3837. [security] A NULL pointer is passed to query_prefetch resulting

                        a REQUIRE assertion failure when a fetch is actually
                        initiated.  [ RT #35899]

Squashed commit of the following:

commit 7f4e1f3917d743089c42cc52ec2c0eea598d2c00
Author: Mukund Sivaraman <muks@isc.org>
Date:   Sun May 4 22:34:34 2014 +0530

    Fix a comment

commit 6a35a6a2346013fa8e3798b9b680d8a3031fcb03
Author: Mark Andrews <marka@isc.org>
Date:   Sun May 4 23:34:25 2014 +1000

    pass the correct name to query_prefetch

(cherry picked from commit b36fc8294e1328912b940899d436c60986c92435)

Conflicts:
	CHANGES

diff --git a/CHANGES b/CHANGES
index cbb32d797a7ea03861a98a9a9bf424fd45e7db02..ef854a3cc13f5dea63f308b193ae6ef8b12a810c 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3837.  [security]      A NULL pointer is passed to query_prefetch resulting
+                       a REQUIRE assertion failure when a fetch is actually
+                       initiated.  [ RT #35899]
+
        --- 9.10.0 released ---
 
 3824.  [bug]           A collision between two flag values could cause

diff --git a/bin/named/query.c b/bin/named/query.c
index 2fc7d334ecc6e83e9b63d96ecc8b0a1000cbed9b..6ad61a4e3ad977ff883dc8cc592828c7501e8184 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -7642,8 +7642,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                                if (rpz_st != NULL)
                                        rdataset->ttl = ISC_MIN(rdataset->ttl,
                                                            rpz_st->m.ttl);
-                               if (!is_zone && RECURSIONOK(client))
-                                       query_prefetch(client, fname, rdataset);
+                               if (!is_zone && RECURSIONOK(client)) {
+                                       dns_name_t *name;
+                                       name = (fname != NULL) ? fname : tname;
+                                       query_prefetch(client, name, rdataset);
+                               }
                                query_addrrset(client,
                                               fname != NULL ? &fname : &tname,
                                               &rdataset, NULL,

diff --git a/bin/tests/system/resolver/ns4/tld2.db b/bin/tests/system/resolver/ns4/tld2.db
index 5a8663a721d64ee40a4a04a11efb2026bd41368b..5231dbd7ea4e340d24f4b5afe92136a2abb20a40 100644 (file)
--- a/bin/tests/system/resolver/ns4/tld2.db
+++ b/bin/tests/system/resolver/ns4/tld2.db
@@ -25,3 +25,6 @@ $TTL 300
 @                      NS      ns.tld.
 ns                     A       10.53.0.4
 fetch  10              TXT     A short ttl
+fetchall  10              TXT     A short ttl
+fetchall  10              A     1.2.3.4
+fetchall  10              AAAA    ::1

diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
index d96fae2994e425dd7b6ba7d2bef02feb3163c64d..3757715f4cb28ed359889bfb910e5d9bb83ffe4d 100755 (executable)
--- a/bin/tests/system/resolver/tests.sh
+++ b/bin/tests/system/resolver/tests.sh
@@ -458,5 +458,21 @@ test ${ttl:-0} -eq ${ttl1:-1} || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo "I:check prefetch qtype * (${n})"
+ret=0
+$DIG @10.53.0.5 -p 5300 fetchall.tld any > dig.out.1.${n} || ret=1
+ttl1=`awk '/"A" "short" "ttl"/ { print $2 - 2 }' dig.out.1.${n}`
+# sleep so we are in prefetch range
+sleep ${ttl1:-0}
+# trigger prefetch
+$DIG @10.53.0.5 -p 5300 fetchall.tld any > dig.out.2.${n} || ret=1
+ttl2=`awk '/"A" "short" "ttl"/ { print $2 }' dig.out.2.${n}`
+sleep 1
+# check that the nameserver is still alive
+$DIG @10.53.0.5 -p 5300 fetchall.tld any > dig.out.3.${n} || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status

diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h
index c1afa26fa989bb25af878cbe4e95930a00609c4b..bea163686f45bdc4a2dc9fc1e90aebffeb6fc871 100644 (file)
--- a/lib/dns/include/dns/resolver.h
+++ b/lib/dns/include/dns/resolver.h
@@ -95,8 +95,8 @@ typedef struct dns_fetchevent {
 #define DNS_FETCHOPT_NOVALIDATE                0x020        /*%< Disable validation. */
 #define DNS_FETCHOPT_EDNS512           0x040        /*%< Advertise a 512 byte
                                                          UDP buffer. */
-#define DNS_FETCHOPT_WANTNSID          0x080         /*%< Request NSID */
-#define DNS_FETCHOPT_PREFETCH          0x100         /*%< Request NSID */
+#define DNS_FETCHOPT_WANTNSID          0x080        /*%< Request NSID */
+#define DNS_FETCHOPT_PREFETCH          0x100        /*%< Do prefetch */
 #define DNS_FETCHOPT_NOCDFLAG          0x200        /*%< Don't set CD flag. */
 
 /* Reserved in use by adb.c            0x00400000 */