Fixes for CVE-2006-4095 and CVE-2006-4096 from bind-9.3.2-P1

* Assertion failure in ISC BIND SIG query processing (CVE-2006-4095)

- Recursive servers
Queries for SIG records will trigger an assertion failure if more
than one RRset is returned. However exposure can be minimized by
restricting which sources can ask for recursion.

- Authoritative servers
If a nameserver is serving a RFC 2535 DNSSEC zone and is queried
for the SIG records where there are multiple RRsets, then the
named program will trigger an assertion failure when it tries
to construct the response.

* INSIST failure in ISC BIND recursive query handling code (CVE-2006-4096)

It is possible to trigger an INSIST failure by sending enough
recursive queries such that the response to the query arrives after
all the clients waiting for the response have left the recursion
queue. However exposure can be minimized by restricting which sources
can ask for recursion.

4 files changed, 153 insertions, 3 deletions

diff --git a/net/bind9/Makefile b/net/bind9/Makefile
index 3c95ba89051..d3cff3a5764 100644
--- a/net/bind9/Makefile
+++ b/net/bind9/Makefile
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.81 2006/09/03 22:58:26 rillig Exp $
+# $NetBSD: Makefile,v 1.82 2006/09/05 20:45:32 adrianp Exp $
 
 DISTNAME=	bind-${BIND_VERSION}
-PKGREVISION=	1
+PKGREVISION=	2
 CATEGORIES=	net
 MASTER_SITES=	ftp://ftp.isc.org/isc/bind9/${BIND_VERSION}/
 
diff --git a/net/bind9/distinfo b/net/bind9/distinfo
index 3568fd76a85..5374dccd0a5 100644
--- a/net/bind9/distinfo
+++ b/net/bind9/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.28 2006/08/28 16:00:45 seb Exp $
+$NetBSD: distinfo,v 1.29 2006/09/05 20:45:32 adrianp Exp $
 
 SHA1 (bind-9.3.2.tar.gz) = 13efeaf496ed110980088fb5cbe22460f04a0fac
 RMD160 (bind-9.3.2.tar.gz) = c825b6308eb374e9bcf9b6ccc48f65d8753c0a6d
@@ -14,3 +14,5 @@ SHA1 (patch-al) = eb6a52d3f865639447ec6f9019c0ea1d2122b772
 SHA1 (patch-am) = bb267f13dbd30d492f4dfcf9c278b941efa97bed
 SHA1 (patch-an) = b3e5cd93890aa9a9cec7c14abf1b62ddbf854b14
 SHA1 (patch-ao) = 8a3f8f1b5871af263fc99bc8e552b3ab615bc815
+SHA1 (patch-ap) = 817c39121f1b62f8033822a42d7d9f8a5b5372ea
+SHA1 (patch-aq) = 20cde9869c69dff2aca4784ec9b8b032639776fe
diff --git a/net/bind9/patches/patch-ap b/net/bind9/patches/patch-ap
new file mode 100644
index 00000000000..1bd9d81ad9d
--- /dev/null
+++ b/net/bind9/patches/patch-ap
@@ -0,0 +1,22 @@
+$NetBSD: patch-ap,v 1.1 2006/09/05 20:45:32 adrianp Exp $
+
+--- bin/named/query.c.orig	2005-08-11 06:25:20.000000000 +0100
++++ bin/named/query.c
+@@ -2393,7 +2393,7 @@ query_find(ns_client_t *client, dns_fetc
+ 		is_zone = ISC_FALSE;
+ 
+ 		qtype = event->qtype;
+-		if (qtype == dns_rdatatype_rrsig)
++		if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
+ 			type = dns_rdatatype_any;
+ 		else
+ 			type = qtype;
+@@ -2434,7 +2434,7 @@ query_find(ns_client_t *client, dns_fetc
+ 	/*
+ 	 * If it's a SIG query, we'll iterate the node.
+ 	 */
+-	if (qtype == dns_rdatatype_rrsig)
++	if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
+ 		type = dns_rdatatype_any;
+ 	else
+ 		type = qtype;
diff --git a/net/bind9/patches/patch-aq b/net/bind9/patches/patch-aq
new file mode 100644
index 00000000000..29a20832f7d
--- /dev/null
+++ b/net/bind9/patches/patch-aq
@@ -0,0 +1,126 @@
+$NetBSD: patch-aq,v 1.1 2006/09/05 20:45:32 adrianp Exp $
+
+--- lib/dns/resolver.c.orig	2005-10-14 02:38:48.000000000 +0100
++++ lib/dns/resolver.c
+@@ -762,7 +762,8 @@ fctx_sendevents(fetchctx_t *fctx, isc_re
+ 		INSIST(result != ISC_R_SUCCESS ||
+ 		       dns_rdataset_isassociated(event->rdataset) ||
+ 		       fctx->type == dns_rdatatype_any ||
+-		       fctx->type == dns_rdatatype_rrsig);
++		       fctx->type == dns_rdatatype_rrsig ||
++		       fctx->type == dns_rdatatype_sig);
+ 
+ 		isc_task_sendanddetach(&task, ISC_EVENT_PTR(&event));
+ 	}
+@@ -3188,7 +3189,8 @@ validated(isc_task_t *task, isc_event_t 
+ 	if (hevent != NULL) {
+ 		if (!negative && !chaining &&
+ 		    (fctx->type == dns_rdatatype_any ||
+-		     fctx->type == dns_rdatatype_rrsig)) {
++		     fctx->type == dns_rdatatype_rrsig ||
++		     fctx->type == dns_rdatatype_sig)) {
+ 			/*
+ 			 * Don't bind rdatasets; the caller
+ 			 * will iterate the node.
+@@ -3306,7 +3308,8 @@ validated(isc_task_t *task, isc_event_t 
+ 	if (!ISC_LIST_EMPTY(fctx->validators)) {
+ 		INSIST(!negative);
+ 		INSIST(fctx->type == dns_rdatatype_any ||
+-		       fctx->type == dns_rdatatype_rrsig);
++		       fctx->type == dns_rdatatype_rrsig ||
++		       fctx->type == dns_rdatatype_sig);
+ 		/*
+ 		 * Don't send a response yet - we have
+ 		 * more rdatasets that still need to
+@@ -3455,14 +3458,15 @@ cache_name(fetchctx_t *fctx, dns_name_t 
+ 				return (result);
+ 			anodep = &event->node;
+ 			/*
+-			 * If this is an ANY or SIG query, we're not going
+-			 * to return any rdatasets, unless we encountered
++			 * If this is an ANY, SIG or RRSIG query, we're not
++			 * going to return any rdatasets, unless we encountered
+ 			 * a CNAME or DNAME as "the answer".  In this case,
+ 			 * we're going to return DNS_R_CNAME or DNS_R_DNAME
+ 			 * and we must set up the rdatasets.
+ 			 */
+ 			if ((fctx->type != dns_rdatatype_any &&
+-			    fctx->type != dns_rdatatype_rrsig) ||
++			     fctx->type != dns_rdatatype_rrsig &&
++			     fctx->type != dns_rdatatype_sig) ||
+ 			    (name->attributes & DNS_NAMEATTR_CHAINING) != 0) {
+ 				ardataset = event->rdataset;
+ 				asigrdataset = event->sigrdataset;
+@@ -3521,7 +3525,7 @@ cache_name(fetchctx_t *fctx, dns_name_t 
+ 		 */
+ 		if (secure_domain && rdataset->trust != dns_trust_glue) {
+ 			/*
+-			 * SIGs are validated as part of validating the
++			 * RRSIGs are validated as part of validating the
+ 			 * type they cover.
+ 			 */
+ 			if (rdataset->type == dns_rdatatype_rrsig)
+@@ -3591,7 +3595,8 @@ cache_name(fetchctx_t *fctx, dns_name_t 
+ 
+ 			if (ANSWER(rdataset) && need_validation) {
+ 				if (fctx->type != dns_rdatatype_any &&
+-				    fctx->type != dns_rdatatype_rrsig) {
++				    fctx->type != dns_rdatatype_rrsig &&
++				    fctx->type != dns_rdatatype_sig) {
+ 					/*
+ 					 * This is The Answer.  We will
+ 					 * validate it, but first we cache
+@@ -3763,23 +3768,28 @@ ncache_adderesult(dns_message_t *message
+ 		  isc_result_t *eresultp)
+ {
+ 	isc_result_t result;
++	dns_rdataset_t rdataset;
++
++	if (ardataset == NULL) {
++		dns_rdataset_init(&rdataset);
++		ardataset = &rdataset;
++	}
+ 	result = dns_ncache_add(message, cache, node, covers, now,
+ 				maxttl, ardataset);
+-	if (result == DNS_R_UNCHANGED) {
++	if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) {
+ 		/*
+-		 * The data in the cache are better than the negative cache
+-		 * entry we're trying to add.
++		 * If the cache now contains a negative entry and we
++		 * care about whether it is DNS_R_NCACHENXDOMAIN or
++		 * DNS_R_NCACHENXRRSET then extract it.
+ 		 */
+-		if (ardataset != NULL && ardataset->type == 0) {
++		if (ardataset->type == 0) {
+ 			/*
+-			 * The cache data is also a negative cache
+-			 * entry.
++			 * The cache data is a negative cache entry.
+ 			 */
+ 			if (NXDOMAIN(ardataset))
+ 				*eresultp = DNS_R_NCACHENXDOMAIN;
+ 			else
+ 				*eresultp = DNS_R_NCACHENXRRSET;
+-			result = ISC_R_SUCCESS;
+ 		} else {
+ 			/*
+ 			 * Either we don't care about the nature of the
+@@ -3791,14 +3801,11 @@ ncache_adderesult(dns_message_t *message
+ 			 * XXXRTH  There's a CNAME/DNAME problem here.
+ 			 */
+ 			*eresultp = ISC_R_SUCCESS;
+-			result = ISC_R_SUCCESS;
+ 		}
+-	} else if (result == ISC_R_SUCCESS) {
+-		if (NXDOMAIN(ardataset))
+-			*eresultp = DNS_R_NCACHENXDOMAIN;
+-		else
+-			*eresultp = DNS_R_NCACHENXRRSET;
++		result = ISC_R_SUCCESS;
+ 	}
++	if (ardataset == &rdataset && dns_rdataset_isassociated(ardataset))
++		dns_rdataset_disassociate(ardataset);
+ 
+ 	return (result);
+ }