From: Alessio Podda <alessio@isc.org>
Date: Mon, 13 Jul 2026 15:32:28 +0000 (+0200)
Subject: Fix mirror zone auth issues
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=26296feaf6201c07e885967abb8de75c1f245857;p=thirdparty%2Fbind9.git

Fix mirror zone auth issues

Previously query_validatezonedb would not save the current version of
mirror zones, which would cause the mirror zone not to be found when
non-glue additional data.

We fix this by storing the mirror zone version in the client, and
deferring the acl check in query_validatezonedb.
---

diff --git a/lib/ns/query.c b/lib/ns/query.c
index edb0e770e0..93d8b48383 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -988,17 +988,13 @@ query_validatezonedb(ns_client_t *client, const dns_name_t *name,
 		     dns_dbversion_t **versionp) {
 	isc_result_t result;
 	dns_acl_t *queryacl, *queryonacl;
+	dns_zonetype_t zonetype;
 	ns_dbversion_t *dbversion;
 
 	REQUIRE(zone != NULL);
 	REQUIRE(db != NULL);
 
-	/*
-	 * Mirror zone data is treated as cache data.
-	 */
-	if (dns_zone_gettype(zone) == dns_zone_mirror) {
-		return query_checkcacheaccess(client, name, qtype, options);
-	}
+	zonetype = dns_zone_gettype(zone);
 
 	/*
 	 * This limits our searching to the zone where the first name
@@ -1007,7 +1003,7 @@ query_validatezonedb(ns_client_t *client, const dns_name_t *name,
 	 * additional data from other zones. This does not apply if we're
 	 * answering a query where recursion is requested and allowed.
 	 */
-	if (client->query.rpz_st == NULL &&
+	if (zonetype != dns_zone_mirror && client->query.rpz_st == NULL &&
 	    !(client->query.wantrecursion && client->query.recursionok) &&
 	    client->query.authdb_id != NS_QUERY_AUTHDB_UNSET &&
 	    (uintptr_t)db != client->query.authdb_id)
@@ -1020,9 +1016,7 @@ query_validatezonedb(ns_client_t *client, const dns_name_t *name,
 	 * zone content is not public data, but a part of local configuration
 	 * and should not be disclosed.
 	 */
-	if (dns_zone_gettype(zone) == dns_zone_staticstub &&
-	    !client->query.recursionok)
-	{
+	if (zonetype == dns_zone_staticstub && !client->query.recursionok) {
 		return DNS_R_REFUSED;
 	}
 
@@ -1043,6 +1037,14 @@ query_validatezonedb(ns_client_t *client, const dns_name_t *name,
 		return DNS_R_SERVFAIL;
 	}
 
+	/*
+	 * Mirror zone data is treated as cache data.
+	 */
+	if (zonetype == dns_zone_mirror) {
+		RETERR(query_checkcacheaccess(client, name, qtype, options));
+		goto approved;
+	}
+
 	if (options.ignoreacl) {
 		goto approved;
 	}