From 3824a600a51188c713e900115d6af129b54706df Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Wed, 6 Feb 2019 11:35:21 -0800 Subject: [PATCH] denied axfr requests were not effective for writable DLZ zones (cherry picked from commit d9077cd0038e59726e1956de18b4b7872038a283) (cherry picked from commit 34348d9ee4db15307c6c42db294419b4df569f76) --- bin/named/xfrout.c | 8 ++++---- bin/tests/system/dlzexternal/driver.c | 18 +++++++++++++++--- bin/tests/system/dlzexternal/tests.sh | 16 ++++++++++++---- 3 files changed, 31 insertions(+), 11 deletions(-) diff --git a/bin/named/xfrout.c b/bin/named/xfrout.c index c531e0acef..f6e57d889e 100644 --- a/bin/named/xfrout.c +++ b/bin/named/xfrout.c @@ -803,12 +803,12 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) { result = dns_zt_find(client->view->zonetable, question_name, 0, NULL, &zone); - if (result != ISC_R_SUCCESS) { + if (result != ISC_R_SUCCESS || dns_zone_gettype(zone) == dns_zone_dlz) { /* - * Normal zone table does not have a match. - * Try the DLZ database + * The normal zone table does not have a match, or this is + * marked in the zone table as a DLZ zone. Check the DLZ + * databases for a match. */ - // Temporary: only searching the first DLZ database if (! ISC_LIST_EMPTY(client->view->dlz_searched)) { result = dns_dlzallowzonexfr(client->view, question_name, diff --git a/bin/tests/system/dlzexternal/driver.c b/bin/tests/system/dlzexternal/driver.c index 37a62622da..dfa7847984 100644 --- a/bin/tests/system/dlzexternal/driver.c +++ b/bin/tests/system/dlzexternal/driver.c @@ -542,10 +542,22 @@ dlz_lookup(const char *zone, const char *name, void *dbdata, */ isc_result_t dlz_allowzonexfr(void *dbdata, const char *name, const char *client) { - UNUSED(client); + isc_result_t result; + + result = dlz_findzonedb(dbdata, name, NULL, NULL); + if (result != ISC_R_SUCCESS) { + return (result); + } - /* Just say yes for all our zones */ - return (dlz_findzonedb(dbdata, name, NULL, NULL)); + /* + * Exception for 10.53.0.5 so we can test that allow-transfer + * is effective. + */ + if (strcmp(client, "10.53.0.5") == 0) { + return (ISC_R_NOPERM); + } + + return (ISC_R_SUCCESS); } /* diff --git a/bin/tests/system/dlzexternal/tests.sh b/bin/tests/system/dlzexternal/tests.sh index 87dd13b10e..1754aaa57c 100644 --- a/bin/tests/system/dlzexternal/tests.sh +++ b/bin/tests/system/dlzexternal/tests.sh @@ -108,15 +108,23 @@ test_update testdc1.alternate.nil. A "86400 A 10.53.0.10" "10.53.0.10" || ret=1 status=`expr $status + $ret` newtest "testing AXFR from DLZ drivers" -$DIG $DIGOPTS +noall +answer axfr example.nil > dig.out.ns1.test$n -lines=`cat dig.out.ns1.test$n | wc -l` +$DIG $DIGOPTS +noall +answer axfr example.nil > dig.out.example.ns1.test$n +lines=`cat dig.out.example.ns1.test$n | wc -l` [ ${lines:-0} -eq 4 ] || ret=1 -$DIG $DIGOPTS +noall +answer axfr alternate.nil > dig.out.ns1.test$n -lines=`cat dig.out.ns1.test$n | wc -l` +$DIG $DIGOPTS +noall +answer axfr alternate.nil > dig.out.alternate.ns1.test$n +lines=`cat dig.out.alternate.ns1.test$n | wc -l` [ ${lines:-0} -eq 5 ] || ret=1 [ "$ret" -eq 0 ] || echo_i "failed" status=`expr $status + $ret` +newtest "testing AXFR denied from DLZ drivers" +$DIG $DIGOPTS -b 10.53.0.5 +noall +answer axfr example.nil > dig.out.example.ns1.test$n +grep "; Transfer failed" dig.out.example.ns1.test$n > /dev/null || ret=1 +$DIG $DIGOPTS -b 10.53.0.5 +noall +answer axfr alternate.nil > dig.out.alternate.ns1.test$n +grep "; Transfer failed" dig.out.alternate.ns1.test$n > /dev/null || ret=1 +[ "$ret" -eq 0 ] || echo_i "failed" +status=`expr $status + $ret` + newtest "testing unsearched/unregistered DLZ zone is not found" $DIG $DIGOPTS +noall +answer ns other.nil > dig.out.ns1.test$n grep "3600.IN.NS.other.nil." dig.out.ns1.test$n > /dev/null && ret=1 -- 2.20.1