From: Mark Andrews <marka@isc.org>
Date: Wed, 15 Jul 2026 07:53:22 +0000 (+1000)
Subject: Prevent ddns-confgen self-domain update-policy injection
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=2a934224b8f5c7a3ad6b375e67fe99ab85331e4a;p=thirdparty%2Fbind9.git

Prevent ddns-confgen self-domain update-policy injection

In ddns-confgen, the user-supplied domain name to be updated
was not properly escaped and put inside a double quoted string
when generating the example code fragment.  This has been corrected.
---

diff --git a/bin/confgen/tsig-keygen.c b/bin/confgen/tsig-keygen.c
index 88acff9e096..fc278214bc7 100644
--- a/bin/confgen/tsig-keygen.c
+++ b/bin/confgen/tsig-keygen.c
@@ -85,6 +85,8 @@ main(int argc, char **argv) {
 	isc_buffer_t key_txtbuffer;
 	char key_txtsecret[256];
 	char namebuf[DNS_NAME_FORMATSIZE];
+	char selfbuf[DNS_NAME_FORMATSIZE];
+	char zonebuf[DNS_NAME_FORMATSIZE];
 	const char *keyname = NULL;
 	const char *zone = NULL;
 	const char *self_domain = NULL;
@@ -216,6 +218,19 @@ main(int argc, char **argv) {
 
 	makesafe_keyname(keyname, namebuf, sizeof(namebuf), &wildcard);
 
+	/*
+	 * If -s or -z is in use, it's fine to overwrite wildcard, because
+	 * those are the ones we'd be using as the update-policy identity.
+	 */
+	if (self_domain != NULL) {
+		makesafe_keyname(self_domain, selfbuf, sizeof(selfbuf),
+				 &wildcard);
+		self_domain = selfbuf;
+	} else if (zone != NULL) {
+		makesafe_keyname(zone, zonebuf, sizeof(zonebuf), &wildcard);
+		zone = zonebuf;
+	}
+
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));
 
 	generate_key(isc_g_mctx, alg, keysize, &key_txtbuffer);
@@ -237,7 +252,10 @@ key \"%s\" {\n\
 
 	if (wildcard && !quiet) {
 		printf("\n\
-# This is a wildcard key, and should not be used in an update-policy.\n");
+# \"%s\" is a wildcard key, and should not be used in an update-policy.\n",
+		       zone != NULL
+			       ? zone
+			       : (self_domain != NULL ? self_domain : namebuf));
 	} else if (!quiet) {
 		if (self_domain != NULL) {
 			printf("\n\
@@ -245,7 +263,7 @@ key \"%s\" {\n\
 # name \"%s\", place an \"update-policy\" statement\n\
 # like this one, adjusted as needed for your preferred permissions:\n\
 update-policy {\n\
-	  grant %s name %s ANY;\n\
+	  grant \"%s\" name \"%s\" ANY;\n\
 };\n",
 			       self_domain, namebuf, self_domain);
 		} else if (zone != NULL) {
@@ -254,7 +272,7 @@ update-policy {\n\
 # place an \"update-policy\" statement like this one, adjusted as \n\
 # needed for your preferred permissions:\n\
 update-policy {\n\
-	  grant %s zonesub ANY;\n\
+	  grant \"%s\" zonesub ANY;\n\
 };\n",
 			       zone, namebuf);
 		} else {
@@ -264,7 +282,7 @@ update-policy {\n\
 # to this key.  For example, the following statement grants this key\n\
 # permission to update any name within the zone:\n\
 update-policy {\n\
-	grant %s zonesub ANY;\n\
+	grant \"%s\" zonesub ANY;\n\
 };\n",
 			       namebuf);
 		}