2066. [security] Handle SIG queries gracefully. [RT #16300]

diff --git a/CHANGES b/CHANGES
index 144f9fd55da7d42e7c3e27b9d6c4075d909c711a..946088cfd6446087c2bfe41268953eb7a84c7b6f 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -43,7 +43,7 @@
 2067.  [bug]           'rndc' could close the socket too early triggering
                        a INSIST under Windows. [RT #16317]
 
-2066.  [placeholder]   rt16300
+2066.  [security]      Handle SIG queries gracefully. [RT #16300]
 
 2065.  [bug]           libbind: probe for HPUX prototypes for
                        endprotoent_r() and endservent_r().  [RT 16313]

diff --git a/bin/named/query.c b/bin/named/query.c
index ddd91508de8a6d4e0d3cb3df41450430d60e4e8d..f3579f47b9987067625628913f07bec333001a05 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.288 2006/06/04 23:59:33 marka Exp $ */
+/* $Id: query.c,v 1.289 2006/08/31 03:56:36 marka Exp $ */
 
 /*! \file */
 
@@ -3369,7 +3369,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                is_zone = ISC_FALSE;
 
                qtype = event->qtype;
-               if (qtype == dns_rdatatype_rrsig)
+               if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
                        type = dns_rdatatype_any;
                else
                        type = qtype;
@@ -3410,7 +3410,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
        /*
         * If it's a SIG query, we'll iterate the node.
         */
-       if (qtype == dns_rdatatype_rrsig)
+       if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
                type = dns_rdatatype_any;
        else
                type = qtype;

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index af7a59ac3eadcc66965c4e90d03daa9278573453..b223691c5d0363b4d3b8061b6262f2086327a878 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resolver.c,v 1.334 2006/08/30 23:09:18 marka Exp $ */
+/* $Id: resolver.c,v 1.335 2006/08/31 03:56:36 marka Exp $ */
 
 /*! \file */
 
@@ -779,7 +779,8 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) {
                INSIST(result != ISC_R_SUCCESS ||
                       dns_rdataset_isassociated(event->rdataset) ||
                       fctx->type == dns_rdatatype_any ||
-                      fctx->type == dns_rdatatype_rrsig);
+                      fctx->type == dns_rdatatype_rrsig ||
+                      fctx->type == dns_rdatatype_sig);
 
                isc_task_sendanddetach(&task, ISC_EVENT_PTR(&event));
                count++;
@@ -3387,7 +3388,8 @@ validated(isc_task_t *task, isc_event_t *event) {
        if (hevent != NULL) {
                if (!negative && !chaining &&
                    (fctx->type == dns_rdatatype_any ||
-                    fctx->type == dns_rdatatype_rrsig)) {
+                    fctx->type == dns_rdatatype_rrsig ||
+                    fctx->type == dns_rdatatype_sig)) {
                        /*
                         * Don't bind rdatasets; the caller
                         * will iterate the node.
@@ -3508,7 +3510,8 @@ validated(isc_task_t *task, isc_event_t *event) {
        if (!ISC_LIST_EMPTY(fctx->validators)) {
                INSIST(!negative);
                INSIST(fctx->type == dns_rdatatype_any ||
-                      fctx->type == dns_rdatatype_rrsig);
+                      fctx->type == dns_rdatatype_rrsig ||
+                      fctx->type == dns_rdatatype_sig);
                /*
                 * Don't send a response yet - we have
                 * more rdatasets that still need to
@@ -3662,14 +3665,15 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
                                return (result);
                        anodep = &event->node;
                        /*
-                        * If this is an ANY or SIG query, we're not going
-                        * to return any rdatasets, unless we encountered
+                        * If this is an ANY, SIG or RRSIG query, we're not
+                        * going to return any rdatasets, unless we encountered
                         * a CNAME or DNAME as "the answer".  In this case,
                         * we're going to return DNS_R_CNAME or DNS_R_DNAME
                         * and we must set up the rdatasets.
                         */
                        if ((fctx->type != dns_rdatatype_any &&
-                           fctx->type != dns_rdatatype_rrsig) ||
+                            fctx->type != dns_rdatatype_rrsig &&
+                            fctx->type != dns_rdatatype_sig) ||
                            (name->attributes & DNS_NAMEATTR_CHAINING) != 0) {
                                ardataset = event->rdataset;
                                asigrdataset = event->sigrdataset;
@@ -3728,7 +3732,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
                 */
                if (secure_domain && rdataset->trust != dns_trust_glue) {
                        /*
-                        * SIGs are validated as part of validating the
+                        * RRSIGs are validated as part of validating the
                         * type they cover.
                         */
                        if (rdataset->type == dns_rdatatype_rrsig)
@@ -3798,7 +3802,8 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
 
                        if (ANSWER(rdataset) && need_validation) {
                                if (fctx->type != dns_rdatatype_any &&
-                                   fctx->type != dns_rdatatype_rrsig) {
+                                   fctx->type != dns_rdatatype_rrsig &&
+                                   fctx->type != dns_rdatatype_sig) {
                                        /*
                                         * This is The Answer.  We will
                                         * validate it, but first we cache