This patch was obtained from ISC for 9.6-ESV-R11-P1. The patch can

only be obtained from [email protected] on an as needed

basis.

diff --git a/CHANGES b/CHANGES

index 178f73d..8ace4fb 100644

--- a/CHANGES

+++ b/CHANGES

@@ -1,3 +1,17 @@

+	--- 9.6-ESV-R11-P1 released ---

+

+4006.	[security]	A flaw in delegation handling could be exploited

+			to put named into an infinite loop.  This has

+			been addressed by placing limits on the number

+			of levels of recursion named will allow (default 7),

+			and the number of iterative queries that it will

+			send (default 50) before terminating a recursive

+			query (CVE-2014-8500).

+

+			The recursion depth limit is configured via the

+			"max-recursion-depth" option, and the query limit

+			via the "max-recursion-queries" option.  [RT #37580]

+

 	--- 9.6-ESV-R11 released ---

 	--- 9.6-ESV-R11rc2 released ---

diff --git a/bin/named/config.c b/bin/named/config.c

index d85afa7..823d101 100644

--- a/bin/named/config.c

+++ b/bin/named/config.c

@@ -15,8 +15,6 @@

  * PERFORMANCE OF THIS SOFTWARE.

  */

-/* $Id$ */

-

 /*! \file */

 #include <config.h>

@@ -145,6 +143,8 @@ options {\n\

 	dnssec-accept-expired no;\n\

 	clients-per-query 10;\n\

 	max-clients-per-query 100;\n\

+	max-recursion-depth 7;\n\

+	max-recursion-queries 50;\n\

 	zero-no-soa-ttl-cache no;\n\

 	nsec3-test-zone no;\n\

 "

diff --git a/bin/named/include/named/query.h b/bin/named/include/named/query.h

index 20aff40..771345e 100644

--- a/bin/named/include/named/query.h

+++ b/bin/named/include/named/query.h

@@ -1,5 +1,5 @@

 /*

- * Copyright (C) 2004, 2005, 2007, 2010, 2012  Internet Systems Consortium, Inc. ("ISC")

+ * Copyright (C) 2004, 2005, 2007, 2010, 2011, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")

  * Copyright (C) 1999-2002  Internet Software Consortium.

  *

  * Permission to use, copy, modify, and/or distribute this software for any

@@ -15,8 +15,6 @@

  * PERFORMANCE OF THIS SOFTWARE.

  */

-/* $Id$ */

-

 #ifndef NAMED_QUERY_H

 #define NAMED_QUERY_H 1

diff --git a/bin/named/query.c b/bin/named/query.c

index 10a7d9a..48e4822 100644

--- a/bin/named/query.c

+++ b/bin/named/query.c

@@ -3343,13 +3343,12 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qdomain,

 		peeraddr = &client->peeraddr;

 	else

 		peeraddr = NULL;

-	result = dns_resolver_createfetch2(client->view->resolver,

+	result = dns_resolver_createfetch3(client->view->resolver,

 					   client->query.qname,

 					   qtype, qdomain, nameservers,

 					   NULL, peeraddr, client->message->id,

-					   client->query.fetchoptions,

-					   client->task,

-					   query_resume, client,

+					   client->query.fetchoptions, 0, NULL,

+					   client->task, query_resume, client,

 					   rdataset, sigrdataset,

 					   &client->query.fetch);

diff --git a/bin/named/server.c b/bin/named/server.c

index af53b48..4d48074 100644

--- a/bin/named/server.c

+++ b/bin/named/server.c

@@ -15,8 +15,6 @@

  * PERFORMANCE OF THIS SOFTWARE.

  */

-/* $Id$ */

-

 /*! \file */

 #include <config.h>

@@ -2048,6 +2046,16 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,

 					max_clients_per_query);

 	obj = NULL;

+	result = ns_config_get(maps, "max-recursion-depth", &obj);

+	INSIST(result == ISC_R_SUCCESS);

+	dns_resolver_setmaxdepth(view->resolver, cfg_obj_asuint32(obj));

+

+	obj = NULL;

+	result = ns_config_get(maps, "max-recursion-queries", &obj);

+	INSIST(result == ISC_R_SUCCESS);

+	dns_resolver_setmaxqueries(view->resolver, cfg_obj_asuint32(obj));

+

+	obj = NULL;

 	result = ns_config_get(maps, "dnssec-enable", &obj);

 	INSIST(result == ISC_R_SUCCESS);

 	view->enablednssec = cfg_obj_asboolean(obj);

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml

index f894aab..b823dc4 100644

--- a/doc/arm/Bv9ARM-book.xml

+++ b/doc/arm/Bv9ARM-book.xml

@@ -4652,6 +4652,8 @@ category notify { null; };

     <optional> max-acache-size <replaceable>size_spec</replaceable> ; </optional>

     <optional> clients-per-query <replaceable>number</replaceable> ; </optional>

     <optional> max-clients-per-query <replaceable>number</replaceable> ; </optional>

+    <optional> max-recursion-depth <replaceable>number</replaceable> ; </optional>

+    <optional> max-recursion-queries <replaceable>number</replaceable> ; </optional>

     <optional> masterfile-format (<constant>text</constant>|<constant>raw</constant>) ; </optional>

     <optional> empty-server <replaceable>name</replaceable> ; </optional>

     <optional> empty-contact <replaceable>name</replaceable> ; </optional>

@@ -4729,6 +4731,35 @@ category notify { null; };

 	    </listitem>

 	  </varlistentry>

+	  <varlistentry id="max-recursion-depth">

+	    <term><command>max-recursion-depth</command></term>

+	    <listitem>

+	      <para>

+		Sets the maximum number of levels of recursion

+		that are permitted at any one time while servicing

+		a recursive query. Resolving a name may require

+		looking up a name server address, which in turn

+		requires resolving another name, etc; if the number

+		of indirections exceeds this value, the recursive

+		query is terminated and returns SERVFAIL.  The

+		default is 7.

+	      </para>

+	    </listitem>

+	  </varlistentry>

+

+	  <varlistentry id="max-recursion-queries">

+	    <term><command>max-recursion-queries</command></term>

+	    <listitem>

+	      <para>

+		Sets the maximum number of iterative queries that

+		may be sent while servicing a recursive query.

+		If more queries are sent, the recursive query

+		is terminated and returns SERVFAIL. The default

+		is 50.

+	      </para>

+	    </listitem>

+	  </varlistentry>

+

 	  <varlistentry>

 	    <term><command>tkey-gssapi-credential</command></term>

 	    <listitem>

diff --git a/lib/dns/adb.c b/lib/dns/adb.c

index 2d7b904..422e59c 100644

--- a/lib/dns/adb.c

+++ b/lib/dns/adb.c

@@ -200,6 +200,7 @@ struct dns_adbfetch {

 	unsigned int                    magic;

 	dns_fetch_t                    *fetch;

 	dns_rdataset_t                  rdataset;

+	unsigned int			depth;

 };

 /*%

@@ -298,8 +299,7 @@ static inline isc_boolean_t dec_entry_refcnt(dns_adb_t *, isc_boolean_t,

 static inline void violate_locking_hierarchy(isc_mutex_t *, isc_mutex_t *);

 static isc_boolean_t clean_namehooks(dns_adb_t *, dns_adbnamehooklist_t *);

 static void clean_target(dns_adb_t *, dns_name_t *);

-static void clean_finds_at_name(dns_adbname_t *, isc_eventtype_t,

-				unsigned int);

+static void clean_finds_at_name(dns_adbname_t *, isc_eventtype_t, unsigned int);

 static isc_boolean_t check_expire_namehooks(dns_adbname_t *, isc_stdtime_t);

 static isc_boolean_t check_expire_entry(dns_adb_t *, dns_adbentry_t **,

 					isc_stdtime_t);

@@ -307,6 +307,7 @@ static void cancel_fetches_at_name(dns_adbname_t *);

 static isc_result_t dbfind_name(dns_adbname_t *, isc_stdtime_t,

 				dns_rdatatype_t);

 static isc_result_t fetch_name(dns_adbname_t *, isc_boolean_t,

+			       unsigned int, isc_counter_t *qc,

 			       dns_rdatatype_t);

 static inline void check_exit(dns_adb_t *);

 static void destroy(dns_adb_t *);

@@ -2282,6 +2283,19 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,

 		   isc_stdtime_t now, dns_name_t *target,

 		   in_port_t port, dns_adbfind_t **findp)

 {

+	return (dns_adb_createfind2(adb, task, action, arg, name,

+				    qname, qtype, options, now,

+				    target, port, 0, NULL, findp));

+}

+

+isc_result_t

+dns_adb_createfind2(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,

+		    void *arg, dns_name_t *name, dns_name_t *qname,

+		    dns_rdatatype_t qtype, unsigned int options,

+		    isc_stdtime_t now, dns_name_t *target,

+		    in_port_t port, unsigned int depth, isc_counter_t *qc,

+		    dns_adbfind_t **findp)

+{

 	dns_adbfind_t *find;

 	dns_adbname_t *adbname;

 	int bucket;

@@ -2512,7 +2526,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,

 		 * Start V4.

 		 */

 		if (WANT_INET(wanted_fetches) &&

-		    fetch_name(adbname, start_at_zone,

+		    fetch_name(adbname, start_at_zone, depth, qc,

 			       dns_rdatatype_a) == ISC_R_SUCCESS) {

 			DP(DEF_LEVEL,

 			   "dns_adb_createfind: started A fetch for name %p",

@@ -2523,7 +2537,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,

 		 * Start V6.

 		 */

 		if (WANT_INET6(wanted_fetches) &&

-		    fetch_name(adbname, start_at_zone,

+		    fetch_name(adbname, start_at_zone, depth, qc,

 			       dns_rdatatype_aaaa) == ISC_R_SUCCESS) {

 			DP(DEF_LEVEL,

 			   "dns_adb_createfind: "

@@ -3256,6 +3270,12 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {

 		DP(DEF_LEVEL, "adb: fetch of '%s' %s failed: %s",

 		   buf, address_type == DNS_ADBFIND_INET ? "A" : "AAAA",

 		   dns_result_totext(dev->result));

+		/*

+		 * Don't record a failure unless this is the initial

+		 * fetch of a chain.

+		 */

+		if (fetch->depth > 1)

+			goto out;

 		/* XXXMLG Don't pound on bad servers. */

 		if (address_type == DNS_ADBFIND_INET) {

 			name->expire_v4 = ISC_MIN(name->expire_v4, now + 300);

@@ -3293,9 +3313,8 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {

 }

 static isc_result_t

-fetch_name(dns_adbname_t *adbname,

-	   isc_boolean_t start_at_zone,

-	   dns_rdatatype_t type)

+fetch_name(dns_adbname_t *adbname, isc_boolean_t start_at_zone,

+	   unsigned int depth, isc_counter_t *qc, dns_rdatatype_t type)

 {

 	isc_result_t result;

 	dns_adbfetch_t *fetch = NULL;

@@ -3340,12 +3359,14 @@ fetch_name(dns_adbname_t *adbname,

 		result = ISC_R_NOMEMORY;

 		goto cleanup;

 	}

+	fetch->depth = depth;

-	result = dns_resolver_createfetch(adb->view->resolver, &adbname->name,

-					  type, name, nameservers, NULL,

-					  options, adb->task, fetch_callback,

-					  adbname, &fetch->rdataset, NULL,

-					  &fetch->fetch);

+	result = dns_resolver_createfetch3(adb->view->resolver, &adbname->name,

+					   type, name, nameservers, NULL,

+					   NULL, 0, options, depth, qc,

+					   adb->task, fetch_callback, adbname,

+					   &fetch->rdataset, NULL,

+					   &fetch->fetch);

 	if (result != ISC_R_SUCCESS)

 		goto cleanup;

diff --git a/lib/dns/include/dns/adb.h b/lib/dns/include/dns/adb.h

index d4d1b05..556fcc2 100644

--- a/lib/dns/include/dns/adb.h

+++ b/lib/dns/include/dns/adb.h

@@ -334,6 +334,13 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,

 		   dns_rdatatype_t qtype, unsigned int options,

 		   isc_stdtime_t now, dns_name_t *target,

 		   in_port_t port, dns_adbfind_t **find);

+isc_result_t

+dns_adb_createfind2(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,

+		    void *arg, dns_name_t *name, dns_name_t *qname,

+		    dns_rdatatype_t qtype, unsigned int options,

+		    isc_stdtime_t now, dns_name_t *target, in_port_t port,

+		    unsigned int depth, isc_counter_t *qc,

+		    dns_adbfind_t **find);

 /*%<

  * Main interface for clients. The adb will look up the name given in

  * "name" and will build up a list of found addresses, and perhaps start

diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h

index d293daa..10c3a3a 100644

--- a/lib/dns/include/dns/resolver.h

+++ b/lib/dns/include/dns/resolver.h

@@ -270,6 +270,18 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,

 			  dns_rdataset_t *rdataset,

 			  dns_rdataset_t *sigrdataset,

 			  dns_fetch_t **fetchp);

+isc_result_t

+dns_resolver_createfetch3(dns_resolver_t *res, dns_name_t *name,

+			  dns_rdatatype_t type,

+			  dns_name_t *domain, dns_rdataset_t *nameservers,

+			  dns_forwarders_t *forwarders,

+			  isc_sockaddr_t *client, isc_uint16_t id,

+			  unsigned int options, unsigned int depth,

+			  isc_counter_t *qc, isc_task_t *task,

+			  isc_taskaction_t action, void *arg,

+			  dns_rdataset_t *rdataset,

+			  dns_rdataset_t *sigrdataset,

+			  dns_fetch_t **fetchp);

 /*%<

  * Recurse to answer a question.

  *

@@ -550,6 +562,30 @@ dns_resolver_printbadcache(dns_resolver_t *resolver, FILE *fp);

  * \li	resolver to be valid.

  */

+void

+dns_resolver_setmaxdepth(dns_resolver_t *resolver, unsigned int maxdepth);

+unsigned int

+dns_resolver_getmaxdepth(dns_resolver_t *resolver);

+/*%

+ * Get and set how many NS indirections will be followed when looking for

+ * nameserver addresses.

+ *

+ * Requires:

+ * \li	resolver to be valid.

+ */

+

+void

+dns_resolver_setmaxqueries(dns_resolver_t *resolver, unsigned int queries);

+unsigned int

+dns_resolver_getmaxqueries(dns_resolver_t *resolver);

+/*%

+ * Get and set how many iterative queries will be allowed before

+ * terminating a recursive query.

+ *

+ * Requires:

+ * \li	resolver to be valid.

+ */

+

 ISC_LANG_ENDDECLS

 #endif /* DNS_RESOLVER_H */

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c

index 7dcea6d..bd3d9fd 100644

--- a/lib/dns/resolver.c

+++ b/lib/dns/resolver.c

@@ -21,6 +21,7 @@

 #include <config.h>

+#include <isc/counter.h>

 #include <isc/log.h>

 #include <isc/platform.h>

 #include <isc/print.h>

@@ -109,6 +110,16 @@

 #define QTRACE(m)

 #endif

+/* The default maximum number of recursions to follow before giving up. */

+#ifndef DEFAULT_RECURSION_DEPTH

+#define DEFAULT_RECURSION_DEPTH 7

+#endif

+

+/* The default maximum number of iterative queries to allow before giving up. */

+#ifndef DEFAULT_MAX_QUERIES

+#define DEFAULT_MAX_QUERIES 50

+#endif

+

 /*%

  * Maximum EDNS0 input packet size.

  */

@@ -211,12 +222,13 @@ struct fetchctx {

 	isc_sockaddrlist_t		edns;

 	isc_sockaddrlist_t		edns512;

 	isc_sockaddrlist_t		bad_edns;

-	dns_validator_t			*validator;

+	dns_validator_t *		validator;

 	ISC_LIST(dns_validator_t)       validators;

 	dns_db_t *			cache;

 	dns_adb_t *			adb;

 	isc_boolean_t			ns_ttl_ok;

 	isc_uint32_t			ns_ttl;

+	isc_counter_t *			qc;

 	/*%

 	 * The number of events we're waiting for.

@@ -283,6 +295,7 @@ struct fetchctx {

 	unsigned int			valfail;

 	isc_boolean_t			timeout;

 	dns_adbaddrinfo_t 		*addrinfo;

+	unsigned int			depth;

 };

 #define FCTX_MAGIC			ISC_MAGIC('F', '!', '!', '!')

@@ -394,6 +407,8 @@ struct dns_resolver {

 	unsigned int			spillatmin;

 	isc_timer_t *			spillattimer;

 	isc_boolean_t			zero_no_soa_ttl;

+	unsigned int			maxdepth;

+	unsigned int			maxqueries;

 	/* Locked by lock. */

 	unsigned int			references;

@@ -1495,6 +1510,7 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,

 		if (result != ISC_R_SUCCESS)

 			goto cleanup_dispatch;

 	}

+

 	fctx->querysent++;

 	ISC_LIST_APPEND(fctx->queries, query, link);

@@ -2146,9 +2162,9 @@ fctx_finddone(isc_task_t *task, isc_event_t *event) {

 		 */

 		INSIST(!SHUTTINGDOWN(fctx));

 		fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;

-		if (event->ev_type == DNS_EVENT_ADBMOREADDRESSES)

+		if (event->ev_type == DNS_EVENT_ADBMOREADDRESSES) {

 			want_try = ISC_TRUE;

-		else {

+		} else {

 			fctx->findfail++;

 			if (fctx->pending == 0) {

 				/*

@@ -2177,7 +2193,7 @@ fctx_finddone(isc_task_t *task, isc_event_t *event) {

 	else if (want_done)

 		fctx_done(fctx, ISC_R_FAILURE, __LINE__);

 	else if (destroy) {

-			fctx_destroy(fctx);

+		fctx_destroy(fctx);

 		if (bucket_empty)

 			empty_bucket(res);

 	}

@@ -2499,12 +2515,13 @@ findname(fetchctx_t *fctx, dns_name_t *name, in_port_t port,

 	 * See what we know about this address.

 	 */

 	find = NULL;

-	result = dns_adb_createfind(fctx->adb,

-				    res->buckets[fctx->bucketnum].task,

-				    fctx_finddone, fctx, name,

-				    &fctx->name, fctx->type,

-				    options, now, NULL,

-				    res->view->dstport, &find);

+	result = dns_adb_createfind2(fctx->adb,

+				     res->buckets[fctx->bucketnum].task,

+				     fctx_finddone, fctx, name,

+				     &fctx->name, fctx->type,

+				     options, now, NULL,

+				     res->view->dstport,

+				     fctx->depth + 1, fctx->qc, &find);

 	if (result != ISC_R_SUCCESS) {

 		if (result == DNS_R_ALIAS) {

 			/*

@@ -2612,6 +2629,14 @@ fctx_getaddresses(fetchctx_t *fctx, isc_boolean_t badcache) {

 	res = fctx->res;

+	if (fctx->depth > res->maxdepth) {

+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,

+			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),

+			      "too much NS indirection resolving '%s'",

+			      fctx->info);

+		return (DNS_R_SERVFAIL);

+	}

+

 	/*

 	 * Forwarders.

 	 */

@@ -3087,6 +3112,16 @@ fctx_try(fetchctx_t *fctx, isc_boolean_t retrying, isc_boolean_t badcache) {

 		}

 	}

+	result = isc_counter_increment(fctx->qc);

+	if (result != ISC_R_SUCCESS) {

+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,

+			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),

+			      "exceeded max queries resolving '%s'",

+			      fctx->info);

+		fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);

+		return;

+	}

+

 	result = fctx_query(fctx, addrinfo, fctx->options);

 	if (result != ISC_R_SUCCESS)

 		fctx_done(fctx, result, __LINE__);

@@ -3185,6 +3220,7 @@ fctx_destroy(fetchctx_t *fctx) {

 		isc_mem_put(fctx->mctx, sa, sizeof(*sa));

 	}

+	isc_counter_detach(&fctx->qc);

 	isc_timer_detach(&fctx->timer);

 	dns_message_destroy(&fctx->rmessage);

 	dns_message_destroy(&fctx->qmessage);

@@ -3512,7 +3548,8 @@ log_ns_ttl(fetchctx_t *fctx, const char *where) {

 static isc_result_t

 fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,

 	    dns_name_t *domain, dns_rdataset_t *nameservers,

-	    unsigned int options, unsigned int bucketnum, fetchctx_t **fctxp)

+	    unsigned int options, unsigned int bucketnum, unsigned int depth,

+	    isc_counter_t *qc, fetchctx_t **fctxp)

 {

 	fetchctx_t *fctx;

 	isc_result_t result;

@@ -3534,6 +3571,21 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,

 	fctx = isc_mem_get(mctx, sizeof(*fctx));

 	if (fctx == NULL)

 		return (ISC_R_NOMEMORY);

+

+	fctx->qc = NULL;

+	if (qc != NULL) {

+		isc_counter_attach(qc, &fctx->qc);

+	} else {

+		result = isc_counter_create(res->mctx,

+					    res->maxqueries, &fctx->qc);

+		if (result != ISC_R_SUCCESS)

+			goto cleanup_fetch;

+	}

+