check asnum validity in geoip ACLs

We now check the validity of autonomous system (AS) numbers when
parsing geoip ACLs that use "asnum" elements at configuration time.

"asnum" values start with an optional case-insensitive "AS" prefix,
followed only by decimal digits, with no spaces or other extraneous
characters. The value represented cannot exceed MAXUINT32.

diff --git a/bin/tests/system/geoip2/conf/bad-asnum.conf b/bin/tests/system/geoip2/conf/bad-asnum.conf
new file mode 100644 (file)
index 0000000..637bc6f
--- /dev/null
+++ b/bin/tests/system/geoip2/conf/bad-asnum.conf
@@ -0,0 +1,17 @@
+// NS2
+
+options {
+       query-source address 10.53.0.2;
+       notify-source 10.53.0.2;
+       transfer-source 10.53.0.2;
+       pid-file "named.pid";
+       listen-on { 10.53.0.2; };
+};
+
+view one {
+       match-clients { geoip asnum "AS1234JUNK"; };
+       zone "example" {
+               type primary;
+               file "example1.db";
+       };
+};

diff --git a/bin/tests/system/geoip2/conf/good-options.conf b/bin/tests/system/geoip2/conf/good-options.conf
index d29871884f95751752d495e53ee154dab57bb4aa..345561a6d90ea21e1b6812f97727b5006d5f9d1b 100644 (file)
--- a/bin/tests/system/geoip2/conf/good-options.conf
+++ b/bin/tests/system/geoip2/conf/good-options.conf
@@ -17,5 +17,6 @@ options {
                geoip timezone "America/Los_Angeles";
                geoip postal 95060;
                geoip postalcode 95060;
+               geoip asnum "AS12345";
        };
 };

diff --git a/lib/isccfg/aclconf.c b/lib/isccfg/aclconf.c
index b0840deaacb7c91edf4856b4bced8fed69981751..df8b64790dbc00179be69b7556040e752d58c36f 100644 (file)
--- a/lib/isccfg/aclconf.c
+++ b/lib/isccfg/aclconf.c
@@ -11,12 +11,14 @@
  * information regarding copyright ownership.
  */
 
+#include <ctype.h>
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
 
 #include <isc/log.h>
 #include <isc/mem.h>
+#include <isc/parseint.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
@@ -537,7 +539,20 @@ parse_geoip_element(const cfg_obj_t *obj, cfg_aclconfctx_t *ctx,
                strlcpy(de.geoip_elem.as_string, search,
                        sizeof(de.geoip_elem.as_string));
        } else if (strcasecmp(stype, "asnum") == 0) {
+               const char *s = search;
+               uint32_t val;
+
+               /* check asnum validity */
                subtype = dns_geoip_as_asnum;
+               if (strncasecmp(s, "AS", 2) == 0) {
+                       s += 2;
+               }
+               if (isc_parse_uint32(&val, s, 10) != ISC_R_SUCCESS) {
+                       cfg_obj_log(obj, ISC_LOG_ERROR, "invalid asnum '%s'",
+                                   search);
+                       return ISC_R_UNEXPECTEDTOKEN;
+               }
+
                strlcpy(de.geoip_elem.as_string, search,
                        sizeof(de.geoip_elem.as_string));
        } else if (strcasecmp(stype, "org") == 0) {