upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-03-11 02:30:44 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

[master] disallow delzone on policiy zones

Browse source 
4311.	[bug]		Prevent "rndc delzone" from being used on
			response-policy zones. [RT #41593]
This commit is contained in:
Evan Hunt 2016-02-01 09:33:14 -08:00
parent d1dbf6b20f
commit ec450fde7c
4 changed files with 32 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
CHANGES
View file

@ -1,3 +1,6 @@
4311. [bug] Prevent "rndc delzone" from being used on
response-policy zones. [RT #41593]
4310. [performance] Use __builtin_expect() where available to annotate
conditions with known behavior. [RT #41411]

10
bin/named/server.c
View file

@ -10211,6 +10211,16 @@ ns_server_delzone(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
INSIST(zonename != NULL);
/* Is this a policy zone? */
if (dns_zone_get_rpz_num(zone) != DNS_RPZ_INVALID_NUM) {
TCHECK(putstr(text, "zone '"));
TCHECK(putstr(text, zonename));
TCHECK(putstr(text,
"' cannot be deleted: response-policy zone."));
result = ISC_R_FAILURE;
goto cleanup;
}
result = isc_task_beginexclusive(server->task);
RUNTIME_CHECK(result == ISC_R_SUCCESS);
exclusive = ISC_TRUE;

19
bin/tests/system/addzone/ns2/named2.conf
View file

@ -14,8 +14,6 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: named2.conf,v 1.5 2011/06/17 23:47:49 tbox Exp $ */
controls { /* empty */ };
include "../../common/controls.conf";
@ -33,10 +31,17 @@ view internal {
allow-new-zones no;
recursion yes;
response-policy { zone "policy"; };
zone "." {
type hint;
file "../../common/root.hint";
};
zone "policy" {
type master;
file "normal.db";
};
};
view external {
@ -54,9 +59,9 @@ view external {
acl match { none; };
acl nobody { none; };
view extra {
match-clients { match; };
allow-new-zones yes;
allow-transfer { nobody; };
allow-query { nobody; };
allow-recursion { nobody; };
match-clients { match; };
allow-new-zones yes;
allow-transfer { nobody; };
allow-query { nobody; };
allow-recursion { nobody; };
};

9
bin/tests/system/addzone/tests.sh
View file

@ -14,8 +14,6 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
# $Id: tests.sh,v 1.6 2011/06/17 23:47:49 tbox Exp $
SYSTEMTESTTOP=..
. $SYSTEMTESTTOP/conf.sh
@ -356,6 +354,13 @@ n=`expr $n + 1`
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:attempting to delete a policy zone ($n)"
ret=0
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 delzone 'policy in internal' 2>&1 | grep 'cannot be deleted' > /dev/null || ret=1
n=`expr $n + 1`
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:ensure the configuration context is cleaned up correctly ($n)"
ret=0
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reconfig > /dev/null 2>&1 || ret=1