upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-28 04:34:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Add additional name checks when using a forwarder

Browse source 
When using a forwarder, check that the owner name of response
records are within the bailiwick of the forwarded name space.
This commit is contained in:
Mark Andrews 2022-01-19 17:38:18 +11:00 committed by Michał Kępień
parent f2c813c635
commit f7cb79b66a
1 changed files with 27 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
lib/dns/resolver.c
View file

@ -371,6 +371,8 @@ struct fetchctx {
dns_rdataset_t qminrrset;
dns_fixedname_t qmindcfname;
dns_name_t *qmindcname;
dns_fixedname_t fwdfname;
dns_name_t *fwdname;
/*%
* The number of events we're waiting for.
@ -3539,6 +3541,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) {
if (result == ISC_R_SUCCESS) {
fwd = ISC_LIST_HEAD(forwarders->fwdrs);
fctx->fwdpolicy = forwarders->fwdpolicy;
dns_name_copy(domain, fctx->fwdname);
if (fctx->fwdpolicy == dns_fwdpolicy_only &&
isstrictsubdomain(domain, fctx->domain))
{
@ -4708,6 +4711,7 @@ fctx_create(dns_resolver_t *res, isc_task_t *task, const dns_name_t *name,
fctx->domain = dns_fixedname_initname(&fctx->dfname);
fctx->qminname = dns_fixedname_initname(&fctx->qminfname);
fctx->qmindcname = dns_fixedname_initname(&fctx->qmindcfname);
fctx->fwdname = dns_fixedname_initname(&fctx->fwdfname);
dns_name_copy(name, fctx->name);
dns_name_copy(name, fctx->qminname);
@ -4752,6 +4756,7 @@ fctx_create(dns_resolver_t *res, isc_task_t *task, const dns_name_t *name,
fname, &forwarders);
if (result == ISC_R_SUCCESS) {
fctx->fwdpolicy = forwarders->fwdpolicy;
dns_name_copy(fname, fctx->fwdname);
}
if (fctx->fwdpolicy != dns_fwdpolicy_only) {
@ -6760,6 +6765,15 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
}
}
static inline bool
name_external(const dns_name_t *name, fetchctx_t *fctx) {
if (ISFORWARDER(fctx->addrinfo)) {
return (!dns_name_issubdomain(name, fctx->fwdname));
}
return (!dns_name_issubdomain(name, fctx->domain));
}
static isc_result_t
check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
dns_rdataset_t *found, dns_section_t section) {
@ -6786,7 +6800,7 @@ check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
result = dns_message_findname(rctx->query->rmessage, section, addname,
dns_rdatatype_any, 0, &name, NULL);
if (result == ISC_R_SUCCESS) {
external = !dns_name_issubdomain(name, fctx->domain);
external = name_external(name, fctx);
if (type == dns_rdatatype_a) {
for (rdataset = ISC_LIST_HEAD(name->list);
rdataset != NULL;
@ -8453,6 +8467,13 @@ rctx_answer_scan(respctx_t *rctx) {
break;
case dns_namereln_subdomain:
/*
* Don't accept DNAME from parent namespace.
*/
if (name_external(name, fctx)) {
continue;
}
/*
* In-scope DNAME records must have at least
* as many labels as the domain being queried.
@ -8768,13 +8789,11 @@ rctx_authority_positive(respctx_t *rctx) {
DNS_SECTION_AUTHORITY);
while (!done && result == ISC_R_SUCCESS) {
dns_name_t *name = NULL;
bool external;
dns_message_currentname(rctx->query->rmessage,
DNS_SECTION_AUTHORITY, &name);
external = !dns_name_issubdomain(name, fctx->domain);
if (!external) {
if (!name_external(name, fctx)) {
dns_rdataset_t *rdataset = NULL;
/*
@ -9161,8 +9180,10 @@ rctx_authority_dnssec(respctx_t *rctx) {
}
if (!dns_name_issubdomain(name, fctx->domain)) {
/* Invalid name found; preserve it for logging
* later */
/*
* Invalid name found; preserve it for logging
* later.
*/
rctx->found_name = name;
rctx->found_type = ISC_LIST_HEAD(name->list)->type;
continue;