upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-28 04:34:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

chg: usr: Enforces the fact that catalog-zone can not be used in non IN views

Browse source 
Catalog-zones can't be used in a view which is not from the IN class.
This is now enforced as the server won't load (instead of loading
without the catalog-zone) if such configuration is detected. This
configuration error is now also caught by `named-checkconf`.

Merge branch 'colin/catz-enforce-non-in' into 'main'

See merge request isc-projects/bind9!11245
This commit is contained in:
Colin Vidal 2025-11-18 10:08:57 +01:00
commit 346007d52d
7 changed files with 73 additions and 67 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
bin/named/server.c
View file

@ -3716,8 +3716,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
named_cachelist_t *oldcachelist, dns_kasplist_t *kasplist,
const cfg_obj_t *bindkeys, isc_mem_t *mctx,
cfg_aclconfctx_t *aclctx,
isc_tlsctx_cache_t *tlsctx_client_cache, bool need_hints,
bool first_time) {
isc_tlsctx_cache_t *tlsctx_client_cache, bool first_time) {
const cfg_obj_t *maps[4] = { 0 };
const cfg_obj_t *cfgmaps[3] = { 0 };
const cfg_obj_t *options = NULL;
@ -3813,7 +3812,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
* is used for real lookups and so cares about hints.
*/
obj = NULL;
if (view->rdclass == dns_rdataclass_in && need_hints &&
if (view->rdclass == dns_rdataclass_in &&
named_config_get(maps, "response-policy", &obj) == ISC_R_SUCCESS)
{
CHECK(configure_rpz(view, NULL, obj, &old_rpz_ok, first_time));
@ -3821,18 +3820,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
}
obj = NULL;
if (view->rdclass != dns_rdataclass_in && need_hints &&
named_config_get(maps, "catalog-zones", &obj) == ISC_R_SUCCESS)
{
cfg_obj_log(obj, ISC_LOG_WARNING,
"'catalog-zones' option is only supported "
"for views with class IN");
}
obj = NULL;
if (view->rdclass == dns_rdataclass_in && need_hints &&
named_config_get(maps, "catalog-zones", &obj) == ISC_R_SUCCESS)
{
if (named_config_get(maps, "catalog-zones", &obj) == ISC_R_SUCCESS) {
CHECK(configure_catz(view, NULL, config, obj));
catz_configured = true;
}
@ -4662,9 +4650,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
&rootzone);
if (rootzone != NULL) {
dns_zone_detach(&rootzone);
need_hints = false;
}
if (need_hints) {
} else {
isc_log_write(NAMED_LOGCATEGORY_GENERAL,
NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
"no root hints for view '%s'",
@ -5558,7 +5544,7 @@ cleanup:
obj = NULL;
if (rpz_configured &&
pview->rdclass == dns_rdataclass_in && need_hints &&
pview->rdclass == dns_rdataclass_in &&
named_config_get(maps, "response-policy", &obj) ==
ISC_R_SUCCESS)
{
@ -5584,7 +5570,7 @@ cleanup:
obj = NULL;
if (catz_configured &&
pview->rdclass == dns_rdataclass_in && need_hints &&
pview->rdclass == dns_rdataclass_in &&
named_config_get(maps, "catalog-zones", &obj) ==
ISC_R_SUCCESS)
{
@ -7791,7 +7777,7 @@ configure_views(cfg_obj_t *config, const cfg_obj_t *bindkeys,
result = configure_view(view, viewlist, config, vconfig,
cachelist, &server->cachelist, kasplist,
bindkeys, isc_g_mctx, aclctx,
tlsctx_client_cache, true, first_time);
tlsctx_client_cache, first_time);
if (result != ISC_R_SUCCESS) {
dns_view_detach(&view);
return result;
@ -7820,7 +7806,7 @@ configure_views(cfg_obj_t *config, const cfg_obj_t *bindkeys,
result = configure_view(view, viewlist, config, NULL, cachelist,
&server->cachelist, kasplist, bindkeys,
isc_g_mctx, aclctx, tlsctx_client_cache,
true, first_time);
first_time);
if (result != ISC_R_SUCCESS) {
dns_view_detach(&view);
return result;

17
bin/tests/system/catz/ns2/named1.conf.in
View file

@ -186,23 +186,6 @@ view "default" {
};
view "ch" ch {
catalog-zones {
zone "catalog-bad5.example"
default-masters { 10.53.0.1; }
in-memory yes;
};
# Non-IN class catalog zone
zone "catalog-bad5.example" ch {
type secondary;
file "catalog-bad5.example.db";
primaries { 10.53.0.1; };
};
};
key tsig_key. {
secret "LSAnCU+Z";
algorithm @DEFAULT_HMAC@;

14
bin/tests/system/catz/ns2/named2.conf.in
View file

@ -121,20 +121,6 @@ view "default" {
};
view "ch" ch {
# Removed catalog-zone option, otherwise this is
# identical to named1.conf.in
# Non-IN class catalog zone
zone "catalog-bad5.example" ch {
type secondary;
file "catalog-bad5.example.db";
primaries { 10.53.0.1; };
};
};
key tsig_key. {
secret "LSAnCU+Z";
algorithm @DEFAULT_HMAC@;

9
bin/tests/system/catz/tests.sh
View file

@ -116,15 +116,6 @@ wait_for_message ns2/named.run "catz: invalid record in catalog zone - version.c
if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=$((status + ret))
n=$((n + 1))
echo_i "checking that catalog-bad5.example (non-IN class) has failed to load ($n)"
ret=0
wait_for_message ns2/named.run "'catalog-zones' option is only supported for views with class IN" \
&& wait_for_message ns2/named.run "all zones loaded" || ret=1
grep -F "catz: dns_catz_zone_add catalog-bad5.example" ns2/named.run && ret=1
if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=$((status + ret))
nextpart ns2/named.run >/dev/null
##########################################################################

23
bin/tests/system/checkconf/bad-catz-class.conf Normal file
View file

@ -0,0 +1,23 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
view bar ch {
catalog-zones {
zone "foo";
};
zone "foo" {
type primary;
file "foo";
};
};

27
bin/tests/system/checkconf/bad-chaos-catz.conf Normal file
View file

@ -0,0 +1,27 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
view "ch" ch {
catalog-zones {
zone "catalog-bad5.example" default-masters { 10.53.0.1; }
in-memory yes;
};
# Non-IN class catalog zone
zone "catalog-bad5.example" ch {
type secondary;
file "catalog-bad5.example.db";
primaries { 10.53.0.1; };
};
};

20
lib/isccfg/check.c
View file

@ -5539,11 +5539,21 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
*/
if (opts != NULL) {
obj = NULL;
if ((cfg_map_get(opts, "catalog-zones", &obj) ==
ISC_R_SUCCESS) &&
(check_catz(obj, viewname, mctx) != ISC_R_SUCCESS))
{
result = ISC_R_FAILURE;
if (cfg_map_get(opts, "catalog-zones", &obj) == ISC_R_SUCCESS) {
if (vclass != dns_rdataclass_in) {
cfg_obj_log(
obj, ISC_LOG_ERROR,
"'catalog-zones' option is only "
"supported for views with class IN");
if (result == ISC_R_SUCCESS) {
result = ISC_R_FAILURE;
}
}
if (check_catz(obj, viewname, mctx) != ISC_R_SUCCESS) {
result = ISC_R_FAILURE;
}
}
}