mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-29 21:47:59 +00:00
Code Issues Releases Wiki Activity

fix: usr: Fix possible assertion failure when reloading server while processing updates

Browse Source 
Closes #5006

Merge branch '5006-get-max-by-type-earlier' into 'main'

See merge request isc-projects/bind9!9745
This commit is contained in:
Mark Andrews 2024-12-05 04:13:49 +00:00
commit be5266a7c6
1 changed files with 35 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

70
lib/ns/update.c
View File

@ -229,8 +229,8 @@ struct update {
ns_client_t *client; ns_client_t *client;
isc_result_t result; isc_result_t result;
dns_message_t *answer; dns_message_t *answer;
const dns_ssurule_t **rules; unsigned int *maxbytype;
size_t ruleslen; size_t maxbytypelen;
}; };
/*% /*%
@ -1639,8 +1639,8 @@ send_update(ns_client_t *client, dns_zone_t *zone) {
dns_rdataclass_t zoneclass; dns_rdataclass_t zoneclass;
dns_rdatatype_t covers; dns_rdatatype_t covers;
dns_name_t *zonename = NULL; dns_name_t *zonename = NULL;
const dns_ssurule_t **rules = NULL; unsigned int *maxbytype = NULL;
size_t rule = 0, ruleslen = 0; size_t update = 0, maxbytypelen = 0;
dns_zoneopt_t options; dns_zoneopt_t options;
dns_db_t *db = NULL; dns_db_t *db = NULL;
dns_dbversion_t *ver = NULL; dns_dbversion_t *ver = NULL;
@ -1685,21 +1685,22 @@ send_update(ns_client_t *client, dns_zone_t *zone) {
* are illegal or violate policy. * are illegal or violate policy.
*/ */
if (ssutable != NULL) { if (ssutable != NULL) {
ruleslen = request->counts[DNS_SECTION_UPDATE]; maxbytypelen = request->counts[DNS_SECTION_UPDATE];
rules = isc_mem_cget(mctx, ruleslen, sizeof(*rules)); maxbytype = isc_mem_cget(mctx, maxbytypelen,
sizeof(*maxbytype));
} }
for (rule = 0, for (update = 0,
result = dns_message_firstname(request, DNS_SECTION_UPDATE); result = dns_message_firstname(request, DNS_SECTION_UPDATE);
result == ISC_R_SUCCESS; result == ISC_R_SUCCESS; update++,
rule++, result = dns_message_nextname(request, DNS_SECTION_UPDATE)) result = dns_message_nextname(request, DNS_SECTION_UPDATE))
{ {
dns_name_t *name = NULL; dns_name_t *name = NULL;
dns_rdata_t rdata = DNS_RDATA_INIT; dns_rdata_t rdata = DNS_RDATA_INIT;
dns_ttl_t ttl; dns_ttl_t ttl;
dns_rdataclass_t update_class; dns_rdataclass_t update_class;
INSIST(ssutable == NULL || rule < ruleslen); INSIST(ssutable == NULL || update < maxbytypelen);
get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name, get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
&rdata, &covers, &ttl, &update_class); &rdata, &covers, &ttl, &update_class);
@ -1775,6 +1776,8 @@ send_update(ns_client_t *client, dns_zone_t *zone) {
dns_rdata_ptr_t ptr; dns_rdata_ptr_t ptr;
dns_rdata_in_srv_t srv; dns_rdata_in_srv_t srv;
maxbytype[update] = 0;
isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr); isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
if (client->message->tsigkey != NULL) { if (client->message->tsigkey != NULL) {
@ -1830,22 +1833,24 @@ send_update(ns_client_t *client, dns_zone_t *zone) {
!dns_ssutable_checkrules( !dns_ssutable_checkrules(
ssutable, client->signer, name, ssutable, client->signer, name,
&netaddr, TCPCLIENT(client), env, &netaddr, TCPCLIENT(client), env,
rdata.type, target, tsigkey, rdata.type, target, tsigkey, NULL))
&rules[rule]))
{ {
FAILC(DNS_R_REFUSED, FAILC(DNS_R_REFUSED,
"rejected by secure update"); "rejected by secure update");
} }
} else if (rdata.type != dns_rdatatype_any) { } else if (rdata.type != dns_rdatatype_any) {
const dns_ssurule_t *ssurule = NULL;
if (!dns_ssutable_checkrules( if (!dns_ssutable_checkrules(
ssutable, client->signer, name, ssutable, client->signer, name,
&netaddr, TCPCLIENT(client), env, &netaddr, TCPCLIENT(client), env,
rdata.type, target, tsigkey, rdata.type, target, tsigkey,
&rules[rule])) &ssurule))
{ {
FAILC(DNS_R_REFUSED, FAILC(DNS_R_REFUSED,
"rejected by secure update"); "rejected by secure update");
} }
maxbytype[update] = dns_ssurule_max(ssurule,
rdata.type);
} else { } else {
if (!ssu_checkall(db, ver, name, ssutable, if (!ssu_checkall(db, ver, name, ssutable,
client->signer, &netaddr, env, client->signer, &netaddr, env,
@ -1877,14 +1882,14 @@ send_update(ns_client_t *client, dns_zone_t *zone) {
*uev = (update_t){ *uev = (update_t){
.zone = zone, .zone = zone,
.client = client, .client = client,
.rules = rules, .maxbytype = maxbytype,
.ruleslen = ruleslen, .maxbytypelen = maxbytypelen,
.result = ISC_R_SUCCESS, .result = ISC_R_SUCCESS,
}; };
isc_nmhandle_attach(client->handle, &client->updatehandle); isc_nmhandle_attach(client->handle, &client->updatehandle);
isc_async_run(dns_zone_getloop(zone), update_action, uev); isc_async_run(dns_zone_getloop(zone), update_action, uev);
rules = NULL; maxbytype = NULL;
failure: failure:
if (db != NULL) { if (db != NULL) {
@ -1892,8 +1897,8 @@ failure:
dns_db_detach(&db); dns_db_detach(&db);
} }
if (rules != NULL) { if (maxbytype != NULL) {
isc_mem_cput(mctx, rules, ruleslen, sizeof(*rules)); isc_mem_cput(mctx, maxbytype, maxbytypelen, sizeof(*maxbytype));
} }
if (ssutable != NULL) { if (ssutable != NULL) {
@ -2724,8 +2729,8 @@ update_action(void *arg) {
update_t *uev = (update_t *)arg; update_t *uev = (update_t *)arg;
dns_zone_t *zone = uev->zone; dns_zone_t *zone = uev->zone;
ns_client_t *client = uev->client; ns_client_t *client = uev->client;
const dns_ssurule_t **rules = uev->rules; unsigned int *maxbytype = uev->maxbytype;
size_t rule = 0, ruleslen = uev->ruleslen; size_t update = 0, maxbytypelen = uev->maxbytypelen;
isc_result_t result; isc_result_t result;
dns_db_t *db = NULL; dns_db_t *db = NULL;
dns_dbversion_t *oldver = NULL; dns_dbversion_t *oldver = NULL;
@ -2888,11 +2893,11 @@ update_action(void *arg) {
/* /*
* Process the Update Section. * Process the Update Section.
*/ */
INSIST(ssutable == NULL || rules != NULL); INSIST(ssutable == NULL || maxbytype != NULL);
for (rule = 0, for (update = 0,
result = dns_message_firstname(request, DNS_SECTION_UPDATE); result = dns_message_firstname(request, DNS_SECTION_UPDATE);
result == ISC_R_SUCCESS; result == ISC_R_SUCCESS; update++,
rule++, result = dns_message_nextname(request, DNS_SECTION_UPDATE)) result = dns_message_nextname(request, DNS_SECTION_UPDATE))
{ {
dns_name_t *name = NULL; dns_name_t *name = NULL;
dns_rdata_t rdata = DNS_RDATA_INIT; dns_rdata_t rdata = DNS_RDATA_INIT;
@ -2900,14 +2905,12 @@ update_action(void *arg) {
dns_rdataclass_t update_class; dns_rdataclass_t update_class;
bool flag; bool flag;
INSIST(ssutable == NULL || rule < ruleslen); INSIST(ssutable == NULL || update < maxbytypelen);
get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name, get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
&rdata, &covers, &ttl, &update_class); &rdata, &covers, &ttl, &update_class);
if (update_class == zoneclass) { if (update_class == zoneclass) {
unsigned int max = 0;
/* /*
* RFC1123 doesn't allow MF and MD in master files. * RFC1123 doesn't allow MF and MD in master files.
*/ */
@ -3046,20 +3049,17 @@ update_action(void *arg) {
} }
} }
if (rules != NULL && rules[rule] != NULL) { if (maxbytype != NULL && maxbytype[update] != 0) {
max = dns_ssurule_max(rules[rule], rdata.type);
}
if (max != 0) {
unsigned int count = 0; unsigned int count = 0;
CHECK(foreach_rr(db, ver, name, rdata.type, CHECK(foreach_rr(db, ver, name, rdata.type,
covers, count_action, &count)); covers, count_action, &count));
if (count >= max) { if (count >= maxbytype[update]) {
update_log(client, zone, update_log(client, zone,
LOGLEVEL_PROTOCOL, LOGLEVEL_PROTOCOL,
"attempt to add more " "attempt to add more "
"records than permitted by " "records than permitted by "
"policy max=%u", "policy max=%u",
max); maxbytype[update]);
continue; continue;
} }
} }
@ -3437,8 +3437,8 @@ common:
dns_db_detach(&db); dns_db_detach(&db);
} }
if (rules != NULL) { if (maxbytype != NULL) {
isc_mem_cput(mctx, rules, ruleslen, sizeof(*rules)); isc_mem_cput(mctx, maxbytype, maxbytypelen, sizeof(*maxbytype));
} }
if (ssutable != NULL) { if (ssutable != NULL) {