ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Add 'tls' validation for XoT enabled primaries

Browse Source 
This commit ensure that the 'tls' name specified in the 'primaries'
clause of a 'zone' statement is a valid one.

Prior to that such a name would be silently accepted, leading to
silent XFRs-via-TLS failures.
This commit is contained in:
Artem Boldariev
2021-11-30 00:31:36 +02:00
parent 7843fb4ece
commit 69cef39099
4 changed files with 73 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
bin/tests/system/checkconf/bad-dot-primaries.conf Normal file
View File

@@ -0,0 +1,17 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
zone "example" {
type secondary;
primaries { 10.53.0.1 tls undefined; };
file "example.db";
allow-transfer { any; };
};

17
bin/tests/system/checkconf/good-dot-primaries-ephemeral.conf Normal file
View File

@@ -0,0 +1,17 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
zone "example" {
type secondary;
primaries { 10.53.0.1 tls ephemeral; };
file "example.db";
allow-transfer { any; };
};

23
bin/tests/system/checkconf/good-dot-primaries.conf Normal file
View File

@@ -0,0 +1,23 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
tls local-tls {
protocols { TLSv1.2; };
ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
prefer-server-ciphers no;
};
zone "example" {
type secondary;
primaries { 10.53.0.1 tls local-tls; };
file "example.db";
allow-transfer { any; };
};

16
lib/bind9/check.c
View File

@@ -2434,6 +2434,22 @@ resume:
result = tresult;
}
}
if (strcasecmp(str, "ephemeral") != 0) {
const cfg_obj_t *tlsmap = NULL;
tlsmap = find_maplist(config, "tls",
str);
if (tlsmap == NULL) {
cfg_obj_log(
tls, logctx,
ISC_LOG_ERROR,
"tls '%s' is not "
"defined",
cfg_obj_asstring(tls));
result = ISC_R_FAILURE;
}
}
}
continue;
}