4032. [bug] Built-in "empty" zones did not correctly inherit the

                        "allow-transfer" ACL from the options or view.
                        [RT #38310]

diff --git a/CHANGES b/CHANGES
index 7f10deeeed7c8db4ef29cf45368b993161849724..be6f6961a8b10c95e222725d3c2374a7d0952755 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+4032.  [bug]           Built-in "empty" zones did not correctly inherit the
+                       "allow-transfer" ACL from the options or view.
+                       [RT #38310]
+
 4031.  [bug]           named-checkconf -z failed to report a missing file
                        with a hint zone. [RT #38294]
 

diff --git a/bin/named/server.c b/bin/named/server.c
index 258a813d8bad570a4f1b0d903fa331d0c39a5065..ab4feb4bf8d8696f1ae2bf66258df267cc298c73 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -2296,16 +2296,19 @@ create_empty_zone(dns_zone_t *zone, dns_name_t *name, dns_view_t *view,
        dns_zone_setnotifytype(zone, dns_notifytype_no);
        dns_zone_setdialup(zone, dns_dialuptype_no);
        dns_zone_setautomatic(zone, ISC_TRUE);
-       if (view->queryacl)
+       if (view->queryacl != NULL)
                dns_zone_setqueryacl(zone, view->queryacl);
        else
                dns_zone_clearqueryacl(zone);
-       if (view->queryonacl)
+       if (view->queryonacl != NULL)
                dns_zone_setqueryonacl(zone, view->queryonacl);
        else
                dns_zone_clearqueryonacl(zone);
        dns_zone_clearupdateacl(zone);
-       dns_zone_clearxfracl(zone);
+       if (view->transferacl != NULL)
+               dns_zone_setxfracl(zone, view->transferacl);
+       else
+               dns_zone_clearxfracl(zone);
 
        CHECK(setquerystats(zone, view->mctx, statlevel));
        if (db != NULL) {

diff --git a/bin/tests/system/emptyzones/clean.sh b/bin/tests/system/emptyzones/clean.sh
index 4ac1fb17ae83a1885a1cf46ebfba567b23a723e4..ea1ee7449ce29a68f02df2b317eccf97820be5d5 100644 (file)
--- a/bin/tests/system/emptyzones/clean.sh
+++ b/bin/tests/system/emptyzones/clean.sh
@@ -14,3 +14,4 @@
 
 rm -f ns1/named.conf
 rm -f ns*/named.lock
+rm -f dig.out.test*

diff --git a/bin/tests/system/emptyzones/ns1/named2.conf b/bin/tests/system/emptyzones/ns1/named2.conf
index 60cc5efd793178e6f291741cc136410bfbe28418..ae0e6e2f99085181e47ae97bd31b35dd778ff5a6 100644 (file)
--- a/bin/tests/system/emptyzones/ns1/named2.conf
+++ b/bin/tests/system/emptyzones/ns1/named2.conf
@@ -41,9 +41,14 @@ options {
                except-from { "goodcname.example.net";
                              "gooddname.example.net"; };
        allow-query {!10.53.0.8; any; };
+       allow-transfer { none; };
 };
 
 zone "." {
        type hint;
        file "root.hint";
 };
+
+zone "1.10.in-addr.arpa" {
+       type master; file "empty.db";
+};

diff --git a/bin/tests/system/emptyzones/tests.sh b/bin/tests/system/emptyzones/tests.sh
index 755d89d56fc354d903ca8acc47ddb8e10b72ab6c..672f9d40554f24e8f8a522838ce9888cda0585ce 100644 (file)
--- a/bin/tests/system/emptyzones/tests.sh
+++ b/bin/tests/system/emptyzones/tests.sh
@@ -32,4 +32,12 @@ $DIG +vc version.bind txt ch @10.53.0.1 -p 5300 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo "I:check that allow-transfer { none; } works ($n)"
+ret=0
+$DIG axfr 10.in-addr.arpa @10.53.0.1 -p 5300 +all > dig.out.test$n || ret=1
+grep "status: REFUSED" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 exit $status

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index d9767b41c6e54cb75317ca70c74813aa4c6d818f..44db50915fc5cd78494f8caed21a15bd4f8e4658 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -459,6 +459,12 @@
          contacting authoritative servers for the first time.
         </para>
       </listitem>
+      <listitem>
+        <para>
+         Built-in "empty" zones did not correctly inherit the
+         "allow-transfer" ACL from the options or view. [RT #38310]
+        </para>
+      </listitem>
     </itemizedlist>
   </sect2>
   <sect2 id="end_of_life">