Skip "deny-answer-address" for non-IN addresses

Ensure that we don't attempt an ACL match for answer addresses
when handling a class-CHAOS zone. This is an additional line of
defense for YWH-PGM40640-74.

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 50f88209dddb7cb94a37247b8dc2304c0f18f1df..7410431284700aa273d841be1b176432319d5746 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -6825,6 +6825,13 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name,
                return true;
        }
 
+       /*
+        * deny-answer-address doesn't apply to non-IN classes.
+        */
+       if (rdataset->rdclass != dns_rdataclass_in) {
+               return true;
+       }
+
        /*
         * Otherwise, search the filter list for a match for each
         * address record.  If a match is found, the address should be