Disable outgoing mirror zone transfers by default

As mirror zone data should be treated the way validated, cached DNS
responses are, outgoing mirror zone transfers should be disabled unless
they are explicitly enabled by zone configuration.

diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index 8c94472367ae862173e8991c060938605b726e41..0e7539e7f70af0d7c279088a8ec76c3ae3e7fc40 100644 (file)
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -1727,8 +1727,25 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
                obj = NULL;
                (void)cfg_map_get(zoptions, "mirror", &obj);
                if (obj != NULL) {
+                       isc_boolean_t mirror = cfg_obj_asboolean(obj);
                        dns_zone_setoption(mayberaw, DNS_ZONEOPT_MIRROR,
-                                          cfg_obj_asboolean(obj));
+                                          mirror);
+                       if (mirror) {
+                               /*
+                                * Disable outgoing zone transfers unless they
+                                * are explicitly enabled by zone
+                                * configuration.
+                                */
+                               obj = NULL;
+                               (void)cfg_map_get(zoptions, "allow-transfer",
+                                                 &obj);
+                               if (obj == NULL) {
+                                       dns_acl_t *none;
+                                       RETERR(dns_acl_none(mctx, &none));
+                                       dns_zone_setxfracl(zone, none);
+                                       dns_acl_detach(&none);
+                               }
+                       }
                }
 
                obj = NULL;

diff --git a/bin/tests/system/mirror/tests.sh b/bin/tests/system/mirror/tests.sh
index b50529529e90cc7f380b3e4fd97f5197377a72ab..ac85a429666ec481bafda4b246edcd9f833a7bb8 100644 (file)
--- a/bin/tests/system/mirror/tests.sh
+++ b/bin/tests/system/mirror/tests.sh
@@ -339,5 +339,13 @@ grep "flags:.* ad" dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo_i "checking that outgoing transfers of mirror zones are disabled by default ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.3 . AXFR > dig.out.ns3.test$n 2>&1 || ret=1
+grep "; Transfer failed" dig.out.ns3.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1