Your message dated Sat, 9 Sep 2006 19:09:57 -0600
with message-id <[EMAIL PROTECTED]>
and subject line bind9: NOTIFY requests refused from IPv4-mapped IPv6 addresses
of masters
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--- Begin Message ---
Package: bind9
Version: 1:9.2.1-2.woody.1
Severity: important
Tags: upstream patch
(Also affects bind9 / libdns8 version 1:9.2.2-2. The problem is actually in
libdns.)
In certain circumstances BIND will (silently) refuse NOTIFY requests for a
slave zone from its configured masters. [This may or may not be related to
Bug#129873.]
The problem occurs when a NOTIFY request is received from an IPv4-mapped IPv6
address. This can happen under Linux when BIND is listening on IPv6 interfaces
and the NOTIFY request is received via TCP. BIND does not treat the IPv4-mapped
IPv6 address of the request source as equivalent to any IPv4 address of the
zone's masters, even if the match-mapped-addresses configuration option is
enabled.
As a possible work-around, an explicit allow-notify { } can be used in the
slave to specify the same addresses given in masters { }. BIND does properly
match IPv4-mapped IPv6 addresses in the allow-notify list when
match-mapped-addresses is enabled.
Alternatively, the following patch will enable BIND to treat IPv4-mapped IPv6
addresses of NOTIFY requests as equivalent to IPv4 addresses for the purpose of
matching a zone master's IPv4 address and allowing the request.
--- lib/dns/zone.c.orig Thu Mar 28 16:20:07 2002
+++ lib/dns/zone.c Wed May 14 22:45:33 2003
@@ -4005,6 +4005,8 @@
char fromtext[ISC_SOCKADDR_FORMATSIZE];
int match = 0;
isc_netaddr_t netaddr;
+ isc_sockaddr_t *matchfrom;
+ isc_sockaddr_t v4from;
REQUIRE(DNS_ZONE_VALID(zone));
@@ -4058,15 +4060,31 @@
return (ISC_R_SUCCESS);
}
+ /*
+ * Accommodate IPv4-mapped IPv6 address equivalence.
+ */
+ isc_netaddr_fromsockaddr(&netaddr, from);
+ if (zone->view->aclenv.match_mapped == ISC_FALSE ||
+ netaddr.family != AF_INET6 ||
+ !IN6_IS_ADDR_V4MAPPED(&netaddr.type.in6))
+ matchfrom = from;
+ else {
+ isc_netaddr_t v4netaddr;
+
+ isc_netaddr_fromv4mapped(&v4netaddr, &netaddr);
+ isc_sockaddr_fromnetaddr(&v4from, &v4netaddr,
+ isc_sockaddr_getport(from));
+ matchfrom = &v4from;
+ }
+
for (i = 0; i < zone->masterscnt; i++)
- if (isc_sockaddr_eqaddr(from, &zone->masters[i]))
+ if (isc_sockaddr_eqaddr(matchfrom, &zone->masters[i]))
break;
/*
* Accept notify requests from non masters if they are on
* 'zone->notify_acl'.
*/
- isc_netaddr_fromsockaddr(&netaddr, from);
if (i >= zone->masterscnt && zone->notify_acl != NULL &&
dns_acl_match(&netaddr, NULL, zone->notify_acl,
&zone->view->aclenv,
-- System Information
Debian Release: 3.0
Architecture: i386
Kernel: Linux surveyor 2.4.18-686 #1 Sun Apr 14 11:32:47 EST 2002 i686
Locale: LANG=C, LC_CTYPE=C
Versions of packages bind9 depends on:
ii libc6 2.2.5-11.5 GNU C Library: Shared libraries an
ii libdns5 1:9.2.1-2.woody.1 DNS Shared Library used by BIND
ii libisc4 1:9.2.1-2.woody.1 ISC Shared Library used by BIND
ii libisccc0 1:9.2.1-2.woody.1 Command Channel Library used by BI
ii libisccfg0 1:9.2.1-2.woody.1 Config File Handling Library used
ii liblwres1 1:9.2.1-2.woody.1 Lightweight Resolver Library used
ii libssl0.9.6 0.9.6c-2.woody.3 SSL shared libraries
ii netbase 4.07 Basic TCP/IP networking system
--- End Message ---
--- Begin Message ---
On Thu, May 15, 2003 at 12:09:50AM -0700, Rob Leslie wrote:
> Package: bind9
> Version: 1:9.2.1-2.woody.1
> Severity: important
> Tags: upstream patch
>
This patch showed up sometime prior to 9.3.2-P1
lamont
--- End Message ---
