From f7e137f321359b99570d5451705759c4fe39aad4 Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Thu, 12 Oct 2023 12:01:46 +1100 Subject: [PATCH 1/3] Restore dns64 state during serve-stale processing If we are in the process of looking for the A records as part of dns64 processing and the server-stale timeout triggers, redo the dns64 changes that had been made to the orignal qctx. (cherry picked from commit 1fcc483df13e049b96f620e515f0d4d45f3680b7) --- lib/ns/query.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/lib/ns/query.c b/lib/ns/query.c index 61749c873b..40e1232391 100644 --- a/lib/ns/query.c +++ b/lib/ns/query.c @@ -6228,6 +6228,13 @@ query_lookup_stale(ns_client_t *client) { query_ctx_t qctx; qctx_init(client, NULL, client->query.qtype, &qctx); + if (DNS64(client)) { + qctx.qtype = qctx.type = dns_rdatatype_a; + qctx.dns64 = true; + } + if (DNS64EXCLUDE(client)) { + qctx.dns64_exclude = true; + } dns_db_attach(client->view->cachedb, &qctx.db); client->query.attributes &= ~NS_QUERYATTR_RECURSIONOK; client->query.dboptions |= DNS_DBFIND_STALETIMEOUT; From 67b93470574d9dd5970f1d80077b05bfc4b187a2 Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Thu, 12 Oct 2023 13:39:57 +1100 Subject: [PATCH 2/3] Add CHANGES note for [GL #4334] (cherry picked from commit 26671f8c478a66296ee5874adbe741c890e435d1) --- CHANGES | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGES b/CHANGES index ead9b742d6..eecf973099 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,6 @@ +6317. [security] Restore DNS64 state when handling a serve-stale timeout. + (CVE-2023-5679) [GL #4334] + 6316. [security] Specific queries could trigger an assertion check with nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281] From b8188210871e1f6a8ce07b3d0541686d08b5378e Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Thu, 12 Oct 2023 13:42:38 +1100 Subject: [PATCH 3/3] Add release note for [GL #4334] (cherry picked from commit c4faf5c69f7eba3b23b8a932e66fc89ec3bee4a9) --- doc/notes/notes-current.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst index a729f95ed3..24f3a3c331 100644 --- a/doc/notes/notes-current.rst +++ b/doc/notes/notes-current.rst @@ -27,6 +27,11 @@ Security Fixes assertion failure when :any:`nxdomain-redirect` was enabled. This has been fixed. :cve:`2023-5517` :gl:`#4281` +- A bad interaction between DNS64 and serve-stale could cause + :iscman:`named` to crash with an assertion failure, when both of these + features were enabled. This has been fixed. :cve:`2023-5679` + :gl:`#4334` + New Features ~~~~~~~~~~~~