svn commit: r201679 - releng/6.3 releng/6.3/contrib/bind9/bin/named releng/6.3/contrib/bind9/lib/dns releng/6.3/contrib/bind9/lib/dns/include/dns releng/6.3/contrib/ntp/ntpd releng/6.3/sys/conf rel...

Simon L. Nielsen simon at FreeBSD.org
Wed Jan 6 21:45:32 UTC 2010


Author: simon
Date: Wed Jan  6 21:45:30 2010
New Revision: 201679
URL: http://svn.freebsd.org/changeset/base/201679

Log:
  Fix BIND named(8) cache poisoning with DNSSEC validation.
  [SA-10:01]
  
  Fix ntpd mode 7 denial of service. [SA-10:02]
  
  Fix ZFS ZIL playback with insecure permissions. [SA-10:03]
  
  Various FreeBSD 8.0-RELEASE improvements. [EN-10:01]
  
  Security:	FreeBSD-SA-10:01.bind
  Security:	FreeBSD-SA-10:02.ntpd
  Security:	FreeBSD-SA-10:03.zfs
  Errata:		FreeBSD-EN-10:01.freebsd
  Approved by:	so (simon)

Modified:
  stable/6/contrib/bind9/bin/named/query.c
  stable/6/contrib/bind9/lib/dns/include/dns/types.h
  stable/6/contrib/bind9/lib/dns/masterdump.c
  stable/6/contrib/bind9/lib/dns/rbtdb.c
  stable/6/contrib/bind9/lib/dns/resolver.c
  stable/6/contrib/bind9/lib/dns/validator.c
  stable/6/contrib/ntp/ntpd/ntp_request.c

Changes in other areas also in this revision:
Modified:
  releng/6.3/UPDATING
  releng/6.3/contrib/bind9/bin/named/query.c
  releng/6.3/contrib/bind9/lib/dns/include/dns/types.h
  releng/6.3/contrib/bind9/lib/dns/masterdump.c
  releng/6.3/contrib/bind9/lib/dns/rbtdb.c
  releng/6.3/contrib/bind9/lib/dns/resolver.c
  releng/6.3/contrib/bind9/lib/dns/validator.c
  releng/6.3/contrib/ntp/ntpd/ntp_request.c
  releng/6.3/sys/conf/newvers.sh
  releng/6.4/UPDATING
  releng/6.4/contrib/bind9/bin/named/query.c
  releng/6.4/contrib/bind9/lib/dns/include/dns/types.h
  releng/6.4/contrib/bind9/lib/dns/masterdump.c
  releng/6.4/contrib/bind9/lib/dns/rbtdb.c
  releng/6.4/contrib/bind9/lib/dns/resolver.c
  releng/6.4/contrib/bind9/lib/dns/validator.c
  releng/6.4/contrib/ntp/ntpd/ntp_request.c
  releng/6.4/sys/conf/newvers.sh
  releng/7.1/UPDATING
  releng/7.1/contrib/bind9/bin/named/query.c
  releng/7.1/contrib/bind9/lib/dns/include/dns/types.h
  releng/7.1/contrib/bind9/lib/dns/masterdump.c
  releng/7.1/contrib/bind9/lib/dns/rbtdb.c
  releng/7.1/contrib/bind9/lib/dns/resolver.c
  releng/7.1/contrib/bind9/lib/dns/validator.c
  releng/7.1/contrib/ntp/ntpd/ntp_request.c
  releng/7.1/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c
  releng/7.1/sys/conf/newvers.sh
  releng/7.2/UPDATING
  releng/7.2/contrib/bind9/bin/named/query.c
  releng/7.2/contrib/bind9/lib/dns/include/dns/types.h
  releng/7.2/contrib/bind9/lib/dns/masterdump.c
  releng/7.2/contrib/bind9/lib/dns/rbtdb.c
  releng/7.2/contrib/bind9/lib/dns/resolver.c
  releng/7.2/contrib/bind9/lib/dns/validator.c
  releng/7.2/contrib/ntp/ntpd/ntp_request.c
  releng/7.2/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c
  releng/7.2/sys/conf/newvers.sh
  releng/8.0/UPDATING
  releng/8.0/contrib/bind9/bin/named/query.c
  releng/8.0/contrib/bind9/lib/dns/include/dns/types.h
  releng/8.0/contrib/bind9/lib/dns/masterdump.c
  releng/8.0/contrib/bind9/lib/dns/rbtdb.c
  releng/8.0/contrib/bind9/lib/dns/resolver.c
  releng/8.0/contrib/bind9/lib/dns/validator.c
  releng/8.0/contrib/ntp/ntpd/ntp_request.c
  releng/8.0/sys/cddl/compat/opensolaris/sys/vnode.h
  releng/8.0/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c
  releng/8.0/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c
  releng/8.0/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_znode.c
  releng/8.0/sys/cddl/contrib/opensolaris/uts/common/sys/vnode.h
  releng/8.0/sys/conf/newvers.sh
  releng/8.0/sys/kern/vfs_lookup.c
  releng/8.0/sys/netinet/ip_mroute.c
  releng/8.0/sys/netinet/raw_ip.c
  releng/8.0/sys/netinet/sctp_input.c
  releng/8.0/sys/netinet6/raw_ip6.c
  releng/8.0/sys/rpc/clnt_vc.c
  stable/7/contrib/ntp/ntpd/ntp_request.c
  stable/7/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c
  stable/8/contrib/ntp/ntpd/ntp_request.c

Modified: stable/6/contrib/bind9/bin/named/query.c
==============================================================================
--- stable/6/contrib/bind9/bin/named/query.c	Wed Jan  6 21:36:33 2010	(r201678)
+++ stable/6/contrib/bind9/bin/named/query.c	Wed Jan  6 21:45:30 2010	(r201679)
@@ -92,6 +92,8 @@
 #define DNS_GETDB_NOLOG 0x02U
 #define DNS_GETDB_PARTIAL 0x04U
 
+#define PENDINGOK(x)	(((x) & DNS_DBFIND_PENDINGOK) != 0)
+
 static void
 query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype);
 
@@ -1698,14 +1700,14 @@ query_addbestns(ns_client_t *client) {
 		zsigrdataset = NULL;
 	}
 
-	if ((client->query.dboptions & DNS_DBFIND_PENDINGOK) == 0 &&
-	    (rdataset->trust == dns_trust_pending ||
-	     (sigrdataset != NULL && sigrdataset->trust == dns_trust_pending)))
+	if ((DNS_TRUST_PENDING(rdataset->trust) ||
+	    (sigrdataset != NULL && DNS_TRUST_PENDING(sigrdataset->trust))) &&
+	    !PENDINGOK(client->query.dboptions))
 		goto cleanup;
 
-	if (WANTDNSSEC(client) && SECURE(client) &&
-	    (rdataset->trust == dns_trust_glue ||
-	     (sigrdataset != NULL && sigrdataset->trust == dns_trust_glue)))
+	if ((DNS_TRUST_GLUE(rdataset->trust) ||
+	    (sigrdataset != NULL && DNS_TRUST_GLUE(sigrdataset->trust))) &&
+  	    SECURE(client) && WANTDNSSEC(client))
 		goto cleanup;
 
 	query_addrrset(client, &fname, &rdataset, &sigrdataset, dbuf,
@@ -2376,6 +2378,8 @@ query_find(ns_client_t *client, dns_fetc
 	isc_boolean_t empty_wild;
 	dns_rdataset_t *noqname;
 	isc_boolean_t resuming;
+	dns_rdataset_t tmprdataset;
+	unsigned int dboptions;
 
 	CTRACE("query_find");
 
@@ -2577,9 +2581,47 @@ query_find(ns_client_t *client, dns_fetc
 	/*
 	 * Now look for an answer in the database.
 	 */
+	dboptions = client->query.dboptions;
+	if (sigrdataset == NULL && client->view->enablednssec) {
+		/*
+		 * If the client doesn't want DNSSEC we still want to
+		 * look for any data pending validation to save a remote
+		 * lookup if possible.
+		 */
+		dns_rdataset_init(&tmprdataset);
+		sigrdataset = &tmprdataset;
+		dboptions |= DNS_DBFIND_PENDINGOK;
+	}
+ refind:
 	result = dns_db_find(db, client->query.qname, version, type,
-			     client->query.dboptions, client->now,
-			     &node, fname, rdataset, sigrdataset);
+			     dboptions, client->now, &node, fname,
+			     rdataset, sigrdataset);
+	/*
+	 * If we have found pending data try to validate it.
+	 * If the data does not validate as secure and we can't
+	 * use the unvalidated data requery the database with
+	 * pending disabled to prevent infinite looping.
+	 */
+	if (result != ISC_R_SUCCESS || !DNS_TRUST_PENDING(rdataset->trust))
+		goto validation_done;
+	if (rdataset->trust != dns_trust_pending_answer ||
+	    !PENDINGOK(client->query.dboptions)) {
+		dns_rdataset_disassociate(rdataset);
+		if (sigrdataset != NULL &&
+		    dns_rdataset_isassociated(sigrdataset))
+			dns_rdataset_disassociate(sigrdataset);
+		if (sigrdataset == &tmprdataset)
+			sigrdataset = NULL;
+		dns_db_detachnode(db, &node);
+		dboptions &= ~DNS_DBFIND_PENDINGOK;
+		goto refind;
+	}
+ validation_done:
+	if (sigrdataset == &tmprdataset) {
+		if (dns_rdataset_isassociated(sigrdataset))
+			dns_rdataset_disassociate(sigrdataset);
+		sigrdataset = NULL;
+	}
 
  resume:
 	CTRACE("query_find: resume");

Modified: stable/6/contrib/bind9/lib/dns/include/dns/types.h
==============================================================================
--- stable/6/contrib/bind9/lib/dns/include/dns/types.h	Wed Jan  6 21:36:33 2010	(r201678)
+++ stable/6/contrib/bind9/lib/dns/include/dns/types.h	Wed Jan  6 21:45:30 2010	(r201679)
@@ -226,40 +226,51 @@ enum {
 	dns_trust_none = 0,
 #define dns_trust_none			((dns_trust_t)dns_trust_none)
 
-	/* Subject to DNSSEC validation but has not yet been validated */
-	dns_trust_pending = 1,
-#define dns_trust_pending		((dns_trust_t)dns_trust_pending)
+	/*%
+	 * Subject to DNSSEC validation but has not yet been validated
+	 * dns_trust_pending_additional (from the additional section).
+	 */
+	dns_trust_pending_additional = 1,
+#define dns_trust_pending_additional \
+		((dns_trust_t)dns_trust_pending_additional)
 
-	/* Received in the additional section of a response. */
-	dns_trust_additional = 2,
+	dns_trust_pending_answer = 2,
+#define dns_trust_pending_answer	((dns_trust_t)dns_trust_pending_answer)
+
+	/*% Received in the additional section of a response. */
+	dns_trust_additional = 3,
 #define dns_trust_additional		((dns_trust_t)dns_trust_additional)
 
-	/* Received in a referral response. */ 
-	dns_trust_glue = 3,
+	/* Received in a referral response. */
+	dns_trust_glue = 4,
 #define dns_trust_glue			((dns_trust_t)dns_trust_glue)
 
-	/* Answser from a non-authoritative server */
-	dns_trust_answer = 4,
+	/* Answer from a non-authoritative server */
+	dns_trust_answer = 5,
 #define dns_trust_answer		((dns_trust_t)dns_trust_answer)
 
 	/*  Received in the authority section as part of an
 	    authoritative response */
-	dns_trust_authauthority = 5,
+	dns_trust_authauthority = 6,
 #define dns_trust_authauthority		((dns_trust_t)dns_trust_authauthority)
 
-	/* Answser from an authoritative server */
-	dns_trust_authanswer = 6,
+	/* Answer from an authoritative server */
+	dns_trust_authanswer = 7,
 #define dns_trust_authanswer		((dns_trust_t)dns_trust_authanswer)
 
-	/* Successfully DNSSEC validated */	
-	dns_trust_secure = 7,
+	/* Successfully DNSSEC validated */
+	dns_trust_secure = 8,
 #define dns_trust_secure		((dns_trust_t)dns_trust_secure)
 
 	/* This server is authoritative */
-	dns_trust_ultimate = 8
+	dns_trust_ultimate = 9
 #define dns_trust_ultimate		((dns_trust_t)dns_trust_ultimate)
 };
 
+#define DNS_TRUST_PENDING(x)		((x) == dns_trust_pending_answer || \
+					 (x) == dns_trust_pending_additional)
+#define DNS_TRUST_GLUE(x)		((x) == dns_trust_glue)
+
 /*
  * Name checking severites.
  */

Modified: stable/6/contrib/bind9/lib/dns/masterdump.c
==============================================================================
--- stable/6/contrib/bind9/lib/dns/masterdump.c	Wed Jan  6 21:36:33 2010	(r201678)
+++ stable/6/contrib/bind9/lib/dns/masterdump.c	Wed Jan  6 21:45:30 2010	(r201679)
@@ -763,7 +763,8 @@ dump_order_compare(const void *a, const 
 
 static const char *trustnames[] = {
 	"none",
-	"pending",
+	"pending-additional",
+	"pending-answer",
 	"additional",
 	"glue",
 	"answer",

Modified: stable/6/contrib/bind9/lib/dns/rbtdb.c
==============================================================================
--- stable/6/contrib/bind9/lib/dns/rbtdb.c	Wed Jan  6 21:36:33 2010	(r201678)
+++ stable/6/contrib/bind9/lib/dns/rbtdb.c	Wed Jan  6 21:45:30 2010	(r201679)
@@ -2667,7 +2667,7 @@ cache_zonecut_callback(dns_rbtnode_t *no
 	}
 
 	if (dname_header != NULL &&
-	    (dname_header->trust != dns_trust_pending ||
+	    (!DNS_TRUST_PENDING(dname_header->trust) ||
 	     (search->options & DNS_DBFIND_PENDINGOK) != 0)) {
 		/*
 		 * We increment the reference count on node to ensure that
@@ -3129,7 +3129,7 @@ cache_find(dns_db_t *db, dns_name_t *nam
 	if (found == NULL ||
 	    (found->trust == dns_trust_glue &&
 	     ((options & DNS_DBFIND_GLUEOK) == 0)) ||
-	    (found->trust == dns_trust_pending &&
+	    (DNS_TRUST_PENDING(found->trust) &&
 	     ((options & DNS_DBFIND_PENDINGOK) == 0))) {
 		/*
 		 * If there is an NS rdataset at this node, then this is the

Modified: stable/6/contrib/bind9/lib/dns/resolver.c
==============================================================================
--- stable/6/contrib/bind9/lib/dns/resolver.c	Wed Jan  6 21:36:33 2010	(r201678)
+++ stable/6/contrib/bind9/lib/dns/resolver.c	Wed Jan  6 21:45:30 2010	(r201679)
@@ -3694,6 +3694,7 @@ cache_name(fetchctx_t *fctx, dns_name_t 
 		 * for it, unless it is glue.
 		 */
 		if (secure_domain && rdataset->trust != dns_trust_glue) {
+			dns_trust_t trust;
 			/*
 			 * RRSIGs are validated as part of validating the
 			 * type they cover.
@@ -3730,12 +3731,34 @@ cache_name(fetchctx_t *fctx, dns_name_t 
 			}
 
 			/*
+			 * Reject out of bailiwick additional records
+			 * without RRSIGs as they can't possibly validate
+			 * as "secure" and as we will never never want to
+			 * store these as "answers" after validation.
+			 */
+			if (rdataset->trust == dns_trust_additional &&
+			    sigrdataset == NULL && EXTERNAL(rdataset))
+				continue;
+ 
+			/*
+			 * XXXMPA: If we store as "answer" after validating
+			 * then we need to do bailiwick processing and
+			 * also need to track whether RRsets are in or
+			 * out of bailiwick.  This will require a another
+			 * pending trust level.
+			 *
 			 * Cache this rdataset/sigrdataset pair as
-			 * pending data.
+			 * pending data.  Track whether it was additional
+			 * or not.
 			 */
-			rdataset->trust = dns_trust_pending;
+			if (rdataset->trust == dns_trust_additional)
+				trust = dns_trust_pending_additional;
+			else
+				trust = dns_trust_pending_answer;
+ 
+			rdataset->trust = trust;
 			if (sigrdataset != NULL)
-				sigrdataset->trust = dns_trust_pending;
+				sigrdataset->trust = trust;
 			if (!need_validation)
 				addedrdataset = ardataset;
 			else
@@ -4081,7 +4104,7 @@ ncache_message(fetchctx_t *fctx, dns_adb
 			for (trdataset = ISC_LIST_HEAD(tname->list);
 			     trdataset != NULL;
 			     trdataset = ISC_LIST_NEXT(trdataset, link))
-				trdataset->trust = dns_trust_pending;
+				trdataset->trust = dns_trust_pending_answer;
 			result = dns_message_nextname(fctx->rmessage,
 						      DNS_SECTION_AUTHORITY);
 		}

Modified: stable/6/contrib/bind9/lib/dns/validator.c
==============================================================================
--- stable/6/contrib/bind9/lib/dns/validator.c	Wed Jan  6 21:36:33 2010	(r201678)
+++ stable/6/contrib/bind9/lib/dns/validator.c	Wed Jan  6 21:45:30 2010	(r201679)
@@ -238,7 +238,7 @@ auth_nonpending(dns_message_t *message) 
 		     rdataset != NULL;
 		     rdataset = ISC_LIST_NEXT(rdataset, link))
 		{
-			if (rdataset->trust == dns_trust_pending)
+			if (DNS_TRUST_PENDING(rdataset->trust))
 				rdataset->trust = dns_trust_authauthority;
 		}
 	}
@@ -1176,7 +1176,7 @@ get_key(dns_validator_t *val, dns_rdata_
 		 * We have an rrset for the given keyname.
 		 */
 		val->keyset = &val->frdataset;
-		if (val->frdataset.trust == dns_trust_pending &&
+		if (DNS_TRUST_PENDING(val->frdataset.trust) &&
 		    dns_rdataset_isassociated(&val->fsigrdataset))
 		{
 			/*
@@ -1191,7 +1191,7 @@ get_key(dns_validator_t *val, dns_rdata_
 			if (result != ISC_R_SUCCESS)
 				return (result);
 			return (DNS_R_WAIT);
-		} else if (val->frdataset.trust == dns_trust_pending) {
+		} else if (DNS_TRUST_PENDING(val->frdataset.trust)) {
 			/*
 			 * Having a pending key with no signature means that
 			 * something is broken.
@@ -1760,7 +1760,7 @@ validatezonekey(dns_validator_t *val) {
 			 * We have DS records.
 			 */
 			val->dsset = &val->frdataset;
-			if (val->frdataset.trust == dns_trust_pending &&
+			if (DNS_TRUST_PENDING(val->frdataset.trust) &&
 			    dns_rdataset_isassociated(&val->fsigrdataset))
 			{
 				result = create_validator(val,
@@ -1773,7 +1773,7 @@ validatezonekey(dns_validator_t *val) {
 				if (result != ISC_R_SUCCESS)
 					return (result);
 				return (DNS_R_WAIT);
-			} else if (val->frdataset.trust == dns_trust_pending) {
+			} else if (DNS_TRUST_PENDING(val->frdataset.trust)) {
 				/*
 				 * There should never be an unsigned DS.
 				 */
@@ -2568,7 +2568,7 @@ proveunsecure(dns_validator_t *val, isc_
 			 * There is no DS.  If this is a delegation,
 			 * we maybe done.
 			 */
-			if (val->frdataset.trust == dns_trust_pending) {
+			if (DNS_TRUST_PENDING(val->frdataset.trust)) {
 				result = create_fetch(val, tname,
 						      dns_rdatatype_ds,
 						      dsfetched2,

Modified: stable/6/contrib/ntp/ntpd/ntp_request.c
==============================================================================
--- stable/6/contrib/ntp/ntpd/ntp_request.c	Wed Jan  6 21:36:33 2010	(r201678)
+++ stable/6/contrib/ntp/ntpd/ntp_request.c	Wed Jan  6 21:45:30 2010	(r201679)
@@ -409,6 +409,7 @@ process_private(
 	int mod_okay
 	)
 {
+	static u_long quiet_until;
 	struct req_pkt *inpkt;
 	struct req_pkt_tail *tailinpkt;
 	struct sockaddr_storage *srcadr;
@@ -444,8 +445,14 @@ process_private(
 	    || (++ec, INFO_MBZ(inpkt->mbz_itemsize) != 0)
 	    || (++ec, rbufp->recv_length < REQ_LEN_HDR)
 		) {
-		msyslog(LOG_ERR, "process_private: INFO_ERR_FMT: test %d failed, pkt from %s", ec, stoa(srcadr));
-		req_ack(srcadr, inter, inpkt, INFO_ERR_FMT);
+		NLOG(NLOG_SYSEVENT)
+			if (current_time >= quiet_until) {
+				msyslog(LOG_ERR,
+					"process_private: drop test %d"
+					" failed, pkt from %s",
+					ec, stoa(srcadr));
+				quiet_until = current_time + 60;
+			}
 		return;
 	}
 


More information about the svn-src-stable-6 mailing list