cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

update to BIND 9.16.22 - CVE-2021-25219

Browse Source 
"Lame cache can be abused to severely degrade resolver performance"

Exploitation of broken authoritative servers using a flaw in response
processing can cause degradation in BIND resolver performance. The way the
lame cache is currently designed makes it possible for its internal data
structures to grow almost infinitely, which may cause significant delays in
client query processing.

The purpose of a resolver's lame cache is to ensure that if an authoritative
server responds to a resolver's query in a specific broken way, subsequent
client queries for the same <QNAME, QTYPE> tuple do not trigger further
queries to the same server for a configurable amount of time. The lame cache
is enabled by setting the lame-ttl option in named.conf to a value greater
than 0. That option is set to lame-ttl 600; in the default configuration,
which means the lame cache is enabled by default.

Impact:

Authoritative-only BIND 9 servers are NOT vulnerable to this flaw.

A successful attack exploiting this flaw causes a named resolver to spend most
of its CPU time on managing and checking the lame cache. This results in
client queries being responded to with large delays, and increased likelihood
of DNS timeouts on client hosts.
This commit is contained in:
sthen 2021-10-27 20:57:06 +00:00
parent a265952437
commit 8c46e7749f
4 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/isc-bind/Makefile
View File

@ -1,10 +1,10 @@
# $OpenBSD: Makefile,v 1.145 2021/09/15 08:21:24 sthen Exp $
# $OpenBSD: Makefile,v 1.146 2021/10/27 20:57:06 sthen Exp $
COMMENT= Berkeley Internet Name Daemon: DNS server and tools
# Second digits: odd numbers devel, even numbers stable,
# ESV branched occasionally. 9.16.x is ESV.
V= 9.16.21
V= 9.16.22
SUBST_VARS+= V
PORTROACH= limitw:1,even
EXTRACT_SUFX= .tar.xz

4
net/isc-bind/distinfo
View File

@ -1,2 +1,2 @@
SHA256 (bind-9.16.21.tar.xz) = Zdpf1PuAt9DXRSh2+B/W1nzc7lSl48HWVhAzRmXfqBU=
SIZE (bind-9.16.21.tar.xz) = 5057816
SHA256 (bind-9.16.22.tar.xz) = Zeeyr2R52zRuL8mbz7bsMkAGZGjgnb7FdevHxX2ZQGE=
SIZE (bind-9.16.22.tar.xz) = 5059000

4
net/isc-bind/patches/patch-configure_ac
View File

@ -1,4 +1,4 @@
$OpenBSD: patch-configure_ac,v 1.18 2021/09/15 08:21:24 sthen Exp $
$OpenBSD: patch-configure_ac,v 1.19 2021/10/27 20:57:06 sthen Exp $
"struct stat" is in stat.h not fcntl.h
https://gitlab.isc.org/isc-projects/bind9/-/issues/2905
@ -6,7 +6,7 @@ https://gitlab.isc.org/isc-projects/bind9/-/issues/2905
Index: configure.ac
--- configure.ac.orig
+++ configure.ac
@@ -1836,7 +1836,7 @@ AC_DEFINE(NEED_OPTARG, 1, [Defined if extern char *opt
@@ -1838,7 +1838,7 @@ AC_DEFINE(NEED_OPTARG, 1, [Defined if extern char *opt
AC_MSG_CHECKING([for st_mtim.tv_nsec])
AC_COMPILE_IFELSE(
[AC_LANG_PROGRAM(

10
net/isc-bind/patches/patch-lib_isc_unix_socket_c
View File

@ -1,11 +1,11 @@
$OpenBSD: patch-lib_isc_unix_socket_c,v 1.31 2021/08/18 19:55:36 sthen Exp $
$OpenBSD: patch-lib_isc_unix_socket_c,v 1.32 2021/10/27 20:57:06 sthen Exp $
Disable some socket options which pledge doesn't allow.
Index: lib/isc/unix/socket.c
--- lib/isc/unix/socket.c.orig
+++ lib/isc/unix/socket.c
@@ -2105,10 +2105,12 @@ set_ip_disable_pmtud(isc_socket_t *sock) {
@@ -2104,10 +2104,12 @@ set_ip_disable_pmtud(isc_socket_t *sock) {
* Disable Path MTU Discover on IP packets
*/
if (sock->pf == AF_INET6) {
@ -18,7 +18,7 @@ Index: lib/isc/unix/socket.c
#if defined(IPV6_MTU_DISCOVER) && defined(IP_PMTUDISC_OMIT)
(void)setsockopt(sock->fd, IPPROTO_IPV6, IPV6_MTU_DISCOVER,
&(int){ IP_PMTUDISC_OMIT }, sizeof(int));
@@ -2385,6 +2387,7 @@ again:
@@ -2384,6 +2386,7 @@ again:
}
#endif /* if defined(SO_SNDBUF) */
}
@ -26,7 +26,7 @@ Index: lib/isc/unix/socket.c
#ifdef IPV6_RECVTCLASS
if ((sock->pf == AF_INET6) &&
(setsockopt(sock->fd, IPPROTO_IPV6, IPV6_RECVTCLASS, (void *)&on,
@@ -2409,6 +2412,7 @@ again:
@@ -2408,6 +2411,7 @@ again:
sock->fd, strbuf);
}
#endif /* ifdef IP_RECVTOS */
@ -34,7 +34,7 @@ Index: lib/isc/unix/socket.c
#endif /* defined(USE_CMSG) || defined(SET_RCVBUF) || defined(SET_SNDBUF) */
set_ip_disable_pmtud(sock);
@@ -5091,6 +5095,13 @@ isc_socket_gettype(isc_socket_t *sock) {
@@ -5090,6 +5094,13 @@ isc_socket_gettype(isc_socket_t *sock) {
void
isc_socket_ipv6only(isc_socket_t *sock, bool yes) {