|
 |
02357b |
From 4eff09c6b1e524b0efc393ee948b5c4cdf16ccb8 Mon Sep 17 00:00:00 2001
|
|
|
02357b |
From: Mark Andrews <marka@isc.org>
|
|
|
02357b |
Date: Wed, 3 Feb 2021 11:10:20 +1100
|
|
|
02357b |
Subject: [PATCH] Check SOA owner names in zone transfers
|
|
|
02357b |
|
|
|
02357b |
An IXFR containing SOA records with owner names different than the
|
|
|
02357b |
transferred zone's origin can result in named serving a version of that
|
|
|
02357b |
zone without an SOA record at the apex. This causes a RUNTIME_CHECK
|
|
|
02357b |
assertion failure the next time such a zone is refreshed. Fix by
|
|
|
02357b |
immediately rejecting a zone transfer (either an incremental or
|
|
|
02357b |
non-incremental one) upon detecting an SOA record not placed at the apex
|
|
|
02357b |
of the transferred zone.
|
|
|
02357b |
---
|
|
|
02357b |
lib/dns/xfrin.c | 14 ++++++++++++++
|
|
|
02357b |
1 file changed, 14 insertions(+)
|
|
|
02357b |
|
|
|
02357b |
diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
|
|
|
02357b |
index 3a3f407289..0ba82e4974 100644
|
|
|
02357b |
--- a/lib/dns/xfrin.c
|
|
|
02357b |
+++ b/lib/dns/xfrin.c
|
|
|
02357b |
@@ -477,6 +477,20 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, uint32_t ttl,
|
|
|
02357b |
dns_rdatatype_ismeta(rdata->type))
|
|
|
02357b |
FAIL(DNS_R_FORMERR);
|
|
|
02357b |
|
|
|
02357b |
+ /*
|
|
|
02357b |
+ * Immediately reject the entire transfer if the RR that is currently
|
|
|
02357b |
+ * being processed is an SOA record that is not placed at the zone
|
|
|
02357b |
+ * apex.
|
|
|
02357b |
+ */
|
|
|
02357b |
+ if (rdata->type == dns_rdatatype_soa &&
|
|
|
02357b |
+ !dns_name_equal(&xfr->name, name)) {
|
|
|
02357b |
+ char namebuf[DNS_NAME_FORMATSIZE];
|
|
|
02357b |
+ dns_name_format(name, namebuf, sizeof(namebuf));
|
|
|
02357b |
+ xfrin_log(xfr, ISC_LOG_DEBUG(3), "SOA name mismatch: '%s'",
|
|
|
02357b |
+ namebuf);
|
|
|
02357b |
+ FAIL(DNS_R_NOTZONETOP);
|
|
|
02357b |
+ }
|
|
|
02357b |
+
|
|
|
02357b |
redo:
|
|
|
02357b |
switch (xfr->state) {
|
|
|
02357b |
case XFRST_SOAQUERY:
|
|
|
02357b |
--
|
|
|
02357b |
2.26.3
|
|
|
02357b |
|