Package: bind9
Version: 1:9.8.4.dfsg.P1-6+nmu2+deb7u1
Severity: important
Tags: patch
Hello,
current bind9 from debian stable rejects responses with duplicate singleton
records.
The problem can be reproduced by querying cid-4711.calendar.live.com, bind is
unable to resolve the A record, as the response is discarded and a FORMERR is
logged.
Therefore the calendar of live.com is not usable when using bind.
I contacted upstream about the issue and was given the advice to update my bind.
Further investigation showed the problem was fixed in 9.9.3b1.
https://kb.isc.org/category/81/20/10/Software-Products/BIND9/Release-Notes/
"Instead of rejecting and logging a FORMERR, named now accepts duplicate
singleton records in a DNS query response. (In some situations, query
responses may contain duplicates - and whilst this is not technically correct,
BIND has been updated to be more tolerant). [RT #32329]"
I 'backported' the patch by cutting it from the diff of 9.9.2-P2 to 9.9.3b1.
The resulting bind9 package works fine.
I propose to accept the backported patch to be able to use bind when using
live.com (or other) services which respond with duplicate singleton responses.
-- System Information:
Debian Release: 7.1
APT prefers stable
APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.32-042stab072.10 (SMP w/2 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages bind9 depends on:
ii adduser 3.113+nmu3
ii bind9utils 1:9.8.4.dfsg.P1-6+nmu2+deb7u1
ii debconf [debconf-2.0] 1.5.49
ii libbind9-80 1:9.8.4.dfsg.P1-6+nmu2+deb7u1
ii libc6 2.13-38
ii libcap2 1:2.22-1.2
ii libdns88 1:9.8.4.dfsg.P1-6+nmu2+deb7u1
ii libgssapi-krb5-2 1.10.1+dfsg-5+deb7u1
ii libisc84 1:9.8.4.dfsg.P1-6+nmu2+deb7u1
ii libisccc80 1:9.8.4.dfsg.P1-6+nmu2+deb7u1
ii libisccfg82 1:9.8.4.dfsg.P1-6+nmu2+deb7u1
ii liblwres80 1:9.8.4.dfsg.P1-6+nmu2+deb7u1
ii libssl1.0.0 1.0.1e-2
ii libxml2 2.8.0+dfsg1-7+nmu1
ii lsb-base 4.1+Debian8+deb7u1
ii net-tools 1.60-24.2
ii netbase 5.0
bind9 recommends no packages.
Versions of packages bind9 suggests:
ii bind9-doc 1:9.8.4.dfsg.P1-6+nmu2+deb7u1
ii dnsutils 1:9.8.4.dfsg.P1-6+nmu2+deb7u1
pn resolvconf <none>
pn ufw <none>
-- Configuration Files:
/etc/bind/named.conf.local changed [not included]
-- debconf information excluded
diff -Naur bind9-9.8.4.dfsg.P1/debian/patches/accept_duplicate_singleton_records.patch ../bind9-9.8.4.dfsg.P1/debian/patches/accept_duplicate_singleton_records.patch
--- bind9-9.8.4.dfsg.P1/debian/patches/accept_duplicate_singleton_records.patch 1970-01-01 01:00:00.000000000 +0100
+++ ../bind9-9.8.4.dfsg.P1/debian/patches/accept_duplicate_singleton_records.patch 2013-09-12 16:28:51.000000000 +0200
@@ -0,0 +1,22 @@
+Index: bind9-9.8.4.dfsg.P1/lib/dns/message.c
+===================================================================
+--- bind9-9.8.4.dfsg.P1.orig/lib/dns/message.c 2013-09-12 16:06:38.000000000 +0200
++++ bind9-9.8.4.dfsg.P1/lib/dns/message.c 2013-09-12 16:06:52.000000000 +0200
+@@ -1441,8 +1441,15 @@
+ * the opcode is an update, or the type search is skipped.
+ */
+ if (result == ISC_R_SUCCESS) {
+- if (dns_rdatatype_issingleton(rdtype))
+- DO_FORMERR;
++ if (dns_rdatatype_issingleton(rdtype)) {
++ dns_rdata_t *first;
++ dns_rdatalist_fromrdataset(rdataset,
++ &rdatalist);
++ first = ISC_LIST_HEAD(rdatalist->rdata);
++ INSIST(first != NULL);
++ if (dns_rdata_compare(rdata, first) != 0)
++ DO_FORMERR;
++ }
+ }
+
+ if (result == ISC_R_NOTFOUND) {
diff -Naur bind9-9.8.4.dfsg.P1/debian/patches/series ../bind9-9.8.4.dfsg.P1/debian/patches/series
--- bind9-9.8.4.dfsg.P1/debian/patches/series 1970-01-01 01:00:00.000000000 +0100
+++ ../bind9-9.8.4.dfsg.P1/debian/patches/series 2013-09-12 16:28:51.000000000 +0200
@@ -0,0 +1 @@
+accept_duplicate_singleton_records.patch
