upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-08 23:32:05 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

4483. [func] Check prefixes in acls to make sure the address and

Browse source 
prefix lengths are consistent.  Warn only in
                        BIND 9.11 and earlier. [RT #43367]
This commit is contained in:
Mark Andrews 2016-10-11 14:52:28 +11:00
parent 61463ab7a4
commit c5d4cfc8aa
6 changed files with 32 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,3 +1,7 @@
4483. [func] Check prefixes in acls to make sure the address and
prefix lengths are consistent. Warn only in
BIND 9.11 and earlier. [RT #43367]
4482. [bug] Address use before require check and remove extraneous
dns_message_gettsigkey call in dns_tsig_sign.
[RT #43374]

16
bin/tests/system/checkconf/bad-acl.conf Normal file
View file

@ -0,0 +1,16 @@
/*
* Copyright (C) 2016 Internet Systems Consortium, Inc. ("ISC")
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*/
acl a {
{ "none"; };
{ !19.0.0.0/7; };
};
options {
allow-query { a; };
};

2
bin/tests/system/checkconf/good-acl.conf
View file

@ -8,7 +8,7 @@
acl a {
{ "none"; };
{ !19.0.0.0/0; };
{ !19.0.0.0/8; };
};
options {

2
bin/tests/system/checkconf/good.conf
View file

@ -36,7 +36,7 @@ options {
hostname none;
interface-interval 30;
keep-response-order {
10.0.0.10/24;
10.0.10.0/24;
};
listen-on port 90 {
"any";

2
bin/tests/system/pending/ns2/named.conf
View file

@ -41,7 +41,7 @@ zone "example" {
zone "example.com" {
type master;
file "example.com.db.signed";
allow-update { 10.53.0.0/8; };
allow-update { 10.53.0.0/16; };
};
zone "good" {

11
lib/isccfg/aclconf.c
View file

@ -6,8 +6,6 @@
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*/
/* $Id$ */
#include <config.h>
#include <isc/mem.h>
@ -712,6 +710,15 @@ cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
dns_acl_detach(&de->nestedacl);
continue;
}
result = isc_netaddr_prefixok(&addr, bitlen);
if (result != ISC_R_SUCCESS) {
char buf[ISC_NETADDR_FORMATSIZE + 1];
isc_netaddr_format(&addr, buf, sizeof(buf));
cfg_obj_log(ce, lctx, ISC_LOG_WARNING,
"'%s/%u': address/prefix length "
"mismatch", buf, bitlen);
goto cleanup;
}
/*
* If nesting ACLs (nest_level != 0), we negate