From nobody Sat Jan 14 09:19:57 2023 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4NvCRd36trz2sTXJ; Sat, 14 Jan 2023 09:19:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4NvCRd2Pj1z44Jx; Sat, 14 Jan 2023 09:19:57 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1673687997; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TUgRn9mavm3v1wcjgH1O+yEFidarC4jcdWSZzrC5HcY=; b=SYBfVTNJDIsRyN51jJNYLnY/T4ZZog4XjkWD/AknO9ugehou1mHQbflYQ342B3wZ0EVzWx p5jDQU33UwYDtDkxZtaqWxdZwga0QQtoSH0aeqlmkv9CAH+DLZrmFMVPFd6li5APgXyeXk YG5y3ZInvoP4hvJKHXRDwmZfOkOeBm6taodY4SWl+43Nxl94nkz9WdosN36TTVB+9sYWxB u1J9BFPRyHC0JznREiSbikj2DNGzmqIJOCmPnfv2aO3E+OK4GNNsVBm87DoABpkPG0PCJE x2eDlmwgJd42D87oKq0WyzTzAtlD/kK17n1oZDP1GIe7n6Wz3Y1vKbwDSctxXA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1673687997; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=TUgRn9mavm3v1wcjgH1O+yEFidarC4jcdWSZzrC5HcY=; b=wH/nkSJumDAlqQBKW83xckpHbrgtxA7Wk/5svjeuawuD53a2eGnwqS7gwgd4iO09kd/Xmx D8OfLuQ1iKk7DinrW7Iy3xTk2nnc8NEf5jDmFtlWg6WsMOwPqHuAoH8lX3VPGkylWYrGfk zp0c5fQTHl5HcNNmBGotqDTwHqpHdDvQQHKFNrqaRIRHh6PcAR6wfgVcC/tT0tnz9tbVot LGVAbXcgcmqAOUUCxf33bagMwKZ/QgZszNicD8vSmMoBzCEzMneiOjq5ehRLGzeELyA0UU Qabz4HcZNiutBont8QP34iJZUqMSIiHPcqVV+LFLKGVm/S44Dcko5eJo3fB38Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1673687997; a=rsa-sha256; cv=none; b=iQT9nzQ6pdp4lBjMDtWs4K439TIv+6gOTiiaQNKoMFm9WG50fxphIC/QxX6VsvwgDbHIKY 2z0/A1OkxbBw3FIovLQxVpUsORfi6Q8s37P40HOE3Mugsw8irD4yA0CH3X9hCnBi+6GQxq d/FHXwmIUEbbJhTvu7hbsj0PE9MK0GcsRvf0NzHhRACQ1Yg75ENJcE4c1Uuns83oX9JYnr qrbDOROnVV57a5OWTQQv8NzJsGB4D75WNPAsFWwA08j/i4CRpoNswpfB7JljSaUIZg75xp w1g1xfpnhLGLe199Jpal8/KYHdegCrDuLP35XDvOdN0J/YePpaJxFKxcyrX57A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4NvCRd1LqDzj3l; Sat, 14 Jan 2023 09:19:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 30E9JvLl057793; Sat, 14 Jan 2023 09:19:57 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 30E9JvwF057792; Sat, 14 Jan 2023 09:19:57 GMT (envelope-from git) Date: Sat, 14 Jan 2023 09:19:57 GMT Message-Id: <202301140919.30E9JvwF057792@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Matthias Andree Subject: git: 038ffa5e63e3 - main - dns/dnsmasq: fix rare cache corruption problem List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-all@freebsd.org X-BeenThere: dev-commits-ports-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: mandree X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 038ffa5e63e3b419b68989e5c822b8cb108af7da Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by mandree: URL: https://cgit.FreeBSD.org/ports/commit/?id=038ffa5e63e3b419b68989e5c822b8cb108af7da commit 038ffa5e63e3b419b68989e5c822b8cb108af7da Author: Matthias Andree AuthorDate: 2023-01-14 09:10:42 +0000 Commit: Matthias Andree CommitDate: 2023-01-14 09:19:23 +0000 dns/dnsmasq: fix rare cache corruption problem Simon Kelley sent an advisory that in rare circumstances, the cache can become corrupted and the DNS subsystem then became disfunctional. This is reported as regression in 2.88. Chances seem higher this happens with DNSSEC enabled, but seems not limited to it. For details, please see the patch contained in this commit, or https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2023q1/016821.html The symptom of this happening is apparently a cache internal error. 2.89 with this fix and a few others is slated for release in a week. Let's fix the patch already and MFH to 2023Q1 so we keep our liberties to decide whether we need to move quarterly to 2.89 or rather stick with 2.88_1. originally Reported by: Timo van Roermund (to Simon Kelley in private) Reported by: Simon Kelley (upstream maintainer, through mailing list) Obtained from: Simon Kelley (upstream maintainer, Git repository) MFH: 2023Q1 --- dns/dnsmasq/Makefile | 2 +- dns/dnsmasq/files/patch-zgf172fdb | 85 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 86 insertions(+), 1 deletion(-) diff --git a/dns/dnsmasq/Makefile b/dns/dnsmasq/Makefile index ba9002cb4f44..ba26d1ec62a8 100644 --- a/dns/dnsmasq/Makefile +++ b/dns/dnsmasq/Makefile @@ -1,7 +1,7 @@ PORTNAME= dnsmasq DISTVERSION= 2.88 # Leave the PORTREVISION in even if 0 to avoid accidental PORTEPOCH bumps: -PORTREVISION= 0 +PORTREVISION= 1 PORTEPOCH= 1 CATEGORIES= dns MASTER_SITES= https://www.thekelleys.org.uk/dnsmasq/ \ diff --git a/dns/dnsmasq/files/patch-zgf172fdb b/dns/dnsmasq/files/patch-zgf172fdb new file mode 100644 index 000000000000..f3128f57d55f --- /dev/null +++ b/dns/dnsmasq/files/patch-zgf172fdb @@ -0,0 +1,85 @@ +From f172fdbb77c422e27d3b7530f3fe95b98d1608e7 Mon Sep 17 00:00:00 2001 +From: Simon Kelley +Date: Wed, 11 Jan 2023 23:23:40 +0000 +Subject: [PATCH] Fix bug which can break the invariants on the order of a hash + chain. + +If there are multiple cache records with the same name but different +F_REVERSE and/or F_IMMORTAL flags, the code added in fe9a134b could +concievable break the REVERSE-FORWARD-IMMORTAL order invariant. + +Reproducing this is damn near impossible, but it is responsible +for rare and otherwise inexplicable reversion between 2.87 and 2.88 +which manifests itself as a cache internal error. All observed +cases have depended on DNSSEC being enabled, but the bug could in +theory manifest itself without DNSSEC + +Thanks to Timo van Roermund for reporting the bug and huge +efforts to isolate it. +--- + CHANGELOG | 16 +++++++++++++++- + src/cache.c | 14 +++++++++----- + 2 files changed, 24 insertions(+), 6 deletions(-) + +diff --git a/CHANGELOG b/CHANGELOG +index 0f36a0f..d6e6753 100644 +--- a/CHANGELOG ++++ b/CHANGELOG +@@ -1,6 +1,20 @@ ++version 2.98 ++ Fix bug introduced in 2.88 (commit fe91134b) which can result ++ in corruption of the DNS cache internal data structures and ++ logging of "cache internal error". This has only been seen ++ in one place in the wild, and it took considerable effort ++ to even generate a test case to reproduce it, but there's ++ no way to be sure it won't strike, and the effect to to break ++ the cache badly. Installations with DNSSEC enabled are more ++ likely to see the problem, but not running DNSSEC does not ++ guarantee that it won't happen. Thanks to Timo van Roermund ++ for reporting the bug and for his great efforts in chasing ++ it down. ++ ++ + version 2.88 + Fix bug in --dynamic-host when an interface has /16 IPv4 +- address. Thanks to Mark Dietzer for spotting this. ++ address. Thanks to Mark Dietzer for spotting this. + + Add --fast-dns-retry option. This gives dnsmasq the ability + to originate retries for upstream DNS queries itself, rather +diff --git a/src/cache.c b/src/cache.c +index 42283bc..0a5fd14 100644 +--- a/src/cache.c ++++ b/src/cache.c +@@ -236,19 +236,23 @@ static void cache_hash(struct crec *crecp) + + char *name = cache_get_name(crecp); + struct crec **up = hash_bucket(name); +- +- if (!(crecp->flags & F_REVERSE)) ++ unsigned int flags = crecp->flags & (F_IMMORTAL | F_REVERSE); ++ ++ if (!(flags & F_REVERSE)) + { + while (*up && ((*up)->flags & F_REVERSE)) + up = &((*up)->hash_next); + +- if (crecp->flags & F_IMMORTAL) ++ if (flags & F_IMMORTAL) + while (*up && !((*up)->flags & F_IMMORTAL)) + up = &((*up)->hash_next); + } + +- /* Preserve order when inserting the same name multiple times. */ +- while (*up && hostname_isequal(cache_get_name(*up), name)) ++ /* Preserve order when inserting the same name multiple times. ++ Do not mess up the flag invariants. */ ++ while (*up && ++ hostname_isequal(cache_get_name(*up), name) && ++ flags == ((*up)->flags & (F_IMMORTAL | F_REVERSE))) + up = &((*up)->hash_next); + + crecp->hash_next = *up; +-- +2.20.1 +