ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

ensure rpz summary consistence during AXFR updates

Browse Source 
4121.	[bug]		When updating a response-policy zone via AXFR,
			summary data about other policy zones could fall
			out of sync. Ultimately this could trigger an
			assertion failure in rpz.c. [RT #39567]

(cherry picked from commit 19365b43e9)
(cherry picked from commit 433b64a548)
This commit is contained in:
Evan Hunt
2015-05-21 12:39:43 -07:00
parent e1dc78dd6e
commit bfdeccc5bd
5 changed files with 162 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/arm/notes.xml
+30 -16
View File
@@ -315,23 +315,37 @@
</listitem>
<listitem>
<para>
A bug in the RPZ implementation could cause some policy
zones that did not specifically require recursion to be
treated as if they did; consequently, setting
<command>qname-wait-recurse no;</command> was
sometimes ineffective. This has been corrected.
In most configurations, behavioral changes due to this
fix will not be noticeable. [RT #39229]
Several bugs have been fixed in the RPZ implementation:
</para>
</listitem>
<listitem>
<para>
A bug in RPZ could cause the server to crash if policy
zones were updated (e.g. via <command>rndc reload</command>
or an incoming zone transfer) while RPZ processing was still
ongoing for an active query. [RT #39415]
</para>
</listitem>
<itemizedlist>
<para>
Policy zones that did not specifically require recursion
could be treated as if they did; consequently, setting
<command>qname-wait-recurse no;</command> was
sometimes ineffective. This has been corrected.
In most configurations, behavioral changes due to this
fix will not be noticeable. [RT #39229]
</para>
</listitem>
<listitem>
<para>
The server could crash if policy zones were updated (e.g.
via <command>rndc reload</command> or an incoming zone
transfer) while RPZ processing was still ongoing for an
active query. [RT #39415]
</para>
</listitem>
<listitem>
<para>
On servers with more than one policy zone configured,
if one policy zone was updated via AXFR (especially when
the zone was very large) a race condition could allow the
RPZ summary data to fall out of sync with the policy zones,
potentially leading to an assertion failure in rpz.c.
[RT #39567]
</para>
</listitem>
</itemizedlist>
</itemizedlist>
</sect2>
<sect2 id="end_of_life">