Skip "deny-answer-address" for non-IN addresses

Ensure that we don't attempt an ACL match for answer addresses
when handling a class-CHAOS zone. This is an additional line of
defense for YWH-PGM40640-74.

(cherry picked from commit 4cd3d8e6d866143ddc62df821a1007bf3ee7f083)
(cherry picked from commit fa60101e910346e64fa2a684b903fbcb84d8243b)

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 1a4dbc6c6003ea745db75987122c73aeea0bb7a1..c7411fa88394e7e900b2fe2804061672c0d5b792 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -6480,9 +6480,16 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name,
        }
 
        /*
-        * Otherwise, search the filter list for a match for each address
-        * record.  If a match is found, the address should be filtered,
-        * so should the entire answer.
+        * deny-answer-address doesn't apply to non-IN classes.
+        */
+       if (rdataset->rdclass != dns_rdataclass_in) {
+               return true;
+       }
+
+       /*
+        * Otherwise, search the filter list for a match for each
+        * address record.  If a match is found, the address should be
+        * filtered, so should the entire answer.
         */
        for (result = dns_rdataset_first(rdataset);
             result == ISC_R_SUCCESS;