pkt_rrsig_covered() moves the buffer position to the RRSIG's TTL and restores it before returning, except on the first early return, when fewer than 25 bytes are left. When it is called from rrset_has_sigover() on an earlier RRSIG while a later RR is being parsed, the parser then continues from the old RRSIG instead of the current RR, and that RR gets the RRSIG's TTL and rdata. Restore the position on that return too.
nsec_at_apex() starts at the TTL, so the rdata ends at pos + 6 +
rdatalen (4 bytes TTL, 2 bytes rdlength), but both bounds checks use
pos + 4 + rdatalen. An NSEC whose type bitmap is 3 or 4 bytes long
is then treated as malformed and not flagged as being at the apex,
even when the SOA bit is set. Use the correct end of the rdata.
response is a more RFC conformant FORMERR, since the EDNS
option is malformed. Also fix to have an EDNS size for
the reply error encoding for failed EDNS parse of the query.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
- Cached messages that reach 0 TTL are considered expired. This prevents
Unbound itself from issuing replies with TTL 0 and possibly causing a
thundering herd at the last second. Upstream replies of TTL 0 still
get the usual pass-through but they are not considered for caching
from Unbound or any of its caching modules.
- 'serve-expired-reply-ttl' is changed and is now capped by the original
TTL value of the record to try and make some sense when replying
with expired records.
- TTL decoding was updated to adhere to RFC8767 section 4 where a set
high-order bit means the value is positive instead of 0.
8 bytes after a client option of length 8, and then ignore them to
recreate a 24 byte response. The fixup does not read out of bounds,
and puts zeroes in the buffer at that point, that then are ignored.
Create server cookies for clients that send client cookies.
Needs to be turned on in the config file with:
answer-cookie: yes
A cookie-secret can be configured for anycast setups.
Also adds an access control list that will allow queries with
either a valid cookie or over a stateful transport.
query into a large number of queries directed to a target.
- CVE-2020-12663 Malformed answers from upstream name servers can be
used to make Unbound unresponsive.
bypassing the cache response stage and uniquifying mesh states. Four EDNS
option lists were added to module_qstate (module_qstate.edns_opts_*) to
store EDNS options from/to front/back side.
- Added two flags to module_qstate (no_cache_lookup, no_cache_store) that
control the modules' cache interactions.
- Added code for registering inplace callback functions. The registered
functions can be called just before replying with local data or Chaos,
replying from cache, replying with SERVFAIL, replying with a resolved
query, sending a query to a nameserver. The functions can inspect the
available data and maybe change response/query related data (i.e. append
EDNS options).
- Updated Python module for the above.
- Updated Python documentation.
git-svn-id: file:///svn/unbound/trunk@3947 be551aaa-1e26-0410-a405-d3ace91eadb9
