From 117cf776a7add27ac6d236b4062258da0d068486 Mon Sep 17 00:00:00 2001
|
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
|
Date: Mon, 15 Nov 2021 16:26:52 +0800
|
Subject: [PATCH] Enable lame response detection even with disabled lame cache
|
|
Previously, when lame cache would be disabled by setting lame-ttl to 0,
|
it would also disable lame answer detection. In this commit, we enable
|
the lame response detection even when the lame cache is disabled. This
|
enables stopping answer processing early rather than going through the
|
whole answer processing flow.
|
|
CVE: CVE-2021-25219
|
|
Upstream-Status: Backport [https://gitlab.isc.org/isc-projects/bind9/-/commit/e4931584a34bdd0a0d18e4d918fb853bf5296787]
|
|
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
|
---
|
lib/dns/resolver.c | 23 ++++++++++++-----------
|
1 file changed, 12 insertions(+), 11 deletions(-)
|
|
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
|
index 50fadc0..9291bd4 100644
|
--- a/lib/dns/resolver.c
|
+++ b/lib/dns/resolver.c
|
@@ -10217,25 +10217,26 @@ rctx_badserver(respctx_t *rctx, isc_result_t result) {
|
*/
|
static isc_result_t
|
rctx_lameserver(respctx_t *rctx) {
|
- isc_result_t result;
|
+ isc_result_t result = ISC_R_SUCCESS;
|
fetchctx_t *fctx = rctx->fctx;
|
resquery_t *query = rctx->query;
|
|
- if (fctx->res->lame_ttl == 0 || ISFORWARDER(query->addrinfo) ||
|
- !is_lame(fctx, query->rmessage))
|
- {
|
+ if (ISFORWARDER(query->addrinfo) || !is_lame(fctx, query->rmessage)) {
|
return (ISC_R_SUCCESS);
|
}
|
|
inc_stats(fctx->res, dns_resstatscounter_lame);
|
log_lame(fctx, query->addrinfo);
|
- result = dns_adb_marklame(fctx->adb, query->addrinfo, &fctx->name,
|
- fctx->type, rctx->now + fctx->res->lame_ttl);
|
- if (result != ISC_R_SUCCESS) {
|
- isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
|
- DNS_LOGMODULE_RESOLVER, ISC_LOG_ERROR,
|
- "could not mark server as lame: %s",
|
- isc_result_totext(result));
|
+ if (fctx->res->lame_ttl != 0) {
|
+ result = dns_adb_marklame(fctx->adb, query->addrinfo,
|
+ &fctx->name, fctx->type,
|
+ rctx->now + fctx->res->lame_ttl);
|
+ if (result != ISC_R_SUCCESS) {
|
+ isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
|
+ DNS_LOGMODULE_RESOLVER, ISC_LOG_ERROR,
|
+ "could not mark server as lame: %s",
|
+ isc_result_totext(result));
|
+ }
|
}
|
rctx->broken_server = DNS_R_LAME;
|
rctx->next_server = true;
|
--
|
2.17.1
|
