upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-13 16:59:59 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

[v9_10] disallow map zones in response-policy

Browse source 
4269.	[bug]		Zones using "map" format master files currently
			don't work as policy zones.  This limitation has
			now been documented; attempting to use such zones
			in "response-policy" statements is now a
			configuration error.  [RT #38321]
This commit is contained in:
Evan Hunt 2015-12-02 21:10:43 -08:00
parent 19cce81c83
commit 4db36f766e
4 changed files with 21 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
CHANGES
View file

@ -1,3 +1,9 @@
4269. [bug] Zones using "map" format master files currently
don't work as policy zones. This limitation has
now been documented; attempting to use such zones
in "response-policy" statements is now a
configuration error. [RT #38321]
4267. [test] Check sdlz error handling. [RT #41142]
4265. [bug] Address unchecked isc_mem_get calls. [RT #41187]

2
doc/arm/Bv9ARM-book.xml
View file

@ -9463,6 +9463,8 @@ deny-answer-aliases { "example.net"; };
that can be queried normally if allowed.
It is usually best to restrict those queries with something like
<command>allow-query { localhost; };</command>.
Note that zones using <command>masterfile-format map</command>
cannot be used as policy zones.
</para>
<para>

11
doc/arm/notes.xml
View file

@ -362,6 +362,17 @@
if wildcard records were present. [RT #40357]
</para>
</listitem>
<listitem>
<para>
Zones configured to use <command>map</command> format
master files can't be used as policy zones because RPZ
summary data isn't compiled when such zones are mapped into
memory. This limitation may be fixed in a future release,
but in the meantime it has been documented, and attempting
to use such zones in <command>response-policy</command>
statements is now a configuration error. [RT #38321]
</para>
</listitem>
</itemizedlist>
</listitem>
</itemizedlist>

2
lib/dns/zone.c
View file

@ -1678,6 +1678,8 @@ dns_zone_rpz_enable(dns_zone_t *zone, dns_rpz_zones_t *rpzs,
if (strcmp(zone->db_argv[0], "rbt") != 0 &&
strcmp(zone->db_argv[0], "rbt64") != 0)
return (ISC_R_NOTIMPLEMENTED);
if (zone->masterformat == dns_masterformat_map)
return (ISC_R_NOTIMPLEMENTED);
/*
* This must happen only once or be redundant.