upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-07-16 18:02:50 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Reject referrals from global forwarders

Browse source 
Reject referrals from root/global forwarders, where there is no narrower
forward-zone apex for name_external() to enforce.
This commit is contained in:
Alessio Podda 2026-06-16 12:08:23 +02:00
parent 492d11fa39
commit 18f4db8f1b
1 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
lib/dns/resolver.c
View file

@ -9439,6 +9439,19 @@ rctx_referral(respctx_t *rctx) {
return ISC_R_COMPLETE;
}
/*
* If a global forwarder is in use, we don't want to cache its
* referrals. Dual-stack alternates are not treated as forwarders for
* namespace checks, even if their address info uses the forwarder flag.
*/
if (ISFORWARDER(fctx->addrinfo) && !ISDUALSTACK(fctx->addrinfo) &&
dns_name_equal(fctx->fwdname, dns_rootname))
{
log_formerr(fctx, "referral from global forwarder");
rctx->result = DNS_R_FORMERR;
return ISC_R_COMPLETE;
}
/*
* We already know ns_name is a subdomain of fctx->domain.
* If ns_name is equal to fctx->domain, we're not making