From: Evan Hunt <each@isc.org>
Date: Wed, 22 Jul 2026 19:59:17 +0000 (-0700)
Subject: check asnum validity in geoip ACLs
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c37d432c5ea4aa46b4fde6a3ddb7c9080d1d5eab;p=thirdparty%2Fbind9.git

check asnum validity in geoip ACLs

We now check the validity of autonomous system (AS) numbers when
parsing geoip ACLs that use "asnum" elements at configuration time.

"asnum" values start with an optional case-insensitive "AS" prefix,
followed only by decimal digits, with no spaces or other extraneous
characters. The value represented cannot exceed MAXUINT32.
---

diff --git a/bin/tests/system/geoip2/conf/bad-asnum.conf b/bin/tests/system/geoip2/conf/bad-asnum.conf
new file mode 100644
index 00000000000..637bc6f627e
--- /dev/null
+++ b/bin/tests/system/geoip2/conf/bad-asnum.conf
@@ -0,0 +1,17 @@
+// NS2
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+};
+
+view one {
+	match-clients { geoip asnum "AS1234JUNK"; };
+	zone "example" {
+		type primary;
+		file "example1.db";
+	};
+};
diff --git a/bin/tests/system/geoip2/conf/good-options.conf b/bin/tests/system/geoip2/conf/good-options.conf
index d29871884f9..345561a6d90 100644
--- a/bin/tests/system/geoip2/conf/good-options.conf
+++ b/bin/tests/system/geoip2/conf/good-options.conf
@@ -17,5 +17,6 @@ options {
 		geoip timezone "America/Los_Angeles";
 		geoip postal 95060;
 		geoip postalcode 95060;
+		geoip asnum "AS12345";
 	};
 };
diff --git a/lib/isccfg/aclconf.c b/lib/isccfg/aclconf.c
index b0840deaacb..df8b64790db 100644
--- a/lib/isccfg/aclconf.c
+++ b/lib/isccfg/aclconf.c
@@ -11,12 +11,14 @@
  * information regarding copyright ownership.
  */
 
+#include <ctype.h>
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
 
 #include <isc/log.h>
 #include <isc/mem.h>
+#include <isc/parseint.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
@@ -537,7 +539,20 @@ parse_geoip_element(const cfg_obj_t *obj, cfg_aclconfctx_t *ctx,
 		strlcpy(de.geoip_elem.as_string, search,
 			sizeof(de.geoip_elem.as_string));
 	} else if (strcasecmp(stype, "asnum") == 0) {
+		const char *s = search;
+		uint32_t val;
+
+		/* check asnum validity */
 		subtype = dns_geoip_as_asnum;
+		if (strncasecmp(s, "AS", 2) == 0) {
+			s += 2;
+		}
+		if (isc_parse_uint32(&val, s, 10) != ISC_R_SUCCESS) {
+			cfg_obj_log(obj, ISC_LOG_ERROR, "invalid asnum '%s'",
+				    search);
+			return ISC_R_UNEXPECTEDTOKEN;
+		}
+
 		strlcpy(de.geoip_elem.as_string, search,
 			sizeof(de.geoip_elem.as_string));
 	} else if (strcasecmp(stype, "org") == 0) {