allow dlz to signal that the view's transfer acl should be used

lib/dns/dlz.c

@@ -133,11 +133,17 @@ dns_dlzallowzonexfr(dns_view_t *view, const dns_name_t *name,
 					 view->rdclass, name, clientaddr, dbp);
 
 		/*
-		 * if ISC_R_NOPERM, we found the right database but
+		 * In these cases, we found the right database. Non-success
-		 * the zone may not transfer.
+		 * result codes indicate the zone might not transfer.
 		 */
-		if (result == ISC_R_SUCCESS || result == ISC_R_NOPERM)
+		switch (result) {
+		case ISC_R_SUCCESS:
+		case ISC_R_NOPERM:
+		case ISC_R_DEFAULT:
 			return (result);
+		default:
+			break;
+		}
 	}
 
 	if (result == ISC_R_NOTIMPLEMENTED)

lib/dns/include/dns/dlz.h

@@ -107,10 +107,11 @@ typedef isc_result_t
  * the DNS server is performing a zone transfer query.  The driver's
  * method should return ISC_R_SUCCESS and a database pointer to the
  * name server if the zone is supported by the database, and zone
- * transfer is allowed.  Otherwise it will return ISC_R_NOTFOUND if
+ * transfer is allowed.  If the view's transfer acl should be used,
- * the zone is not supported by the database, or ISC_R_NOPERM if zone
+ * then the driver's method should return ISC_R_DEFAULT.  Otherwise,
- * transfers are not allowed.  If an error occurs it should return a
+ * it should return ISC_R_NOTFOUND if the zone is not supported by
- * result code indicating the type of error.
+ * the database, or ISC_R_NOPERM if zone transfers are not allowed.
+ * If an error occurs, the result code should indicate the type of error.
  */
 
 typedef isc_result_t

lib/dns/sdlz.c

@@ -1610,17 +1610,23 @@ dns_sdlzallowzonexfr(void *driverarg, void *dbdata, isc_mem_t *mctx,
 
 	/* Call SDLZ driver's find zone method */
 	if (imp->methods->allowzonexfr != NULL) {
+		isc_result_t rresult = ISC_R_SUCCESS;
+
 		MAYBE_LOCK(imp);
 		result = imp->methods->allowzonexfr(imp->driverarg, dbdata,
 						    namestr, clientstr);
 		MAYBE_UNLOCK(imp);
 		/*
-		 * if zone is supported and transfers allowed build a 'bind'
+		 * if zone is supported and transfers are (or might be)
-		 * database driver
+		 * allowed, build a 'bind' database driver
 		 */
-		if (result == ISC_R_SUCCESS)
+		if (result == ISC_R_SUCCESS || result == ISC_R_DEFAULT) {
-			result = dns_sdlzcreateDBP(mctx, driverarg, dbdata,
+			rresult = dns_sdlzcreateDBP(mctx, driverarg, dbdata,
 						    name, rdclass, dbp);
+		}
+		if (rresult != ISC_R_SUCCESS) {
+			result = rresult;
+		}
 		return (result);
 	}
 

lib/isc/include/isc/result.h

@@ -87,9 +87,10 @@
 #define ISC_R_CRYPTOFAILURE		65	/*%< cryptography library failure */
 #define ISC_R_DISCQUOTA			66	/*%< disc quota */
 #define ISC_R_DISCFULL			67	/*%< disc full */
+#define ISC_R_DEFAULT			68	/*%< default */
 
 /*% Not a result code: the number of results. */
-#define ISC_R_NRESULTS 			68
+#define ISC_R_NRESULTS 			69
 
 ISC_LANG_BEGINDECLS
 

lib/isc/result.c

@@ -99,6 +99,7 @@ static const char *description[ISC_R_NRESULTS] = {
 	"crypto failure",			/*%< 65 */
 	"disc quota",				/*%< 66 */
 	"disc full",				/*%< 67 */
+	"default",				/*%< 68 */
 };
 
 static const char *identifier[ISC_R_NRESULTS] = {
@@ -170,6 +171,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
 	"ISC_R_CRYPTOFAILURE",
 	"ISC_R_DISCQUOTA",
 	"ISC_R_DISCFULL",
+	"ISC_R_DEFAULT",
 };
 
 #define ISC_RESULT_RESULTSET			2

lib/ns/xfrout.c

@@ -763,6 +763,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	bool is_poll = false;
 	bool is_dlz = false;
 	bool is_ixfr = false;
+	bool useviewacl = false;
 	uint32_t begin_serial = 0, current_serial;
 
 	switch (reqtype) {
@@ -826,7 +827,10 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 						     question_name,
 						     &client->peeraddr,
 						     &db);
-
+			if (result == ISC_R_DEFAULT) {
+				useviewacl = true;
+				result = ISC_R_SUCCESS;
+			}
 			if (result == ISC_R_NOPERM) {
 				char _buf1[DNS_NAME_FORMATSIZE];
 				char _buf2[DNS_RDATACLASS_FORMATSIZE];
@@ -843,9 +847,10 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 					      _buf1, _buf2);
 				goto failure;
 			}
-			if (result != ISC_R_SUCCESS)
+			if (result != ISC_R_SUCCESS) {
 				FAILQ(DNS_R_NOTAUTH, "non-authoritative zone",
 				      question_name, question_class);
+			}
 			is_dlz = true;
 		} else {
 			/*
@@ -926,14 +931,21 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 		    "%s authority section OK", mnemonic);
 
 	/*
-	 * If not a DLZ zone, decide whether to allow this transfer.
+	 * If not a DLZ zone or we are falling back to the view's transfer
+	 * ACL, decide whether to allow this transfer.
 	 */
-	if (!is_dlz) {
+	if (!is_dlz || useviewacl) {
+		dns_acl_t *acl;
+
 		ns_client_aclmsg("zone transfer", question_name, reqtype,
 				 client->view->rdclass, msg, sizeof(msg));
-		CHECK(ns_client_checkacl(client, NULL, msg,
+		if (useviewacl) {
-					 dns_zone_getxfracl(zone),
+			acl = client->view->transferacl;
-					 true, ISC_LOG_ERROR));
+		} else {
+			acl = dns_zone_getxfracl(zone);
+		}
+		CHECK(ns_client_checkacl(client, NULL, msg, acl, true,
+					 ISC_LOG_ERROR));
 	}
 
 	/*
@@ -958,8 +970,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	/*
 	 * Get a dynamically allocated copy of the current SOA.
 	 */
-	if (is_dlz)
+	if (is_dlz) {
 		dns_db_currentversion(db, &ver);
+	}
 
 	CHECK(dns_db_createsoatuple(db, ver, mctx, DNS_DIFFOP_EXISTS,
 				    &current_soa_tuple));