|
 |
302b22 |
From 3824a600a51188c713e900115d6af129b54706df Mon Sep 17 00:00:00 2001
|
|
|
302b22 |
From: Mark Andrews <marka@isc.org>
|
|
|
302b22 |
Date: Wed, 6 Feb 2019 11:35:21 -0800
|
|
|
302b22 |
Subject: [PATCH] denied axfr requests were not effective for writable DLZ
|
|
|
302b22 |
zones
|
|
|
302b22 |
|
|
|
302b22 |
(cherry picked from commit d9077cd0038e59726e1956de18b4b7872038a283)
|
|
|
302b22 |
(cherry picked from commit 34348d9ee4db15307c6c42db294419b4df569f76)
|
|
|
302b22 |
---
|
|
|
302b22 |
bin/named/xfrout.c | 8 ++++----
|
|
|
302b22 |
bin/tests/system/dlzexternal/driver.c | 18 +++++++++++++++---
|
|
|
302b22 |
bin/tests/system/dlzexternal/tests.sh | 16 ++++++++++++----
|
|
|
302b22 |
3 files changed, 31 insertions(+), 11 deletions(-)
|
|
|
302b22 |
|
|
|
302b22 |
diff --git a/bin/named/xfrout.c b/bin/named/xfrout.c
|
|
|
302b22 |
index c531e0acef..f6e57d889e 100644
|
|
|
302b22 |
--- a/bin/named/xfrout.c
|
|
|
302b22 |
+++ b/bin/named/xfrout.c
|
|
|
302b22 |
@@ -803,12 +803,12 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
|
|
|
302b22 |
result = dns_zt_find(client->view->zonetable, question_name, 0, NULL,
|
|
|
302b22 |
&zone);
|
|
|
302b22 |
|
|
|
302b22 |
- if (result != ISC_R_SUCCESS) {
|
|
|
302b22 |
+ if (result != ISC_R_SUCCESS || dns_zone_gettype(zone) == dns_zone_dlz) {
|
|
|
302b22 |
/*
|
|
|
302b22 |
- * Normal zone table does not have a match.
|
|
|
302b22 |
- * Try the DLZ database
|
|
|
302b22 |
+ * The normal zone table does not have a match, or this is
|
|
|
302b22 |
+ * marked in the zone table as a DLZ zone. Check the DLZ
|
|
|
302b22 |
+ * databases for a match.
|
|
|
302b22 |
*/
|
|
|
302b22 |
- // Temporary: only searching the first DLZ database
|
|
|
302b22 |
if (! ISC_LIST_EMPTY(client->view->dlz_searched)) {
|
|
|
302b22 |
result = dns_dlzallowzonexfr(client->view,
|
|
|
302b22 |
question_name,
|
|
|
302b22 |
diff --git a/bin/tests/system/dlzexternal/driver.c b/bin/tests/system/dlzexternal/driver.c
|
|
|
302b22 |
index 37a62622da..dfa7847984 100644
|
|
|
302b22 |
--- a/bin/tests/system/dlzexternal/driver.c
|
|
|
302b22 |
+++ b/bin/tests/system/dlzexternal/driver.c
|
|
|
302b22 |
@@ -542,10 +542,22 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
|
|
|
302b22 |
*/
|
|
|
302b22 |
isc_result_t
|
|
|
302b22 |
dlz_allowzonexfr(void *dbdata, const char *name, const char *client) {
|
|
|
302b22 |
- UNUSED(client);
|
|
|
302b22 |
+ isc_result_t result;
|
|
|
302b22 |
+
|
|
|
302b22 |
+ result = dlz_findzonedb(dbdata, name, NULL, NULL);
|
|
|
302b22 |
+ if (result != ISC_R_SUCCESS) {
|
|
|
302b22 |
+ return (result);
|
|
|
302b22 |
+ }
|
|
|
302b22 |
|
|
|
302b22 |
- /* Just say yes for all our zones */
|
|
|
302b22 |
- return (dlz_findzonedb(dbdata, name, NULL, NULL));
|
|
|
302b22 |
+ /*
|
|
|
302b22 |
+ * Exception for 10.53.0.5 so we can test that allow-transfer
|
|
|
302b22 |
+ * is effective.
|
|
|
302b22 |
+ */
|
|
|
302b22 |
+ if (strcmp(client, "10.53.0.5") == 0) {
|
|
|
302b22 |
+ return (ISC_R_NOPERM);
|
|
|
302b22 |
+ }
|
|
|
302b22 |
+
|
|
|
302b22 |
+ return (ISC_R_SUCCESS);
|
|
|
302b22 |
}
|
|
|
302b22 |
|
|
|
302b22 |
/*
|
|
|
302b22 |
diff --git a/bin/tests/system/dlzexternal/tests.sh b/bin/tests/system/dlzexternal/tests.sh
|
|
|
302b22 |
index 87dd13b10e..1754aaa57c 100644
|
|
|
302b22 |
--- a/bin/tests/system/dlzexternal/tests.sh
|
|
|
302b22 |
+++ b/bin/tests/system/dlzexternal/tests.sh
|
|
|
302b22 |
@@ -108,15 +108,23 @@ test_update testdc1.alternate.nil. A "86400 A 10.53.0.10" "10.53.0.10" || ret=1
|
|
|
302b22 |
status=`expr $status + $ret`
|
|
|
302b22 |
|
|
|
302b22 |
newtest "testing AXFR from DLZ drivers"
|
|
|
302b22 |
-$DIG $DIGOPTS +noall +answer axfr example.nil > dig.out.ns1.test$n
|
|
|
302b22 |
-lines=`cat dig.out.ns1.test$n | wc -l`
|
|
|
302b22 |
+$DIG $DIGOPTS +noall +answer axfr example.nil > dig.out.example.ns1.test$n
|
|
|
302b22 |
+lines=`cat dig.out.example.ns1.test$n | wc -l`
|
|
|
302b22 |
[ ${lines:-0} -eq 4 ] || ret=1
|
|
|
302b22 |
-$DIG $DIGOPTS +noall +answer axfr alternate.nil > dig.out.ns1.test$n
|
|
|
302b22 |
-lines=`cat dig.out.ns1.test$n | wc -l`
|
|
|
302b22 |
+$DIG $DIGOPTS +noall +answer axfr alternate.nil > dig.out.alternate.ns1.test$n
|
|
|
302b22 |
+lines=`cat dig.out.alternate.ns1.test$n | wc -l`
|
|
|
302b22 |
[ ${lines:-0} -eq 5 ] || ret=1
|
|
|
302b22 |
[ "$ret" -eq 0 ] || echo_i "failed"
|
|
|
302b22 |
status=`expr $status + $ret`
|
|
|
302b22 |
|
|
|
302b22 |
+newtest "testing AXFR denied from DLZ drivers"
|
|
|
302b22 |
+$DIG $DIGOPTS -b 10.53.0.5 +noall +answer axfr example.nil > dig.out.example.ns1.test$n
|
|
|
302b22 |
+grep "; Transfer failed" dig.out.example.ns1.test$n > /dev/null || ret=1
|
|
|
302b22 |
+$DIG $DIGOPTS -b 10.53.0.5 +noall +answer axfr alternate.nil > dig.out.alternate.ns1.test$n
|
|
|
302b22 |
+grep "; Transfer failed" dig.out.alternate.ns1.test$n > /dev/null || ret=1
|
|
|
302b22 |
+[ "$ret" -eq 0 ] || echo_i "failed"
|
|
|
302b22 |
+status=`expr $status + $ret`
|
|
|
302b22 |
+
|
|
|
302b22 |
newtest "testing unsearched/unregistered DLZ zone is not found"
|
|
|
302b22 |
$DIG $DIGOPTS +noall +answer ns other.nil > dig.out.ns1.test$n
|
|
|
302b22 |
grep "3600.IN.NS.other.nil." dig.out.ns1.test$n > /dev/null && ret=1
|
|
|
302b22 |
--
|
|
|
302b22 |
2.20.1
|
|
|
302b22 |
|