summaryrefslogtreecommitdiffstats
path: root/debian/patches/0035-CVE-2021-25220.patch
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--debian/patches/0035-CVE-2021-25220.patch203
1 files changed, 203 insertions, 0 deletions
diff --git a/debian/patches/0035-CVE-2021-25220.patch b/debian/patches/0035-CVE-2021-25220.patch
new file mode 100644
index 0000000..48652e1
--- /dev/null
+++ b/debian/patches/0035-CVE-2021-25220.patch
@@ -0,0 +1,203 @@
+From: Debian DNS Team <team+dns@tracker.debian.org>
+Date: Mon, 14 Mar 2022 15:31:10 +0100
+Subject: CVE-2021-25220
+
+---
+ lib/dns/resolver.c | 125 ++++++++++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 120 insertions(+), 5 deletions(-)
+
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index bfc1ae2..cabcbdc 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -68,6 +68,7 @@
+ #include <dns/stats.h>
+ #include <dns/tsig.h>
+ #include <dns/validator.h>
++#include <dns/zone.h>
+
+ #ifdef WANT_QUERYTRACE
+ #define RTRACE(m) isc_log_write(dns_lctx, \
+@@ -314,6 +315,8 @@ struct fetchctx {
+ bool ns_ttl_ok;
+ uint32_t ns_ttl;
+ isc_counter_t * qc;
++ dns_fixedname_t fwdfname;
++ dns_name_t *fwdname;
+
+ /*%
+ * The number of events we're waiting for.
+@@ -3304,6 +3307,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
+ if (result == ISC_R_SUCCESS) {
+ fwd = ISC_LIST_HEAD(forwarders->fwdrs);
+ fctx->fwdpolicy = forwarders->fwdpolicy;
++ dns_name_copy(domain, fctx->fwdname, NULL);
+ if (fctx->fwdpolicy == dns_fwdpolicy_only &&
+ isstrictsubdomain(domain, &fctx->domain)) {
+ fcount_decr(fctx);
+@@ -4334,6 +4338,9 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
+ fctx->restarts = 0;
+ fctx->querysent = 0;
+ fctx->referrals = 0;
++
++ fctx->fwdname = dns_fixedname_initname(&fctx->fwdfname);
++
+ TIME_NOW(&fctx->start);
+ fctx->timeouts = 0;
+ fctx->lamecount = 0;
+@@ -4386,8 +4393,10 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
+ domain = dns_fixedname_initname(&fixed);
+ result = dns_fwdtable_find2(fctx->res->view->fwdtable, fwdname,
+ domain, &forwarders);
+- if (result == ISC_R_SUCCESS)
++ if (result == ISC_R_SUCCESS) {
+ fctx->fwdpolicy = forwarders->fwdpolicy;
++ dns_name_copy(domain, fctx->fwdname, NULL);
++ }
+
+ if (fctx->fwdpolicy != dns_fwdpolicy_only) {
+ /*
+@@ -6144,6 +6153,107 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset,
+ rdataset->attributes |= DNS_RDATASETATTR_EXTERNAL;
+ }
+
++/*
++ * Returns true if 'name' is external to the namespace for which
++ * the server being queried can answer, either because it's not a
++ * subdomain or because it's below a forward declaration or a
++ * locally served zone.
++ */
++static inline bool
++name_external(dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
++ isc_result_t result;
++ dns_forwarders_t *forwarders = NULL;
++ dns_fixedname_t fixed, zfixed;
++ dns_name_t *fname = dns_fixedname_initname(&fixed);
++ dns_name_t *zfname = dns_fixedname_initname(&zfixed);
++ dns_name_t *apex = NULL;
++ dns_name_t suffix;
++ dns_zone_t *zone = NULL;
++ unsigned int labels;
++ dns_namereln_t rel;
++
++ apex = ISFORWARDER(fctx->addrinfo) ? fctx->fwdname : &fctx->domain;
++
++ /*
++ * The name is outside the queried namespace.
++ */
++ rel = dns_name_fullcompare(name, apex, &(int){ 0 },
++ &(unsigned int){ 0U });
++ if (rel != dns_namereln_subdomain && rel != dns_namereln_equal) {
++ return (true);
++ }
++
++ /*
++ * If the record lives in the parent zone, adjust the name so we
++ * look for the correct zone or forward clause.
++ */
++ labels = dns_name_countlabels(name);
++ if (dns_rdatatype_atparent(type) && labels > 1U) {
++ dns_name_init(&suffix, NULL);
++ dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
++ name = &suffix;
++ } else if (rel == dns_namereln_equal) {
++ /* If 'name' is 'apex', no further checking is needed. */
++ return (false);
++ }
++
++ /*
++ * If there is a locally served zone between 'apex' and 'name'
++ * then don't cache.
++ */
++ LOCK(&fctx->res->view->lock);
++ if (fctx->res->view->zonetable != NULL) {
++ unsigned int options = DNS_ZTFIND_NOEXACT;
++ result = dns_zt_find(fctx->res->view->zonetable, name, options,
++ zfname, &zone);
++ if (zone != NULL) {
++ dns_zone_detach(&zone);
++ }
++ if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
++ if (dns_name_fullcompare(zfname, apex, &(int){ 0 },
++ &(unsigned int){ 0U }) ==
++ dns_namereln_subdomain)
++ {
++ UNLOCK(&fctx->res->view->lock);
++ return (true);
++ }
++ }
++ }
++ UNLOCK(&fctx->res->view->lock);
++
++ /*
++ * Look for a forward declaration below 'name'.
++ */
++ result = dns_fwdtable_find2(fctx->res->view->fwdtable, name, fname,
++ &forwarders);
++
++ if (ISFORWARDER(fctx->addrinfo)) {
++ /*
++ * See if the forwarder declaration is better.
++ */
++ if (result == ISC_R_SUCCESS) {
++ return (!dns_name_equal(fname, fctx->fwdname));
++ }
++
++ /*
++ * If the lookup failed, the configuration must have
++ * changed: play it safe and don't cache.
++ */
++ return (true);
++ } else if (result == ISC_R_SUCCESS &&
++ forwarders->fwdpolicy == dns_fwdpolicy_only &&
++ !ISC_LIST_EMPTY(forwarders->fwdrs))
++ {
++ /*
++ * If 'name' is covered by a 'forward only' clause then we
++ * can't cache this repsonse.
++ */
++ return (true);
++ }
++
++ return (false);
++}
++
+ static isc_result_t
+ check_section(void *arg, dns_name_t *addname, dns_rdatatype_t type,
+ dns_section_t section)
+@@ -6170,7 +6280,7 @@ check_section(void *arg, dns_name_t *addname, dns_rdatatype_t type,
+ result = dns_message_findname(fctx->rmessage, section, addname,
+ dns_rdatatype_any, 0, &name, NULL);
+ if (result == ISC_R_SUCCESS) {
+- external = !dns_name_issubdomain(name, &fctx->domain);
++ external = name_external(name, type, fctx);
+ if (type == dns_rdatatype_a) {
+ for (rdataset = ISC_LIST_HEAD(name->list);
+ rdataset != NULL;
+@@ -7018,6 +7128,13 @@ answer_response(fetchctx_t *fctx) {
+ break;
+
+ case dns_namereln_subdomain:
++ /*
++ * Don't accept DNAME from parent namespace.
++ */
++ if (name_external(name, dns_rdatatype_dname, fctx)) {
++ continue;
++ }
++
+ /*
+ * In-scope DNAME records must have at least
+ * as many labels as the domain being queried.
+@@ -7246,11 +7363,9 @@ answer_response(fetchctx_t *fctx) {
+ */
+ result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
+ while (!done && result == ISC_R_SUCCESS) {
+- bool external;
+ name = NULL;
+ dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
+- external = !dns_name_issubdomain(name, &fctx->domain);
+- if (!external) {
++ if (!name_external(name, dns_rdatatype_ns, fctx)) {
+ /*
+ * We expect to find NS or SIG NS rdatasets, and
+ * nothing else.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-23 10:47:27 +0000