From: Mark Andrews <marka@isc.org>
Date: Fri, 12 Feb 2021 03:51:28 +0000 (+1100)
Subject: Address inconsistencies in checking added RRsets
X-Git-Tag: v9.17.13~35^2~5^2~3
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2ca0bd882d389b6b1f8c0533560a78e456de4154;p=thirdparty%2Fbind9.git

Address inconsistencies in checking added RRsets

loading_addrdataset() rejects SOA RRsets which are not at top of zone.
addrdataset() should similarly reject such RRsets.
---

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index f9c93416eda..0e4872d1bce 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -6798,6 +6798,13 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb);
 
 	if (rbtdb->common.methods == &zone_methods) {
+		/*
+		 * SOA records are only allowed at top of zone.
+		 */
+		if (rdataset->type == dns_rdatatype_soa &&
+		    node != rbtdb->origin_node) {
+			return (DNS_R_NOTZONETOP);
+		}
 		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
 		REQUIRE(((rbtnode->nsec == DNS_RBT_NSEC_NSEC3 &&
 			  (rdataset->type == dns_rdatatype_nsec3 ||