|
 |
6139ce |
From 7e2d9531a79d289ee99dd436da14efb6d9a505fc Mon Sep 17 00:00:00 2001
|
|
|
6139ce |
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
|
|
|
6139ce |
Date: Wed, 3 Jun 2020 14:42:11 +0200
|
|
|
6139ce |
Subject: [PATCH] Change the invalid CIDR from parser error to warning
|
|
|
6139ce |
|
|
|
6139ce |
In [RT #43367], the BIND 9 changed the strictness of address / prefix
|
|
|
6139ce |
length checks:
|
|
|
6139ce |
|
|
|
6139ce |
Check prefixes in acls to make sure the address and
|
|
|
6139ce |
prefix lengths are consistent. Warn only in
|
|
|
6139ce |
BIND 9.11 and earlier.
|
|
|
6139ce |
|
|
|
6139ce |
Unfortunately, a regression slipped in and the check was made an error
|
|
|
6139ce |
also in the BIND 9.11. This commit fixes the regression, but turning
|
|
|
6139ce |
the error into a warning.
|
|
|
6139ce |
---
|
|
|
6139ce |
bin/tests/system/checkconf/tests.sh | 9 +++++++++
|
|
|
6139ce |
...conf => warn-address-prefix-length-mismatch.conf} | 12 ++++++++++--
|
|
|
6139ce |
lib/isccfg/parser.c | 9 ---------
|
|
|
6139ce |
util/copyrights | 2 +-
|
|
|
6139ce |
4 files changed, 20 insertions(+), 12 deletions(-)
|
|
|
6139ce |
rename bin/tests/system/checkconf/{bad-ipv4-prefix-dotted2.conf => warn-address-prefix-length-mismatch.conf} (70%)
|
|
|
6139ce |
|
|
|
6139ce |
diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
|
|
|
6139ce |
index 85fb4839e9..d2b0daa35c 100644
|
|
|
6139ce |
--- a/bin/tests/system/checkconf/tests.sh
|
|
|
6139ce |
+++ b/bin/tests/system/checkconf/tests.sh
|
|
|
6139ce |
@@ -386,6 +386,15 @@ grep "dlv.isc.org has been shut down" < checkconf.out$n > /dev/null || ret=1
|
|
|
6139ce |
if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
|
|
|
6139ce |
status=`expr $status + $ret`
|
|
|
6139ce |
|
|
|
6139ce |
+n=`expr $n + 1`
|
|
|
6139ce |
+echo_i "check that invalid address/prefix length generates a warning ($n)"
|
|
|
6139ce |
+ret=0
|
|
|
6139ce |
+$CHECKCONF warn-address-prefix-length-mismatch.conf > checkconf.out$n 2>/dev/null || ret=1
|
|
|
6139ce |
+LINES=$(grep -c "address/prefix length mismatch" < checkconf.out$n) || ret=1
|
|
|
6139ce |
+[ "$LINES" -eq 8 ] || ret=1
|
|
|
6139ce |
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
|
|
|
6139ce |
+status=`expr $status + $ret`
|
|
|
6139ce |
+
|
|
|
6139ce |
n=`expr $n + 1`
|
|
|
6139ce |
echo_i "check that 'dnssec-lookaside . trust-anchor dlv.example.com;' doesn't generates a warning ($n)"
|
|
|
6139ce |
ret=0
|
|
|
6139ce |
diff --git a/bin/tests/system/checkconf/bad-ipv4-prefix-dotted2.conf b/bin/tests/system/checkconf/warn-address-prefix-length-mismatch.conf
|
|
|
6139ce |
similarity index 70%
|
|
|
6139ce |
rename from bin/tests/system/checkconf/bad-ipv4-prefix-dotted2.conf
|
|
|
6139ce |
rename to bin/tests/system/checkconf/warn-address-prefix-length-mismatch.conf
|
|
|
6139ce |
index 2c768c7e1a..5e3bc3f6ee 100644
|
|
|
6139ce |
--- a/bin/tests/system/checkconf/bad-ipv4-prefix-dotted2.conf
|
|
|
6139ce |
+++ b/bin/tests/system/checkconf/warn-address-prefix-length-mismatch.conf
|
|
|
6139ce |
@@ -9,6 +9,14 @@
|
|
|
6139ce |
* information regarding copyright ownership.
|
|
|
6139ce |
*/
|
|
|
6139ce |
|
|
|
6139ce |
-acl myacl {
|
|
|
6139ce |
- 127.1/8; /* No-zero bits */
|
|
|
6139ce |
+zone example {
|
|
|
6139ce |
+ type master;
|
|
|
6139ce |
+ file "example.db";
|
|
|
6139ce |
+ auto-dnssec maintain;
|
|
|
6139ce |
+ allow-update {
|
|
|
6139ce |
+ 192.0.2.64/24;
|
|
|
6139ce |
+ 192.0.2.128/24;
|
|
|
6139ce |
+ 198.51.100.255/24;
|
|
|
6139ce |
+ 203.0.113.2/24;
|
|
|
6139ce |
+ };
|
|
|
6139ce |
};
|
|
|
6139ce |
diff --git a/lib/isccfg/parser.c b/lib/isccfg/parser.c
|
|
|
6139ce |
index e2af054661..44a1dfc37a 100644
|
|
|
6139ce |
--- a/lib/isccfg/parser.c
|
|
|
6139ce |
+++ b/lib/isccfg/parser.c
|
|
|
6139ce |
@@ -2634,15 +2634,6 @@ cfg_parse_netprefix(cfg_parser_t *pctx, const cfg_type_t *type,
|
|
|
6139ce |
"invalid prefix length");
|
|
|
6139ce |
return (ISC_R_RANGE);
|
|
|
6139ce |
}
|
|
|
6139ce |
- result = isc_netaddr_prefixok(&netaddr, prefixlen);
|
|
|
6139ce |
- if (result != ISC_R_SUCCESS) {
|
|
|
6139ce |
- char buf[ISC_NETADDR_FORMATSIZE + 1];
|
|
|
6139ce |
- isc_netaddr_format(&netaddr, buf, sizeof(buf));
|
|
|
6139ce |
- cfg_parser_error(pctx, CFG_LOG_NOPREP,
|
|
|
6139ce |
- "'%s/%u': address/prefix length "
|
|
|
6139ce |
- "mismatch", buf, prefixlen);
|
|
|
6139ce |
- return (ISC_R_FAILURE);
|
|
|
6139ce |
- }
|
|
|
6139ce |
} else {
|
|
|
6139ce |
if (expectprefix) {
|
|
|
6139ce |
cfg_parser_error(pctx, CFG_LOG_NEAR,
|
|
|
6139ce |
--
|
|
|
6139ce |
GitLab
|
|
|
6139ce |
|