diff --git a/bind-CVE-2021-25219.patch b/bind-CVE-2021-25219.patch new file mode 100644 index 0000000..c05cbcf --- /dev/null +++ b/bind-CVE-2021-25219.patch @@ -0,0 +1,73 @@ +diff --git a/bin/named/config.c b/bin/named/config.c +index 213c45cb33..0b28c8db7a 100644 +--- a/bin/named/config.c ++++ b/bin/named/config.c +@@ -164,7 +164,7 @@ options {\n\ + fetches-per-server 0;\n\ + fetches-per-zone 0;\n\ + glue-cache yes;\n\ +- lame-ttl 600;\n" ++ lame-ttl 0;\n" + #ifdef HAVE_LMDB + " lmdb-mapsize 32M;\n" + #endif /* ifdef HAVE_LMDB */ +diff --git a/bin/named/server.c b/bin/named/server.c +index ff04689685..0f001ba303 100644 +--- a/bin/named/server.c ++++ b/bin/named/server.c +@@ -4840,8 +4840,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config, + result = named_config_get(maps, "lame-ttl", &obj); + INSIST(result == ISC_R_SUCCESS); + lame_ttl = cfg_obj_asduration(obj); +- if (lame_ttl > 1800) { +- lame_ttl = 1800; ++ if (lame_ttl > 0) { ++ cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING, ++ "disabling lame cache despite lame-ttl > 0 as it " ++ "may cause performance issues"); ++ lame_ttl = 0; + } + dns_resolver_setlamettl(view->resolver, lame_ttl); + +diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c +index 0358241d95..40c416dcf1 100644 +--- a/lib/dns/resolver.c ++++ b/lib/dns/resolver.c +@@ -10122,25 +10122,26 @@ rctx_badserver(respctx_t *rctx, isc_result_t result) { + */ + static isc_result_t + rctx_lameserver(respctx_t *rctx) { +- isc_result_t result; ++ isc_result_t result = ISC_R_SUCCESS; + fetchctx_t *fctx = rctx->fctx; + resquery_t *query = rctx->query; + +- if (fctx->res->lame_ttl == 0 || ISFORWARDER(query->addrinfo) || +- !is_lame(fctx, query->rmessage)) +- { ++ if (ISFORWARDER(query->addrinfo) || !is_lame(fctx, query->rmessage)) { + return (ISC_R_SUCCESS); + } + + inc_stats(fctx->res, dns_resstatscounter_lame); + log_lame(fctx, query->addrinfo); +- result = dns_adb_marklame(fctx->adb, query->addrinfo, &fctx->name, +- fctx->type, rctx->now + fctx->res->lame_ttl); +- if (result != ISC_R_SUCCESS) { +- isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, +- DNS_LOGMODULE_RESOLVER, ISC_LOG_ERROR, +- "could not mark server as lame: %s", +- isc_result_totext(result)); ++ if (fctx->res->lame_ttl != 0) { ++ result = dns_adb_marklame(fctx->adb, query->addrinfo, ++ &fctx->name, fctx->type, ++ rctx->now + fctx->res->lame_ttl); ++ if (result != ISC_R_SUCCESS) { ++ isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, ++ DNS_LOGMODULE_RESOLVER, ISC_LOG_ERROR, ++ "could not mark server as lame: %s", ++ isc_result_totext(result)); ++ } + } + rctx->broken_server = DNS_R_LAME; + rctx->next_server = true; diff --git a/bind.changes b/bind.changes index 740f835..3d150fc 100644 --- a/bind.changes +++ b/bind.changes @@ -1,3 +1,26 @@ +------------------------------------------------------------------- +Mon Nov 8 09:01:21 UTC 2021 - Josef Möllers + +- Aligned SLE15-SP4 and Factory spec files. + [bind.spec] + +------------------------------------------------------------------- +Thu Nov 4 08:28:45 UTC 2021 - Josef Möllers + +- Fixed CVE-2021-25219: + The lame-ttl option controls how long named caches certain types + of broken responses from authoritative servers (see the security + advisory for details). This caching mechanism could be abused by + an attacker to significantly degrade resolver performance. The + vulnerability has been mitigated by changing the default value of + lame-ttl to 0 and overriding any explicitly set value with 0, + effectively disabling this mechanism altogether. ISC's testing has + determined that doing that has a negligible impact on resolver + performance while also preventing abuse. + Administrators may observe more traffic towards servers issuing + certain types of broken responses than in previous BIND 9 releases. + [bsc#1192146, CVE-2021-25219, bind-CVE-2021-25219.patch] + ------------------------------------------------------------------- Mon Oct 18 09:55:18 UTC 2021 - Josef Möllers diff --git a/bind.spec b/bind.spec index b508bc7..6669ae9 100644 --- a/bind.spec +++ b/bind.spec @@ -17,6 +17,7 @@ %define _buildshell /bin/bash + %define VENDOR SUSE %if 0%{?suse_version} >= 1500 %define with_systemd 1 @@ -51,21 +52,22 @@ Summary: Domain Name System (DNS) Server (named) License: MPL-2.0 Group: Productivity/Networking/DNS/Servers URL: https://www.isc.org/bind/ -Source0: https://downloads.isc.org/isc/bind9/%{version}/bind-%{version}.tar.xz +Source: https://downloads.isc.org/isc/bind9/%{version}/bind-%{version}.tar.xz Source1: https://downloads.isc.org/isc/bind9/%{version}/bind-%{version}.tar.xz.sha512.asc Source2: vendor-files.tar.bz2 # from http://www.isc.org/about/openpgp/ ... changes yearly apparently. -Source4: %{name}.keyring +Source3: %{name}.keyring Source9: ftp://ftp.internic.net/domain/named.root Source40: dnszone-schema.txt Source60: dlz-schema.txt -# configuation file for systemd-tmpfiles +# configuration file for systemd-tmpfiles Source70: bind.conf # configuation file for systemd-sysusers Source72: named.conf Patch52: named-bootconf.diff Patch56: bind-ldapdump-use-valid-host.patch Patch68: bind-fix-build-with-older-sphinx.patch +Patch69: bind-CVE-2021-25219.patch BuildRequires: libcap-devel BuildRequires: libmysqlclient-devel BuildRequires: libopenssl-devel @@ -121,19 +123,22 @@ System implementation of the Domain Name System (DNS) protocols. This includes also the BIND Administrator Reference Manual (ARM). %package utils -Summary: Utilities to query and test DNS +Summary: Libraries for "bind" and utilities to query and test DNS # Needed for dnssec parts Group: Productivity/Networking/DNS/Utilities Requires: python3-bind = %{version} Provides: bind9-utils Provides: bindutil Provides: dns_utils +Obsoletes: bind-devel < %{version} Obsoletes: bind9-utils < %{version} Obsoletes: bindutil < %{version} +Obsoletes: libirs-devel < %{version} %description utils This package includes the utilities "host", "dig", and "nslookup" used to -test and query the Domain Name System (DNS). The Berkeley Internet +test and query the Domain Name System (DNS) and also the libraries rquired +for the base "bind" package. The Berkeley Internet Name Domain (BIND) DNS server is found in the package named bind. %package -n python3-bind @@ -169,7 +174,7 @@ for file in docu/README* config/{README,named.conf} sysconfig/named-named; do done popd -%if 0%{?sle_version} >= 150000 && 0%{?sle_version} <= 150300 +%if 0%{?sle_version} >= 150000 && 0%{?sle_version} <= 150400 # the Administration Reference Manual doesn't build with Leap/SLES due to an way too old Sphinx package # that is missing sphinx.util.docutils.ReferenceRole. # patch68 disables this extension, and here, we're removing the :gl: tags in the notes @@ -197,7 +202,7 @@ export LDFLAGS="-pie" --with-pic \ --disable-openssl-version-check \ --with-tuning=large \ - --with-geoip \ + --with-maxminddb \ --with-dlopen \ --with-gssapi=yes \ --disable-isc-spnego \ @@ -218,7 +223,7 @@ for d in arm; do make -C doc/${d} SPHINXBUILD=sphinx-build doc done %if %{with_systemd} -%sysusers_generate_pre %{SOURCE72} named named.conf +%sysusers_generate_pre %{SOURCE72} named %endif %install @@ -254,8 +259,8 @@ mv vendor-files/config/rndc-access.conf %{buildroot}/%{_sysconfdir}/named.d %if %{with_systemd} for file in named; do install -D -m 0644 vendor-files/system/${file}.service %{buildroot}%{_unitdir}/${file}.service - sed -e "s,@LIBEXECDIR@,%{_libexecdir},g" -i %{buildroot}%{_unitdir}/${file}.service - install -m 0755 vendor-files/system/${file}.prep %{buildroot}%{_libexecdir}/bind/${file}.prep + sed -e "s,@LIBEXECDIR@,%{_libexecdir},g" -i %{buildroot}%{_unitdir}/${file}.service + install -m 0755 vendor-files/system/${file}.prep %{buildroot}%{_libexecdir}/bind/${file}.prep ln -s /sbin/service %{buildroot}%{_sbindir}/rc${file} done install -D -m 0644 %{SOURCE70} %{buildroot}%{_prefix}/lib/tmpfiles.d/bind.conf @@ -290,7 +295,6 @@ for file in vendor-files/docu/README*; do basename=$( basename ${file}) cp -a ${file} %{buildroot}/%{_defaultdocdir}/bind/${basename}.%{VENDOR} done - mkdir -p vendor-files/config/ISC-examples cp -a bin/tests/*.conf* vendor-files/config/ISC-examples for d in arm; do @@ -315,7 +319,6 @@ install -m 644 %{SOURCE72} %{buildroot}%{_sysusersdir}/ %pre -f named.pre %service_add_pre named.service %else - %pre %{GROUPADD_NAMED} %{USERADD_NAMED} @@ -338,7 +341,7 @@ install -m 644 %{SOURCE72} %{buildroot}%{_sysusersdir}/ %else %{fillup_and_insserv -nf named} if [ -x %{_bindir}/systemctl ]; then -# make sure systemctl knows about the service even though it's not a systemd service +# make sure systemctl knows about the service # Without this, systemctl status named would return # Unit named.service could not be found. # until systemctl daemon-reload has been executed