4508. [security] Named incorrectly tried to cache TKEY records which

                        could trigger a assertion failure when there was
                        a class mismatch. (CVE-2016-9131) [RT #43522]

diff --git a/CHANGES b/CHANGES
index a53e4133a2f625470085b36eba2ef668b561654d..0ca2f93bc5b57876c63d5c97e1427f9ee4015282 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+4508.  [security]      Named incorrectly tried to cache TKEY records which
+                       could trigger a assertion failure when there was
+                       a class mismatch. (CVE-2016-9131) [RT #43522]
+
        --- 9.10.4-P4 released ---
 
 4489.  [security]      It was possible to trigger assertions when processing

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 736c354af39493bd7246461eec015c6120f334c3..afce9dfa67d2310c58a50ba22ed9b54e62c3ba96 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -6813,6 +6813,19 @@ answer_response(fetchctx_t *fctx) {
                                        log_formerr(fctx, "NSEC3 in answer");
                                        return (DNS_R_FORMERR);
                                }
+                               if (rdataset->type == dns_rdatatype_tkey) {
+                                       /*
+                                        * TKEY is not a valid record in a
+                                        * response to any query we can make.
+                                        */
+                                       log_formerr(fctx, "TKEY in answer");
+                                       return (DNS_R_FORMERR);
+                               }
+                               if (rdataset->rdclass != fctx->res->rdclass) {
+                                       log_formerr(fctx, "Mismatched class "
+                                                   "in answer");
+                                       return (DNS_R_FORMERR);
+                               }
 
                                /*
                                 * Apply filters, if given, on answers to reject
@@ -6999,6 +7012,12 @@ answer_response(fetchctx_t *fctx) {
                             rdataset != NULL;
                             rdataset = ISC_LIST_NEXT(rdataset, link))
                        {
+                               if (rdataset->rdclass != fctx->res->rdclass) {
+                                       log_formerr(fctx, "Mismatched class "
+                                                   "in answer");
+                                       return (DNS_R_FORMERR);
+                               }
+
                                /*
                                 * Only pass DNAME or RRSIG(DNAME).
                                 */