Compare commits

...
Sign in to create a new pull request.

8 commits

Author SHA1 Message Date
Petr Menšík
7ffdde8fe1 Update to 9.19.22 (rhbz#2270475)
https://downloads.isc.org/isc/bind9/9.19.22/doc/arm/html/notes.html#notes-for-bind-9-19-22
2024-04-15 21:27:34 +02:00
Petr Menšík
46841be611 Update to 9.19.21 (#2264048)
https://downloads.isc.org/isc/bind9/9.19.21/RELEASE-NOTES-bind-9.19.21.html

Security Fixes

- Validating DNS messages containing a lot of DNSSEC signatures could cause
  excessive CPU load, leading to a denial-of-service condition. This has
  been fixed. (CVE-2023-50387)

  ISC would like to thank Elias Heftrig, Haya Schulmann, Niklas Vogel, and
  Michael Waidner from the German National Research Center for Applied
  Cybersecurity ATHENE for bringing this vulnerability to our attention. [GL #4424]

- Parsing DNS messages with many different names could cause excessive CPU load.
  This has been fixed. (CVE-2023-4408)

  ISC would like to thank Shoham Danino from Reichman University, Anat Bremler-Barr
  from Tel-Aviv University, Yehuda Afek from Tel-Aviv University, and Yuval Shavitt
  from Tel-Aviv University for bringing this vulnerability to our attention. [GL #4234]

- Specific queries could cause named to crash with an assertion failure when
  nxdomain-redirect was enabled. This has been fixed. (CVE-2023-5517) [GL #4281]

- A bad interaction between DNS64 and serve-stale could cause named to crash with an
  assertion failure, when both of these features were enabled. This has been fixed.
  (CVE-2023-5679) [GL #4334]

Resolves: CVE-2023-50387 CVE-2023-4408 CVE-2023-5517 CVE-2023-5679
2024-02-17 03:12:52 +01:00
Petr Menšík
f17a799334 Update changed b.root-servers.net address in hints (#2253463) 2024-01-16 13:40:37 +01:00
Petr Menšík
06cb24cfdc Remove i686 compatibility changes
It should now work with upstream changes included, thanks to:
https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8516
2024-01-16 11:08:38 +01:00
Petr Menšík
c1c7621d71 Update to 9.19.19 (#2255406)
https://downloads.isc.org/isc/bind9/9.19.19/doc/arm/html/notes.html#notes-for-bind-9-19-19

New Features

- Initial support for the PROXYv2 protocol was added. named can now accept PROXYv2 headers over all currently implemented DNS transports and dig can insert these headers into the queries it sends. Please consult the related documentation (allow-proxy, allow-proxy-on, listen-on, and listen-on-v6 for named, dig +proxy and dig +proxy-plain for dig) for additional details. [GL #4388]

Removed Features

- Support for using AES as the DNS COOKIE algorithm (cookie-algorithm aes;) has been removed. The only supported DNS COOKIE algorithm is now the current default, SipHash-2-4. [GL #4421]

- The resolver-nonbackoff-tries and resolver-retry-interval statements have been removed. Using them is now a fatal error. [GL #4405]

Feature Changes

- The maximum number of NSEC3 iterations allowed for validation purposes has been lowered from 150 to 50. DNSSEC responses containing NSEC3 records with iteration counts greater than 50 are now treated as insecure. [GL #4363]

- Following RFC 9276 recommendations, dnssec-policy now only allows an NSEC3 iteration count of 0 for the DNSSEC-signed zones using NSEC3 that the policy manages. [GL #4363]
2024-01-16 11:08:38 +01:00
Petr Menšík
d1d29058a6 Fully remove PDF building support
Upstream has discontinued and remove support for local PDF building in
commit 561a83a29182b00bda9237ae30343d76a68dcdf4. Just remove remaining
bits, it is not likely to return.
2023-11-20 12:30:29 +01:00
Petr Menšík
6eaef8126b Disable PDF building and enable epub inclusion
Ship built epub ARM in doc subpackage. But disable latex pdf building,
since it is not built anymore and does not even exist.
2023-11-20 12:30:29 +01:00
Petr Menšík
b5d7143a46 Update to 9.19.18 (#2249833)
https://downloads.isc.org/isc/bind9/9.19.18/doc/arm/html/notes.html#notes-for-bind-9-19-18
2023-11-20 12:30:29 +01:00
6 changed files with 18 additions and 263 deletions

8
.gitignore vendored
View file

@ -214,3 +214,11 @@ bind-9.7.2b1.tar.gz
/bind-9.19.16.tar.xz.asc
/bind-9.19.17.tar.xz
/bind-9.19.17.tar.xz.asc
/bind-9.19.18.tar.xz
/bind-9.19.18.tar.xz.asc
/bind-9.19.19.tar.xz
/bind-9.19.19.tar.xz.asc
/bind-9.19.21.tar.xz
/bind-9.19.21.tar.xz.asc
/bind-9.19.22.tar.xz
/bind-9.19.22.tar.xz.asc

View file

@ -1,178 +0,0 @@
From 0a423df93aa9b4a6391c0483518f2b2961b547e1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 13 Sep 2023 15:37:57 +0200
Subject: [PATCH] Try to release cache size of complete slab
node used to store new header might be significantly bigger that
expired node from the cache. Count into freed size also node size used
to hold the cache. Mark it released only if it is the last reference.
---
lib/dns/include/dns/rbt.h | 5 +++++
lib/dns/rbt-cachedb.c | 34 ++++++++++++++++++----------------
lib/dns/rbt.c | 5 +++++
lib/dns/rbtdb.c | 2 +-
lib/dns/rbtdb_p.h | 3 ++-
5 files changed, 31 insertions(+), 18 deletions(-)
diff --git a/lib/dns/include/dns/rbt.h b/lib/dns/include/dns/rbt.h
index 08b4803ab99..79ab496842d 100644
--- a/lib/dns/include/dns/rbt.h
+++ b/lib/dns/include/dns/rbt.h
@@ -778,6 +778,11 @@ dns__rbtnode_getdistance(dns_rbtnode_t *node);
* has a distance of 2.
*/
+size_t
+dns__rbtnode_getsize(dns_rbtnode_t *node);
+/*%<
+ * Return allocated size for a node.
+ */
/*****
***** Chain Functions
*****/
diff --git a/lib/dns/rbt-cachedb.c b/lib/dns/rbt-cachedb.c
index d57eb2a6cc7..db3c09c9323 100644
--- a/lib/dns/rbt-cachedb.c
+++ b/lib/dns/rbt-cachedb.c
@@ -1534,7 +1534,7 @@ expiredata(dns_db_t *db, dns_dbnode_t *node, void *data) {
isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
NODE_WRLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
- dns__cachedb_expireheader(header, &tlocktype,
+ (void)dns__cachedb_expireheader(header, &tlocktype,
dns_expire_flush DNS__DB_FLARG_PASS);
NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, &nlocktype);
INSIST(tlocktype == isc_rwlocktype_none);
@@ -1573,13 +1573,24 @@ dns_dbmethods_t dns__rbtdb_cachemethods = {
.deletedata = dns__rbtdb_deletedata,
};
+static size_t
+rdataset_size(dns_slabheader_t *header) {
+ if (!NONEXISTENT(header)) {
+ return (dns_rdataslab_size((unsigned char *)header,
+ sizeof(*header)));
+ }
+
+ return (sizeof(*header));
+}
+
/*
* Caller must hold the node (write) lock.
*/
-void
+size_t
dns__cachedb_expireheader(dns_slabheader_t *header,
isc_rwlocktype_t *tlocktypep,
dns_expire_t reason DNS__DB_FLARG) {
+ size_t freed = rdataset_size(header);
dns__rbtdb_setttl(header, 0);
dns__rbtdb_mark(header, DNS_SLABHEADERATTR_ANCIENT);
HEADER_NODE(header)->dirty = 1;
@@ -1593,13 +1604,14 @@ dns__cachedb_expireheader(dns_slabheader_t *header,
* We first need to gain a new reference to the node to meet a
* requirement of dns__rbtdb_decref().
*/
+ freed += dns__rbtnode_getsize(HEADER_NODE(header));
dns__rbtdb_newref(rbtdb, HEADER_NODE(header),
nlocktype DNS__DB_FLARG_PASS);
dns__rbtdb_decref(rbtdb, HEADER_NODE(header), 0, &nlocktype,
tlocktypep, true, false DNS__DB_FLARG_PASS);
if (rbtdb->cachestats == NULL) {
- return;
+ return freed;
}
switch (reason) {
@@ -1615,16 +1627,7 @@ dns__cachedb_expireheader(dns_slabheader_t *header,
break;
}
}
-}
-
-static size_t
-rdataset_size(dns_slabheader_t *header) {
- if (!NONEXISTENT(header)) {
- return (dns_rdataslab_size((unsigned char *)header,
- sizeof(*header)));
- }
-
- return (sizeof(*header));
+ return freed;
}
static size_t
@@ -1637,7 +1640,6 @@ expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum,
for (header = ISC_LIST_TAIL(rbtdb->lru[locknum]);
header != NULL && purged <= purgesize; header = header_prev)
{
- size_t header_size = rdataset_size(header);
header_prev = ISC_LIST_PREV(header, link);
/*
@@ -1648,9 +1650,8 @@ expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum,
* TTL was reset to 0.
*/
ISC_LIST_UNLINK(rbtdb->lru[locknum], header, link);
- dns__cachedb_expireheader(header, tlocktypep,
+ purged += dns__cachedb_expireheader(header, tlocktypep,
dns_expire_lru DNS__DB_FLARG_PASS);
- purged += header_size;
}
return (purged);
@@ -1676,6 +1677,7 @@ dns__cachedb_overmem(dns_rbtdb_t *rbtdb, dns_slabheader_t *newheader,
unsigned int locknum;
size_t purgesize = rdataset_size(newheader);
size_t purged = 0;
+ purgesize += dns__rbtnode_getsize(HEADER_NODE(newheader));
for (locknum = (locknum_start + 1) % rbtdb->node_lock_count;
locknum != locknum_start && purged <= purgesize;
diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
index 32e1c2cc3d4..fc47be84444 100644
--- a/lib/dns/rbt.c
+++ b/lib/dns/rbt.c
@@ -176,6 +176,11 @@ dns__rbtnode_getdistance(dns_rbtnode_t *node) {
return (nodes);
}
+size_t
+dns__rbtnode_getsize(dns_rbtnode_t *node) {
+ return (NODE_SIZE(node));
+}
+
/*
* Forward declarations.
*/
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 78464170b06..344dd17bf42 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -3286,7 +3286,7 @@ dns__rbtdb_addrdataset(dns_db_t *db, dns_dbnode_t *node,
if (header != NULL && header->ttl + STALE_TTL(header, rbtdb) <
now - RBTDB_VIRTUAL)
{
- dns__cachedb_expireheader(
+ (void)dns__cachedb_expireheader(
header, &tlocktype,
dns_expire_ttl DNS__DB_FLARG_PASS);
}
diff --git a/lib/dns/rbtdb_p.h b/lib/dns/rbtdb_p.h
index ddc98fe7f2e..f9c711a966c 100644
--- a/lib/dns/rbtdb_p.h
+++ b/lib/dns/rbtdb_p.h
@@ -601,7 +601,8 @@ dns__zonedb_addwildcards(dns_rbtdb_t *rbtdb, const dns_name_t *name, bool lock);
/*
* Cache-specific functions that are called from rbtdb.c
*/
-void
+/* Returns number of released bytes. */
+size_t
dns__cachedb_expireheader(dns_slabheader_t *header,
isc_rwlocktype_t *tlocktypep,
dns_expire_t reason DNS__DB_FLARG);
--
2.41.0

View file

@ -1,50 +0,0 @@
From 2514f8d77d52da0e95af4256f9ae9905b890e69e Mon Sep 17 00:00:00 2001
From: Petr Mensik <pemensik@redhat.com>
Date: Wed, 6 Sep 2023 20:20:53 +0200
Subject: [PATCH] Use range to show value for rbtdb overmempurge_ tests
overmempurge_longname is failing reliably on i686 builds. If that
happens, make displaying failing values part of the output.
FIXME: Includes debug tests
---
tests/dns/rbtdb_test.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/tests/dns/rbtdb_test.c b/tests/dns/rbtdb_test.c
index 6f2ab3c..f1046b9 100644
--- a/tests/dns/rbtdb_test.c
+++ b/tests/dns/rbtdb_test.c
@@ -328,7 +328,7 @@ ISC_RUN_TEST_IMPL(overmempurge_bigrdata) {
*/
while (i-- > 0) {
overmempurge_addrdataset(db, now, i, 50054, 65535, false);
- assert_true(isc_mem_inuse(mctx2) < maxcache);
+ assert_in_range(isc_mem_inuse(mctx2), 0, maxcache-1);
}
dns_db_detach(&db);
@@ -360,6 +360,8 @@ ISC_RUN_TEST_IMPL(overmempurge_longname) {
* iteration to avoid an infinite loop in case something gets wrong.
*/
for (i = 0; !isc_mem_isovermem(mctx2) && i < (maxcache / 10); i++) {
+ printf("Mem in use #%zu: %zu\n", i, isc_mem_inuse(mctx2));
+ assert_in_range(isc_mem_inuse(mctx2), 0, maxcache-1);
overmempurge_addrdataset(db, now, i, 50053, 0, false);
}
assert_true(isc_mem_isovermem(mctx2));
@@ -371,8 +373,10 @@ ISC_RUN_TEST_IMPL(overmempurge_longname) {
* size doesn't reach the "max".
*/
while (i-- > 0) {
+ printf("Mem in use before #%zu: %zu\n", i, isc_mem_inuse(mctx2));
overmempurge_addrdataset(db, now, i, 50054, 0, true);
- assert_true(isc_mem_inuse(mctx2) < maxcache);
+ printf("Mem in use after #%zu: %zu\n", i, isc_mem_inuse(mctx2));
+ assert_in_range(isc_mem_inuse(mctx2), 0, maxcache-1);
}
dns_db_detach(&db);
--
2.41.0

View file

@ -20,12 +20,6 @@
%bcond_without DNSTAP
%bcond_without LMDB
%bcond_without DOC
# Because of issues with PDF rebuild, include only HTML pages
# Current error: unable top find isc-logo.pdf
%if 0%{?fedora}
# RHEL and ELN do not have all required packages
%bcond_without DOCPDF
%endif
%bcond_with TSAN
%bcond_without DTRACE
@ -58,7 +52,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
Name: bind9-next
License: MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause
#
Version: 9.19.17
Version: 9.19.22
Release: %autorelease
Epoch: 32
Url: https://www.isc.org/downloads/bind/
@ -94,9 +88,6 @@ Source49: named-chroot.files
# Common patches
# Red Hat specific documentation is not relevant to upstream
Patch1: bind-9.16-redhat_doc.patch
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8285
Patch2: bind-9.19-tests-dns-rbtdb-i386.patch
Patch3: bind-9.19-rbtdb-i686.patch
%{?systemd_ordering}
Requires: coreutils
@ -166,10 +157,6 @@ BuildRequires: fstrm-devel protobuf-c-devel
BuildRequires: python3-sphinx python3-sphinx_rtd_theme
BuildRequires: doxygen
%endif
%if %{with DOCPDF}
# Because remaining issues with COPR, allow turning off PDF (re)generation
BuildRequires: python3-sphinx-latex latexmk texlive-xetex texlive-xindy
%endif
%if %{with TSAN}
BuildRequires: libtsan
%endif
@ -426,14 +413,6 @@ export LIBDIR_SUFFIX
popd
%endif
%if %{with DOCPDF}
# avoid using home for pdf latex files
export TEXMFVAR="`pwd`"
export TEXMFCONFIG="`pwd`"
fmtutil-user --listcfg || :
fmtutil-user --missing || :
%endif
%make_build SPHINX_W=''
%if %{with DOC}
@ -637,9 +616,7 @@ do
ln -s "$DIR" "$BINDTHEMEDIR"
fi
done
%endif
%if %{with DOCPDF}
cp -p build/doc/arm/_build/latex/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir}
cp -p build/doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
%endif
# Ghost config files:
@ -962,9 +939,7 @@ fi;
%dir %{_pkgdocdir}
%doc %{_pkgdocdir}/html
%doc %{_pkgdocdir}/Bv9ARM.html
%endif
%if %{with DOCPDF}
%doc %{_pkgdocdir}/Bv9ARM.pdf
%doc %{_pkgdocdir}/Bv9ARM.epub
%endif
%changelog

View file

@ -8,9 +8,9 @@
; file /domain/named.cache
; on server FTP.INTERNIC.NET
; -OR- RS.INTERNIC.NET
;
; last update: June 24, 2021
; related version of root zone: 2021062401
;
; last update: December 20, 2023
; related version of root zone: 2023122001
;
; FORMERLY NS.INTERNIC.NET
;
@ -21,8 +21,8 @@ A.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:ba3e::2:30
; FORMERLY NS1.ISI.EDU
;
. 3600000 NS B.ROOT-SERVERS.NET.
B.ROOT-SERVERS.NET. 3600000 A 199.9.14.201
B.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:200::b
B.ROOT-SERVERS.NET. 3600000 A 170.247.170.2
B.ROOT-SERVERS.NET. 3600000 AAAA 2801:1b8:10::b
;
; FORMERLY C.PSI.NET
;

View file

@ -1,2 +1,2 @@
SHA512 (bind-9.19.17.tar.xz) = 59e1d900594ad3730319a4e0707e31eb4ecafc47089a577241eb6f76028b30879c067517ce8e6b41847fb43feb3ece56bac0b73b1f9d4d156cb7452ba82e871e
SHA512 (bind-9.19.17.tar.xz.asc) = 1808e9897e6fda6185447578b8bece5d40afdf72f61737e890bcc89a4cf81a176c961f8d2cd8dc0e170735cadfee6503de0abc1d2233bfefdec0d2050164a76a
SHA512 (bind-9.19.22.tar.xz) = 609f73ab7e34e9ef0e5854a0bf150009c1ae34615c5f8c7fecf0352ea65ce0d92fecc02b918a0b3b90b3c303dad659e4981a97b1413d02724b20a5ed2d1d905f
SHA512 (bind-9.19.22.tar.xz.asc) = 4839365da593ab6b924372019bbb8b8212856116c563e4f9b6d0b03681234fb855b7f3c85766919fac400be7508f7b72bc9d2a3d8496ce9ee21c6b5fb4369cf3