upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-13 15:09:59 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch '309-fix-default-recursion' into 'master'

Browse source 
Resolve "Recursion improperly allowed by default"

Closes #309

See merge request isc-projects/bind9!372
This commit is contained in:
Ondřej Surý 2018-06-14 08:51:55 -04:00
commit 85da0086a8
11 changed files with 128 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
CHANGES
View file

@ -29,7 +29,12 @@
4961. [protocol] Remove support for ECC-GOST (GOST R 34.11-94).
[GL #295]
4960. [placeholder]
4960. [security] When recursion is enabled, but the "allow-recursion"
and "allow-query-cache" ACLs are not specified,
they should be limited to local networks,
but were inadvertently set to match the default
"allow-query", thus allowing remote queries.
(CVE-2018-5738) [GL #309]
4959. [func] NSID logging (enabled by the "request-nsid" option)
now has its own "nsid" category, instead of using the

43
bin/named/server.c
View file

@ -3726,10 +3726,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
CHECKM(named_config_getport(config, &port), "port");
dns_view_setdstport(view, port);
CHECK(configure_view_acl(vconfig, config, named_g_config,
"allow-query", NULL, actx,
named_g_mctx, &view->queryacl));
/*
* Make the list of response policy zone names for a view that
* is used for real lookups and so cares about hints.
@ -4714,21 +4710,35 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
"allow-query-cache-on", NULL, actx,
named_g_mctx, &view->cacheonacl));
/*
* Set "allow-query-cache", "allow-recursion", and
* "allow-recursion-on" acls if configured in named.conf.
* (Ignore the global defaults for now, because these ACLs
* can inherit from each other when only some of them set at
* the options/view level.)
* Set the "allow-query", "allow-query-cache", "allow-recursion",
* and "allow-recursion-on" ACLs if configured in named.conf, but
* NOT from the global defaults. This is done by leaving the third
* argument to configure_view_acl() NULL.
*
* We ignore the global defaults here because these ACLs
* can inherit from each other. If any are still unset after
* applying the inheritance rules, we'll look up the defaults at
* that time.
*/
CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache",
NULL, actx, named_g_mctx, &view->cacheacl));
/* named.conf only */
CHECK(configure_view_acl(vconfig, config, NULL,
"allow-query", NULL, actx,
named_g_mctx, &view->queryacl));
/* named.conf only */
CHECK(configure_view_acl(vconfig, config, NULL,
"allow-query-cache", NULL, actx,
named_g_mctx, &view->cacheacl));
if (strcmp(view->name, "_bind") != 0 &&
view->rdclass != dns_rdataclass_chaos)
{
/* named.conf only */
CHECK(configure_view_acl(vconfig, config, NULL,
"allow-recursion", NULL, actx,
named_g_mctx, &view->recursionacl));
/* named.conf only */
CHECK(configure_view_acl(vconfig, config, NULL,
"allow-recursion-on", NULL, actx,
named_g_mctx, &view->recursiononacl));
@ -4766,18 +4776,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
* the global config.
*/
if (view->recursionacl == NULL) {
/* global default only */
CHECK(configure_view_acl(NULL, NULL, named_g_config,
"allow-recursion", NULL,
actx, named_g_mctx,
&view->recursionacl));
}
if (view->recursiononacl == NULL) {
/* global default only */
CHECK(configure_view_acl(NULL, NULL, named_g_config,
"allow-recursion-on", NULL,
actx, named_g_mctx,
&view->recursiononacl));
}
if (view->cacheacl == NULL) {
/* global default only */
CHECK(configure_view_acl(NULL, NULL, named_g_config,
"allow-query-cache", NULL,
actx, named_g_mctx,
@ -4791,6 +4804,14 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
CHECK(dns_acl_none(mctx, &view->cacheacl));
}
if (view->queryacl == NULL) {
/* global default only */
CHECK(configure_view_acl(NULL, NULL, named_g_config,
"allow-query", NULL,
actx, named_g_mctx,
&view->queryacl));
}
/*
* Ignore case when compressing responses to the specified
* clients. This causes case not always to be preserved,

3
bin/tests/system/allow-query/clean.sh
View file

@ -14,7 +14,8 @@
#
rm -f dig.out.*
rm -f ns2/named.conf ns2/controls.conf
rm -f ns*/named.conf
rm -f ns2/controls.conf
rm -f */named.memstats
rm -f ns*/named.lock
rm -f ns*/named.run ns*/named.run.prev

23
bin/tests/system/allow-query/ns1/named.conf.in Normal file
View file

@ -0,0 +1,23 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
options {
port @PORT@;
pid-file "named.pid";
listen-on { 10.53.0.1; };
listen-on-v6 { none; };
recursion no;
};
zone "." {
type master;
file "root.db";
};

16
bin/tests/system/allow-query/ns1/root.db Normal file
View file

@ -0,0 +1,16 @@
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
;
; This Source Code Form is subject to the terms of the Mozilla Public
; License, v. 2.0. If a copy of the MPL was not distributed with this
; file, You can obtain one at http://mozilla.org/MPL/2.0/.
;
; See the COPYRIGHT file distributed with this work for additional
; information regarding copyright ownership.
$TTL 300
@ SOA ns1. hostmaster.localhost. 1 3600 1200 604800 3600
NS ns1.
ns1. A 10.53.0.1
normal.example. NS ns2.normal.example.
ns2.normal.example. A 10.53.0.2

2
bin/tests/system/allow-query/ns3/named.args Normal file
View file

@ -0,0 +1,2 @@
# this server only has 127.0.0.1 in its localhost/localnets ACLs
-m record,size,mctx -c named.conf -d 99 -X named.lock -g -T clienttest -T fixedlocal

24
bin/tests/system/allow-query/ns3/named.conf.in Normal file
View file

@ -0,0 +1,24 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
options {
port @PORT@;
pid-file "named.pid";
listen-on { 10.53.0.3; };
listen-on-v6 { none; };
recursion yes;
dnssec-validation no;
};
zone "." {
type hint;
file "../../common/root.hint";
};

2
bin/tests/system/allow-query/setup.sh
View file

@ -13,4 +13,6 @@ SYSTEMTESTTOP=..
. $SYSTEMTESTTOP/conf.sh
copy_setports ../common/controls.conf.in ns2/controls.conf
copy_setports ns1/named.conf.in ns1/named.conf
copy_setports ns2/named01.conf.in ns2/named.conf
copy_setports ns3/named.conf.in ns3/named.conf

11
bin/tests/system/allow-query/tests.sh
View file

@ -602,5 +602,16 @@ grep '^a.aclnotallow.example' dig.out.ns2.2.$n > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
# Test 58 - allow-recursion inheritance
n=`expr $n + 1`
echo_i "test $n: default recursion configuration"
ret=0
$DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 a.normal.example a > dig.out.ns3.1.$n
grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1
$DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 a.normal.example a > dig.out.ns3.2.$n
grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1

8
doc/arm/notes.xml
View file

@ -65,7 +65,11 @@
<itemizedlist>
<listitem>
<para>
None.
When recursion is enabled but the <command>allow-recursion</command>
and <command>allow-query-cache</command> ACLs are not specified, they
should be limited to local networks, but they were inadvertently set
to match the default <command>allow-query</command>, thus allowing
remote queries. This flaw is disclosed in CVE-2018-5738. [GL #309]
</para>
</listitem>
</itemizedlist>
@ -89,7 +93,7 @@
information about root key rollover status can be gathered.
To disable this feature, add
<command>root-key-sentinel no;</command> to
<filename>named.conf</filename>.
<filename>named.conf</filename>. [GL #37]
</para>
</listitem>
<listitem>

4
util/copyrights
View file

@ -461,6 +461,8 @@
./bin/tests/system/addzone/tests.sh SH 2010,2011,2012,2013,2014,2015,2016,2017,2018
./bin/tests/system/allow-query/.gitignore X 2018
./bin/tests/system/allow-query/clean.sh SH 2010,2012,2014,2015,2016,2018
./bin/tests/system/allow-query/ns1/named.conf.in CONF-C 2018
./bin/tests/system/allow-query/ns1/root.db ZONE 2018
./bin/tests/system/allow-query/ns2/generic.db ZONE 2018
./bin/tests/system/allow-query/ns2/named01.conf.in CONF-C 2010,2016,2018
./bin/tests/system/allow-query/ns2/named02.conf.in CONF-C 2010,2016,2018
@ -494,6 +496,8 @@
./bin/tests/system/allow-query/ns2/named55.conf.in CONF-C 2010,2016,2018
./bin/tests/system/allow-query/ns2/named56.conf.in CONF-C 2010,2016,2018
./bin/tests/system/allow-query/ns2/named57.conf.in CONF-C 2013,2016,2018
./bin/tests/system/allow-query/ns3/named.args X 2018
./bin/tests/system/allow-query/ns3/named.conf.in CONF-C 2018
./bin/tests/system/allow-query/setup.sh SH 2010,2012,2016,2018
./bin/tests/system/allow-query/tests.sh SH 2010,2012,2013,2016,2018
./bin/tests/system/ans.pl PERL 2011,2012,2014,2016,2017,2018