4483. [func] Check prefixes in acls to make sure the address and

                        prefix lengths are consistent.  Warn only in
                        BIND 9.11 and earlier. [RT #43367]

diff --git a/CHANGES b/CHANGES
index 4450be6babd2f61e36d71187c9978017f90aa4c4..b8ddcbf7d5ba30a2640a1f8ec0c7b62f029df567 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+4483.  [func]          Check prefixes in acls to make sure the address and
+                       prefix lengths are consistent.  Warn only in
+                       BIND 9.11 and earlier. [RT #43367]
+
 4482.  [bug]           Address use before require check and remove extraneous
                        dns_message_gettsigkey call in dns_tsig_sign.
                        [RT #43374]

diff --git a/bin/tests/system/checkconf/bad-acl.conf b/bin/tests/system/checkconf/bad-acl.conf
new file mode 100644 (file)
index 0000000..803a199
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-acl.conf
@@ -0,0 +1,16 @@
+/*
+ * Copyright (C) 2016  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+acl a {
+       { "none"; };
+       { !19.0.0.0/7; };
+};
+
+options {
+       allow-query { a; };
+};

diff --git a/bin/tests/system/checkconf/good-acl.conf b/bin/tests/system/checkconf/good-acl.conf
index 7249b6fc3f201042399a015ab9448f18c93e8399..c80ed0cd8a00074d998ee32ce6dfd577b2048ea0 100644 (file)
--- a/bin/tests/system/checkconf/good-acl.conf
+++ b/bin/tests/system/checkconf/good-acl.conf
@@ -8,7 +8,7 @@
 
 acl a {
        { "none"; };
-       { !19.0.0.0/0; };
+       { !19.0.0.0/8; };
 };
 
 options {

diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
index b80a843378b5d08946f6583fc212778dcba9fc14..e7df659100805b9f71bcf4b77ce8a7b6b9118857 100644 (file)
--- a/bin/tests/system/checkconf/good.conf
+++ b/bin/tests/system/checkconf/good.conf
@@ -36,7 +36,7 @@ options {
        hostname none;
        interface-interval 30;
        keep-response-order {
-               10.0.0.10/24;
+               10.0.10.0/24;
        };
        listen-on port 90 {
                "any";

diff --git a/bin/tests/system/pending/ns2/named.conf b/bin/tests/system/pending/ns2/named.conf
index 832f08c46e1e9b6cec0b0cb1a20e836ca0d51d58..a6ac98a6c1a8da844aedb6ed3b14d7adadf4d867 100644 (file)
--- a/bin/tests/system/pending/ns2/named.conf
+++ b/bin/tests/system/pending/ns2/named.conf
@@ -41,7 +41,7 @@ zone "example" {
 zone "example.com" {
        type master;
        file "example.com.db.signed";
-       allow-update { 10.53.0.0/8; };
+       allow-update { 10.53.0.0/16; };
 };
 
 zone "good" {

diff --git a/lib/isccfg/aclconf.c b/lib/isccfg/aclconf.c
index 83f5937d2ff6a11c3f6e05401d358f77ca974b02..8743e2eaf1358611e620cf59b1ac48aafd49a05f 100644 (file)
--- a/lib/isccfg/aclconf.c
+++ b/lib/isccfg/aclconf.c
@@ -6,8 +6,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 
-/* $Id$ */
-
 #include <config.h>
 
 #include <isc/mem.h>
@@ -712,6 +710,15 @@ cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
                                        dns_acl_detach(&de->nestedacl);
                                continue;
                        }
+                       result = isc_netaddr_prefixok(&addr, bitlen);
+                       if (result != ISC_R_SUCCESS) {
+                               char buf[ISC_NETADDR_FORMATSIZE + 1];
+                               isc_netaddr_format(&addr, buf, sizeof(buf));
+                               cfg_obj_log(ce, lctx, ISC_LOG_WARNING,
+                                           "'%s/%u': address/prefix length "
+                                           "mismatch", buf, bitlen);
+                               goto cleanup;
+                       }
 
                        /*
                         * If nesting ACLs (nest_level != 0), we negate