upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-23 18:47:40 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

checkconf: check key existence in views

Browse source 
Commit `2956e4fc45b3c2142a3351682d4200647448f193` hardened the `key`
name check when used in `primaries` to reject the configuration if
the key was not defined, rather than simply checking whether the
key name was correctly formed.

However, the key name check didn't include the view configuration,
causing keys not to be recognized if they were defined inside the
view and not at the global level.  This regression is now fixed.
This commit is contained in:
Colin Vidal 2026-02-23 19:36:19 +01:00 committed by Evan Hunt
parent 19ebf8ebf8
commit b90399ebdc
1 changed files with 61 additions and 47 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

108
lib/isccfg/check.c
View file

@ -85,8 +85,8 @@ static const cfg_obj_t *
find_maplist(const cfg_obj_t *config, const char *listname, const char *name);
static isc_result_t
validate_remotes(const cfg_obj_t *obj, const cfg_obj_t *config,
uint32_t *countp, isc_mem_t *mctx);
validate_remotes(const cfg_obj_t *obj, const cfg_obj_t *voptions,
const cfg_obj_t *config, uint32_t *countp, isc_mem_t *mctx);
static void
freekey(char *key, unsigned int type, isc_symvalue_t value, void *userarg) {
UNUSED(type);
@ -2093,7 +2093,7 @@ check_remoteserverlist(const cfg_obj_t *cctx, const char *list,
}
uint32_t dummy = 0;
result = validate_remotes(obj, cctx, &dummy, mctx);
result = validate_remotes(obj, NULL, cctx, &dummy, mctx);
if (result != ISC_R_SUCCESS) {
break;
}
@ -2423,16 +2423,56 @@ get_remoteservers_def(const char *name, const cfg_obj_t *cctx,
return get_remotes(cctx, "masters", name, ret);
}
static bool
lookup_key(const cfg_obj_t *config, const dns_name_t *keyname) {
const cfg_obj_t *keys = NULL;
if (config == NULL) {
return false;
}
(void)cfg_map_get(config, "key", &keys);
CFG_LIST_FOREACH(keys, elt) {
/*
* `key` are normalized TSIG which must be identified by
* a domain name, so this is needed. Otherwise, with a
* raw string comparison we could have:
*
* remote-servers { x.y.z.s key foo };
* key foo. {
* ...
* };
*
* This would otherwise fail, even though the key
* exists.
*/
const cfg_obj_t *foundkey = cfg_listelt_value(elt);
const char *foundkeystr =
cfg_obj_asstring(cfg_map_getname(foundkey));
dns_fixedname_t foundfname;
dns_name_t *foundkeyname = dns_fixedname_initname(&foundfname);
isc_result_t result = dns_name_fromstring(
foundkeyname, foundkeystr, dns_rootname, 0, NULL);
if (result == ISC_R_SUCCESS &&
dns_name_equal(keyname, foundkeyname))
{
return true;
}
}
return false;
}
static isc_result_t
validate_remotes_key(const cfg_obj_t *config, const cfg_obj_t *key) {
validate_remotes_key(const cfg_obj_t *voptions, const cfg_obj_t *config,
const cfg_obj_t *key) {
isc_result_t result = ISC_R_SUCCESS;
if (cfg_obj_isstring(key)) {
const cfg_obj_t *keys = NULL;
const char *str = cfg_obj_asstring(key);
dns_fixedname_t fname;
dns_name_t *nm = dns_fixedname_initname(&fname);
bool found = false;
result = dns_name_fromstring(nm, str, dns_rootname, 0, NULL);
if (result != ISC_R_SUCCESS) {
@ -2440,43 +2480,14 @@ validate_remotes_key(const cfg_obj_t *config, const cfg_obj_t *key) {
"'%s' is not a valid name", str);
}
result = cfg_map_get(config, "key", &keys);
CFG_LIST_FOREACH(keys, elt) {
/*
* `key` are normalized TSIG which must be identified by
* a domain name, so this is needed. Otherwise, with a
* raw string comparison we could have:
*
* remote-servers { x.y.z.s key foo };
* key foo. {
* ...
* };
*
* This would otherwise fail, even though the key
* exists.
*/
const cfg_obj_t *foundkey = cfg_listelt_value(elt);
const char *foundkeystr =
cfg_obj_asstring(cfg_map_getname(foundkey));
dns_fixedname_t foundfname;
dns_name_t *foundkeyname =
dns_fixedname_initname(&foundfname);
result = dns_name_fromstring(foundkeyname, foundkeystr,
dns_rootname, 0, NULL);
if (dns_name_equal(nm, foundkeyname)) {
found = true;
break;
if (!lookup_key(voptions, nm)) {
if (!lookup_key(config, nm)) {
cfg_obj_log(key, ISC_LOG_ERROR,
"key '%s' is not defined",
cfg_obj_asstring(key));
result = ISC_R_FAILURE;
}
}
if (!found) {
cfg_obj_log(key, ISC_LOG_ERROR,
"key '%s' is not defined",
cfg_obj_asstring(key));
result = ISC_R_FAILURE;
}
}
return result;
@ -2514,8 +2525,8 @@ validate_remotes_tls(const cfg_obj_t *config, const cfg_obj_t *tls) {
}
static isc_result_t
validate_remotes(const cfg_obj_t *obj, const cfg_obj_t *config,
uint32_t *countp, isc_mem_t *mctx) {
validate_remotes(const cfg_obj_t *obj, const cfg_obj_t *voptions,
const cfg_obj_t *config, uint32_t *countp, isc_mem_t *mctx) {
isc_result_t result = ISC_R_SUCCESS;
isc_result_t tresult;
uint32_t count = 0;
@ -2544,7 +2555,7 @@ resume:
key = cfg_tuple_get(cfg_listelt_value(element), "key");
tls = cfg_tuple_get(cfg_listelt_value(element), "tls");
result = validate_remotes_key(config, key);
result = validate_remotes_key(voptions, config, key);
if (result != ISC_R_SUCCESS) {
goto out;
}
@ -3680,7 +3691,8 @@ isccfg_check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
}
if (obj != NULL && donotify) {
uint32_t count;
tresult = validate_remotes(obj, config, &count, mctx);
tresult = validate_remotes(obj, voptions, config,
&count, mctx);
if (tresult != ISC_R_SUCCESS && result == ISC_R_SUCCESS)
{
result = tresult;
@ -3766,7 +3778,8 @@ isccfg_check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
result = ISC_R_FAILURE;
} else {
uint32_t count;
tresult = validate_remotes(obj, config, &count, mctx);
tresult = validate_remotes(obj, voptions, config,
&count, mctx);
if (tresult != ISC_R_SUCCESS && result == ISC_R_SUCCESS)
{
result = tresult;
@ -3791,7 +3804,8 @@ isccfg_check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
"parental-agents", &obj);
if (obj != NULL) {
uint32_t count;
tresult = validate_remotes(obj, config, &count, mctx);
tresult = validate_remotes(obj, voptions, config,
&count, mctx);
if (tresult != ISC_R_SUCCESS && result == ISC_R_SUCCESS)
{
result = tresult;