From: Kees Monshouwer <mind04@monshouwer.org>
Date: Sun, 4 Jun 2017 11:31:54 +0000 (+0200)
Subject: auth: make sure Lua axfrfilter() does not insert out of zone data
X-Git-Tag: auth-4.0.4-rc1^2~2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=53be802dbe13a954104dbe3e5b610d27e986ad41;p=pdns

auth: make sure Lua axfrfilter() does not insert out of zone data
---

diff --git a/pdns/slavecommunicator.cc b/pdns/slavecommunicator.cc
index 72f716887..0f854d27e 100644
--- a/pdns/slavecommunicator.cc
+++ b/pdns/slavecommunicator.cc
@@ -262,6 +262,10 @@ vector<DNSResourceRecord> doAxfr(const ComboAddress& raddr, const DNSName& domai
       }
 
       for(DNSResourceRecord& rr :  out) {
+        if(!rr.qname.isPartOf(domain)) {
+          L<<Logger::Error<<"Lua axfrfilter() filter tried to sneak in out-of-zone data '"<<i->qname<<"'|"<<i->qtype.getName()<<" during AXFR of zone '"<<domain<<"', ignoring"<<endl;
+          continue;
+        }
         if(!processRecordForZS(domain, firstNSEC3, rr, zs))
           continue;
         if(rr.qtype.getCode() == QType::SOA) {