upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-28 04:34:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

negative 'blackhole' ACL match could be treated as positive

Browse source 
There was a bug in the checking of the "blackhole" ACL in
dns_request_create*(), causing an address to be treated as included
in the ACL if it was explicitly *excluded*. Thus, leaving "blackhole"
unset had no effect, but setting it to "none" would cause any
destination addresses to be rejected for dns_request purposes. This
would cause zone transfer requests and SOA queries to fail, among
other things.

The bug has been fixed, and "blackhole { none; };" was added to the
xfer system test as a regression test.
This commit is contained in:
Evan Hunt 2022-02-16 15:46:33 -08:00
parent 5fbbc312a7
commit 4444b168db
2 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
bin/tests/system/xfer/ns4/named.conf.base
View file

@ -21,6 +21,7 @@ options {
listen-on-v6 { none; };
recursion no;
notify yes;
blackhole { none; };
};
key rndc_key {

2
lib/dns/request.c
View file

@ -383,7 +383,7 @@ isblackholed(dns_dispatchmgr_t *dispatchmgr, const isc_sockaddr_t *destaddr) {
isc_netaddr_fromsockaddr(&netaddr, destaddr);
result = dns_acl_match(&netaddr, NULL, blackhole, NULL, &match, NULL);
if (result != ISC_R_SUCCESS || match == 0) {
if (result != ISC_R_SUCCESS || match <= 0) {
return (false);
}