ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

[master] fix "allow-transfer" inheritance and clean up ACL configuration

Browse Source 
4836.	[bug]		Zones created using "rndc addzone" could
			temporarily fail to inherit an "allow-transfer"
			ACL that had been configured in the options
			statement. [RT #46603]
This commit is contained in:
Evan Hunt
2017-11-30 12:37:08 -08:00
parent a4a148cf9a
commit e197a2bd15
10 changed files with 296 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
bin/tests/system/acl/tests.sh
View File

@@ -172,5 +172,65 @@ t=`expr $t + 1`
$DIG example. soa @10.53.0.2 +subnet="192.0.2.128/32" -p 5300 > dig.out.${t}
grep "CLIENT-SUBNET.*192.0.2.128/32/24" dig.out.${t} > /dev/null || { echo "I:test $t failed" ; status=1; }
# AXFR tests against ns3
echo "I:testing allow-transfer ACLs against ns3 (no existing zones)"
echo "I:calling addzone example.com on ns3"
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 addzone 'example.com {type master; file "example.db"; }; '
sleep 1
t=`expr $t + 1`
ret=0
echo "I:checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
$DIG @10.53.0.3 -p 5300 example.com axfr > dig.out.${t} 2>&1
grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
[ $ret -eq 0 ] || echo "I:failed"
status=`expr $status + $ret`
echo "I:calling rndc reconfig"
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 reconfig
sleep 1
t=`expr $t + 1`
ret=0
echo "I:re-checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
$DIG @10.53.0.3 -p 5300 example.com axfr > dig.out.${t} 2>&1
grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
[ $ret -eq 0 ] || echo "I:failed"
status=`expr $status + $ret`
# AXFR tests against ns4
echo "I:testing allow-transfer ACLs against ns4 (1 pre-existing zone)"
echo "I:calling addzone example.com on ns4"
$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 addzone 'example.com {type master; file "example.db"; }; '
sleep 1
t=`expr $t + 1`
ret=0
echo "I:checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
$DIG @10.53.0.4 -p 5300 example.com axfr > dig.out.${t} 2>&1
grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
[ $ret -eq 0 ] || echo "I:failed"
status=`expr $status + $ret`
echo "I:calling rndc reconfig"
$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 reconfig
sleep 1
t=`expr $t + 1`
ret=0
echo "I:re-checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
$DIG @10.53.0.4 -p 5300 example.com axfr > dig.out.${t} 2>&1
grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
[ $ret -eq 0 ] || echo "I:failed"
status=`expr $status + $ret`
echo "I:exit status: $status"
[ $status -eq 0 ] || exit 1