From 117cf776a7add27ac6d236b4062258da0d068486 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Mon, 15 Nov 2021 16:26:52 +0800 Subject: [PATCH] Enable lame response detection even with disabled lame cache Previously, when lame cache would be disabled by setting lame-ttl to 0, it would also disable lame answer detection. In this commit, we enable the lame response detection even when the lame cache is disabled. This enables stopping answer processing early rather than going through the whole answer processing flow. CVE: CVE-2021-25219 Upstream-Status: Backport [https://gitlab.isc.org/isc-projects/bind9/-/commit/e4931584a34bdd0a0d18e4d918fb853bf5296787] Signed-off-by: Mingli Yu --- lib/dns/resolver.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 50fadc0..9291bd4 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -10217,25 +10217,26 @@ rctx_badserver(respctx_t *rctx, isc_result_t result) { */ static isc_result_t rctx_lameserver(respctx_t *rctx) { - isc_result_t result; + isc_result_t result = ISC_R_SUCCESS; fetchctx_t *fctx = rctx->fctx; resquery_t *query = rctx->query; - if (fctx->res->lame_ttl == 0 || ISFORWARDER(query->addrinfo) || - !is_lame(fctx, query->rmessage)) - { + if (ISFORWARDER(query->addrinfo) || !is_lame(fctx, query->rmessage)) { return (ISC_R_SUCCESS); } inc_stats(fctx->res, dns_resstatscounter_lame); log_lame(fctx, query->addrinfo); - result = dns_adb_marklame(fctx->adb, query->addrinfo, &fctx->name, - fctx->type, rctx->now + fctx->res->lame_ttl); - if (result != ISC_R_SUCCESS) { - isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, - DNS_LOGMODULE_RESOLVER, ISC_LOG_ERROR, - "could not mark server as lame: %s", - isc_result_totext(result)); + if (fctx->res->lame_ttl != 0) { + result = dns_adb_marklame(fctx->adb, query->addrinfo, + &fctx->name, fctx->type, + rctx->now + fctx->res->lame_ttl); + if (result != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, + DNS_LOGMODULE_RESOLVER, ISC_LOG_ERROR, + "could not mark server as lame: %s", + isc_result_totext(result)); + } } rctx->broken_server = DNS_R_LAME; rctx->next_server = true; -- 2.17.1