mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 06:25:31 +00:00
Code Issues Releases Wiki Activity

Fix servestale fetchlimits crash

Browse Source 
When we query the resolver for a domain name that is in the same zone
for which is already one or more fetches outstanding, we could
potentially hit the fetch limits. If so, recursion fails immediately
for the incoming query and if serve-stale is enabled, we may try to
return a stale answer.

If the resolver is also is authoritative for the parent zone (for
example the root zone), first a delegation is found, but we first
check the cache for a better response.

Nothing is found in the cache, so we try to recurse to find the
answer to the query.

Because of fetch-limits 'dns_resolver_createfetch()' returns an error,
which 'ns_query_recurse()' propagates to the caller,
'query_delegation_recurse()'.

Because serve-stale is enabled, 'query_usestale()' is called,
setting 'qctx->db' to the cache db, but leaving 'qctx->version'
untouched. Now 'query_lookup()' is called to search for stale data
in the cache database with a non-NULL 'qctx->version'
(which is set to a zone db version), and thus we hit an assertion
in rbtdb.

This crash was introduced in 'main' by commit
8bcd7fe69e.
This commit is contained in:
Matthijs Mekking
2021-03-10 15:14:56 +01:00
parent 74a0294be0
commit 87591de6f7
4 changed files with 136 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
lib/ns/query.c
View File

@@ -7462,6 +7462,7 @@ query_usestale(query_ctx_t *qctx, isc_result_t result) {
if (dns_view_staleanswerenabled(qctx->client->view)) {
dns_db_attach(qctx->client->view->cachedb, &qctx->db);
qctx->version = NULL;
qctx->client->query.dboptions |= DNS_DBFIND_STALEOK;
if (qctx->client->query.fetch != NULL) {
dns_resolver_destroyfetch(&qctx->client->query.fetch);