don't fail when allow-update{,-forwarding} is used globally

(cherry picked from commit 91dca0f8da192e8b3439e80717bad3bfc139118f)

diff --git a/bin/named/server.c b/bin/named/server.c
index 6c77f779d4fcdaefd7103e2a7988621e7aa463c6..5ec13dba0c7d4cdf883514a8e9b2bd5f2eadcb5b 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -5021,8 +5021,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 
        /*
         * Configure default allow-update and allow-update-forwarding ACLs,
-        * so they can be inherited by zones.  (Note these cannot be set at
-        * options/view level.)
+        * so they can be inherited by zones. (XXX: These are not
+        * read from the options/view level here. However, they may be
+        * read from there in zoneconf.c:configure_zone_acl() later.)
         */
        if (view->updateacl == NULL) {
                CHECK(configure_view_acl(NULL, NULL, named_g_config,

diff --git a/bin/tests/system/checkconf/bad-allow-update-forwarding-view.conf b/bin/tests/system/checkconf/good-allow-update-forwarding-view.conf
similarity index 97%
rename from bin/tests/system/checkconf/bad-allow-update-forwarding-view.conf
rename to bin/tests/system/checkconf/good-allow-update-forwarding-view.conf
index 47f34950ada167855ce70a8732edb96ff2d0b3c8..0c2aeb8ddbc421923065b05fd74f7198e099c6d1 100644 (file)
--- a/bin/tests/system/checkconf/bad-allow-update-forwarding-view.conf
+++ b/bin/tests/system/checkconf/good-allow-update-forwarding-view.conf
@@ -9,6 +9,6 @@
  * information regarding copyright ownership.
  */
 
-view {
+view one {
        allow-update-forwarding { any; };
 };

diff --git a/bin/tests/system/checkconf/bad-allow-update-forwarding.conf b/bin/tests/system/checkconf/good-allow-update-forwarding.conf
similarity index 100%
rename from bin/tests/system/checkconf/bad-allow-update-forwarding.conf
rename to bin/tests/system/checkconf/good-allow-update-forwarding.conf

diff --git a/bin/tests/system/checkconf/bad-allow-update-view.conf b/bin/tests/system/checkconf/good-allow-update-view.conf
similarity index 97%
rename from bin/tests/system/checkconf/bad-allow-update-view.conf
rename to bin/tests/system/checkconf/good-allow-update-view.conf
index 22c4361e1ed5edfbf4cf4826f2d98ede006e52e9..a893b9a2c5e8f0d189130b87adbc0d99dd15b6e7 100644 (file)
--- a/bin/tests/system/checkconf/bad-allow-update-view.conf
+++ b/bin/tests/system/checkconf/good-allow-update-view.conf
@@ -9,6 +9,6 @@
  * information regarding copyright ownership.
  */
 
-view {
+view one {
        allow-update { any; };
 };

diff --git a/bin/tests/system/checkconf/bad-allow-update.conf b/bin/tests/system/checkconf/good-allow-update.conf
similarity index 100%
rename from bin/tests/system/checkconf/bad-allow-update.conf
rename to bin/tests/system/checkconf/good-allow-update.conf

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 33d7499f0ebb914a144509b3bdd042fbe13c0e77..9213ef588b96e6da94d3d0669b37280214ee297c 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -7051,15 +7051,21 @@ options {
                  When set in the <command>zone</command> statement for
                  a master zone, specifies which hosts are allowed to
                  submit Dynamic DNS updates to that zone.  The default
-                 is to deny updates from all hosts.  This can only
-                 be set at the <command>zone</command> level, not in
-                 <command>options</command> or <command>view</command>.
+                 is to deny updates from all hosts.
                </para>
                <para>
                  Note that allowing updates based on the
                  requestor's IP address is insecure; see
                  <xref linkend="dynamic_update_security"/> for details.
                </para>
+               <para>
+                 In general this option should only be set at the
+                 <command>zone</command> level. While a default
+                 value can be set at the <command>options</command> or
+                 <command>view</command> level and inherited by zones,
+                 this could lead to some zones unintentionally allowing
+                 updates.
+               </para>
              </listitem>
            </varlistentry>
 
@@ -7072,9 +7078,7 @@ options {
                  submit Dynamic DNS updates and have them be forwarded
                  to the master.  The default is
                  <userinput>{ none; }</userinput>, which means that no
-                 update forwarding will be performed.  This can only be
-                 set at the <command>zone</command> level, not in
-                 <command>options</command> or <command>view</command>.
+                 update forwarding will be performed.
                </para>
                <para>
                  To enable update forwarding, specify
@@ -7092,6 +7096,14 @@ options {
                  on insecure IP-address-based access control; see
                  <xref linkend="dynamic_update_security"/> for more details.
                </para>
+               <para>
+                 In general this option should only be set at the
+                 <command>zone</command> level. While a default
+                 value can be set at the <command>options</command> or
+                 <command>view</command> level and inherited by zones,
+                 this can lead to some zones unintentionally forwarding
+                 updates.
+               </para>
              </listitem>
            </varlistentry>
 

diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index 215e767de0add939b2ef8ffe8cfd564c712971fb..9dac1afc919ad3d124d98cb710faa9c49876e4a9 100644 (file)
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -484,43 +484,6 @@ check_viewacls(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
        return (result);
 }
 
-static isc_result_t
-check_non_viewacls(const cfg_obj_t *voptions, const cfg_obj_t *config,
-                  isc_log_t *logctx)
-{
-       const cfg_obj_t *aclobj = NULL;
-       const cfg_obj_t *options;
-       const char *where = NULL;
-       int i;
-
-       static const char *acls[] = {
-               "allow-update", "allow-update-forwarding", NULL
-       };
-
-       for (i = 0; acls[i] != NULL; i++) {
-               if (voptions != NULL && aclobj == NULL) {
-                       cfg_map_get(voptions, acls[i], &aclobj);
-                       where = "view";
-               }
-               if (config != NULL && aclobj == NULL) {
-                       options = NULL;
-                       cfg_map_get(config, "options", &options);
-                       if (options != NULL) {
-                               cfg_map_get(options, acls[i], &aclobj);
-                               where = "options";
-                       }
-               }
-               if (aclobj != NULL) {
-                       cfg_obj_log(aclobj, logctx, ISC_LOG_ERROR,
-                                   "'%s' can only be set per-zone, "
-                                   "not in '%s'", acls[i], where);
-                       return (ISC_R_FAILURE);
-               }
-       }
-
-       return (ISC_R_SUCCESS);
-}
-
 static const unsigned char zeros[16];
 
 static isc_result_t
@@ -3740,11 +3703,6 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
        if (tresult != ISC_R_SUCCESS)
                result = tresult;
 
-       tresult = check_non_viewacls(voptions, config, logctx);
-       if (tresult != ISC_R_SUCCESS) {
-               result = tresult;
-       }
-
        tresult = check_recursionacls(actx, voptions, viewname,
                                      config, logctx, mctx);
        if (tresult != ISC_R_SUCCESS)