NLnetLabs/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-10-12 02:06:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

- Fix that auth-zone, and RPZ zones, do not allow out-of-zone

Browse Source 
records. These are records that are not under the zone apex.
  The out-of-zone records are dropped from the zone contents.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
This commit is contained in:
W.C.A. Wijngaards
2026-06-16 09:48:10 +02:00
parent 96f15b9160
commit 6f9b6db7be
2 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/Changelog
+4
View File
@@ -11,6 +11,10 @@
- Fix that a half-written trust anchor file does not crash
the server at runtime. It unlinks a wrong file from the list.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
- Fix that auth-zone, and RPZ zones, do not allow out-of-zone
records. These are records that are not under the zone apex.
The out-of-zone records are dropped from the zone contents.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
15 June 2026: Wouter
- Fix to add `max-transfer-size` and `max-transfer-time` that
services/authzone.c
+9
View File
@@ -1188,6 +1188,15 @@ az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
log_err("malformed AAAA record");
return 0;
}
if(!dname_subdomain_c(dname, z->name)) {
char nm[LDNS_MAX_DOMAINLEN], zn[LDNS_MAX_DOMAINLEN];
dname_str(dname, nm);
dname_str(z->name, zn);
verbose(VERB_ALGO, "auth-zone %s: dropping out-of-zone RR "
"%s", zn, nm);
if(duplicate) *duplicate=1; /* treat as bad insert */
return 1;
}
if(!(node=az_domain_find_or_create(z, dname, dname_len))) {
log_err("cannot create domain");
return 0;