ msg->tsigstatus = dns_tsigerror_badtrunc;
+ tsig_log(msg->tsigkey, 2,
+ "truncated signature length "
+ "too small");
+ ret = DNS_R_TSIGVERIFYFAILURE;
+ goto cleanup_context;
+ }
+ if (tsig.siglen > 0 && digestbits == 0 &&
+ tsig.siglen < siglen)
+ {
+ msg->tsigstatus = dns_tsigerror_badtrunc;
+ tsig_log(msg->tsigkey, 2,
+ "signature length too small");
+ ret = DNS_R_TSIGVERIFYFAILURE;
+ goto cleanup_context;
+ }
+ }
+
+ if (tsig.error != dns_rcode_noerror) {
+ msg->tsigstatus = tsig.error;
+ if (tsig.error == dns_tsigerror_badtime)
+ ret = DNS_R_CLOCKSKEW;
+ else
+ ret = DNS_R_TSIGERRORSET;
+ goto cleanup_context;
+ }
}
msg->tsigstatus = dns_rcode_noerror;
- return (ISC_R_SUCCESS);
+ msg->verified_sig = 1;
+ ret = ISC_R_SUCCESS;
cleanup_context:
- dst_context_destroy(&msg->tsigctx);
+ if (msg->tsigctx != NULL)
+ dst_context_destroy(&msg->tsigctx);
cleanup_querystruct:
dns_rdata_freestruct(&querytsig);
return (ret);
-
}
isc_result_t
