os/doc
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Add SA-16:12 and SA-16:13.

Browse source
This commit is contained in:
Xin LI 2016-03-10 10:18:18 +00:00
parent d6215fb9d9
commit 2e3c7704e0
Notes: svn2git 2020-12-08 03:00:23 +00:00 
svn path=/head/; revision=48363
13 changed files with 4126 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

BIN
share/security/patches/SA-16:12/openssl-10.1.patch.xz Normal file
View file

Binary file not shown.

17
share/security/patches/SA-16:12/openssl-10.1.patch.xz.asc Normal file
View file

@ -0,0 +1,17 @@
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.11 (FreeBSD)
iQIcBAABCgAGBQJW4Uc7AAoJEO1n7NZdz2rnFUkQAOUocmwrJu8r9mDZ0qrpdz9k
qR3UyO3MY6HAdo+j1Sa5t7QaKKM/Ddp+zAMgoNCkb7vzr0wn5HcXcmEzQ4TrCBW9
igFZSyqR6KRWjgJ5HbzkynIJ14983/vAkrVh6t1lU2Z9sBn3g0+I+GW7WLumCxt9
eXk+eqrHeWK/RfUNdTeQxBU4ZLgre85xiRJXEBJdoqnpfcvfQ7TtCL9O6tFPg1TX
ZoMPx8g2+SsNXyBkULWuntim4w+zF+eNo9XxRAIvmLzZki5fXIvb10lH6VZQJMKL
RP36m++1a6zI47xRBH7JoVdHcINAfCPdKmHNtcX34lEsCnF2N1bpUkcWlL9H1G0Q
qEXp6wuVttiB5TNC+tNCqui68F3QnZEzvgCBRDDBA9Qi8KZa6+B4jHAhGE0lVBBR
wYvYYlKgh0T/Tm0b2OWqlgV948A4uYa3jXUf3sLlH8VsUhLioL8L3Ou0dUqGWn9L
w1QZwey+6q7aGu5DTxfkD32fTJOkQET4Mjri9+aQSbGv25//4T9JRx3NYW+tX8KG
1rdLcI+f9SiBNtudI0nbSfKis6GKfTtgW+nNEXMc6WffRrQvx1/CDKmpAbjM/Tjc
jm+n4JS5UosWQKHmz9AahsKJSnJbiFH2PrRwADrdtcruxwj9apHm6RajPqOWHqsb
DF+5gvdzOebBGCd0C13t
=6ui0
-----END PGP SIGNATURE-----

2963
share/security/patches/SA-16:12/openssl-10.2.patch Normal file
View file

File diff suppressed because it is too large Load diff

17
share/security/patches/SA-16:12/openssl-10.2.patch.asc Normal file
View file

@ -0,0 +1,17 @@
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.11 (FreeBSD)
iQIcBAABCgAGBQJW4Uc6AAoJEO1n7NZdz2rnrIoP/2/UGUonUC5BKXx4zf32rNSh
TbyYxBTZiQAEqhUaK3H8B/F0ez3gmhv7KN4mXBy0IzCNzCrstq467EaCIhzeYVwR
xwvKUwJptE75YjsqqGR5g6gr2AL9bSNdSt9nOCsRfYlvqU67V0VaLu4daxuok6Wz
V6T7kySTJlFWNKyLtL1GZwX8CU2C1r63+dzQHF/vNKCnHXott6zgvS2NjAfIOs8z
OFXh5RTEdZuyXzyTPd62SZGpZRVfvVIr/oZPOeVvQWbpUSN5UZjFHxA0l47rOJ/Z
3qZENsxm43JKpUOE7dw16mD/0GVT+lXNmwei4KBNzQPnCeuDCF391uq2Xy5c2d3C
af+PFH5305IgleKGV7yNfJ16AD+gQiOPORMcv4gtFiw8HN9hzXf0phKOfS6QEkW8
PgVFJz171iQsV0dRugCeNcGegRthLDJ02U+aZ345wH10cYCvIJnzr4tEQqsTz6sb
ZavJz62PWf1IpACdjJbEV+h16uHgqMXw9WImEhsjhIrtScvxfPzJVqAlkFbKJHPU
oRm4iDmz5NTIUDEgTGP5NhqeE5+r/6uqhwVl7iCdKRVwy19XgixIJUC3ltfP3oPl
eMq8Of5358n/vjB1h5gWJi+fIuLn+5NiRAAUu+kcXSdPuNb98DCKYXnD2plf2v1j
GUydikj+tgEMgvW/+BaZ
=X7i6
-----END PGP SIGNATURE-----

247
share/security/patches/SA-16:12/openssl-9.3-fix.patch Normal file
View file

@ -0,0 +1,247 @@
--- crypto/openssl/crypto/bn/bn_exp.c.orig
+++ crypto/openssl/crypto/bn/bn_exp.c
@@ -107,13 +107,13 @@
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
- */
-
-#include "cryptlib.h"
-#include "constant_time_locl.h"
-#include "bn_lcl.h"
-
-/* maximum precomputation table size for *variable* sliding windows */
+ */
+
+#include "cryptlib.h"
+#include "constant_time_locl.h"
+#include "bn_lcl.h"
+
+/* maximum precomputation table size for *variable* sliding windows */
#define TABLE_SIZE 32
/* this one works - simple but works */
@@ -521,79 +521,79 @@
* pattern as far as cache lines are concerned. The following functions are
* used to transfer a BIGNUM from/to that table.
*/
-
-static int MOD_EXP_CTIME_COPY_TO_PREBUF(BIGNUM *b, int top,
- unsigned char *buf, int idx,
- int window)
-{
- int i, j;
- int width = 1 << window;
- BN_ULONG *table = (BN_ULONG *)buf;
-
- if (bn_wexpand(b, top) == NULL)
- return 0;
+
+static int MOD_EXP_CTIME_COPY_TO_PREBUF(BIGNUM *b, int top,
+ unsigned char *buf, int idx,
+ int window)
+{
+ int i, j;
+ int width = 1 << window;
+ BN_ULONG *table = (BN_ULONG *)buf;
+
+ if (bn_wexpand(b, top) == NULL)
+ return 0;
while (b->top < top) {
- b->d[b->top++] = 0;
- }
-
- for (i = 0, j = idx; i < top; i++, j += width) {
- table[j] = b->d[i];
- }
-
- bn_correct_top(b);
+ b->d[b->top++] = 0;
+ }
+
+ for (i = 0, j = idx; i < top; i++, j += width) {
+ table[j] = b->d[i];
+ }
+
+ bn_correct_top(b);
return 1;
}
-
-static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top,
- unsigned char *buf, int idx,
- int window)
-{
- int i, j;
- int width = 1 << window;
- volatile BN_ULONG *table = (volatile BN_ULONG *)buf;
-
- if (bn_wexpand(b, top) == NULL)
- return 0;
-
- if (window <= 3) {
- for (i = 0; i < top; i++, table += width) {
- BN_ULONG acc = 0;
-
- for (j = 0; j < width; j++) {
- acc |= table[j] &
- ((BN_ULONG)0 - (constant_time_eq_int(j,idx)&1));
- }
-
- b->d[i] = acc;
- }
- } else {
- int xstride = 1 << (window - 2);
- BN_ULONG y0, y1, y2, y3;
-
- i = idx >> (window - 2); /* equivalent of idx / xstride */
- idx &= xstride - 1; /* equivalent of idx % xstride */
-
- y0 = (BN_ULONG)0 - (constant_time_eq_int(i,0)&1);
- y1 = (BN_ULONG)0 - (constant_time_eq_int(i,1)&1);
- y2 = (BN_ULONG)0 - (constant_time_eq_int(i,2)&1);
- y3 = (BN_ULONG)0 - (constant_time_eq_int(i,3)&1);
-
- for (i = 0; i < top; i++, table += width) {
- BN_ULONG acc = 0;
-
- for (j = 0; j < xstride; j++) {
- acc |= ( (table[j + 0 * xstride] & y0) |
- (table[j + 1 * xstride] & y1) |
- (table[j + 2 * xstride] & y2) |
- (table[j + 3 * xstride] & y3) )
- & ((BN_ULONG)0 - (constant_time_eq_int(j,idx)&1));
- }
-
- b->d[i] = acc;
- }
- }
-
- b->top = top;
+
+static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top,
+ unsigned char *buf, int idx,
+ int window)
+{
+ int i, j;
+ int width = 1 << window;
+ volatile BN_ULONG *table = (volatile BN_ULONG *)buf;
+
+ if (bn_wexpand(b, top) == NULL)
+ return 0;
+
+ if (window <= 3) {
+ for (i = 0; i < top; i++, table += width) {
+ BN_ULONG acc = 0;
+
+ for (j = 0; j < width; j++) {
+ acc |= table[j] &
+ ((BN_ULONG)0 - (constant_time_eq_int(j,idx)&1));
+ }
+
+ b->d[i] = acc;
+ }
+ } else {
+ int xstride = 1 << (window - 2);
+ BN_ULONG y0, y1, y2, y3;
+
+ i = idx >> (window - 2); /* equivalent of idx / xstride */
+ idx &= xstride - 1; /* equivalent of idx % xstride */
+
+ y0 = (BN_ULONG)0 - (constant_time_eq_int(i,0)&1);
+ y1 = (BN_ULONG)0 - (constant_time_eq_int(i,1)&1);
+ y2 = (BN_ULONG)0 - (constant_time_eq_int(i,2)&1);
+ y3 = (BN_ULONG)0 - (constant_time_eq_int(i,3)&1);
+
+ for (i = 0; i < top; i++, table += width) {
+ BN_ULONG acc = 0;
+
+ for (j = 0; j < xstride; j++) {
+ acc |= ( (table[j + 0 * xstride] & y0) |
+ (table[j + 1 * xstride] & y1) |
+ (table[j + 2 * xstride] & y2) |
+ (table[j + 3 * xstride] & y3) )
+ & ((BN_ULONG)0 - (constant_time_eq_int(j,idx)&1));
+ }
+
+ b->d[i] = acc;
+ }
+ }
+
+ b->top = top;
bn_correct_top(b);
return 1;
}
@@ -684,13 +684,13 @@
/*
* Initialize the intermediate result. Do this early to save double
* conversion, once each for a^0 and intermediate result.
- */
- if (!BN_to_montgomery(r, BN_value_one(), mont, ctx))
- goto err;
- if (!MOD_EXP_CTIME_COPY_TO_PREBUF(r, top, powerbuf, 0, window))
- goto err;
-
- /* Initialize computeTemp as a^1 with montgomery precalcs */
+ */
+ if (!BN_to_montgomery(r, BN_value_one(), mont, ctx))
+ goto err;
+ if (!MOD_EXP_CTIME_COPY_TO_PREBUF(r, top, powerbuf, 0, window))
+ goto err;
+
+ /* Initialize computeTemp as a^1 with montgomery precalcs */
computeTemp = BN_CTX_get(ctx);
am = BN_CTX_get(ctx);
if (computeTemp == NULL || am == NULL)
@@ -703,13 +703,13 @@
} else
aa = a;
if (!BN_to_montgomery(am, aa, mont, ctx))
- goto err;
- if (!BN_copy(computeTemp, am))
- goto err;
- if (!MOD_EXP_CTIME_COPY_TO_PREBUF(am, top, powerbuf, 1, window))
- goto err;
-
- /*
+ goto err;
+ if (!BN_copy(computeTemp, am))
+ goto err;
+ if (!MOD_EXP_CTIME_COPY_TO_PREBUF(am, top, powerbuf, 1, window))
+ goto err;
+
+ /*
* If the window size is greater than 1, then calculate
* val[i=2..2^winsize-1]. Powers are computed as a*a^(i-1) (even powers
* could instead be computed as (a^(i/2))^2 to use the slight performance
@@ -718,14 +718,14 @@
if (window > 1) {
for (i = 2; i < numPowers; i++) {
/* Calculate a^i = a^(i-1) * a */
- if (!BN_mod_mul_montgomery
- (computeTemp, am, computeTemp, mont, ctx))
- goto err;
- if (!MOD_EXP_CTIME_COPY_TO_PREBUF(computeTemp, top, powerbuf, i,
- window))
- goto err;
- }
- }
+ if (!BN_mod_mul_montgomery
+ (computeTemp, am, computeTemp, mont, ctx))
+ goto err;
+ if (!MOD_EXP_CTIME_COPY_TO_PREBUF(computeTemp, top, powerbuf, i,
+ window))
+ goto err;
+ }
+ }
/*
* Adjust the number of bits up to a multiple of the window size. If the
@@ -758,7 +758,7 @@
* Fetch the appropriate pre-computed value from the pre-buf
*/
if (!MOD_EXP_CTIME_COPY_FROM_PREBUF
- (computeTemp, top, powerbuf, wvalue, numPowers))
+ (computeTemp, top, powerbuf, wvalue, window))
goto err;
/* Multiply the result into the intermediate result */

17
share/security/patches/SA-16:12/openssl-9.3-fix.patch.asc Normal file
View file

@ -0,0 +1,17 @@
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.11 (FreeBSD)
iQIcBAABCgAGBQJW4Uc6AAoJEO1n7NZdz2rnlbcQAOE5i1wKTaq6tM3neMf7CRfd
lsb+VIHnaPu4kZFhUKxCx0XhdaZ1UF/lB0x4VMOb8GKwLcz7r/0vjym0ibuyW+T6
/8oPzpZAsVM8KQEs4YzJDOPbG/Pq2TQJyvDSo1QtupyckaQlRMy9mPwWxxnrP6qQ
poxqDP3UHYx8bl4PtTzYIX9b14d3ZFfcdyTrHGOQhhyCN76EBMRyfmGQqpXrOxcn
BsHO94a/slwjB+8OL6InUe91y8hVVazC2zT+KkDP8IAx61Z0y0lHJaQd3eRB+shm
i67XBoOV+m12y4pI+ic3/Yg/BH9OwMMd+msJ83V/8bA6EmG7+AkuTEKcWXrCpHeX
zWG6HbycZM2vuPdUG6j7ofZlCanNI8uMlVk4rCRi7zAcj0jSMRX1sjukwITt2nJ2
32uIdAdGNJ1+6bjMgiAGGYzjaq7YFWrS6lMQsYTswJ5dQFxYhT0yqxbrWtgG6Dqw
GIWoUrcSvPtVjqOa48lH2G+gny0vOvuElb7OZYNmRmIWbR2YBolKjBE1Oz665OkV
9xfRAMdDMKAkLZAai+0HB5HNuoe9/M+jmQc+wBV94aH0KwW7E38HW1Njs7HSEuoT
YpD5ZA7VoLKKtZqzpoJH6qVrIyTc7T0hRYLI6IWE5xOX9mSRRSeMGshuzE4L0tce
TAsjrzJeJx/kCH7VmUIt
=enos
-----END PGP SIGNATURE-----

BIN
share/security/patches/SA-16:12/openssl-9.3.patch.xz Normal file
View file

Binary file not shown.

17
share/security/patches/SA-16:12/openssl-9.3.patch.xz.asc Normal file
View file

@ -0,0 +1,17 @@
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.11 (FreeBSD)
iQIcBAABCgAGBQJW4Uc7AAoJEO1n7NZdz2rnjuwP/0FNSZquQqyi82z9F21XXrZO
X/jXgY4YGYRuUj08G9rnGV1i7dBzVwILP+8dssDvYH/I+GvH4LxP2ZlAoB2eH6a5
zfXw4t8qx82gHDlSmB1Dl4x/Dp0KDHTVuyL4ndJ62mhdYEuYbp5nwGV91qJXSAKh
2gDqhT6OPQBVwMFE8aBAqzgjGATuix5Nghz0a0Y2U/rwTBo/lC2kEIUtwYijHlOp
ec9RKA4xGkZXQRPKZHKpNO55nLa/eCK2xNBj/mfFoPj2wObvc0oKBAKVHrHxanlZ
GzS1N4Q+Wez9wD4kwC4lHRf7sGu7S9wctRrguh30NFvfmV/ohDqrV9q9xJi4x7DR
kURN9AWm0i//jme62APHonfLRixBFb224tMeA8I9Ukq1vXLmiEhof1UH6XluuuMd
I7hqnsJI0OnnrMVOxUohWNLJKqwf/CrotSya0QA7V++zNXGTe1qhiQy6dzCnKv33
FRq4eHN7gvMFbWJEHrfD0lDL4w+uHgpF98X65mPUDHgdTu1gB1UapTIdHZq0liCB
KshW62lZnKWiKc1ruiJTRGW/lkRRxGmsIjkXu8z84+No6RVqnDrKEcnjIShTKI4W
QTWKvsli19xWzMV8Z0uEFI1ZytnT6quaEladlcV1twvDTIvMYmti3LePncy6ll4Y
l1lvgiSD5ZryDIirSEpz
=4aXD
-----END PGP SIGNATURE-----

428
share/security/patches/SA-16:13/bind.patch Normal file
View file

@ -0,0 +1,428 @@
--- contrib/bind9/bin/named/control.c.orig
+++ contrib/bind9/bin/named/control.c
@@ -69,7 +69,7 @@
#endif
data = isccc_alist_lookup(message, "_data");
- if (data == NULL) {
+ if (!isccc_alist_alistp(data)) {
/*
* No data section.
*/
--- contrib/bind9/bin/named/controlconf.c.orig
+++ contrib/bind9/bin/named/controlconf.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2008, 2011-2014 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2011-2014, 2016 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 2001-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -396,7 +396,7 @@
* Limit exposure to replay attacks.
*/
_ctrl = isccc_alist_lookup(request, "_ctrl");
- if (_ctrl == NULL) {
+ if (!isccc_alist_alistp(_ctrl)) {
log_invalid(&conn->ccmsg, ISC_R_FAILURE);
goto cleanup_request;
}
--- contrib/bind9/bin/rndc/rndc.c.orig
+++ contrib/bind9/bin/rndc/rndc.c
@@ -252,8 +252,8 @@
DO("parse message", isccc_cc_fromwire(&source, &response, &secret));
data = isccc_alist_lookup(response, "_data");
- if (data == NULL)
- fatal("no data section in response");
+ if (!isccc_alist_alistp(data))
+ fatal("bad or missing data section in response");
result = isccc_cc_lookupstring(data, "err", &errormsg);
if (result == ISC_R_SUCCESS) {
failed = ISC_TRUE;
@@ -316,8 +316,8 @@
DO("parse message", isccc_cc_fromwire(&source, &response, &secret));
_ctrl = isccc_alist_lookup(response, "_ctrl");
- if (_ctrl == NULL)
- fatal("_ctrl section missing");
+ if (!isccc_alist_alistp(_ctrl))
+ fatal("bad or missing ctrl section in response");
nonce = 0;
if (isccc_cc_lookupuint32(_ctrl, "_nonce", &nonce) != ISC_R_SUCCESS)
nonce = 0;
--- contrib/bind9/lib/dns/resolver.c.orig
+++ contrib/bind9/lib/dns/resolver.c
@@ -5385,14 +5385,11 @@
}
static inline isc_result_t
-dname_target(fetchctx_t *fctx, dns_rdataset_t *rdataset, dns_name_t *qname,
- dns_name_t *oname, dns_fixedname_t *fixeddname)
+dname_target(dns_rdataset_t *rdataset, dns_name_t *qname,
+ unsigned int nlabels, dns_fixedname_t *fixeddname)
{
isc_result_t result;
dns_rdata_t rdata = DNS_RDATA_INIT;
- unsigned int nlabels;
- int order;
- dns_namereln_t namereln;
dns_rdata_dname_t dname;
dns_fixedname_t prefix;
@@ -5407,21 +5404,6 @@
if (result != ISC_R_SUCCESS)
return (result);
- /*
- * Get the prefix of qname.
- */
- namereln = dns_name_fullcompare(qname, oname, &order, &nlabels);
- if (namereln != dns_namereln_subdomain) {
- char qbuf[DNS_NAME_FORMATSIZE];
- char obuf[DNS_NAME_FORMATSIZE];
-
- dns_rdata_freestruct(&dname);
- dns_name_format(qname, qbuf, sizeof(qbuf));
- dns_name_format(oname, obuf, sizeof(obuf));
- log_formerr(fctx, "unrelated DNAME in answer: "
- "%s is not in %s", qbuf, obuf);
- return (DNS_R_FORMERR);
- }
dns_fixedname_init(&prefix);
dns_name_split(qname, nlabels, dns_fixedname_name(&prefix), NULL);
dns_fixedname_init(fixeddname);
@@ -6034,13 +6016,13 @@
answer_response(fetchctx_t *fctx) {
isc_result_t result;
dns_message_t *message;
- dns_name_t *name, *qname, tname, *ns_name;
+ dns_name_t *name, *dname = NULL, *qname, tname, *ns_name;
dns_rdataset_t *rdataset, *ns_rdataset;
isc_boolean_t done, external, chaining, aa, found, want_chaining;
isc_boolean_t have_answer, found_cname, found_type, wanted_chaining;
unsigned int aflag;
dns_rdatatype_t type;
- dns_fixedname_t dname, fqname;
+ dns_fixedname_t fdname, fqname;
dns_view_t *view;
FCTXTRACE("answer_response");
@@ -6068,10 +6050,15 @@
view = fctx->res->view;
result = dns_message_firstname(message, DNS_SECTION_ANSWER);
while (!done && result == ISC_R_SUCCESS) {
+ dns_namereln_t namereln;
+ int order;
+ unsigned int nlabels;
+
name = NULL;
dns_message_currentname(message, DNS_SECTION_ANSWER, &name);
external = ISC_TF(!dns_name_issubdomain(name, &fctx->domain));
- if (dns_name_equal(name, qname)) {
+ namereln = dns_name_fullcompare(qname, name, &order, &nlabels);
+ if (namereln == dns_namereln_equal) {
wanted_chaining = ISC_FALSE;
for (rdataset = ISC_LIST_HEAD(name->list);
rdataset != NULL;
@@ -6196,10 +6183,11 @@
*/
INSIST(!external);
if (aflag ==
- DNS_RDATASETATTR_ANSWER)
+ DNS_RDATASETATTR_ANSWER) {
have_answer = ISC_TRUE;
- name->attributes |=
- DNS_NAMEATTR_ANSWER;
+ name->attributes |=
+ DNS_NAMEATTR_ANSWER;
+ }
rdataset->attributes |= aflag;
if (aa)
rdataset->trust =
@@ -6254,6 +6242,8 @@
if (wanted_chaining)
chaining = ISC_TRUE;
} else {
+ dns_rdataset_t *dnameset = NULL;
+
/*
* Look for a DNAME (or its SIG). Anything else is
* ignored.
@@ -6261,32 +6251,56 @@
wanted_chaining = ISC_FALSE;
for (rdataset = ISC_LIST_HEAD(name->list);
rdataset != NULL;
- rdataset = ISC_LIST_NEXT(rdataset, link)) {
- isc_boolean_t found_dname = ISC_FALSE;
- dns_name_t *dname_name;
+ rdataset = ISC_LIST_NEXT(rdataset, link))
+ {
+ /*
+ * Only pass DNAME or RRSIG(DNAME).
+ */
+ if (rdataset->type != dns_rdatatype_dname &&
+ (rdataset->type != dns_rdatatype_rrsig ||
+ rdataset->covers != dns_rdatatype_dname))
+ continue;
- found = ISC_FALSE;
+ /*
+ * If we're not chaining, then the DNAME and
+ * its signature should not be external.
+ */
+ if (!chaining && external) {
+ char qbuf[DNS_NAME_FORMATSIZE];
+ char obuf[DNS_NAME_FORMATSIZE];
+
+ dns_name_format(name, qbuf,
+ sizeof(qbuf));
+ dns_name_format(&fctx->domain, obuf,
+ sizeof(obuf));
+ log_formerr(fctx, "external DNAME or "
+ "RRSIG covering DNAME "
+ "in answer: %s is "
+ "not in %s", qbuf, obuf);
+ return (DNS_R_FORMERR);
+ }
+
+ if (namereln != dns_namereln_subdomain) {
+ char qbuf[DNS_NAME_FORMATSIZE];
+ char obuf[DNS_NAME_FORMATSIZE];
+
+ dns_name_format(qname, qbuf,
+ sizeof(qbuf));
+ dns_name_format(name, obuf,
+ sizeof(obuf));
+ log_formerr(fctx, "unrelated DNAME "
+ "in answer: %s is "
+ "not in %s", qbuf, obuf);
+ return (DNS_R_FORMERR);
+ }
+
aflag = 0;
if (rdataset->type == dns_rdatatype_dname) {
- /*
- * We're looking for something else,
- * but we found a DNAME.
- *
- * If we're not chaining, then the
- * DNAME should not be external.
- */
- if (!chaining && external) {
- log_formerr(fctx,
- "external DNAME");
- return (DNS_R_FORMERR);
- }
- found = ISC_TRUE;
want_chaining = ISC_TRUE;
POST(want_chaining);
aflag = DNS_RDATASETATTR_ANSWER;
- result = dname_target(fctx, rdataset,
- qname, name,
- &dname);
+ result = dname_target(rdataset, qname,
+ nlabels, &fdname);
if (result == ISC_R_NOSPACE) {
/*
* We can't construct the
@@ -6298,90 +6312,73 @@
} else if (result != ISC_R_SUCCESS)
return (result);
else
- found_dname = ISC_TRUE;
+ dnameset = rdataset;
- dname_name = dns_fixedname_name(&dname);
+ dname = dns_fixedname_name(&fdname);
if (!is_answertarget_allowed(view,
- qname,
- rdataset->type,
- dname_name,
- &fctx->domain)) {
+ qname, rdataset->type,
+ dname, &fctx->domain)) {
return (DNS_R_SERVFAIL);
}
- } else if (rdataset->type == dns_rdatatype_rrsig
- && rdataset->covers ==
- dns_rdatatype_dname) {
+ } else {
/*
* We've found a signature that
* covers the DNAME.
*/
- found = ISC_TRUE;
aflag = DNS_RDATASETATTR_ANSWERSIG;
}
- if (found) {
+ /*
+ * We've found an answer to our
+ * question.
+ */
+ name->attributes |= DNS_NAMEATTR_CACHE;
+ rdataset->attributes |= DNS_RDATASETATTR_CACHE;
+ rdataset->trust = dns_trust_answer;
+ if (!chaining) {
/*
- * We've found an answer to our
- * question.
+ * This data is "the" answer to
+ * our question only if we're
+ * not chaining.
*/
- name->attributes |=
- DNS_NAMEATTR_CACHE;
- rdataset->attributes |=
- DNS_RDATASETATTR_CACHE;
- rdataset->trust = dns_trust_answer;
- if (!chaining) {
- /*
- * This data is "the" answer
- * to our question only if
- * we're not chaining.
- */
- INSIST(!external);
- if (aflag ==
- DNS_RDATASETATTR_ANSWER)
- have_answer = ISC_TRUE;
+ INSIST(!external);
+ if (aflag == DNS_RDATASETATTR_ANSWER) {
+ have_answer = ISC_TRUE;
name->attributes |=
DNS_NAMEATTR_ANSWER;
- rdataset->attributes |= aflag;
- if (aa)
- rdataset->trust =
- dns_trust_authanswer;
- } else if (external) {
- rdataset->attributes |=
- DNS_RDATASETATTR_EXTERNAL;
}
-
- /*
- * DNAME chaining.
- */
- if (found_dname) {
- /*
- * Copy the dname into the
- * qname fixed name.
- *
- * Although we check for
- * failure of the copy
- * operation, in practice it
- * should never fail since
- * we already know that the
- * result fits in a fixedname.
- */
- dns_fixedname_init(&fqname);
- result = dns_name_copy(
- dns_fixedname_name(&dname),
- dns_fixedname_name(&fqname),
- NULL);
- if (result != ISC_R_SUCCESS)
- return (result);
- wanted_chaining = ISC_TRUE;
- name->attributes |=
- DNS_NAMEATTR_CHAINING;
- rdataset->attributes |=
- DNS_RDATASETATTR_CHAINING;
- qname = dns_fixedname_name(
- &fqname);
- }
+ rdataset->attributes |= aflag;
+ if (aa)
+ rdataset->trust =
+ dns_trust_authanswer;
+ } else if (external) {
+ rdataset->attributes |=
+ DNS_RDATASETATTR_EXTERNAL;
}
}
+
+ /*
+ * DNAME chaining.
+ */
+ if (dnameset != NULL) {
+ /*
+ * Copy the dname into the qname fixed name.
+ *
+ * Although we check for failure of the copy
+ * operation, in practice it should never fail
+ * since we already know that the result fits
+ * in a fixedname.
+ */
+ dns_fixedname_init(&fqname);
+ qname = dns_fixedname_name(&fqname);
+ result = dns_name_copy(dname, qname, NULL);
+ if (result != ISC_R_SUCCESS)
+ return (result);
+ wanted_chaining = ISC_TRUE;
+ name->attributes |= DNS_NAMEATTR_CHAINING;
+ dnameset->attributes |=
+ DNS_RDATASETATTR_CHAINING;
+ }
if (wanted_chaining)
chaining = ISC_TRUE;
}
--- contrib/bind9/lib/isccc/cc.c.orig
+++ contrib/bind9/lib/isccc/cc.c
@@ -287,10 +287,10 @@
* Extract digest.
*/
_auth = isccc_alist_lookup(alist, "_auth");
- if (_auth == NULL)
+ if (!isccc_alist_alistp(_auth))
return (ISC_R_FAILURE);
hmd5 = isccc_alist_lookup(_auth, "hmd5");
- if (hmd5 == NULL)
+ if (!isccc_sexpr_binaryp(hmd5))
return (ISC_R_FAILURE);
/*
* Compute digest.
@@ -545,7 +545,7 @@
REQUIRE(ackp != NULL && *ackp == NULL);
_ctrl = isccc_alist_lookup(message, "_ctrl");
- if (_ctrl == NULL ||
+ if (!isccc_alist_alistp(_ctrl) ||
isccc_cc_lookupuint32(_ctrl, "_ser", &serial) != ISC_R_SUCCESS ||
isccc_cc_lookupuint32(_ctrl, "_tim", &t) != ISC_R_SUCCESS)
return (ISC_R_FAILURE);
@@ -590,7 +590,7 @@
isccc_sexpr_t *_ctrl;
_ctrl = isccc_alist_lookup(message, "_ctrl");
- if (_ctrl == NULL)
+ if (!isccc_alist_alistp(_ctrl))
return (ISC_FALSE);
if (isccc_cc_lookupstring(_ctrl, "_ack", NULL) == ISC_R_SUCCESS)
return (ISC_TRUE);
@@ -603,7 +603,7 @@
isccc_sexpr_t *_ctrl;
_ctrl = isccc_alist_lookup(message, "_ctrl");
- if (_ctrl == NULL)
+ if (!isccc_alist_alistp(_ctrl))
return (ISC_FALSE);
if (isccc_cc_lookupstring(_ctrl, "_rpl", NULL) == ISC_R_SUCCESS)
return (ISC_TRUE);
@@ -623,7 +623,7 @@
_ctrl = isccc_alist_lookup(message, "_ctrl");
_data = isccc_alist_lookup(message, "_data");
- if (_ctrl == NULL || _data == NULL ||
+ if (!isccc_alist_alistp(_ctrl) || !isccc_alist_alistp(_data) ||
isccc_cc_lookupuint32(_ctrl, "_ser", &serial) != ISC_R_SUCCESS ||
isccc_cc_lookupstring(_data, "type", &type) != ISC_R_SUCCESS)
return (ISC_R_FAILURE);
@@ -812,7 +812,7 @@
isccc_sexpr_t *_ctrl;
_ctrl = isccc_alist_lookup(message, "_ctrl");
- if (_ctrl == NULL ||
+ if (!isccc_alist_alistp(_ctrl) ||
isccc_cc_lookupstring(_ctrl, "_ser", &_ser) != ISC_R_SUCCESS ||
isccc_cc_lookupstring(_ctrl, "_tim", &_tim) != ISC_R_SUCCESS)
return (ISC_R_FAILURE);

17
share/security/patches/SA-16:13/bind.patch.asc Normal file
View file

@ -0,0 +1,17 @@
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.11 (FreeBSD)
iQIcBAABCgAGBQJW4UdnAAoJEO1n7NZdz2rnkqEP/jy9S6RFnw/Xs6JOtzCU2ytH
d4KQZcqcrR7imlvRu04HJVgYQHXdLOu6matartTAx5pXrLpN6R0KvPMhNdA5A03z
eGkJ9/O6eeA4y4dRa37mhXt18XAdUPJStxdCayFo30eef9RHNE6vvd0v0WJ1pree
RTHsDo/gmztdjP9cFT+FqX6rcfZT9rtlfgoEeJLCtGauWFSwQLSWf+FbYT+z/9Te
sVOANzu8lhmsOiRJlX+c5AsrkcAdtkRCd8NuzSasvACsSJNEZe6lKpCLV/mo5EQ0
ab6juv5TbRAB6FFlkTmt5sKnaPnzRkoYQ6NBP+MIkJwEFfRkr+vIN+HL8Nkppi8f
NYuchcREi3xh36Kngcxf+XlAUwLJUfphy5ozzQd1SRDwo8Ne18uQkvCFv80tVXAP
0NdRo3HhdFUCgsZNZkwDjQ62XEsZAvXmkdAi9K3cUttDFGLcMUxoiat1vyr+D8x2
suHMf2TMnqMkt7Kemu4oIUpFBKPv39MNS/jpCKloXpg0+pe9rzA+0kJI+Oavv8Ug
bibRdKfZBxUYwXAK7UB40Rr3iN8dD5DP7E+sW3IvZW5BKug4tg4BqsEeV5oBij5t
4pjudghKkBlZcRJFsUuwdIY6NDj0b07AwfCg3cPl0QL5KPZMpywCLQ/5Wu2ZtLMh
xro5vBX3tMouYg1Pqgcj
=EOBy
-----END PGP SIGNATURE-----