3656. [bug] Treat a all zero netmask as invalid when generating

                        the localnets acl. [RT #34687]

(cherry picked from commit c9ee72cb3acb4562c43333b206737ee94cbbda5e)

diff --git a/CHANGES b/CHANGES
index e3c55958b1bd0b8fe0c26ca8b007d69805c129d2..6c4fae80766c3c56b1650b822dd6aaf8a32db684 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3656.  [bug]           Treat a all zero netmask as invalid when generating
+                       the localnets acl. [RT #34687]
+
        --- 9.9.4 released ---
 
 3643.  [doc]           Clarify RRL "slip" documentation.

diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
index 84bf21d77142056bc470792432f612865fa9b140..514d702978a9c9c574e93cd8b2fe78a596736cbd 100644 (file)
--- a/bin/named/interfacemgr.c
+++ b/bin/named/interfacemgr.c
@@ -553,15 +553,22 @@ setup_locals(ns_interfacemgr_t *mgr, isc_interface_t *interface) {
                return (result);
 
        if (result != ISC_R_SUCCESS) {
-               isc_log_write(IFMGR_COMMON_LOGARGS,
-                             ISC_LOG_WARNING,
+               isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_WARNING,
                              "omitting IPv4 interface %s from "
-                             "localnets ACL: %s",
-                             interface->name,
+                             "localnets ACL: %s", interface->name,
                              isc_result_totext(result));
                return (ISC_R_SUCCESS);
        }
 
+       if (prefixlen == 0U) {
+               isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_WARNING,
+                             "omitting %s interface %s from localnets ACL: "
+                             "zero prefix length detected",
+                             (netaddr->family == AF_INET) ? "IPv4" : "IPv6",
+                             interface->name);
+               return (ISC_R_SUCCESS);
+       }
+
        result = dns_iptable_addprefix(mgr->aclenv.localnets->iptable,
                                       netaddr, prefixlen, ISC_TRUE);
        if (result != ISC_R_SUCCESS)