接收来自合法权威服务器响应的 Named 服务，因 CVE-2018-5740 而崩溃。
安装 CentOS 7.5。
安装 bind 和 bind-utils 软件包。
# yum install bind-9.9.4-61.el7.x86_64 bind-utils-9.9.4-61.el7.x86_64
为 example.com 区域创建区域文件。
# vi /var/named/example.com
# chown root:named /var/named/example.com
example.com 区域文件。
$TTL 1D
@ IN SOA @ rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS @
A 127.0.0.1
AAAA ::1
dname IN DNAME child.example.com.
编辑 named.conf 以添加 example.com 区域。
# vi /etc/named.conf
example.com 区域指令。
zone "example.com" IN {
type master;
file "example.com";
};
启动权威服务器服务。
# systemctl start named
为全解析服务器创建配置文件。
# vi /etc/named-full-resulver.conf
named-full-resolver.conf
options {
listen-on port 10053 { 127.0.0.1; };
listen-on-v6 port 10053 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; };
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/var/run/named/named-full-resolver.pid";
session-keyfile "/run/named/session.key";
deny-answer-aliases {
"dname.example.com";
};
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
zone "example.com" IN {
type static-stub;
server-addresses { 127.0.0.1; };
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
启动全解析服务器服务。
# /usr/sbin/named -u named -c /etc/named-full-resolver.conf
向全解析服务器发送查询。
$ dig @127.0.0.1 -p 10053 dname.example.com DNAME +rec
查看 /var/log/messages。
Aug 15 10:45:30 bind named[11523]: name.c:2117: REQUIRE(suffixlabels > 0) failed, back trace
Aug 15 10:45:30 bind named[11523]: #0 0x55651c255b60 in ??
Aug 15 10:45:30 bind named[11523]: #1 0x7fa8a4e1717a in ??
Aug 15 10:45:30 bind named[11523]: #2 0x7fa8a64f87e9 in ??
Aug 15 10:45:30 bind named[11523]: #3 0x7fa8a64a3daf in ??
Aug 15 10:45:30 bind named[11523]: #4 0x7fa8a64a4ff0 in ??
Aug 15 10:45:30 bind named[11523]: #5 0x7fa8a657d33e in ??
Aug 15 10:45:30 bind named[11523]: #6 0x7fa8a4e3a066 in ??
Aug 15 10:45:30 bind named[11523]: #7 0x7fa8a49eae25 in ??
Aug 15 10:45:30 bind named[11523]: #8 0x7fa8a3a5ebad in ??
Aug 15 10:45:30 bind named[11523]: exiting (due to assertion failure)