MSVSphere Packaging Team
11 months ago
parent
1cc3540ffb
commit
d81f72fc9a
@ -0,0 +1,240 @@
|
|||||||
|
From 128b3b676eb9413b4d25fb29c560895cfbbfa92e Mon Sep 17 00:00:00 2001
|
||||||
|
From: Evan Hunt <each@isc.org>
|
||||||
|
Date: Thu, 1 Sep 2022 16:05:04 -0700
|
||||||
|
Subject: [PATCH] add an update quota
|
||||||
|
|
||||||
|
limit the number of simultaneous DNS UPDATE events that can be
|
||||||
|
processed by adding a quota for update and update forwarding.
|
||||||
|
this quota currently, arbitrarily, defaults to 100.
|
||||||
|
|
||||||
|
also add a statistics counter to record when the update quota
|
||||||
|
has been exceeded.
|
||||||
|
|
||||||
|
(cherry picked from commit 7c47254a140c3e9cf383cda73c7b6a55c4782826)
|
||||||
|
---
|
||||||
|
bin/named/bind9.xsl | 2 +-
|
||||||
|
bin/named/bind9.xsl.h | 8 +++++++-
|
||||||
|
bin/named/include/named/server.h | 7 ++++++-
|
||||||
|
bin/named/server.c | 3 +++
|
||||||
|
bin/named/statschannel.c | 5 +++--
|
||||||
|
bin/named/update.c | 34 +++++++++++++++++++++++++++++++-
|
||||||
|
doc/arm/Bv9ARM-book.xml | 15 ++++++++++++++
|
||||||
|
7 files changed, 68 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/bin/named/bind9.xsl b/bin/named/bind9.xsl
|
||||||
|
index 9a1c6ff..85fd4c4 100644
|
||||||
|
--- a/bin/named/bind9.xsl
|
||||||
|
+++ b/bin/named/bind9.xsl
|
||||||
|
@@ -12,7 +12,7 @@
|
||||||
|
|
||||||
|
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
|
||||||
|
<xsl:output method="html" indent="yes" version="4.0"/>
|
||||||
|
- <xsl:template match="statistics[@version="3.8"]">
|
||||||
|
+ <xsl:template match="statistics[@version="3.8.1"]">
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
|
||||||
|
diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h
|
||||||
|
index 9ce8cd7..5e0a892 100644
|
||||||
|
--- a/bin/named/bind9.xsl.h
|
||||||
|
+++ b/bin/named/bind9.xsl.h
|
||||||
|
@@ -17,7 +17,13 @@ static char xslmsg[] =
|
||||||
|
"\n"
|
||||||
|
"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
|
||||||
|
" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
|
||||||
|
- " <xsl:template match=\"statistics[@version="3.8"]\">\n"
|
||||||
|
+#if 0
|
||||||
|
+ " <!-- the version number **below** must match version in "
|
||||||
|
+ "bin/named/statschannel.c -->\n"
|
||||||
|
+ " <!-- don't forget to update \"/xml/v<STATS_XML_VERSION_MAJOR>\" in "
|
||||||
|
+ "the HTTP endpoints listed below -->\n"
|
||||||
|
+#endif
|
||||||
|
+ " <xsl:template match=\"statistics[@version="3.8.1"]\">\n"
|
||||||
|
" <html>\n"
|
||||||
|
" <head>\n"
|
||||||
|
" <script type=\"text/javascript\" src=\"https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js\"></script>\n"
|
||||||
|
diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
|
||||||
|
index 08a02dc..259acc7 100644
|
||||||
|
--- a/bin/named/include/named/server.h
|
||||||
|
+++ b/bin/named/include/named/server.h
|
||||||
|
@@ -137,6 +137,9 @@ struct ns_server {
|
||||||
|
|
||||||
|
uint16_t transfer_tcp_message_size;
|
||||||
|
isc_rng_t * rngctx;
|
||||||
|
+
|
||||||
|
+/* CVE-2022-3094 */
|
||||||
|
+ isc_quota_t updquota;
|
||||||
|
};
|
||||||
|
|
||||||
|
struct ns_altsecret {
|
||||||
|
@@ -230,7 +233,9 @@ enum {
|
||||||
|
dns_nsstatscounter_trystale = 59,
|
||||||
|
dns_nsstatscounter_usedstale = 60,
|
||||||
|
|
||||||
|
- dns_nsstatscounter_max = 61
|
||||||
|
+ dns_nsstatscounter_updatequota = 61,
|
||||||
|
+
|
||||||
|
+ dns_nsstatscounter_max = 62
|
||||||
|
};
|
||||||
|
|
||||||
|
/*%
|
||||||
|
diff --git a/bin/named/server.c b/bin/named/server.c
|
||||||
|
index 2d2fa0e..f09b895 100644
|
||||||
|
--- a/bin/named/server.c
|
||||||
|
+++ b/bin/named/server.c
|
||||||
|
@@ -9143,6 +9143,8 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
|
||||||
|
RUNTIME_CHECK(result == ISC_R_SUCCESS);
|
||||||
|
result = isc_quota_init(&server->recursionquota, 100);
|
||||||
|
RUNTIME_CHECK(result == ISC_R_SUCCESS);
|
||||||
|
+ result = isc_quota_init(&server->updquota, 100);
|
||||||
|
+ RUNTIME_CHECK(result == ISC_R_SUCCESS);
|
||||||
|
|
||||||
|
result = dns_aclenv_init(mctx, &server->aclenv);
|
||||||
|
RUNTIME_CHECK(result == ISC_R_SUCCESS);
|
||||||
|
@@ -9410,6 +9412,7 @@ ns_server_destroy(ns_server_t **serverp) {
|
||||||
|
|
||||||
|
dns_aclenv_destroy(&server->aclenv);
|
||||||
|
|
||||||
|
+ isc_quota_destroy(&server->updquota);
|
||||||
|
isc_quota_destroy(&server->recursionquota);
|
||||||
|
isc_quota_destroy(&server->tcpquota);
|
||||||
|
isc_quota_destroy(&server->xfroutquota);
|
||||||
|
diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
|
||||||
|
index 56a9c21..1e8723c 100644
|
||||||
|
--- a/bin/named/statschannel.c
|
||||||
|
+++ b/bin/named/statschannel.c
|
||||||
|
@@ -300,6 +300,7 @@ init_desc(void) {
|
||||||
|
SET_NSSTATDESC(reclimitdropped,
|
||||||
|
"queries dropped due to recursive client limit",
|
||||||
|
"RecLimitDropped");
|
||||||
|
+ SET_NSSTATDESC(updatequota, "Update quota exceeded", "UpdateQuota");
|
||||||
|
SET_NSSTATDESC(trystale,
|
||||||
|
"attempts to use stale cache data after lookup failure",
|
||||||
|
"QryTryStale");
|
||||||
|
@@ -1546,7 +1547,7 @@ generatexml(ns_server_t *server, uint32_t flags,
|
||||||
|
ISC_XMLCHAR "type=\"text/xsl\" href=\"/bind9.xsl\""));
|
||||||
|
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
|
||||||
|
TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
|
||||||
|
- ISC_XMLCHAR "3.8"));
|
||||||
|
+ ISC_XMLCHAR "3.8.1"));
|
||||||
|
|
||||||
|
/* Set common fields for statistics dump */
|
||||||
|
dumparg.type = isc_statsformat_xml;
|
||||||
|
@@ -2303,7 +2304,7 @@ generatejson(ns_server_t *server, size_t *msglen,
|
||||||
|
/*
|
||||||
|
* These statistics are included no matter which URL we use.
|
||||||
|
*/
|
||||||
|
- obj = json_object_new_string("1.2");
|
||||||
|
+ obj = json_object_new_string("1.2.1");
|
||||||
|
CHECKMEM(obj);
|
||||||
|
json_object_object_add(bindstats, "json-stats-version", obj);
|
||||||
|
|
||||||
|
diff --git a/bin/named/update.c b/bin/named/update.c
|
||||||
|
index 6ad7d27..dccc543 100644
|
||||||
|
--- a/bin/named/update.c
|
||||||
|
+++ b/bin/named/update.c
|
||||||
|
@@ -1526,6 +1526,17 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
|
||||||
|
isc_task_t *zonetask = NULL;
|
||||||
|
ns_client_t *evclient;
|
||||||
|
|
||||||
|
+ result = isc_quota_attach(&ns_g_server->updquota,
|
||||||
|
+ &(isc_quota_t *){ NULL });
|
||||||
|
+ if (result != ISC_R_SUCCESS) {
|
||||||
|
+ update_log(client, zone, LOGLEVEL_PROTOCOL,
|
||||||
|
+ "update failed: too many DNS UPDATEs queued (%s)",
|
||||||
|
+ isc_result_totext(result));
|
||||||
|
+ isc_stats_increment(ns_g_server->nsstats,
|
||||||
|
+ dns_nsstatscounter_updatequota);
|
||||||
|
+ CHECK(DNS_R_DROP);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
event = (update_event_t *)
|
||||||
|
isc_event_allocate(client->mctx, client, DNS_EVENT_UPDATE,
|
||||||
|
update_action, NULL, sizeof(*event));
|
||||||
|
@@ -1652,7 +1663,12 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
|
||||||
|
* We are still in the client task context, so we can
|
||||||
|
* simply give an error response without switching tasks.
|
||||||
|
*/
|
||||||
|
- respond(client, result);
|
||||||
|
+ if (result == DNS_R_DROP) {
|
||||||
|
+ ns_client_next(client, result);
|
||||||
|
+ } else {
|
||||||
|
+ respond(client, result);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (zone != NULL)
|
||||||
|
dns_zone_detach(&zone);
|
||||||
|
}
|
||||||
|
@@ -3385,6 +3401,7 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {
|
||||||
|
dns_zone_detach(&uev->zone);
|
||||||
|
client->nupdates--;
|
||||||
|
respond(client, uev->result);
|
||||||
|
+ isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
|
||||||
|
isc_event_free(&event);
|
||||||
|
ns_client_detach(&client);
|
||||||
|
}
|
||||||
|
@@ -3402,6 +3419,8 @@ forward_fail(isc_task_t *task, isc_event_t *event) {
|
||||||
|
INSIST(client->nupdates > 0);
|
||||||
|
client->nupdates--;
|
||||||
|
respond(client, DNS_R_SERVFAIL);
|
||||||
|
+
|
||||||
|
+ isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
|
||||||
|
isc_event_free(&event);
|
||||||
|
ns_client_detach(&client);
|
||||||
|
}
|
||||||
|
@@ -3439,6 +3458,8 @@ forward_done(isc_task_t *task, isc_event_t *event) {
|
||||||
|
client->nupdates--;
|
||||||
|
ns_client_sendraw(client, uev->answer);
|
||||||
|
dns_message_detach(&uev->answer);
|
||||||
|
+
|
||||||
|
+ isc_quota_detach(&(isc_quota_t *){ &ns_g_server->updquota });
|
||||||
|
isc_event_free(&event);
|
||||||
|
ns_client_detach(&client);
|
||||||
|
}
|
||||||
|
@@ -3472,6 +3493,17 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
|
||||||
|
isc_task_t *zonetask = NULL;
|
||||||
|
ns_client_t *evclient;
|
||||||
|
|
||||||
|
+ result = isc_quota_attach(&ns_g_server->updquota,
|
||||||
|
+ &(isc_quota_t *){ NULL });
|
||||||
|
+ if (result != ISC_R_SUCCESS) {
|
||||||
|
+ update_log(client, zone, LOGLEVEL_PROTOCOL,
|
||||||
|
+ "update failed: too many DNS UPDATEs queued (%s)",
|
||||||
|
+ isc_result_totext(result));
|
||||||
|
+ isc_stats_increment(ns_g_server->nsstats,
|
||||||
|
+ dns_nsstatscounter_updatequota);
|
||||||
|
+ return (DNS_R_DROP);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* This may take some time so replace this client.
|
||||||
|
*/
|
||||||
|
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
|
||||||
|
index c17f168..9aca6d7 100644
|
||||||
|
--- a/doc/arm/Bv9ARM-book.xml
|
||||||
|
+++ b/doc/arm/Bv9ARM-book.xml
|
||||||
|
@@ -15105,6 +15105,21 @@ HOST-127.EXAMPLE. MX 0 .
|
||||||
|
</para>
|
||||||
|
</entry>
|
||||||
|
</row>
|
||||||
|
+ <row rowsep="0">
|
||||||
|
+ <entry colname="1">
|
||||||
|
+ <para><command>UpdateQuota</command></para>
|
||||||
|
+ </entry>
|
||||||
|
+ <entry colname="2">
|
||||||
|
+ <para><command/></para>
|
||||||
|
+ </entry>
|
||||||
|
+ <entry colname="3">
|
||||||
|
+ <para>
|
||||||
|
+ This indicates the number of times a dynamic update or update
|
||||||
|
+ forwarding request was rejected because the number of pending
|
||||||
|
+ requests exceeded the update quota.
|
||||||
|
+ </para>
|
||||||
|
+ </entry>
|
||||||
|
+ </row>
|
||||||
|
<row rowsep="0">
|
||||||
|
<entry colname="1">
|
||||||
|
<para><command>RateDropped</command></para>
|
||||||
|
--
|
||||||
|
2.39.2
|
||||||
|
|
||||||
@ -0,0 +1,136 @@
|
|||||||
|
From d9a03233c6ea11f20c2fbeca87b763673859f8b2 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Evan Hunt <each@isc.org>
|
||||||
|
Date: Thu, 1 Sep 2022 16:22:46 -0700
|
||||||
|
Subject: [PATCH] add a configuration option for the update quota
|
||||||
|
|
||||||
|
add an "update-quota" option to configure the update quota.
|
||||||
|
|
||||||
|
(cherry picked from commit f57758a7303ad0034ff2ff08eaaf2ef899630f19)
|
||||||
|
---
|
||||||
|
bin/named/config.c | 1 +
|
||||||
|
bin/named/named.conf.docbook | 2 ++
|
||||||
|
bin/named/server.c | 1 +
|
||||||
|
bin/tests/system/checkconf/good.conf | 1 +
|
||||||
|
doc/arm/Bv9ARM-book.xml | 11 +++++++++++
|
||||||
|
doc/arm/options.grammar.xml | 1 +
|
||||||
|
doc/misc/options | 1 +
|
||||||
|
lib/isccfg/namedconf.c | 1 +
|
||||||
|
8 files changed, 19 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/bin/named/config.c b/bin/named/config.c
|
||||||
|
index 62d1e88..e3731cf 100644
|
||||||
|
--- a/bin/named/config.c
|
||||||
|
+++ b/bin/named/config.c
|
||||||
|
@@ -134,6 +134,7 @@ options {\n\
|
||||||
|
transfers-per-ns 2;\n\
|
||||||
|
# treat-cr-as-space <obsolete>;\n\
|
||||||
|
trust-anchor-telemetry yes;\n\
|
||||||
|
+ update-quota 100;\n\
|
||||||
|
# use-id-pool <obsolete>;\n\
|
||||||
|
# use-ixfr <obsolete>;\n\
|
||||||
|
\n\
|
||||||
|
diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
|
||||||
|
index 6565fce..5842cb5 100644
|
||||||
|
--- a/bin/named/named.conf.docbook
|
||||||
|
+++ b/bin/named/named.conf.docbook
|
||||||
|
@@ -455,6 +455,7 @@ options {
|
||||||
|
trust-anchor-telemetry <replaceable>boolean</replaceable>; // experimental
|
||||||
|
try-tcp-refresh <replaceable>boolean</replaceable>;
|
||||||
|
update-check-ksk <replaceable>boolean</replaceable>;
|
||||||
|
+ update-quota <replaceable>integer</replaceable>;
|
||||||
|
use-alt-transfer-source <replaceable>boolean</replaceable>;
|
||||||
|
use-v4-udp-ports { <replaceable>portrange</replaceable>; ... };
|
||||||
|
use-v6-udp-ports { <replaceable>portrange</replaceable>; ... };
|
||||||
|
@@ -864,6 +865,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
|
||||||
|
type ( delegation-only | forward | hint | master | redirect
|
||||||
|
| slave | static-stub | stub );
|
||||||
|
update-check-ksk <replaceable>boolean</replaceable>;
|
||||||
|
+ update-quota <replaceable>integer</replaceable>;
|
||||||
|
update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> (
|
||||||
|
6to4-self | external | krb5-self | krb5-selfsub |
|
||||||
|
krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
|
||||||
|
diff --git a/bin/named/server.c b/bin/named/server.c
|
||||||
|
index f09b895..7af90d0 100644
|
||||||
|
--- a/bin/named/server.c
|
||||||
|
+++ b/bin/named/server.c
|
||||||
|
@@ -7792,6 +7792,7 @@ load_configuration(const char *filename, ns_server_t *server,
|
||||||
|
configure_server_quota(maps, "tcp-clients", &server->tcpquota);
|
||||||
|
configure_server_quota(maps, "recursive-clients",
|
||||||
|
&server->recursionquota);
|
||||||
|
+ configure_server_quota(maps, "update-quota", &server->updquota);
|
||||||
|
|
||||||
|
if (server->recursionquota.max > 1000) {
|
||||||
|
int margin = ISC_MAX(100, ns_g_cpus + 1);
|
||||||
|
diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
|
||||||
|
index 1359cf3..5d9b292 100644
|
||||||
|
--- a/bin/tests/system/checkconf/good.conf
|
||||||
|
+++ b/bin/tests/system/checkconf/good.conf
|
||||||
|
@@ -63,6 +63,7 @@ options {
|
||||||
|
serial-queries 10;
|
||||||
|
serial-query-rate 100;
|
||||||
|
server-id none;
|
||||||
|
+ update-quota 200;
|
||||||
|
max-cache-size 20000000000000;
|
||||||
|
nta-lifetime 604800;
|
||||||
|
nta-recheck 604800;
|
||||||
|
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
|
||||||
|
index 9aca6d7..acf772b 100644
|
||||||
|
--- a/doc/arm/Bv9ARM-book.xml
|
||||||
|
+++ b/doc/arm/Bv9ARM-book.xml
|
||||||
|
@@ -8599,6 +8599,17 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
+ <varlistentry>
|
||||||
|
+ <term><command>update-quota</command></term>
|
||||||
|
+ <listitem>
|
||||||
|
+ <para>
|
||||||
|
+ This is the maximum number of simultaneous DNS UPDATE messages that
|
||||||
|
+ the server will accept for updating local authoritiative zones or
|
||||||
|
+ forwarding to a primary server. The default is <userinput>100</userinput>.
|
||||||
|
+ </para>
|
||||||
|
+ </listitem>
|
||||||
|
+ </varlistentry>
|
||||||
|
+
|
||||||
|
</variablelist>
|
||||||
|
|
||||||
|
</section>
|
||||||
|
diff --git a/doc/arm/options.grammar.xml b/doc/arm/options.grammar.xml
|
||||||
|
index 793ac0b..1d17ea8 100644
|
||||||
|
--- a/doc/arm/options.grammar.xml
|
||||||
|
+++ b/doc/arm/options.grammar.xml
|
||||||
|
@@ -277,6 +277,7 @@
|
||||||
|
<command>trust-anchor-telemetry</command> <replaceable>boolean</replaceable>; // experimental
|
||||||
|
<command>try-tcp-refresh</command> <replaceable>boolean</replaceable>;
|
||||||
|
<command>update-check-ksk</command> <replaceable>boolean</replaceable>;
|
||||||
|
+ <command>update-quota</command> <replaceable>integer</replaceable>;
|
||||||
|
<command>use-alt-transfer-source</command> <replaceable>boolean</replaceable>;
|
||||||
|
<command>use-v4-udp-ports</command> { <replaceable>portrange</replaceable>; ... };
|
||||||
|
<command>use-v6-udp-ports</command> { <replaceable>portrange</replaceable>; ... };
|
||||||
|
diff --git a/doc/misc/options b/doc/misc/options
|
||||||
|
index fde93c7..e6d6ba6 100644
|
||||||
|
--- a/doc/misc/options
|
||||||
|
+++ b/doc/misc/options
|
||||||
|
@@ -357,6 +357,7 @@ options {
|
||||||
|
trust-anchor-telemetry <boolean>; // experimental
|
||||||
|
try-tcp-refresh <boolean>;
|
||||||
|
update-check-ksk <boolean>;
|
||||||
|
+ update-quota <integer>;
|
||||||
|
use-alt-transfer-source <boolean>;
|
||||||
|
use-id-pool <boolean>; // obsolete
|
||||||
|
use-ixfr <boolean>; // obsolete
|
||||||
|
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
|
||||||
|
index b562f95..667111c 100644
|
||||||
|
--- a/lib/isccfg/namedconf.c
|
||||||
|
+++ b/lib/isccfg/namedconf.c
|
||||||
|
@@ -1136,6 +1136,7 @@ options_clauses[] = {
|
||||||
|
{ "transfers-out", &cfg_type_uint32, 0 },
|
||||||
|
{ "transfers-per-ns", &cfg_type_uint32, 0 },
|
||||||
|
{ "treat-cr-as-space", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
|
||||||
|
+ { "update-quota", &cfg_type_uint32, 0 },
|
||||||
|
{ "use-id-pool", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
|
||||||
|
{ "use-ixfr", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
|
||||||
|
{ "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
|
||||||
|
--
|
||||||
|
2.39.2
|
||||||
|
|
||||||
@ -0,0 +1,553 @@
|
|||||||
|
From cba333b262b7ee0034a66cc93cf27f6c4918eea2 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Evan Hunt <each@isc.org>
|
||||||
|
Date: Tue, 8 Nov 2022 17:32:41 -0800
|
||||||
|
Subject: [PATCH] move update ACL and update-policy checks before quota
|
||||||
|
|
||||||
|
check allow-update, update-policy, and allow-update-forwarding before
|
||||||
|
consuming quota slots, so that unauthorized clients can't fill the
|
||||||
|
quota.
|
||||||
|
|
||||||
|
(this moves the access check before the prerequisite check, which
|
||||||
|
violates the precise wording of RFC 2136. however, RFC co-author Paul
|
||||||
|
Vixie has stated that the RFC is mistaken on this point; it should have
|
||||||
|
said that access checking must happen *no later than* the completion of
|
||||||
|
prerequisite checks, not that it must happen exactly then.)
|
||||||
|
|
||||||
|
(cherry picked from commit 964f559edb5036880b8e463b8f190b9007ee055d)
|
||||||
|
---
|
||||||
|
bin/named/update.c | 440 ++++++++++++++++++++++++++++++---------------
|
||||||
|
1 file changed, 298 insertions(+), 142 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/bin/named/update.c b/bin/named/update.c
|
||||||
|
index 8853ee7..4d1fe78 100644
|
||||||
|
--- a/bin/named/update.c
|
||||||
|
+++ b/bin/named/update.c
|
||||||
|
@@ -251,6 +251,9 @@ static void updatedone_action(isc_task_t *task, isc_event_t *event);
|
||||||
|
static isc_result_t send_forward_event(ns_client_t *client, dns_zone_t *zone);
|
||||||
|
static void forward_done(isc_task_t *task, isc_event_t *event);
|
||||||
|
static isc_result_t add_rr_prepare_action(void *data, rr_t *rr);
|
||||||
|
+static isc_result_t
|
||||||
|
+rr_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
|
||||||
|
+ const dns_rdata_t *rdata, bool *flag);
|
||||||
|
|
||||||
|
/**************************************************************************/
|
||||||
|
|
||||||
|
@@ -328,23 +331,24 @@ checkqueryacl(ns_client_t *client, dns_acl_t *queryacl, dns_name_t *zonename,
|
||||||
|
{
|
||||||
|
char namebuf[DNS_NAME_FORMATSIZE];
|
||||||
|
char classbuf[DNS_RDATACLASS_FORMATSIZE];
|
||||||
|
- int level;
|
||||||
|
isc_result_t result;
|
||||||
|
+ bool update_possible =
|
||||||
|
+ ((updateacl != NULL && !dns_acl_isnone(updateacl)) ||
|
||||||
|
+ ssutable != NULL);
|
||||||
|
|
||||||
|
result = ns_client_checkaclsilent(client, NULL, queryacl, true);
|
||||||
|
if (result != ISC_R_SUCCESS) {
|
||||||
|
+ int level = update_possible ? ISC_LOG_ERROR : ISC_LOG_INFO;
|
||||||
|
+
|
||||||
|
dns_name_format(zonename, namebuf, sizeof(namebuf));
|
||||||
|
dns_rdataclass_format(client->view->rdclass, classbuf,
|
||||||
|
sizeof(classbuf));
|
||||||
|
|
||||||
|
- level = (updateacl == NULL && ssutable == NULL) ?
|
||||||
|
- ISC_LOG_INFO : ISC_LOG_ERROR;
|
||||||
|
-
|
||||||
|
ns_client_log(client, NS_LOGCATEGORY_UPDATE_SECURITY,
|
||||||
|
NS_LOGMODULE_UPDATE, level,
|
||||||
|
"update '%s/%s' denied due to allow-query",
|
||||||
|
namebuf, classbuf);
|
||||||
|
- } else if (updateacl == NULL && ssutable == NULL) {
|
||||||
|
+ } else if (!update_possible) {
|
||||||
|
dns_name_format(zonename, namebuf, sizeof(namebuf));
|
||||||
|
dns_rdataclass_format(client->view->rdclass, classbuf,
|
||||||
|
sizeof(classbuf));
|
||||||
|
@@ -1525,6 +1529,277 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
|
||||||
|
update_event_t *event = NULL;
|
||||||
|
isc_task_t *zonetask = NULL;
|
||||||
|
ns_client_t *evclient;
|
||||||
|
+#if 1
|
||||||
|
+ dns_ssutable_t *ssutable = NULL;
|
||||||
|
+ dns_message_t *request = client->message;
|
||||||
|
+ dns_rdataclass_t zoneclass;
|
||||||
|
+ dns_rdatatype_t covers;
|
||||||
|
+ dns_name_t *zonename = NULL;
|
||||||
|
+ dns_db_t *db = NULL;
|
||||||
|
+ dns_dbversion_t *ver = NULL;
|
||||||
|
+
|
||||||
|
+ CHECK(dns_zone_getdb(zone, &db));
|
||||||
|
+ zonename = dns_db_origin(db);
|
||||||
|
+ zoneclass = dns_db_class(db);
|
||||||
|
+ dns_zone_getssutable(zone, &ssutable);
|
||||||
|
+ dns_db_currentversion(db, &ver);
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * Update message processing can leak record existence information
|
||||||
|
+ * so check that we are allowed to query this zone. Additionally,
|
||||||
|
+ * if we would refuse all updates for this zone, we bail out here.
|
||||||
|
+ */
|
||||||
|
+ CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone),
|
||||||
|
+ dns_zone_getorigin(zone),
|
||||||
|
+ dns_zone_getupdateacl(zone), ssutable));
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * Check requestor's permissions.
|
||||||
|
+ */
|
||||||
|
+ if (ssutable == NULL)
|
||||||
|
+ CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
|
||||||
|
+ "update", zonename, false, false));
|
||||||
|
+ else if (client->signer == NULL && !TCPCLIENT(client))
|
||||||
|
+ CHECK(checkupdateacl(client, NULL, "update", zonename,
|
||||||
|
+ false, true));
|
||||||
|
+
|
||||||
|
+ if (dns_zone_getupdatedisabled(zone))
|
||||||
|
+ FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
|
||||||
|
+ "because the zone is frozen. Use "
|
||||||
|
+ "'rndc thaw' to re-enable updates.");
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * Perform the Update Section Prescan.
|
||||||
|
+ */
|
||||||
|
+
|
||||||
|
+ for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
|
||||||
|
+ result == ISC_R_SUCCESS;
|
||||||
|
+ result = dns_message_nextname(request, DNS_SECTION_UPDATE))
|
||||||
|
+ {
|
||||||
|
+ dns_name_t *name = NULL;
|
||||||
|
+ dns_rdata_t rdata = DNS_RDATA_INIT;
|
||||||
|
+ dns_ttl_t ttl;
|
||||||
|
+ dns_rdataclass_t update_class;
|
||||||
|
+ get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
|
||||||
|
+ &name, &rdata, &covers, &ttl, &update_class);
|
||||||
|
+
|
||||||
|
+ if (! dns_name_issubdomain(name, zonename))
|
||||||
|
+ FAILC(DNS_R_NOTZONE,
|
||||||
|
+ "update RR is outside zone");
|
||||||
|
+ if (update_class == zoneclass) {
|
||||||
|
+ /*
|
||||||
|
+ * Check for meta-RRs. The RFC2136 pseudocode says
|
||||||
|
+ * check for ANY|AXFR|MAILA|MAILB, but the text adds
|
||||||
|
+ * "or any other QUERY metatype"
|
||||||
|
+ */
|
||||||
|
+ if (dns_rdatatype_ismeta(rdata.type)) {
|
||||||
|
+ FAILC(DNS_R_FORMERR,
|
||||||
|
+ "meta-RR in update");
|
||||||
|
+ }
|
||||||
|
+ result = dns_zone_checknames(zone, name, &rdata);
|
||||||
|
+ if (result != ISC_R_SUCCESS)
|
||||||
|
+ FAIL(DNS_R_REFUSED);
|
||||||
|
+ } else if (update_class == dns_rdataclass_any) {
|
||||||
|
+ if (ttl != 0 || rdata.length != 0 ||
|
||||||
|
+ (dns_rdatatype_ismeta(rdata.type) &&
|
||||||
|
+ rdata.type != dns_rdatatype_any))
|
||||||
|
+ FAILC(DNS_R_FORMERR,
|
||||||
|
+ "meta-RR in update");
|
||||||
|
+ } else if (update_class == dns_rdataclass_none) {
|
||||||
|
+ if (ttl != 0 ||
|
||||||
|
+ dns_rdatatype_ismeta(rdata.type))
|
||||||
|
+ FAILC(DNS_R_FORMERR,
|
||||||
|
+ "meta-RR in update");
|
||||||
|
+ } else {
|
||||||
|
+ update_log(client, zone, ISC_LOG_WARNING,
|
||||||
|
+ "update RR has incorrect class %d",
|
||||||
|
+ update_class);
|
||||||
|
+ FAIL(DNS_R_FORMERR);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * draft-ietf-dnsind-simple-secure-update-01 says
|
||||||
|
+ * "Unlike traditional dynamic update, the client
|
||||||
|
+ * is forbidden from updating NSEC records."
|
||||||
|
+ */
|
||||||
|
+ if (rdata.type == dns_rdatatype_nsec3) {
|
||||||
|
+ FAILC(DNS_R_REFUSED,
|
||||||
|
+ "explicit NSEC3 updates are not allowed "
|
||||||
|
+ "in secure zones");
|
||||||
|
+ } else if (rdata.type == dns_rdatatype_nsec) {
|
||||||
|
+ FAILC(DNS_R_REFUSED,
|
||||||
|
+ "explicit NSEC updates are not allowed "
|
||||||
|
+ "in secure zones");
|
||||||
|
+ } else if (rdata.type == dns_rdatatype_rrsig &&
|
||||||
|
+ !dns_name_equal(name, zonename)) {
|
||||||
|
+ FAILC(DNS_R_REFUSED,
|
||||||
|
+ "explicit RRSIG updates are currently "
|
||||||
|
+ "not supported in secure zones except "
|
||||||
|
+ "at the apex");
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (ssutable != NULL) {
|
||||||
|
+ isc_netaddr_t netaddr;
|
||||||
|
+ dst_key_t *tsigkey = NULL;
|
||||||
|
+ isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
|
||||||
|
+
|
||||||
|
+ if (client->message->tsigkey != NULL)
|
||||||
|
+ tsigkey = client->message->tsigkey->key;
|
||||||
|
+
|
||||||
|
+ if (rdata.type != dns_rdatatype_any) {
|
||||||
|
+ if (!dns_ssutable_checkrules2
|
||||||
|
+ (ssutable, client->signer, name, &netaddr,
|
||||||
|
+ TCPCLIENT(client),
|
||||||
|
+ &ns_g_server->aclenv,
|
||||||
|
+ rdata.type, tsigkey))
|
||||||
|
+ {
|
||||||
|
+ FAILC(DNS_R_REFUSED,
|
||||||
|
+ "rejected by secure update");
|
||||||
|
+ }
|
||||||
|
+ } else {
|
||||||
|
+ if (!ssu_checkall(db, ver, name, ssutable,
|
||||||
|
+ client->signer,
|
||||||
|
+ &netaddr,
|
||||||
|
+ TCPCLIENT(client),
|
||||||
|
+ tsigkey))
|
||||||
|
+ {
|
||||||
|
+ FAILC(DNS_R_REFUSED,
|
||||||
|
+ "rejected by secure update");
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ if (result != ISC_R_NOMORE)
|
||||||
|
+ FAIL(result);
|
||||||
|
+
|
||||||
|
+ update_log(client, zone, LOGLEVEL_DEBUG,
|
||||||
|
+ "update section prescan OK");
|
||||||
|
+#if 0
|
||||||
|
+ if (ssutable == NULL) {
|
||||||
|
+ CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
|
||||||
|
+ // zonename
|
||||||
|
+ "update", dns_zone_getorigin(zone), false,
|
||||||
|
+ false));
|
||||||
|
+ } else if (client->signer == NULL && !TCPCLIENT(client)) {
|
||||||
|
+ CHECK(checkupdateacl(client, NULL, "update",
|
||||||
|
+ dns_zone_getorigin(zone), false, true));
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (dns_zone_getupdatedisabled(zone)) {
|
||||||
|
+ FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
|
||||||
|
+ "because the zone is frozen. Use "
|
||||||
|
+ "'rndc thaw' to re-enable updates.");
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * Prescan the update section, checking for updates that
|
||||||
|
+ * are illegal or violate policy.
|
||||||
|
+ */
|
||||||
|
+ for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
|
||||||
|
+ result == ISC_R_SUCCESS;
|
||||||
|
+ result = dns_message_nextname(request, DNS_SECTION_UPDATE))
|
||||||
|
+ {
|
||||||
|
+ dns_name_t *name = NULL;
|
||||||
|
+ dns_rdata_t rdata = DNS_RDATA_INIT;
|
||||||
|
+ dns_ttl_t ttl;
|
||||||
|
+ dns_rdataclass_t update_class;
|
||||||
|
+
|
||||||
|
+ get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
|
||||||
|
+ &rdata, &covers, &ttl, &update_class);
|
||||||
|
+
|
||||||
|
+ if (!dns_name_issubdomain(name, zonename)) {
|
||||||
|
+ FAILC(DNS_R_NOTZONE, "update RR is outside zone");
|
||||||
|
+ }
|
||||||
|
+ if (update_class == zoneclass) {
|
||||||
|
+ /*
|
||||||
|
+ * Check for meta-RRs. The RFC2136 pseudocode says
|
||||||
|
+ * check for ANY|AXFR|MAILA|MAILB, but the text adds
|
||||||
|
+ * "or any other QUERY metatype"
|
||||||
|
+ */
|
||||||
|
+ if (dns_rdatatype_ismeta(rdata.type)) {
|
||||||
|
+ FAILC(DNS_R_FORMERR, "meta-RR in update");
|
||||||
|
+ }
|
||||||
|
+ result = dns_zone_checknames(zone, name, &rdata);
|
||||||
|
+ if (result != ISC_R_SUCCESS) {
|
||||||
|
+ FAIL(DNS_R_REFUSED);
|
||||||
|
+ }
|
||||||
|
+ } else if (update_class == dns_rdataclass_any) {
|
||||||
|
+ if (ttl != 0 || rdata.length != 0 ||
|
||||||
|
+ (dns_rdatatype_ismeta(rdata.type) &&
|
||||||
|
+ rdata.type != dns_rdatatype_any))
|
||||||
|
+ {
|
||||||
|
+ FAILC(DNS_R_FORMERR, "meta-RR in update");
|
||||||
|
+ }
|
||||||
|
+ } else if (update_class == dns_rdataclass_none) {
|
||||||
|
+ if (ttl != 0 || dns_rdatatype_ismeta(rdata.type)) {
|
||||||
|
+ FAILC(DNS_R_FORMERR, "meta-RR in update");
|
||||||
|
+ }
|
||||||
|
+ } else {
|
||||||
|
+ update_log(client, zone, ISC_LOG_WARNING,
|
||||||
|
+ "update RR has incorrect class %d",
|
||||||
|
+ update_class);
|
||||||
|
+ FAIL(DNS_R_FORMERR);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * draft-ietf-dnsind-simple-secure-update-01 says
|
||||||
|
+ * "Unlike traditional dynamic update, the client
|
||||||
|
+ * is forbidden from updating NSEC records."
|
||||||
|
+ */
|
||||||
|
+ if (rdata.type == dns_rdatatype_nsec3) {
|
||||||
|
+ FAILC(DNS_R_REFUSED, "explicit NSEC3 updates are not "
|
||||||
|
+ "allowed "
|
||||||
|
+ "in secure zones");
|
||||||
|
+ } else if (rdata.type == dns_rdatatype_nsec) {
|
||||||
|
+ FAILC(DNS_R_REFUSED, "explicit NSEC updates are not "
|
||||||
|
+ "allowed "
|
||||||
|
+ "in secure zones");
|
||||||
|
+ } else if (rdata.type == dns_rdatatype_rrsig &&
|
||||||
|
+ !dns_name_equal(name, zonename))
|
||||||
|
+ {
|
||||||
|
+ FAILC(DNS_R_REFUSED, "explicit RRSIG updates are "
|
||||||
|
+ "currently "
|
||||||
|
+ "not supported in secure zones "
|
||||||
|
+ "except "
|
||||||
|
+ "at the apex");
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (ssutable != NULL) {
|
||||||
|
+ isc_netaddr_t netaddr;
|
||||||
|
+ dst_key_t *tsigkey = NULL;
|
||||||
|
+ isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
|
||||||
|
+
|
||||||
|
+ if (client->message->tsigkey != NULL) {
|
||||||
|
+ tsigkey = client->message->tsigkey->key;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (rdata.type != dns_rdatatype_any) {
|
||||||
|
+ if (!dns_ssutable_checkrules(
|
||||||
|
+ ssutable, client->signer, name,
|
||||||
|
+ &netaddr, TCPCLIENT(client), env,
|
||||||
|
+ rdata.type, tsigkey))
|
||||||
|
+ {
|
||||||
|
+ FAILC(DNS_R_REFUSED, "rejected by "
|
||||||
|
+ "secure update");
|
||||||
|
+ }
|
||||||
|
+ } else {
|
||||||
|
+ if (!ssu_checkall(db, ver, name, ssutable,
|
||||||
|
+ client->signer, &netaddr, env,
|
||||||
|
+ TCPCLIENT(client), tsigkey))
|
||||||
|
+ {
|
||||||
|
+ FAILC(DNS_R_REFUSED, "rejected by "
|
||||||
|
+ "secure update");
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ if (result != ISC_R_NOMORE) {
|
||||||
|
+ FAIL(result);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
|
||||||
|
+#endif
|
||||||
|
+#endif
|
||||||
|
|
||||||
|
result = isc_quota_attach(&ns_g_server->updquota,
|
||||||
|
&(isc_quota_t *){ NULL });
|
||||||
|
@@ -1558,6 +1833,15 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
|
||||||
|
failure:
|
||||||
|
if (event != NULL)
|
||||||
|
isc_event_free(ISC_EVENT_PTR(&event));
|
||||||
|
+ if (db != NULL) {
|
||||||
|
+ dns_db_closeversion(db, &ver, false);
|
||||||
|
+ dns_db_detach(&db);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (ssutable != NULL) {
|
||||||
|
+ dns_ssutable_detach(&ssutable);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
return (result);
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -1644,9 +1928,6 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
|
||||||
|
CHECK(send_update_event(client, zone));
|
||||||
|
break;
|
||||||
|
case dns_zone_slave:
|
||||||
|
- CHECK(checkupdateacl(client, dns_zone_getforwardacl(zone),
|
||||||
|
- "update forwarding", zonename, true,
|
||||||
|
- false));
|
||||||
|
CHECK(send_forward_event(client, zone));
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
@@ -1656,7 +1937,6 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
|
||||||
|
|
||||||
|
failure:
|
||||||
|
if (result == DNS_R_REFUSED) {
|
||||||
|
- INSIST(dns_zone_gettype(zone) == dns_zone_slave);
|
||||||
|
inc_stats(zone, dns_nsstatscounter_updaterej);
|
||||||
|
}
|
||||||
|
/*
|
||||||
|
@@ -2520,7 +2800,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
|
||||||
|
dns_rdatatype_t covers;
|
||||||
|
dns_message_t *request = client->message;
|
||||||
|
dns_rdataclass_t zoneclass;
|
||||||
|
- dns_name_t *zonename;
|
||||||
|
+ dns_name_t *zonename = NULL;
|
||||||
|
dns_ssutable_t *ssutable = NULL;
|
||||||
|
dns_fixedname_t tmpnamefixed;
|
||||||
|
dns_name_t *tmpname = NULL;
|
||||||
|
@@ -2542,14 +2822,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
|
||||||
|
zonename = dns_db_origin(db);
|
||||||
|
zoneclass = dns_db_class(db);
|
||||||
|
dns_zone_getssutable(zone, &ssutable);
|
||||||
|
-
|
||||||
|
- /*
|
||||||
|
- * Update message processing can leak record existence information
|
||||||
|
- * so check that we are allowed to query this zone. Additionally
|
||||||
|
- * if we would refuse all updates for this zone we bail out here.
|
||||||
|
- */
|
||||||
|
- CHECK(checkqueryacl(client, dns_zone_getqueryacl(zone), zonename,
|
||||||
|
- dns_zone_getupdateacl(zone), ssutable));
|
||||||
|
+ options = dns_zone_getoptions(zone);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Get old and new versions now that queryacl has been checked.
|
||||||
|
@@ -2673,134 +2946,10 @@ update_action(isc_task_t *task, isc_event_t *event) {
|
||||||
|
update_log(client, zone, LOGLEVEL_DEBUG,
|
||||||
|
"prerequisites are OK");
|
||||||
|
|
||||||
|
- /*
|
||||||
|
- * Check Requestor's Permissions. It seems a bit silly to do this
|
||||||
|
- * only after prerequisite testing, but that is what RFC2136 says.
|
||||||
|
- */
|
||||||
|
- if (ssutable == NULL)
|
||||||
|
- CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
|
||||||
|
- "update", zonename, false, false));
|
||||||
|
- else if (client->signer == NULL && !TCPCLIENT(client))
|
||||||
|
- CHECK(checkupdateacl(client, NULL, "update", zonename,
|
||||||
|
- false, true));
|
||||||
|
-
|
||||||
|
- if (dns_zone_getupdatedisabled(zone))
|
||||||
|
- FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
|
||||||
|
- "because the zone is frozen. Use "
|
||||||
|
- "'rndc thaw' to re-enable updates.");
|
||||||
|
-
|
||||||
|
- /*
|
||||||
|
- * Perform the Update Section Prescan.
|
||||||
|
- */
|
||||||
|
-
|
||||||
|
- for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
|
||||||
|
- result == ISC_R_SUCCESS;
|
||||||
|
- result = dns_message_nextname(request, DNS_SECTION_UPDATE))
|
||||||
|
- {
|
||||||
|
- dns_name_t *name = NULL;
|
||||||
|
- dns_rdata_t rdata = DNS_RDATA_INIT;
|
||||||
|
- dns_ttl_t ttl;
|
||||||
|
- dns_rdataclass_t update_class;
|
||||||
|
- get_current_rr(request, DNS_SECTION_UPDATE, zoneclass,
|
||||||
|
- &name, &rdata, &covers, &ttl, &update_class);
|
||||||
|
-
|
||||||
|
- if (! dns_name_issubdomain(name, zonename))
|
||||||
|
- FAILC(DNS_R_NOTZONE,
|
||||||
|
- "update RR is outside zone");
|
||||||
|
- if (update_class == zoneclass) {
|
||||||
|
- /*
|
||||||
|
- * Check for meta-RRs. The RFC2136 pseudocode says
|
||||||
|
- * check for ANY|AXFR|MAILA|MAILB, but the text adds
|
||||||
|
- * "or any other QUERY metatype"
|
||||||
|
- */
|
||||||
|
- if (dns_rdatatype_ismeta(rdata.type)) {
|
||||||
|
- FAILC(DNS_R_FORMERR,
|
||||||
|
- "meta-RR in update");
|
||||||
|
- }
|
||||||
|
- result = dns_zone_checknames(zone, name, &rdata);
|
||||||
|
- if (result != ISC_R_SUCCESS)
|
||||||
|
- FAIL(DNS_R_REFUSED);
|
||||||
|
- } else if (update_class == dns_rdataclass_any) {
|
||||||
|
- if (ttl != 0 || rdata.length != 0 ||
|
||||||
|
- (dns_rdatatype_ismeta(rdata.type) &&
|
||||||
|
- rdata.type != dns_rdatatype_any))
|
||||||
|
- FAILC(DNS_R_FORMERR,
|
||||||
|
- "meta-RR in update");
|
||||||
|
- } else if (update_class == dns_rdataclass_none) {
|
||||||
|
- if (ttl != 0 ||
|
||||||
|
- dns_rdatatype_ismeta(rdata.type))
|
||||||
|
- FAILC(DNS_R_FORMERR,
|
||||||
|
- "meta-RR in update");
|
||||||
|
- } else {
|
||||||
|
- update_log(client, zone, ISC_LOG_WARNING,
|
||||||
|
- "update RR has incorrect class %d",
|
||||||
|
- update_class);
|
||||||
|
- FAIL(DNS_R_FORMERR);
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- /*
|
||||||
|
- * draft-ietf-dnsind-simple-secure-update-01 says
|
||||||
|
- * "Unlike traditional dynamic update, the client
|
||||||
|
- * is forbidden from updating NSEC records."
|
||||||
|
- */
|
||||||
|
- if (rdata.type == dns_rdatatype_nsec3) {
|
||||||
|
- FAILC(DNS_R_REFUSED,
|
||||||
|
- "explicit NSEC3 updates are not allowed "
|
||||||
|
- "in secure zones");
|
||||||
|
- } else if (rdata.type == dns_rdatatype_nsec) {
|
||||||
|
- FAILC(DNS_R_REFUSED,
|
||||||
|
- "explicit NSEC updates are not allowed "
|
||||||
|
- "in secure zones");
|
||||||
|
- } else if (rdata.type == dns_rdatatype_rrsig &&
|
||||||
|
- !dns_name_equal(name, zonename)) {
|
||||||
|
- FAILC(DNS_R_REFUSED,
|
||||||
|
- "explicit RRSIG updates are currently "
|
||||||
|
- "not supported in secure zones except "
|
||||||
|
- "at the apex");
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- if (ssutable != NULL) {
|
||||||
|
- isc_netaddr_t netaddr;
|
||||||
|
- dst_key_t *tsigkey = NULL;
|
||||||
|
- isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
|
||||||
|
-
|
||||||
|
- if (client->message->tsigkey != NULL)
|
||||||
|
- tsigkey = client->message->tsigkey->key;
|
||||||
|
-
|
||||||
|
- if (rdata.type != dns_rdatatype_any) {
|
||||||
|
- if (!dns_ssutable_checkrules2
|
||||||
|
- (ssutable, client->signer, name, &netaddr,
|
||||||
|
- TCPCLIENT(client),
|
||||||
|
- &ns_g_server->aclenv,
|
||||||
|
- rdata.type, tsigkey))
|
||||||
|
- {
|
||||||
|
- FAILC(DNS_R_REFUSED,
|
||||||
|
- "rejected by secure update");
|
||||||
|
- }
|
||||||
|
- } else {
|
||||||
|
- if (!ssu_checkall(db, ver, name, ssutable,
|
||||||
|
- client->signer,
|
||||||
|
- &netaddr,
|
||||||
|
- TCPCLIENT(client),
|
||||||
|
- tsigkey))
|
||||||
|
- {
|
||||||
|
- FAILC(DNS_R_REFUSED,
|
||||||
|
- "rejected by secure update");
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
- if (result != ISC_R_NOMORE)
|
||||||
|
- FAIL(result);
|
||||||
|
-
|
||||||
|
- update_log(client, zone, LOGLEVEL_DEBUG,
|
||||||
|
- "update section prescan OK");
|
||||||
|
-
|
||||||
|
/*
|
||||||
|
* Process the Update Section.
|
||||||
|
*/
|
||||||
|
|
||||||
|
- options = dns_zone_getoptions(zone);
|
||||||
|
options2 = dns_zone_getoptions2(zone);
|
||||||
|
for (result = dns_message_firstname(request, DNS_SECTION_UPDATE);
|
||||||
|
result == ISC_R_SUCCESS;
|
||||||
|
@@ -3494,6 +3643,13 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
|
||||||
|
isc_task_t *zonetask = NULL;
|
||||||
|
ns_client_t *evclient;
|
||||||
|
|
||||||
|
+ result = checkupdateacl(client, dns_zone_getforwardacl(zone),
|
||||||
|
+ "update forwarding", dns_zone_getorigin(zone),
|
||||||
|
+ true, false);
|
||||||
|
+ if (result != ISC_R_SUCCESS) {
|
||||||
|
+ return (result);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
result = isc_quota_attach(&ns_g_server->updquota,
|
||||||
|
&(isc_quota_t *){ NULL });
|
||||||
|
if (result != ISC_R_SUCCESS) {
|
||||||
|
--
|
||||||
|
2.39.2
|
||||||
|
|
||||||
@ -0,0 +1,266 @@
|
|||||||
|
From 3d84c651f823cb90b73fd736d32ad6de57b11610 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Evan Hunt <each@isc.org>
|
||||||
|
Date: Wed, 9 Nov 2022 21:56:16 -0800
|
||||||
|
Subject: [PATCH] test failure conditions
|
||||||
|
|
||||||
|
verify that updates are refused when the client is disallowed by
|
||||||
|
allow-query, and update forwarding is refused when the client is
|
||||||
|
is disallowed by update-forwarding.
|
||||||
|
|
||||||
|
verify that "too many DNS UPDATEs" appears in the log file when too
|
||||||
|
many simultaneous updates are processing.
|
||||||
|
|
||||||
|
(cherry picked from commit b91339b80e5b82a56622c93cc1e3cca2d0c11bc0)
|
||||||
|
---
|
||||||
|
bin/tests/system/nsupdate/ns1/named.conf.in | 2 +
|
||||||
|
bin/tests/system/nsupdate/tests.sh | 28 +++++++++++++
|
||||||
|
bin/tests/system/upforwd/clean.sh | 2 +
|
||||||
|
.../ns3/{named.conf.in => named1.conf.in} | 7 +++-
|
||||||
|
bin/tests/system/upforwd/ns3/named2.conf.in | 41 +++++++++++++++++++
|
||||||
|
bin/tests/system/upforwd/setup.sh | 2 +-
|
||||||
|
bin/tests/system/upforwd/tests.sh | 40 ++++++++++++++++++
|
||||||
|
7 files changed, 120 insertions(+), 2 deletions(-)
|
||||||
|
rename bin/tests/system/upforwd/ns3/{named.conf.in => named1.conf.in} (85%)
|
||||||
|
create mode 100644 bin/tests/system/upforwd/ns3/named2.conf.in
|
||||||
|
|
||||||
|
diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
|
||||||
|
index cb80269..228ad6a 100644
|
||||||
|
--- a/bin/tests/system/nsupdate/ns1/named.conf.in
|
||||||
|
+++ b/bin/tests/system/nsupdate/ns1/named.conf.in
|
||||||
|
@@ -20,6 +20,7 @@ options {
|
||||||
|
listen-on-v6 { none; };
|
||||||
|
recursion no;
|
||||||
|
notify yes;
|
||||||
|
+ update-quota 1;
|
||||||
|
};
|
||||||
|
|
||||||
|
key rndc_key {
|
||||||
|
@@ -76,6 +77,7 @@ zone "other.nil" {
|
||||||
|
check-integrity no;
|
||||||
|
check-mx warn;
|
||||||
|
update-policy local;
|
||||||
|
+ allow-query { !10.53.0.2; any; };
|
||||||
|
allow-query-on { 10.53.0.1; 127.0.0.1; };
|
||||||
|
allow-transfer { any; };
|
||||||
|
};
|
||||||
|
diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
|
||||||
|
index f8994ff..4cabf8d 100755
|
||||||
|
--- a/bin/tests/system/nsupdate/tests.sh
|
||||||
|
+++ b/bin/tests/system/nsupdate/tests.sh
|
||||||
|
@@ -1069,6 +1069,34 @@ END
|
||||||
|
grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out-$n >/dev/null || ret=1
|
||||||
|
[ $ret = 0 ] || { echo_i "failed"; status=1; }
|
||||||
|
|
||||||
|
+n=$((n + 1))
|
||||||
|
+ret=0
|
||||||
|
+echo_i "check that update is rejected if query is not allowed ($n)"
|
||||||
|
+{
|
||||||
|
+ $NSUPDATE -d <<END
|
||||||
|
+ local 10.53.0.2
|
||||||
|
+ server 10.53.0.1 ${PORT}
|
||||||
|
+ update add reject.other.nil 3600 IN TXT Whatever
|
||||||
|
+ send
|
||||||
|
+END
|
||||||
|
+} > nsupdate.out.test$n 2>&1
|
||||||
|
+grep 'status: REFUSED' nsupdate.out.test$n > /dev/null || ret=1
|
||||||
|
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
|
||||||
|
+
|
||||||
|
+n=$((n + 1))
|
||||||
|
+ret=0
|
||||||
|
+echo_i "check that update is rejected if quota is exceeded ($n)"
|
||||||
|
+for loop in 1 2 3 4 5 6 7 8 9 10; do
|
||||||
|
+{
|
||||||
|
+ $NSUPDATE -l -p ${PORT} -k ns1/session.key > nsupdate.out.test$n-${loop} 2>&1 <<END
|
||||||
|
+ update add txt-$loop.other.nil 3600 IN TXT Whatever
|
||||||
|
+ send
|
||||||
|
+END
|
||||||
|
+} &
|
||||||
|
+done
|
||||||
|
+wait_for_log 10 "too many DNS UPDATEs queued" ns1/named.run || ret=1
|
||||||
|
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
|
||||||
|
+
|
||||||
|
if $FEATURETEST --gssapi ; then
|
||||||
|
n=`expr $n + 1`
|
||||||
|
ret=0
|
||||||
|
diff --git a/bin/tests/system/upforwd/clean.sh b/bin/tests/system/upforwd/clean.sh
|
||||||
|
index 15cf423..832c727 100644
|
||||||
|
--- a/bin/tests/system/upforwd/clean.sh
|
||||||
|
+++ b/bin/tests/system/upforwd/clean.sh
|
||||||
|
@@ -24,3 +24,5 @@ rm -f Ksig0.example2.*
|
||||||
|
rm -f keyname
|
||||||
|
rm -f ns*/named.lock
|
||||||
|
rm -f ns1/example2.db
|
||||||
|
+rm -f nsupdate.out.*
|
||||||
|
+rm -f ns*/named.run.prev
|
||||||
|
diff --git a/bin/tests/system/upforwd/ns3/named.conf.in b/bin/tests/system/upforwd/ns3/named1.conf.in
|
||||||
|
similarity index 85%
|
||||||
|
rename from bin/tests/system/upforwd/ns3/named.conf.in
|
||||||
|
rename to bin/tests/system/upforwd/ns3/named1.conf.in
|
||||||
|
index e81cd1a..83a490f 100644
|
||||||
|
--- a/bin/tests/system/upforwd/ns3/named.conf.in
|
||||||
|
+++ b/bin/tests/system/upforwd/ns3/named1.conf.in
|
||||||
|
@@ -22,10 +22,15 @@ options {
|
||||||
|
notify yes;
|
||||||
|
};
|
||||||
|
|
||||||
|
+include "../../common/rndc.key";
|
||||||
|
+controls {
|
||||||
|
+ inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
zone "example" {
|
||||||
|
type slave;
|
||||||
|
file "example.bk";
|
||||||
|
- allow-update-forwarding { any; };
|
||||||
|
+ allow-update-forwarding { 10.53.0.1; };
|
||||||
|
masters { 10.53.0.1; };
|
||||||
|
};
|
||||||
|
|
||||||
|
diff --git a/bin/tests/system/upforwd/ns3/named2.conf.in b/bin/tests/system/upforwd/ns3/named2.conf.in
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000..992cd69
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/bin/tests/system/upforwd/ns3/named2.conf.in
|
||||||
|
@@ -0,0 +1,41 @@
|
||||||
|
+/*
|
||||||
|
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||||
|
+ *
|
||||||
|
+ * SPDX-License-Identifier: MPL-2.0
|
||||||
|
+ *
|
||||||
|
+ * This Source Code Form is subject to the terms of the Mozilla Public
|
||||||
|
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||||
|
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||||
|
+ *
|
||||||
|
+ * See the COPYRIGHT file distributed with this work for additional
|
||||||
|
+ * information regarding copyright ownership.
|
||||||
|
+ */
|
||||||
|
+
|
||||||
|
+options {
|
||||||
|
+ query-source address 10.53.0.3;
|
||||||
|
+ notify-source 10.53.0.3;
|
||||||
|
+ transfer-source 10.53.0.3;
|
||||||
|
+ port @PORT@;
|
||||||
|
+ pid-file "named.pid";
|
||||||
|
+ listen-on { 10.53.0.3; };
|
||||||
|
+ listen-on-v6 { none; };
|
||||||
|
+ recursion no;
|
||||||
|
+ notify yes;
|
||||||
|
+ update-quota 1;
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+key rndc_key {
|
||||||
|
+ secret "1234abcd8765";
|
||||||
|
+ algorithm hmac-sha256;
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+controls {
|
||||||
|
+ inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+zone "example" {
|
||||||
|
+ type slave;
|
||||||
|
+ file "example.bk";
|
||||||
|
+ allow-update-forwarding { any; };
|
||||||
|
+ masters { 10.53.0.1; };
|
||||||
|
+};
|
||||||
|
diff --git a/bin/tests/system/upforwd/setup.sh b/bin/tests/system/upforwd/setup.sh
|
||||||
|
index 74c7ba3..928902b 100644
|
||||||
|
--- a/bin/tests/system/upforwd/setup.sh
|
||||||
|
+++ b/bin/tests/system/upforwd/setup.sh
|
||||||
|
@@ -17,7 +17,7 @@ cp -f ns3/nomaster.db ns3/nomaster1.db
|
||||||
|
|
||||||
|
copy_setports ns1/named.conf.in ns1/named.conf
|
||||||
|
copy_setports ns2/named.conf.in ns2/named.conf
|
||||||
|
-copy_setports ns3/named.conf.in ns3/named.conf
|
||||||
|
+copy_setports ns3/named1.conf.in ns3/named.conf
|
||||||
|
|
||||||
|
#
|
||||||
|
# SIG(0) required cryptographic support which may not be configured.
|
||||||
|
diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
|
||||||
|
index f4c3216..ebc9ded 100644
|
||||||
|
--- a/bin/tests/system/upforwd/tests.sh
|
||||||
|
+++ b/bin/tests/system/upforwd/tests.sh
|
||||||
|
@@ -17,6 +17,7 @@ SYSTEMTESTTOP=..
|
||||||
|
. $SYSTEMTESTTOP/conf.sh
|
||||||
|
|
||||||
|
DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
|
||||||
|
+RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
|
||||||
|
|
||||||
|
status=0
|
||||||
|
n=1
|
||||||
|
@@ -69,6 +70,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
|
||||||
|
echo_i "updating zone (signed) ($n)"
|
||||||
|
ret=0
|
||||||
|
$NSUPDATE -y hmac-sha256:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
|
||||||
|
+local 10.53.0.1
|
||||||
|
server 10.53.0.3 ${PORT}
|
||||||
|
update add updated.example. 600 A 10.10.10.1
|
||||||
|
update add updated.example. 600 TXT Foo
|
||||||
|
@@ -116,6 +118,7 @@ n=`expr $n + 1`
|
||||||
|
echo_i "updating zone (unsigned) ($n)"
|
||||||
|
ret=0
|
||||||
|
$NSUPDATE -- - <<EOF || ret=1
|
||||||
|
+local 10.53.0.1
|
||||||
|
server 10.53.0.3 ${PORT}
|
||||||
|
update add unsigned.example. 600 A 10.10.10.1
|
||||||
|
update add unsigned.example. 600 TXT Foo
|
||||||
|
@@ -161,6 +164,7 @@ while [ $count -lt 5 -a $ret -eq 0 ]
|
||||||
|
do
|
||||||
|
(
|
||||||
|
$NSUPDATE -- - <<EOF
|
||||||
|
+local 10.53.0.1
|
||||||
|
server 10.53.0.3 ${PORT}
|
||||||
|
zone nomaster
|
||||||
|
update add unsigned.nomaster. 600 A 10.10.10.1
|
||||||
|
@@ -181,6 +185,7 @@ then
|
||||||
|
ret=0
|
||||||
|
keyname=`cat keyname`
|
||||||
|
$NSUPDATE -k $keyname.private -- - <<EOF
|
||||||
|
+ local 10.53.0.1
|
||||||
|
server 10.53.0.3 ${PORT}
|
||||||
|
zone example2
|
||||||
|
update add unsigned.example2. 600 A 10.10.10.1
|
||||||
|
@@ -194,5 +199,40 @@ EOF
|
||||||
|
n=`expr $n + 1`
|
||||||
|
fi
|
||||||
|
|
||||||
|
+echo_i "attempting an update that should be rejected by ACL ($n)"
|
||||||
|
+ret=0
|
||||||
|
+{
|
||||||
|
+ $NSUPDATE -- - << EOF
|
||||||
|
+ local 10.53.0.2
|
||||||
|
+ server 10.53.0.3 ${PORT}
|
||||||
|
+ update add another.unsigned.example. 600 A 10.10.10.2
|
||||||
|
+ update add another.unsigned.example. 600 TXT Bar
|
||||||
|
+ send
|
||||||
|
+EOF
|
||||||
|
+} > nsupdate.out.$n 2>&1
|
||||||
|
+grep REFUSED nsupdate.out.$n > /dev/null || ret=1
|
||||||
|
+if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
|
||||||
|
+n=`expr $n + 1`
|
||||||
|
+
|
||||||
|
+n=$((n + 1))
|
||||||
|
+ret=0
|
||||||
|
+echo_i "attempting updates that should exceed quota ($n)"
|
||||||
|
+# lower the update quota to 1.
|
||||||
|
+copy_setports ns3/named2.conf.in ns3/named.conf
|
||||||
|
+$RNDCCMD 10.53.0.3 reconfig
|
||||||
|
+nextpart ns3/named.run > /dev/null
|
||||||
|
+for loop in 1 2 3 4 5 6 7 8 9 10; do
|
||||||
|
+{
|
||||||
|
+ $NSUPDATE -- - > /dev/null 2>&1 <<END
|
||||||
|
+ local 10.53.0.1
|
||||||
|
+ server 10.53.0.3 ${PORT}
|
||||||
|
+ update add txt-$loop.unsigned.example 300 IN TXT Whatever
|
||||||
|
+ send
|
||||||
|
+END
|
||||||
|
+} &
|
||||||
|
+done
|
||||||
|
+wait_for_log 10 "too many DNS UPDATEs queued" ns3/named.run || ret=1
|
||||||
|
+[ $ret = 0 ] || { echo_i "failed"; status=1; }
|
||||||
|
+
|
||||||
|
echo_i "exit status: $status"
|
||||||
|
[ $status -eq 0 ] || exit 1
|
||||||
|
--
|
||||||
|
2.39.2
|
||||||
|
|
||||||
Loading…
Reference in new issue