[master] reject $ORIGIN before inherited name

3445.	[bug]		Reject zone files with blank owner names immediately
			after $ORIGIN directives. [RT #31848]

diff --git a/CHANGES b/CHANGES
index 932f42f79cb3ab0f3e2b5106ef6fc1276b327e6c..cb6c92dcab5ae76b9e2b1ba6662fe1a0af524f7c 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3445.  [bug]           Reject zone files with blank owner names immediately
+                       after $ORIGIN directives. [RT #31848]
+
 3444.  [bug]           The NOQNAME proof was not being returned from cached
                        insecure responses. [RT #21409]
 

diff --git a/lib/dns/include/dns/result.h b/lib/dns/include/dns/result.h
index 18c49ba8a04a4de762732852b10b8a8b2990ae92..90ac11110825779da2b7a55d94eb762c83840144 100644 (file)
--- a/lib/dns/include/dns/result.h
+++ b/lib/dns/include/dns/result.h
@@ -152,8 +152,9 @@
 #define DNS_R_BROKENCHAIN              (ISC_RESULTCLASS_DNS + 106)
 #define DNS_R_EXPIRED                  (ISC_RESULTCLASS_DNS + 107)
 #define DNS_R_NOTDYNAMIC               (ISC_RESULTCLASS_DNS + 108)
+#define DNS_R_UNSAFENAME               (ISC_RESULTCLASS_DNS + 109)
 
-#define DNS_R_NRESULTS                 109     /*%< Number of results */
+#define DNS_R_NRESULTS                 110     /*%< Number of results */
 
 /*
  * DNS wire format rcodes.

diff --git a/lib/dns/master.c b/lib/dns/master.c
index 46867dcc5b8ec553a81730d80aaa0eb5eb0dc744..e701549acdb30f85648b77e7652d888f2ecb10f0 100644 (file)
--- a/lib/dns/master.c
+++ b/lib/dns/master.c
@@ -160,6 +160,7 @@ struct dns_incctx {
        int                     glue_in_use;
        int                     current_in_use;
        int                     origin_in_use;
+       isc_boolean_t           origin_changed;
        isc_boolean_t           drop;
        unsigned int            glue_line;
        unsigned int            current_line;
@@ -1406,6 +1407,7 @@ load_text(dns_loadctx_t *lctx) {
                                ictx->origin_in_use = new_in_use;
                                ictx->in_use[ictx->origin_in_use] = ISC_TRUE;
                                ictx->origin = new_name;
+                               ictx->origin_changed = ISC_TRUE;
                                finish_origin = ISC_FALSE;
                                EXPECTEOL;
                                continue;
@@ -1578,8 +1580,31 @@ load_text(dns_loadctx_t *lctx) {
                                } else if (result != ISC_R_SUCCESS)
                                        goto insist_and_cleanup;
                        }
+
+                       if (ictx->origin_changed) {
+                               char cbuf[DNS_NAME_FORMATSIZE];
+                               char obuf[DNS_NAME_FORMATSIZE];
+                               dns_name_format(ictx->current, cbuf,
+                                               sizeof(cbuf));
+                               dns_name_format(ictx->origin, obuf,
+                                               sizeof(obuf));
+                               (*callbacks->error)(callbacks,
+                                       "%s:%lu: record with inherited "
+                                       "owner (%s) immediately after "
+                                       "$ORIGIN (%s)", source, line,
+                                       cbuf, obuf);
+                               result = DNS_R_UNSAFENAME;
+                               if (MANYERRS(lctx, result)) {
+                                       SETRESULT(lctx, result);
+                                       read_till_eol = ISC_TRUE;
+                                       continue;
+                               } else if (result != ISC_R_SUCCESS)
+                                       goto insist_and_cleanup;
+                       }
                }
 
+               ictx->origin_changed = ISC_FALSE;
+
                if (dns_rdataclass_fromtext(&rdclass,
                                            &token.value.as_textregion)
                                == ISC_R_SUCCESS)

diff --git a/lib/dns/result.c b/lib/dns/result.c
index 192ea06b89a5bb77c4659658da27e5b613f28b54..31d5ef364282878e244127388a39b05bc613c246 100644 (file)
--- a/lib/dns/result.c
+++ b/lib/dns/result.c
@@ -160,8 +160,9 @@ static const char *text[DNS_R_NRESULTS] = {
 
        "not master",                          /*%< 105 DNS_R_NOTMASTER */
        "broken trust chain",                  /*%< 106 DNS_R_BROKENCHAIN */
-       "expired",                             /*%< 106 DNS_R_EXPIRED */
-       "not dynamic",                         /*%< 107 DNS_R_NOTDYNAMIC */
+       "expired",                             /*%< 107 DNS_R_EXPIRED */
+       "not dynamic",                         /*%< 108 DNS_R_NOTDYNAMIC */
+       "unsafe name",                         /*%< 109 DNS_R_UNSAFENAME */
 };
 
 static const char *rcode_text[DNS_R_NRCODERESULTS] = {

diff --git a/lib/dns/tests/master_test.c b/lib/dns/tests/master_test.c
index 093e930a68f53d7b43ce59ad0539f4a483dbb1f6..86a514286928a901e117d0f622e04eb306dcd0b1 100644 (file)
--- a/lib/dns/tests/master_test.c
+++ b/lib/dns/tests/master_test.c
@@ -622,6 +622,29 @@ ATF_TC_BODY(dumpraw, tc) {
        dns_test_end();
 }
 
+/* Origin change test */
+ATF_TC(neworigin);
+ATF_TC_HEAD(neworigin, tc) {
+       atf_tc_set_md_var(tc, "descr", "dns_master_loadfile() rejects "
+                                      "zones with inherited name following "
+                                      "$ORIGIN");
+}
+ATF_TC_BODY(neworigin, tc) {
+       isc_result_t result;
+
+       UNUSED(tc);
+
+       result = dns_test_begin(NULL, ISC_FALSE);
+       ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+       setup_master();
+       result = test_master("testdata/master/master17.data",
+                            dns_masterformat_text);
+       ATF_REQUIRE_EQ(result, DNS_R_UNSAFENAME);
+
+       dns_test_end();
+}
+
 /*
  * Main
  */
@@ -643,6 +666,7 @@ ATF_TP_ADD_TCS(tp) {
        ATF_TP_ADD_TC(tp, dumpraw);
        ATF_TP_ADD_TC(tp, toobig);
        ATF_TP_ADD_TC(tp, maxrdata);
+       ATF_TP_ADD_TC(tp, neworigin);
 
        return (atf_no_error());
 }

diff --git a/lib/dns/tests/testdata/master/master17.data b/lib/dns/tests/testdata/master/master17.data
new file mode 100644 (file)
index 0000000..4b2b63d
--- /dev/null
+++ b/lib/dns/tests/testdata/master/master17.data
@@ -0,0 +1,14 @@
+$ORIGIN test.
+$TTL 1000
+@              in      soa     localhost. postmaster.localhost. (
+                               1993050801      ;serial
+                               3600            ;refresh
+                               1800            ;retry
+                               604800          ;expiration
+                               3600 )          ;minimum
+               in      ns      ns.test.
+               in      ns      ns2.test.
+               in      ns      ns3.test.
+b              in      a       1.2.3.4
+$ORIGIN sub.test.
+               in      a       4.3.2.1