From ea56069ae0a10e8fbcd970085f82b5f6eebc2838 Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Fri, 12 Feb 2021 14:51:28 +1100 Subject: [PATCH] Address inconsistencies in checking added RRsets loading_addrdataset() rejects SOA RRsets which are not at top of zone. addrdataset() should similarly reject such RRsets. --- lib/dns/rbtdb.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c index 6e7d4f4a33..9790d01809 100644 --- a/lib/dns/rbtdb.c +++ b/lib/dns/rbtdb.c @@ -6799,6 +6799,13 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, INSIST(rbtversion == NULL || rbtversion->rbtdb == rbtdb); if (rbtdb->common.methods == &zone_methods) { + /* + * SOA records are only allowed at top of zone. + */ + if (rdataset->type == dns_rdatatype_soa && + node != rbtdb->origin_node) { + return (DNS_R_NOTZONETOP); + } RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read); REQUIRE(((rbtnode->nsec == DNS_RBT_NSEC_NSEC3 && (rdataset->type == dns_rdatatype_nsec3 ||