From 878dfb1e5200ea930a5ba98015a137589cb9c0b6 Mon Sep 17 00:00:00 2001
From: Mark Andrews
Date: Tue, 19 Mar 2019 14:14:21 +1100
Subject: [PATCH 1/3] move item_out test inside lock in dns_dispatch_getnext()
(cherry picked from commit 60c42f849d520564ed42e5ed0ba46b4b69c07712)
---
lib/dns/dispatch.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index b6fdd52051..d090649b05 100644
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -128,7 +128,7 @@ struct dns_dispentry {
isc_task_t *task;
isc_taskaction_t action;
void *arg;
- bool item_out;
+ bool item_out;
dispsocket_t *dispsocket;
ISC_LIST(dns_dispatchevent_t) items;
ISC_LINK(dns_dispentry_t) link;
@@ -3273,13 +3273,14 @@ dns_dispatch_getnext(dns_dispentry_t *resp, dns_dispatchevent_t **sockevent) {
disp = resp->disp;
REQUIRE(VALID_DISPATCH(disp));
- REQUIRE(resp->item_out == true);
- resp->item_out = false;
-
ev = *sockevent;
*sockevent = NULL;
LOCK(&disp->lock);
+
+ REQUIRE(resp->item_out == true);
+ resp->item_out = false;
+
if (ev->buffer.base != NULL)
free_buffer(disp, ev->buffer.base, ev->buffer.length);
free_devent(disp, ev);
@@ -3424,6 +3425,9 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
isc_task_send(disp->task[0], &disp->ctlevent);
}
+/*
+ * disp must be locked.
+ */
static void
do_cancel(dns_dispatch_t *disp) {
dns_dispatchevent_t *ev;
From 1c6ce19e1b6f56656a2a3f1667fa4be36bc51ad6 Mon Sep 17 00:00:00 2001
From: Evan Hunt
Date: Thu, 9 May 2019 10:53:18 -0700
Subject: [PATCH 2/3] CHANGES, release note
(cherry picked from commit 332af50eed96cbcb20173f297e543adaded0ed92)
---
CHANGES | 5 +++++
doc/arm/notes.xml | 10 +++++++++-
2 files changed, 14 insertions(+), 1 deletion(-)
diff --git a/CHANGES b/CHANGES
index 37f40ec006..24f816c8b8 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+5244. [security] Fixed a race condition in dns_dispatch_getnext()
+ that could cause an assertion failure if a
+ significant number of incoming packets were
+ rejected. (CVE-2019-6471) [GL #942]
+
5243. [bug] Fix a possible race between dispatcher and socket
code in a high-load cold-cache resolver scenario.
[GL #943]
diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index eb29b4747f..70416a65d7 100644
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -99,7 +99,15 @@
The TCP client quota set using the tcp-clients
option could be exceeded in some cases. This could lead to
- exhaustion of file descriptors. (CVE-2018-5743) [GL #615]
+ exhaustion of file descriptors. This flaw is disclosed in
+ CVE-2018-5743. [GL #615]
+
+
+
+
+ A race condition could trigger an assertion failure when
+ a large number of incoming packets were being rejected.
+ This flaw is disclosed in CVE-2019-6471. [GL #942]
From 5a70336065234170c94449d25c87e43b542c0085 Mon Sep 17 00:00:00 2001
From: Tinderbox User
Date: Mon, 3 Jun 2019 19:59:32 +0000
Subject: [PATCH 3/3] prep 9.14.3
---
CHANGES | 2 +
CONTRIBUTING | 2 +
HISTORY | 10 ++--
OPTIONS | 4 +-
PLATFORMS | 27 +---------
README | 35 ++++++++-----
README.md | 5 ++
bin/dig/dig.1 | 6 +--
bin/dig/dig.html | 6 ++-
doc/arm/Bv9ARM.ch01.html | 2 +-
doc/arm/Bv9ARM.ch02.html | 2 +-
doc/arm/Bv9ARM.ch03.html | 2 +-
doc/arm/Bv9ARM.ch04.html | 2 +-
doc/arm/Bv9ARM.ch05.html | 2 +-
doc/arm/Bv9ARM.ch06.html | 2 +-
doc/arm/Bv9ARM.ch07.html | 2 +-
doc/arm/Bv9ARM.ch08.html | 72 +++++----------------------
doc/arm/Bv9ARM.ch09.html | 2 +-
doc/arm/Bv9ARM.ch10.html | 2 +-
doc/arm/Bv9ARM.ch11.html | 2 +-
doc/arm/Bv9ARM.ch12.html | 2 +-
doc/arm/Bv9ARM.html | 8 ++-
doc/arm/Bv9ARM.pdf | Bin 1079712 -> 1078925 bytes
doc/arm/man.arpaname.html | 2 +-
doc/arm/man.ddns-confgen.html | 2 +-
doc/arm/man.delv.html | 2 +-
doc/arm/man.dig.html | 8 +--
doc/arm/man.dnssec-cds.html | 2 +-
doc/arm/man.dnssec-checkds.html | 2 +-
doc/arm/man.dnssec-coverage.html | 2 +-
doc/arm/man.dnssec-dsfromkey.html | 2 +-
doc/arm/man.dnssec-importkey.html | 2 +-
doc/arm/man.dnssec-keyfromlabel.html | 2 +-
doc/arm/man.dnssec-keygen.html | 2 +-
doc/arm/man.dnssec-keymgr.html | 2 +-
doc/arm/man.dnssec-revoke.html | 2 +-
doc/arm/man.dnssec-settime.html | 2 +-
doc/arm/man.dnssec-signzone.html | 2 +-
doc/arm/man.dnssec-verify.html | 2 +-
doc/arm/man.dnstap-read.html | 2 +-
doc/arm/man.filter-aaaa.html | 2 +-
doc/arm/man.host.html | 2 +-
doc/arm/man.mdig.html | 2 +-
doc/arm/man.named-checkconf.html | 2 +-
doc/arm/man.named-checkzone.html | 2 +-
doc/arm/man.named-journalprint.html | 2 +-
doc/arm/man.named-nzd2nzf.html | 2 +-
doc/arm/man.named-rrchecker.html | 2 +-
doc/arm/man.named.conf.html | 2 +-
doc/arm/man.named.html | 2 +-
doc/arm/man.nsec3hash.html | 2 +-
doc/arm/man.nslookup.html | 2 +-
doc/arm/man.nsupdate.html | 2 +-
doc/arm/man.pkcs11-destroy.html | 2 +-
doc/arm/man.pkcs11-keygen.html | 2 +-
doc/arm/man.pkcs11-list.html | 2 +-
doc/arm/man.pkcs11-tokens.html | 2 +-
doc/arm/man.rndc-confgen.html | 2 +-
doc/arm/man.rndc.conf.html | 2 +-
doc/arm/man.rndc.html | 2 +-
doc/arm/notes.html | 66 ++++--------------------
doc/arm/notes.pdf | Bin 59487 -> 57323 bytes
doc/arm/notes.txt | 40 ++++-----------
doc/arm/notes.xml | 64 +++---------------------
lib/dns/api | 2 +-
lib/isc/api | 2 +-
lib/ns/api | 2 +-
version | 2 +-
68 files changed, 149 insertions(+), 308 deletions(-)
diff --git a/CHANGES b/CHANGES
index 24f816c8b8..935cde2cc3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+ --- 9.14.3 released ---
+
5244. [security] Fixed a race condition in dns_dispatch_getnext()
that could cause an assertion failure if a
significant number of incoming packets were
diff --git a/CONTRIBUTING b/CONTRIBUTING
index 003a7c8593..288bcab915 100644
--- a/CONTRIBUTING
+++ b/CONTRIBUTING
@@ -1,3 +1,5 @@
+CONTRIBUTING
+
BIND Source Access and Contributor Guidelines
Feb 22, 2018
diff --git a/HISTORY b/HISTORY
index e56a44d443..90f3558388 100644
--- a/HISTORY
+++ b/HISTORY
@@ -1,3 +1,5 @@
+HISTORY
+
Functional enhancements from prior major releases of BIND 9
BIND 9.11
@@ -431,11 +433,11 @@ BIND 9.4.0
* Detect duplicates of UDP queries we are recursing on and drop them.
New stats category "duplicates".
* "USE INTERNAL MALLOC" is now runtime selectable.
- * The lame cache is now done on a basis as some servers only appear to
- be lame for certain query types.
+ * The lame cache is now done on a basis as some
+ servers only appear to be lame for certain query types.
* Limit the number of recursive clients that can be waiting for a single
- query () to resolve. New options clients-per-query and
- max-clients-per-query.
+ query () to resolve. New options clients-per-query
+ and max-clients-per-query.
* dig: report the number of extra bytes still left in the packet after
processing all the records.
* Support for IPSECKEY rdata type.
diff --git a/OPTIONS b/OPTIONS
index 340b53db67..811cf7c867 100644
--- a/OPTIONS
+++ b/OPTIONS
@@ -1,10 +1,12 @@
+OPTIONS
+
Setting the STD_CDEFINES environment variable before running configure can
be used to enable certain compile-time options that are not explicitly
defined in configure.
Some of these settings are:
-Setting Description
+ Setting Description
Overwrite memory with tag values when allocating
-DISC_MEM_DEFAULTFILL=1 or freeing it; this impairs performance but
makes debugging of memory problems easier.
diff --git a/PLATFORMS b/PLATFORMS
index d670b7dad1..a5e3f274eb 100644
--- a/PLATFORMS
+++ b/PLATFORMS
@@ -1,3 +1,5 @@
+PLATFORMS
+
Supported platforms
In general, this version of BIND will build and run on any POSIX-compliant
@@ -64,31 +66,6 @@ These are platforms on which BIND 9.14 is known not to build or run:
Platform quirks
-ARM
-
-If the compilation ends with following error:
-
-Error: selected processor does not support `yield' in ARM mode
-
-You will need to set -march compiler option to native, so the compiler
-recognizes yield assembler instruction. The proper way to set -march=
-native would be to put it into CFLAGS, e.g. run ./configure like this:
-CFLAGS="-march=native -Os -g" ./configure plus your usual options.
-
-If that doesn't work, you can enforce the minimum CPU and FPU (taken from
-Debian armhf documentation):
-
- * The lowest worthwhile CPU implementation is Armv7-A, therefore the
- recommended build option is -march=armv7-a.
-
- * FPU should be set at VFPv3-D16 as they represent the minimum
- specification of the processors to support here, therefore the
- recommended build option is -mfpu=vfpv3-d16.
-
-The configure command should look like this:
-
-CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure
-
NetBSD 6 i386
The i386 build of NetBSD requires the libatomic library, available from
diff --git a/README b/README
index ef8772dd0f..7796a709a4 100644
--- a/README
+++ b/README
@@ -1,3 +1,5 @@
+README
+
BIND 9
Contents
@@ -152,6 +154,11 @@ BIND 9.14.2
BIND 9.14.2 is a maintenance release.
+BIND 9.14.3
+
+BIND 9.14.3 is a maintenance release, and addresses the security
+vulnerability disclosed in CVE-2019-6471.
+
Building BIND
Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
@@ -181,7 +188,7 @@ make depend. If you're using Emacs, you might find make tags helpful.
Several environment variables that can be set before running configure
will affect compilation:
-Variable Description
+ Variable Description
CC The C compiler to use. configure tries to figure out the
right one for supported systems.
C compiler flags. Defaults to include -g and/or -O2 as
@@ -333,7 +340,7 @@ development BIND 9 is included in the file CHANGES, with the most recent
changes listed first. Change notes include tags indicating the category of
the change that was made; these categories are:
-Category Description
+ Category Description
[func] New feature
[bug] General bug fix
[security] Fix for a significant security flaw
@@ -384,21 +391,23 @@ Acknowledgments
* The original development of BIND 9 was underwritten by the following
organizations:
- Sun Microsystems, Inc.
- Hewlett Packard
- Compaq Computer Corporation
- IBM
- Process Software Corporation
- Silicon Graphics, Inc.
- Network Associates, Inc.
- U.S. Defense Information Systems Agency
- USENIX Association
- Stichting NLnet - NLnet Foundation
- Nominum, Inc.
+ Sun Microsystems, Inc.
+ Hewlett Packard
+ Compaq Computer Corporation
+ IBM
+ Process Software Corporation
+ Silicon Graphics, Inc.
+ Network Associates, Inc.
+ U.S. Defense Information Systems Agency
+ USENIX Association
+ Stichting NLnet - NLnet Foundation
+ Nominum, Inc.
* This product includes software developed by the OpenSSL Project for
use in the OpenSSL Toolkit. http://www.OpenSSL.org/
+
* This product includes cryptographic software written by Eric Young
(eay@cryptsoft.com)
+
* This product includes software written by Tim Hudson
(tjh@cryptsoft.com)
diff --git a/README.md b/README.md
index d86ca4c7fd..633fc4546d 100644
--- a/README.md
+++ b/README.md
@@ -169,6 +169,11 @@ vulnerabilities disclosed in CVE-2018-5743 and CVE-2019-6467.
BIND 9.14.2 is a maintenance release.
+#### BIND 9.14.3
+
+BIND 9.14.3 is a maintenance release, and addresses the security
+vulnerability disclosed in CVE-2019-6471.
+
### Building BIND
Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
diff --git a/bin/dig/dig.1 b/bin/dig/dig.1
index 67be14eeb2..4b6bf0f156 100644
--- a/bin/dig/dig.1
+++ b/bin/dig/dig.1
@@ -584,11 +584,11 @@ A synonym for
.RS 4
Toggle the setting of the RD (recursion desired) bit in the query\&. This bit is set by default, which means
\fBdig\fR
-normally sends recursive queries\&. Recursion is automatically disabled when the
+normally sends recursive queries\&. Recursion is automatically disabled when using the
\fI+nssearch\fR
-or
+option, and when using
\fI+trace\fR
-query options are used\&.
+except for an initial recursive query to get the list of root servers\&.
.RE
.PP
\fB+retry=T\fR
diff --git a/bin/dig/dig.html b/bin/dig/dig.html
index 268edd4713..4364f0583e 100644
--- a/bin/dig/dig.html
+++ b/bin/dig/dig.html
@@ -790,8 +790,10 @@
in the query. This bit is set by default, which means
dig normally sends recursive
queries. Recursion is automatically disabled when
- the +nssearch or
- +trace query options are used.
+ using the +nssearch option, and
+ when using +trace except for
+ an initial recursive query to get the list of root
+ servers.
+retry=T
diff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html
index e88f9b9b41..23a3966762 100644
--- a/doc/arm/Bv9ARM.ch01.html
+++ b/doc/arm/Bv9ARM.ch01.html
@@ -614,6 +614,6 @@
-BIND 9.14.2 (Stable Release)
+BIND 9.14.3 (Stable Release)