upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-28 04:34:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Log "not authoritative for update zone" more clearly

Browse source 
Ensure the update zone name is mentioned in the NOTAUTH error message
in the server log, so that it is easier to track down problematic
update clients. There are two cases: either the update zone is
unrelated to any of the server's zones (previously no zone was
mentioned); or the update zone is a subdomain of one or more of the
server's zones (previously the name of the irrelevant parent zone was
misleadingly logged).

Closes #3209

(cherry picked from commit 84c4eb02e7)
This commit is contained in:
Tony Finch 2022-03-15 17:57:43 +00:00
parent d45abcbd2f
commit ec54de9e47
3 changed files with 40 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
CHANGES
View file

@ -1,3 +1,8 @@
5843. [bug] When an UPDATE targets a zone that is not configured,
the requested zone name is now logged in the "not
authoritative" error message, so that it is easier to
track down problematic update clients. [GL #3209]
5838. [cleanup] When modifying a member zone in a catalog zone, and it
is detected that the zone exists and was not created by
the current catalog zone, distinguish the two cases when

26
bin/tests/system/nsupdate/tests.sh
View file

@ -82,6 +82,32 @@ digcomp knowngood.ns1.before dig.out.ns1 || ret=1
digcomp knowngood.ns1.before dig.out.ns2 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
ret=0
echo_i "ensure an unrelated zone is mentioned in its NOTAUTH log"
$NSUPDATE -k ns1/ddns.key > nsupdate.out 2>&1 << END && ret=1
server 10.53.0.1 ${PORT}
zone unconfigured.test
update add unconfigured.test 600 IN A 10.53.0.1
send
END
grep NOTAUTH nsupdate.out > /dev/null 2>&1 || ret=1
grep ' unconfigured.test: not authoritative' ns1/named.run \
> /dev/null 2>&1 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
ret=0
echo_i "ensure a subdomain is mentioned in its NOTAUTH log"
$NSUPDATE -k ns1/ddns.key > nsupdate.out 2>&1 << END && ret=1
server 10.53.0.1 ${PORT}
zone sub.sub.example.nil
update add sub.sub.sub.example.nil 600 IN A 10.53.0.1
send
END
grep NOTAUTH nsupdate.out > /dev/null 2>&1 || ret=1
grep ' sub.sub.example.nil: not authoritative' ns1/named.run \
> /dev/null 2>&1 || ret=1
[ $ret = 0 ] || { echo_i "failed"; status=1; }
ret=0
echo_i "updating zone"
# nsupdate will print a ">" prompt to stdout as it gets each input line.

10
lib/ns/update.c
View file

@ -1726,7 +1726,15 @@ ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
result = dns_zt_find(client->view->zonetable, zonename, 0, NULL, &zone);
if (result != ISC_R_SUCCESS) {
FAILC(DNS_R_NOTAUTH, "not authoritative for update zone");
/*
* If we found a zone that is a parent of the update zonename,
* detach it so it isn't mentioned in log - it is irrelevant.
*/
if (zone != NULL) {
dns_zone_detach(&zone);
}
FAILN(DNS_R_NOTAUTH, zonename,
"not authoritative for update zone");
}
/*