From: Peter Thomassen <peter@desec.io>
Date: Thu, 10 Jul 2025 13:28:12 +0000 (+0200)
Subject: auth: fix set-meta for single-value metadata
X-Git-Tag: rec-5.4.0-alpha0~21^2~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2a7cebaddbd89a534539fd733f73bdb89d248e7d;p=thirdparty%2Fpdns.git

auth: fix set-meta for single-value metadata
---

diff --git a/pdns/pdnsutil.cc b/pdns/pdnsutil.cc
index d43bb2387c..527c4b259b 100644
--- a/pdns/pdnsutil.cc
+++ b/pdns/pdnsutil.cc
@@ -4249,13 +4249,16 @@ static int setMeta(vector<string>& cmds, const std::string_view synopsis)
   const static std::array<string, 7> multiMetaWhitelist = {"ALLOW-AXFR-FROM", "ALLOW-DNSUPDATE-FROM",
     "ALSO-NOTIFY", "TSIG-ALLOW-AXFR", "TSIG-ALLOW-DNSUPDATE", "GSS-ALLOW-AXFR-PRINCIPAL",
     "PUBLISH-CDS"};
-  bool clobber = true;
-  if (cmds.at(0) == "add-meta") {
-    clobber = false;
-    if (find(multiMetaWhitelist.begin(), multiMetaWhitelist.end(), kind) == multiMetaWhitelist.end() && kind.find("X-") != 0) {
+  bool clobber = (cmds.at(0) != "add-meta");
+  if (find(multiMetaWhitelist.begin(), multiMetaWhitelist.end(), kind) == multiMetaWhitelist.end() && kind.find("X-") != 0) {
+    if(!clobber) {
       cerr<<"Refusing to add metadata to single-value metadata "<<kind<<endl;
       return 1;
     }
+    if(cmds.size() > 4) {
+      cerr<<"Refusing to set several metadata to single-value metadata "<<kind<<endl;
+      return 1;
+    }
   }
   vector<string> meta(cmds.begin() + 3, cmds.end());
   return addOrSetMeta(zone, kind, meta, clobber);