From: Michał Kępień <michal@isc.org>
Date: Thu, 28 Jun 2018 11:38:39 +0000 (+0200)
Subject: Disable outgoing mirror zone transfers by default
X-Git-Tag: v9.13.2~7^2~5
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3af412c0e093af9049266a9366d301956583d427;p=thirdparty%2Fbind9.git

Disable outgoing mirror zone transfers by default

As mirror zone data should be treated the way validated, cached DNS
responses are, outgoing mirror zone transfers should be disabled unless
they are explicitly enabled by zone configuration.
---

diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index 8c94472367a..0e7539e7f70 100644
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -1727,8 +1727,25 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		(void)cfg_map_get(zoptions, "mirror", &obj);
 		if (obj != NULL) {
+			isc_boolean_t mirror = cfg_obj_asboolean(obj);
 			dns_zone_setoption(mayberaw, DNS_ZONEOPT_MIRROR,
-					   cfg_obj_asboolean(obj));
+					   mirror);
+			if (mirror) {
+				/*
+				 * Disable outgoing zone transfers unless they
+				 * are explicitly enabled by zone
+				 * configuration.
+				 */
+				obj = NULL;
+				(void)cfg_map_get(zoptions, "allow-transfer",
+						  &obj);
+				if (obj == NULL) {
+					dns_acl_t *none;
+					RETERR(dns_acl_none(mctx, &none));
+					dns_zone_setxfracl(zone, none);
+					dns_acl_detach(&none);
+				}
+			}
 		}
 
 		obj = NULL;
diff --git a/bin/tests/system/mirror/tests.sh b/bin/tests/system/mirror/tests.sh
index b50529529e9..ac85a429666 100644
--- a/bin/tests/system/mirror/tests.sh
+++ b/bin/tests/system/mirror/tests.sh
@@ -339,5 +339,13 @@ grep "flags:.* ad" dig.out.ns3.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo_i "checking that outgoing transfers of mirror zones are disabled by default ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.3 . AXFR > dig.out.ns3.test$n 2>&1 || ret=1
+grep "; Transfer failed" dig.out.ns3.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1