From 3230429e175dcaafe9c59967124d44c02ca0ccad Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Mon, 17 Nov 2014 23:24:44 -0800 Subject: [PATCH] [master] limit recursion depth and iterative queries 4006. [security] A flaw in delegation handling could be exploited to put named into an infinite loop. This has been addressed by placing limits on the number of levels of recursion named will allow (default 7), and the number of iterative queries that it will send (default 50) before terminating a recursive query (CVE-2014-8500). The recursion depth limit is configured via the "max-recursion-depth" option. [RT #35780] --- CHANGES | 11 ++++ bin/named/config.c | 3 +- bin/named/include/named/query.h | 2 - bin/named/query.c | 16 ++--- bin/named/server.c | 5 ++ bin/tests/system/many/clean.sh | 7 +++ bin/tests/system/many/ns1/named.conf | 33 ++++++++++ bin/tests/system/many/ns2/named.conf | 30 ++++++++++ bin/tests/system/many/ns3/named.conf | 32 ++++++++++ bin/tests/system/many/ns4/named.conf | 30 ++++++++++ bin/tests/system/many/ns5/hints.db | 2 + bin/tests/system/many/ns5/named.conf | 29 +++++++++ bin/tests/system/many/setup.sh | 75 +++++++++++++++++++++++ bin/tests/system/many/tests.sh | 48 +++++++++++++++ doc/arm/Bv9ARM-book.xml | 12 ++++ lib/dns/adb.c | 56 ++++++++++++----- lib/dns/include/dns/adb.h | 8 +++ lib/dns/include/dns/resolver.h | 25 ++++++++ lib/dns/resolver.c | 90 ++++++++++++++++++++++++---- lib/isccfg/namedconf.c | 1 + 20 files changed, 475 insertions(+), 40 deletions(-) create mode 100644 bin/tests/system/many/clean.sh create mode 100644 bin/tests/system/many/ns1/named.conf create mode 100644 bin/tests/system/many/ns2/named.conf create mode 100644 bin/tests/system/many/ns3/named.conf create mode 100644 bin/tests/system/many/ns4/named.conf create mode 100644 bin/tests/system/many/ns5/hints.db create mode 100644 bin/tests/system/many/ns5/named.conf create mode 100644 bin/tests/system/many/setup.sh create mode 100644 bin/tests/system/many/tests.sh diff --git a/CHANGES b/CHANGES index bce9536c10..5f425bef33 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,14 @@ +4006. [security] A flaw in delegation handling could be exploited + to put named into an infinite loop. This has + been addressed by placing limits on the number + of levels of recursion named will allow (default 7), + and the number of iterative queries that it will + send (default 50) before terminating a recursive + query (CVE-2014-8500). + + The recursion depth limit is configured via the + "max-recursion-depth" option. [RT #35780] + 4005. [func] The buffer used for returning text from rndc commands is now dynamically resizable, allowing arbitrarily large amounts of text to be sent back diff --git a/bin/named/config.c b/bin/named/config.c index dbc156aba8..ae9e6d2555 100644 --- a/bin/named/config.c +++ b/bin/named/config.c @@ -15,8 +15,6 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: config.c,v 1.123 2012/01/06 23:46:41 tbox Exp $ */ - /*! \file */ #include @@ -176,6 +174,7 @@ options {\n\ dnssec-accept-expired no;\n\ clients-per-query 10;\n\ max-clients-per-query 100;\n\ + max-recursion-depth 7;\n\ zero-no-soa-ttl-cache no;\n\ nsec3-test-zone no;\n\ allow-new-zones no;\n\ diff --git a/bin/named/include/named/query.h b/bin/named/include/named/query.h index ff2a61073e..e4179f1f93 100644 --- a/bin/named/include/named/query.h +++ b/bin/named/include/named/query.h @@ -15,8 +15,6 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: query.h,v 1.45 2011/01/13 04:59:24 tbox Exp $ */ - #ifndef NAMED_QUERY_H #define NAMED_QUERY_H 1 diff --git a/bin/named/query.c b/bin/named/query.c index 87f0033256..a73c14421c 100644 --- a/bin/named/query.c +++ b/bin/named/query.c @@ -3905,12 +3905,13 @@ query_prefetch(ns_client_t *client, dns_name_t *qname, peeraddr = NULL; ns_client_attach(client, &dummy); options = client->query.fetchoptions | DNS_FETCHOPT_PREFETCH; - result = dns_resolver_createfetch2(client->view->resolver, + result = dns_resolver_createfetch3(client->view->resolver, qname, rdataset->type, NULL, NULL, NULL, peeraddr, client->message->id, - options, client->task, - prefetch_done, client, tmprdataset, - NULL, &client->query.prefetch); + options, 0, client->task, + prefetch_done, client, + tmprdataset, NULL, + &client->query.prefetch); if (result != ISC_R_SUCCESS) { query_putrdataset(client, &tmprdataset); ns_client_detach(&dummy); @@ -4025,12 +4026,11 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname, peeraddr = &client->peeraddr; else peeraddr = NULL; - result = dns_resolver_createfetch2(client->view->resolver, + result = dns_resolver_createfetch3(client->view->resolver, qname, qtype, qdomain, nameservers, NULL, peeraddr, client->message->id, - client->query.fetchoptions, - client->task, - query_resume, client, + client->query.fetchoptions, 0, + client->task, query_resume, client, rdataset, sigrdataset, &client->query.fetch); diff --git a/bin/named/server.c b/bin/named/server.c index 68d505f707..a2d8612ae8 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -3473,6 +3473,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_asuint32(obj), max_clients_per_query); + obj = NULL; + result = ns_config_get(maps, "max-recursion-depth", &obj); + INSIST(result == ISC_R_SUCCESS); + dns_resolver_setmaxdepth(view->resolver, cfg_obj_asuint32(obj)); + #ifdef ALLOW_FILTER_AAAA obj = NULL; result = ns_config_get(maps, "filter-aaaa-on-v4", &obj); diff --git a/bin/tests/system/many/clean.sh b/bin/tests/system/many/clean.sh new file mode 100644 index 0000000000..119b1f5fec --- /dev/null +++ b/bin/tests/system/many/clean.sh @@ -0,0 +1,7 @@ +rm -f ns1/[1-9]*example.tld?.db +rm -f ns2/[1-9]*example.tld?.db +rm -f ns1/zones.conf +rm -f ns2/zones.conf +rm -f */root.db +rm -f ns3/tld1.db +rm -f ns4/tld2.db diff --git a/bin/tests/system/many/ns1/named.conf b/bin/tests/system/many/ns1/named.conf new file mode 100644 index 0000000000..abc9dca4bc --- /dev/null +++ b/bin/tests/system/many/ns1/named.conf @@ -0,0 +1,33 @@ +/* + * Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +controls { /* empty */ }; + +options { + query-source address 10.53.0.1; + notify-source 10.53.0.1; + transfer-source 10.53.0.1; + port 5300; + pid-file "named.pid"; + listen-on { 10.53.0.1; }; + listen-on-v6 { none; }; + recursion no; +}; + +include "zones.conf"; + +// zone "tld1" { type master; file "tld1.db"; }; +// zone "tld2" { type master; file "tld2.db"; }; diff --git a/bin/tests/system/many/ns2/named.conf b/bin/tests/system/many/ns2/named.conf new file mode 100644 index 0000000000..16266e225a --- /dev/null +++ b/bin/tests/system/many/ns2/named.conf @@ -0,0 +1,30 @@ +/* + * Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +controls { /* empty */ }; + +options { + query-source address 10.53.0.2; + notify-source 10.53.0.2; + transfer-source 10.53.0.2; + port 5300; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; +}; + +include "zones.conf"; diff --git a/bin/tests/system/many/ns3/named.conf b/bin/tests/system/many/ns3/named.conf new file mode 100644 index 0000000000..b950afe9c7 --- /dev/null +++ b/bin/tests/system/many/ns3/named.conf @@ -0,0 +1,32 @@ +/* + * Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +controls { /* empty */ }; + +options { + query-source address 10.53.0.3; + notify-source 10.53.0.3; + transfer-source 10.53.0.3; + port 5300; + pid-file "named.pid"; + listen-on { 10.53.0.3; }; + listen-on-v6 { none; }; + recursion no; +}; + +zone "." { type master; file "root.db"; }; + +zone "tld1" { type master; file "tld1.db"; }; diff --git a/bin/tests/system/many/ns4/named.conf b/bin/tests/system/many/ns4/named.conf new file mode 100644 index 0000000000..ca9aa6a7ee --- /dev/null +++ b/bin/tests/system/many/ns4/named.conf @@ -0,0 +1,30 @@ +/* + * Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +controls { /* empty */ }; + +options { + query-source address 10.53.0.4; + notify-source 10.53.0.4; + transfer-source 10.53.0.4; + port 5300; + pid-file "named.pid"; + listen-on { 10.53.0.4; }; + listen-on-v6 { none; }; + recursion no; +}; + +zone "tld2" { type master; file "tld2.db"; }; diff --git a/bin/tests/system/many/ns5/hints.db b/bin/tests/system/many/ns5/hints.db new file mode 100644 index 0000000000..c05809bf2c --- /dev/null +++ b/bin/tests/system/many/ns5/hints.db @@ -0,0 +1,2 @@ +. 60 in ns ns.nil. +ns.nil. 60 in A 10.53.0.3 diff --git a/bin/tests/system/many/ns5/named.conf b/bin/tests/system/many/ns5/named.conf new file mode 100644 index 0000000000..fce7d5925f --- /dev/null +++ b/bin/tests/system/many/ns5/named.conf @@ -0,0 +1,29 @@ +/* + * Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +controls { /* empty */ }; + +options { + query-source address 10.53.0.5; + notify-source 10.53.0.5; + transfer-source 10.53.0.5; + port 5300; + pid-file "named.pid"; + listen-on { 10.53.0.5; }; + listen-on-v6 { none; }; +}; + +zone "." { type hint; file "hints.db"; }; diff --git a/bin/tests/system/many/setup.sh b/bin/tests/system/many/setup.sh new file mode 100644 index 0000000000..80695b57d1 --- /dev/null +++ b/bin/tests/system/many/setup.sh @@ -0,0 +1,75 @@ +i=1 + +cat > ns3/root.db << EOF +. 60 in soa ns.nil. hostmaster.ns.nil. 1 0 0 0 0 +. 60 in ns ns.nil. +ns.nil. 60 in a 10.53.0.3 +tld1. 60 in ns ns.tld1. +ns.tld1. 60 in a 10.53.0.3 +tld2. 60 in ns ns.tld2. +ns.tld2. 60 in a 10.53.0.4 +EOF + +cat > ns3/tld1.db << EOF +tld1. 60 in soa ns.tld1. hostmaster.ns.tld1. 1 0 0 0 0 +tld1. 60 in ns ns.tld1. +ns.tld1. 60 in a 10.53.0.1 +EOF + +cat > ns4/tld2.db << EOF +tld2. 60 in soa ns.tld2. hostmaster.ns.tld4. 1 0 0 0 0 +tld2. 60 in ns ns.tld2. +ns.tld2. 60 in a 10.53.0.1 +EOF + +: > ns1/zones.conf +: > ns2/zones.conf + +while [ $i -lt 1000 ] +do +j=`expr $i + 1` +s=`expr $j % 2 + 1` +n=`expr $i % 2 + 1` +t=`expr $s + 2` + +# i=1 j=2 s=1 n=2 +# i=2 j=3 s=1 n=2 +# i=3 j=4 s=1 n=2 + +cat > ns1/${i}example.tld${s}.db << EOF +${i}example.tld${s}. 60 in soa ns.${j}example.tld${n}. hostmaster 1 0 0 0 0 +${i}example.tld${s}. 60 in ns ns.${j}example.tld${n}. +ns.${i}example.tld${s}. 60 in a 10.53.0.1 +EOF + +cat >> ns1/zones.conf << EOF +zone "${i}example.tld${s}" { type master; file "${i}example.tld${s}.db"; }; +EOF + +cat >> ns${t}/tld${s}.db << EOF +${i}example.tld${s}. 60 in ns ns.${j}example.tld${n}. +EOF + +i=$j + +done + +j=`expr $i + 1` +s=`expr $j % 2 + 1` +n=`expr $s % 2 + 1` +t=`expr $s + 2` + +cat > ns1/${i}example.tld${s}.db << EOF +${i}example.tld${s}. 60 in soa ns.${i}example.tld${s}. hostmaster 1 0 0 0 0 +${i}example.tld${s}. 60 in ns ns.${i}example.tld${s}. +ns.${i}example.tld${s}. 60 in a 10.53.0.1 +EOF + +cat >> ns1/zones.conf << EOF +zone "${i}example.tld${s}" { type master; file "${i}example.tld${s}.db"; }; +EOF + +cat >> ns${t}/tld${s}.db << EOF +${i}example.tld${s}. 60 in ns ns.${i}example.tld${s}. +ns.${i}example.tld${s}. 60 in a 10.53.0.1 +EOF diff --git a/bin/tests/system/many/tests.sh b/bin/tests/system/many/tests.sh new file mode 100644 index 0000000000..37964e2635 --- /dev/null +++ b/bin/tests/system/many/tests.sh @@ -0,0 +1,48 @@ +#!/bin/sh +# +# Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +SYSTEMTESTTOP=.. +. $SYSTEMTESTTOP/conf.sh + +status=0 +n=0 + +n=`expr $n + 1` +echo "I: attempt lookup 1example.tld2 soa ($n)" +ret=0 +$DIG +tcp 1example.tld1 soa @10.53.0.5 -p 5300 > dig.out.test$n +grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo "I:failed"; fi +status=`expr $status + $ret` + +n=`expr $n + 1` +echo "I: attempt lookup 992example.tld2 soa ($n)" +ret=0 +$DIG +tcp 992example.tld2 soa @10.53.0.5 -p 5300 > dig.out.test$n +grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo "I:failed"; fi +status=`expr $status + $ret` + +n=`expr $n + 1` +echo "I: attempt lookup 993example.tld1 soa ($n)" +ret=0 +$DIG +tcp 993example.tld1 soa @10.53.0.5 -p 5300 > dig.out.test$n +grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo "I:failed"; fi +status=`expr $status + $ret` + +echo "I:exit status: $status" +exit $status diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 66e1530bb6..6fe4056089 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -4932,6 +4932,7 @@ badresp:1,adberr:0,findfail:0,valfail:0] max-acache-size size_spec ; clients-per-query number ; max-clients-per-query number ; + max-recursion-depth number ; masterfile-format (text|raw|map) ; masterfile-style @@ -9093,6 +9094,17 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; + + max-recursion-depth + + + Sets the maximum number of levels of recursion + permitted at any one time while resolving a name. + The default is 7. + + + + notify-delay diff --git a/lib/dns/adb.c b/lib/dns/adb.c index 89fc70f493..3b8deaff7f 100644 --- a/lib/dns/adb.c +++ b/lib/dns/adb.c @@ -199,6 +199,7 @@ struct dns_adbfetch { unsigned int magic; dns_fetch_t *fetch; dns_rdataset_t rdataset; + unsigned int depth; }; /*% @@ -313,7 +314,7 @@ static inline void violate_locking_hierarchy(isc_mutex_t *, isc_mutex_t *); static isc_boolean_t clean_namehooks(dns_adb_t *, dns_adbnamehooklist_t *); static void clean_target(dns_adb_t *, dns_name_t *); static void clean_finds_at_name(dns_adbname_t *, isc_eventtype_t, - unsigned int); + isc_uint32_t, unsigned int); static isc_boolean_t check_expire_namehooks(dns_adbname_t *, isc_stdtime_t); static isc_boolean_t check_expire_entry(dns_adb_t *, dns_adbentry_t **, isc_stdtime_t); @@ -321,7 +322,7 @@ static void cancel_fetches_at_name(dns_adbname_t *); static isc_result_t dbfind_name(dns_adbname_t *, isc_stdtime_t, dns_rdatatype_t); static isc_result_t fetch_name(dns_adbname_t *, isc_boolean_t, - dns_rdatatype_t); + unsigned int, dns_rdatatype_t); static inline void check_exit(dns_adb_t *); static void destroy(dns_adb_t *); static isc_boolean_t shutdown_names(dns_adb_t *); @@ -1024,7 +1025,7 @@ kill_name(dns_adbname_t **n, isc_eventtype_t ev) { * Clean up the name's various lists. These two are destructive * in that they will always empty the list. */ - clean_finds_at_name(name, ev, DNS_ADBFIND_ADDRESSMASK); + clean_finds_at_name(name, ev, 0, DNS_ADBFIND_ADDRESSMASK); result4 = clean_namehooks(adb, &name->v4); result6 = clean_namehooks(adb, &name->v6); clean_target(adb, &name->target); @@ -1449,7 +1450,7 @@ event_free(isc_event_t *event) { */ static void clean_finds_at_name(dns_adbname_t *name, isc_eventtype_t evtype, - unsigned int addrs) + isc_uint32_t qtotal, unsigned int addrs) { isc_event_t *ev; isc_task_t *task; @@ -1509,6 +1510,7 @@ clean_finds_at_name(dns_adbname_t *name, isc_eventtype_t evtype, ev->ev_sender = find; find->result_v4 = find_err_map[name->fetch_err]; find->result_v6 = find_err_map[name->fetch6_err]; + find->qtotal += qtotal; ev->ev_type = evtype; ev->ev_destroy = event_free; ev->ev_destroy_arg = find; @@ -1884,6 +1886,7 @@ new_adbfind(dns_adb_t *adb) { h->flags = 0; h->result_v4 = ISC_R_UNEXPECTED; h->result_v6 = ISC_R_UNEXPECTED; + h->qtotal = 0; ISC_LINK_INIT(h, publink); ISC_LINK_INIT(h, plink); ISC_LIST_INIT(h->list); @@ -2864,6 +2867,19 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action, dns_rdatatype_t qtype, unsigned int options, isc_stdtime_t now, dns_name_t *target, in_port_t port, dns_adbfind_t **findp) +{ + return (dns_adb_createfind2(adb, task, action, arg, name, + qname, qtype, options, now, + target, port, 0, findp)); +} + +isc_result_t +dns_adb_createfind2(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action, + void *arg, dns_name_t *name, dns_name_t *qname, + dns_rdatatype_t qtype, unsigned int options, + isc_stdtime_t now, dns_name_t *target, + in_port_t port, unsigned int depth, + dns_adbfind_t **findp) { dns_adbfind_t *find; dns_adbname_t *adbname; @@ -3101,7 +3117,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action, * Start V4. */ if (WANT_INET(wanted_fetches) && - fetch_name(adbname, start_at_zone, + fetch_name(adbname, start_at_zone, depth, dns_rdatatype_a) == ISC_R_SUCCESS) { DP(DEF_LEVEL, "dns_adb_createfind: " "started A fetch for name %s (%p)", @@ -3112,7 +3128,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action, * Start V6. */ if (WANT_INET6(wanted_fetches) && - fetch_name(adbname, start_at_zone, + fetch_name(adbname, start_at_zone, depth, dns_rdatatype_aaaa) == ISC_R_SUCCESS) { DP(DEF_LEVEL, "dns_adb_createfind: " "started AAAA fetch for name %s (%p)", @@ -3744,6 +3760,7 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) { isc_result_t result; unsigned int address_type; isc_boolean_t want_check_exit = ISC_FALSE; + isc_uint32_t qtotal = 0; UNUSED(task); @@ -3754,6 +3771,8 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) { adb = name->adb; INSIST(DNS_ADB_VALID(adb)); + qtotal = dev->qtotal; + bucket = name->lock_bucket; LOCK(&adb->namelocks[bucket]); @@ -3871,6 +3890,12 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) { DP(DEF_LEVEL, "adb: fetch of '%s' %s failed: %s", buf, address_type == DNS_ADBFIND_INET ? "A" : "AAAA", dns_result_totext(dev->result)); + /* + * Don't record a failure unless this is the initial + * fetch of a chain. + */ + if (fetch->depth > 1) + goto out; /* XXXMLG Don't pound on bad servers. */ if (address_type == DNS_ADBFIND_INET) { name->expire_v4 = ISC_MIN(name->expire_v4, now + 300); @@ -3902,15 +3927,14 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) { free_adbfetch(adb, &fetch); isc_event_free(&ev); - clean_finds_at_name(name, ev_status, address_type); + clean_finds_at_name(name, ev_status, qtotal, address_type); UNLOCK(&adb->namelocks[bucket]); } static isc_result_t -fetch_name(dns_adbname_t *adbname, - isc_boolean_t start_at_zone, - dns_rdatatype_t type) +fetch_name(dns_adbname_t *adbname, isc_boolean_t start_at_zone, + unsigned int depth, dns_rdatatype_t type) { isc_result_t result; dns_adbfetch_t *fetch = NULL; @@ -3955,12 +3979,14 @@ fetch_name(dns_adbname_t *adbname, result = ISC_R_NOMEMORY; goto cleanup; } + fetch->depth = depth; - result = dns_resolver_createfetch(adb->view->resolver, &adbname->name, - type, name, nameservers, NULL, - options, adb->task, fetch_callback, - adbname, &fetch->rdataset, NULL, - &fetch->fetch); + result = dns_resolver_createfetch3(adb->view->resolver, &adbname->name, + type, name, nameservers, NULL, + NULL, 0, options, depth, adb->task, + fetch_callback, adbname, + &fetch->rdataset, NULL, + &fetch->fetch); if (result != ISC_R_SUCCESS) goto cleanup; diff --git a/lib/dns/include/dns/adb.h b/lib/dns/include/dns/adb.h index c45008ae7e..063602f84f 100644 --- a/lib/dns/include/dns/adb.h +++ b/lib/dns/include/dns/adb.h @@ -118,6 +118,8 @@ struct dns_adbfind { isc_result_t result_v6; /*%< RO: v6 result */ ISC_LINK(dns_adbfind_t) publink; /*%< RW: client use */ + isc_uint32_t qtotal; + /* Private */ isc_mutex_t lock; /* locks all below */ in_port_t port; @@ -336,6 +338,12 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action, dns_rdatatype_t qtype, unsigned int options, isc_stdtime_t now, dns_name_t *target, in_port_t port, dns_adbfind_t **find); +isc_result_t +dns_adb_createfind2(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action, + void *arg, dns_name_t *name, dns_name_t *qname, + dns_rdatatype_t qtype, unsigned int options, + isc_stdtime_t now, dns_name_t *target, in_port_t port, + unsigned int depth, dns_adbfind_t **find); /*%< * Main interface for clients. The adb will look up the name given in * "name" and will build up a list of found addresses, and perhaps start diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h index e9aabc2b8c..5ceac6e841 100644 --- a/lib/dns/include/dns/resolver.h +++ b/lib/dns/include/dns/resolver.h @@ -82,6 +82,7 @@ typedef struct dns_fetchevent { isc_sockaddr_t * client; dns_messageid_t id; isc_result_t vresult; + isc_uint32_t qtotal; } dns_fetchevent_t; /* @@ -278,6 +279,18 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name, dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset, dns_fetch_t **fetchp); +isc_result_t +dns_resolver_createfetch3(dns_resolver_t *res, dns_name_t *name, + dns_rdatatype_t type, + dns_name_t *domain, dns_rdataset_t *nameservers, + dns_forwarders_t *forwarders, + isc_sockaddr_t *client, isc_uint16_t id, + unsigned int options, unsigned int depth, + isc_task_t *task, + isc_taskaction_t action, void *arg, + dns_rdataset_t *rdataset, + dns_rdataset_t *sigrdataset, + dns_fetch_t **fetchp); /*%< * Recurse to answer a question. * @@ -629,6 +642,18 @@ dns_resolver_getquerydscp6(dns_resolver_t *resolver); * \li resolver to be valid. */ +void +dns_resolver_setmaxdepth(dns_resolver_t *resolver, unsigned int maxdepth); +unsigned int +dns_resolver_getmaxdepth(dns_resolver_t *resolver); +/*% + * Get and set how many NS indirections will be followed when looking for + * nameserver addresses. + * + * Requires: + * \li resolver to be valid. + */ + ISC_LANG_ENDDECLS #endif /* DNS_RESOLVER_H */ diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index f833337bb1..8c7bf692a9 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -156,6 +156,16 @@ #define MAXIMUM_QUERY_TIMEOUT 30 /* The maximum time in seconds for the whole query to live. */ #endif +/* The default maximum number of recursions to follow before giving up. */ +#ifndef DEFAULT_RECURSION_DEPTH +#define DEFAULT_RECURSION_DEPTH 7 +#endif + +/* The default maximum number of iterative queries to allow before giving up. */ +#ifndef DEFAULT_MAX_QUERIES +#define DEFAULT_MAX_QUERIES 50 +#endif + /*% * Maximum EDNS0 input packet size. */ @@ -334,6 +344,7 @@ struct fetchctx { isc_uint64_t duration; isc_boolean_t logged; unsigned int querysent; + unsigned int totalqueries; unsigned int referrals; unsigned int lamecount; unsigned int neterr; @@ -344,6 +355,7 @@ struct fetchctx { isc_boolean_t timeout; dns_adbaddrinfo_t *addrinfo; isc_sockaddr_t *client; + unsigned int depth; }; #define FCTX_MAGIC ISC_MAGIC('F', '!', '!', '!') @@ -447,6 +459,7 @@ struct dns_resolver { isc_timer_t * spillattimer; isc_boolean_t zero_no_soa_ttl; unsigned int query_timeout; + unsigned int maxdepth; /* Locked by lock. */ unsigned int references; @@ -1162,6 +1175,7 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result, int line) { event->result == DNS_R_NCACHENXRRSET); } + event->qtotal = fctx->totalqueries; isc_task_sendanddetach(&task, ISC_EVENT_PTR(&event)); count++; } @@ -1626,7 +1640,9 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, if (result != ISC_R_SUCCESS) goto cleanup_dispatch; } + fctx->querysent++; + fctx->totalqueries++; ISC_LIST_APPEND(fctx->queries, query, link); query->fctx->nqueries++; @@ -2523,9 +2539,10 @@ fctx_finddone(isc_task_t *task, isc_event_t *event) { */ INSIST(!SHUTTINGDOWN(fctx)); fctx->attributes &= ~FCTX_ATTR_ADDRWAIT; - if (event->ev_type == DNS_EVENT_ADBMOREADDRESSES) + if (event->ev_type == DNS_EVENT_ADBMOREADDRESSES) { want_try = ISC_TRUE; - else { + fctx->totalqueries += find->qtotal; + } else { fctx->findfail++; if (fctx->pending == 0) { /* @@ -2809,12 +2826,13 @@ findname(fetchctx_t *fctx, dns_name_t *name, in_port_t port, * See what we know about this address. */ find = NULL; - result = dns_adb_createfind(fctx->adb, - res->buckets[fctx->bucketnum].task, - fctx_finddone, fctx, name, - &fctx->name, fctx->type, - options, now, NULL, - res->view->dstport, &find); + result = dns_adb_createfind2(fctx->adb, + res->buckets[fctx->bucketnum].task, + fctx_finddone, fctx, name, + &fctx->name, fctx->type, + options, now, NULL, + res->view->dstport, + fctx->depth + 1, &find); if (result != ISC_R_SUCCESS) { if (result == DNS_R_ALIAS) { /* @@ -2922,6 +2940,11 @@ fctx_getaddresses(fetchctx_t *fctx, isc_boolean_t badcache) { res = fctx->res; + if (fctx->depth > res->maxdepth) { + FCTXTRACE("too much NS indirection"); + return (DNS_R_SERVFAIL); + } + /* * Forwarders. */ @@ -3359,6 +3382,9 @@ fctx_try(fetchctx_t *fctx, isc_boolean_t retrying, isc_boolean_t badcache) { REQUIRE(!ADDRWAIT(fctx)); + if (fctx->totalqueries > DEFAULT_MAX_QUERIES) + fctx_done(fctx, DNS_R_SERVFAIL, __LINE__); + addrinfo = fctx_nextaddress(fctx); if (addrinfo == NULL) { /* @@ -3721,6 +3747,7 @@ fctx_start(isc_task_t *task, isc_event_t *event) { * Normal fctx startup. */ fctx->state = fetchstate_active; + fctx->totalqueries = 0; /* * Reset the control event for later use in shutting down * the fctx. @@ -3790,6 +3817,7 @@ fctx_join(fetchctx_t *fctx, isc_task_t *task, isc_sockaddr_t *client, event->fetch = fetch; event->client = client; event->id = id; + event->qtotal = 0; dns_fixedname_init(&event->foundname); /* @@ -3826,7 +3854,8 @@ log_ns_ttl(fetchctx_t *fctx, const char *where) { static isc_result_t fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type, dns_name_t *domain, dns_rdataset_t *nameservers, - unsigned int options, unsigned int bucketnum, fetchctx_t **fctxp) + unsigned int options, unsigned int bucketnum, unsigned int depth, + fetchctx_t **fctxp) { fetchctx_t *fctx; isc_result_t result; @@ -3883,6 +3912,7 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type, fctx->state = fetchstate_init; fctx->want_shutdown = ISC_FALSE; fctx->cloned = ISC_FALSE; + fctx->depth = depth; ISC_LIST_INIT(fctx->queries); ISC_LIST_INIT(fctx->finds); ISC_LIST_INIT(fctx->altfinds); @@ -3901,6 +3931,7 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type, fctx->pending = 0; fctx->restarts = 0; fctx->querysent = 0; + fctx->totalqueries = 0; fctx->referrals = 0; TIME_NOW(&fctx->start); fctx->timeouts = 0; @@ -8302,6 +8333,7 @@ dns_resolver_create(dns_view_t *view, res->spillattimer = NULL; res->zero_no_soa_ttl = ISC_FALSE; res->query_timeout = DEFAULT_QUERY_TIMEOUT; + res->maxdepth = DEFAULT_RECURSION_DEPTH; res->nbuckets = ntasks; if (view->resstats != NULL) isc_stats_set(view->resstats, ntasks, @@ -8748,9 +8780,9 @@ dns_resolver_createfetch(dns_resolver_t *res, dns_name_t *name, dns_rdataset_t *sigrdataset, dns_fetch_t **fetchp) { - return (dns_resolver_createfetch2(res, name, type, domain, + return (dns_resolver_createfetch3(res, name, type, domain, nameservers, forwarders, NULL, 0, - options, task, action, arg, + options, 0, task, action, arg, rdataset, sigrdataset, fetchp)); } @@ -8765,6 +8797,25 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name, dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset, dns_fetch_t **fetchp) +{ + return (dns_resolver_createfetch3(res, name, type, domain, + nameservers, forwarders, client, id, + options, 0, task, action, arg, + rdataset, sigrdataset, fetchp)); +} + +isc_result_t +dns_resolver_createfetch3(dns_resolver_t *res, dns_name_t *name, + dns_rdatatype_t type, + dns_name_t *domain, dns_rdataset_t *nameservers, + dns_forwarders_t *forwarders, + isc_sockaddr_t *client, dns_messageid_t id, + unsigned int options, unsigned int depth, + isc_task_t *task, + isc_taskaction_t action, void *arg, + dns_rdataset_t *rdataset, + dns_rdataset_t *sigrdataset, + dns_fetch_t **fetchp) { dns_fetch_t *fetch; fetchctx_t *fctx = NULL; @@ -8854,11 +8905,12 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name, if (fctx == NULL) { result = fctx_create(res, name, type, domain, nameservers, - options, bucketnum, &fctx); + options, bucketnum, depth, &fctx); if (result != ISC_R_SUCCESS) goto unlock; new_fctx = ISC_TRUE; - } + } else if (fctx->depth > depth) + fctx->depth = depth; result = fctx_join(fctx, task, client, id, action, arg, rdataset, sigrdataset, fetch); @@ -9582,3 +9634,15 @@ dns_resolver_getquerydscp6(dns_resolver_t *resolver) { return (resolver->querydscp6); } +void +dns_resolver_setmaxdepth(dns_resolver_t *resolver, unsigned int maxdepth) { + REQUIRE(VALID_RESOLVER(resolver)); + resolver->maxdepth = maxdepth; +} + +unsigned int +dns_resolver_getmaxdepth(dns_resolver_t *resolver) { + REQUIRE(VALID_RESOLVER(resolver)); + return (resolver->maxdepth); +} + diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c index 038e84ebe8..46f31a0139 100644 --- a/lib/isccfg/namedconf.c +++ b/lib/isccfg/namedconf.c @@ -1520,6 +1520,7 @@ view_clauses[] = { { "max-cache-ttl", &cfg_type_uint32, 0 }, { "max-clients-per-query", &cfg_type_uint32, 0 }, { "max-ncache-ttl", &cfg_type_uint32, 0 }, + { "max-recursion-depth", &cfg_type_uint32, 0 }, { "max-udp-size", &cfg_type_uint32, 0 }, { "min-roots", &cfg_type_uint32, CFG_CLAUSEFLAG_NOTIMP }, { "minimal-responses", &cfg_type_boolean, 0 },