|
 |
d4e835 |
From 09f1a6e812c02bd8bf1644e2253e21c26d25613a Mon Sep 17 00:00:00 2001
|
|
|
d4e835 |
From: Tomas Hozza <thozza@redhat.com>
|
|
|
d4e835 |
Date: Thu, 20 Feb 2014 11:01:00 +0100
|
|
|
d4e835 |
Subject: [PATCH] check TSIG key ID when receiving NOTIFY
|
|
|
d4e835 |
|
|
|
d4e835 |
Signed-off-by: Tomas Hozza <thozza@redhat.com>
|
|
|
d4e835 |
---
|
|
|
d4e835 |
lib/dns/zone.c | 8 ++++++--
|
|
|
d4e835 |
1 file changed, 6 insertions(+), 2 deletions(-)
|
|
|
d4e835 |
|
|
|
d4e835 |
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
|
|
|
d4e835 |
index 01ff97b..54b7896 100644
|
|
|
d4e835 |
--- a/lib/dns/zone.c
|
|
|
d4e835 |
+++ b/lib/dns/zone.c
|
|
|
d4e835 |
@@ -11846,6 +11846,8 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
|
|
|
d4e835 |
int match = 0;
|
|
|
d4e835 |
isc_netaddr_t netaddr;
|
|
|
d4e835 |
isc_sockaddr_t local, remote;
|
|
|
d4e835 |
+ dns_tsigkey_t *tsigkey;
|
|
|
d4e835 |
+ dns_name_t *tsig;
|
|
|
d4e835 |
|
|
|
d4e835 |
REQUIRE(DNS_ZONE_VALID(zone));
|
|
|
d4e835 |
|
|
|
d4e835 |
@@ -11928,10 +11930,12 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
|
|
|
d4e835 |
|
|
|
d4e835 |
/*
|
|
|
d4e835 |
* Accept notify requests from non masters if they are on
|
|
|
d4e835 |
- * 'zone->notify_acl'.
|
|
|
d4e835 |
+ * 'zone->notify_acl' or if used key ID match the ACLs.
|
|
|
d4e835 |
*/
|
|
|
d4e835 |
+ tsigkey = dns_message_gettsigkey(msg);
|
|
|
d4e835 |
+ tsig = dns_tsigkey_identity(tsigkey);
|
|
|
d4e835 |
if (i >= zone->masterscnt && zone->notify_acl != NULL &&
|
|
|
d4e835 |
- dns_acl_match(&netaddr, NULL, zone->notify_acl,
|
|
|
d4e835 |
+ dns_acl_match(&netaddr, tsig, zone->notify_acl,
|
|
|
d4e835 |
&zone->view->aclenv,
|
|
|
d4e835 |
&match, NULL) == ISC_R_SUCCESS &&
|
|
|
d4e835 |
match > 0)
|
|
|
d4e835 |
--
|
|
|
d4e835 |
1.8.5.3
|
|
|
d4e835 |
|