Bug 915792

please add steps to verify

(In reply to comment #1)
> please add steps to verify

Please see first sentence of bug description: 
Set `idnsAllowTransfer` attribute to `xnone;` and you should see a crash.

Fixed in upstream by commit 654971e45872471b800fa3f5afd7f7f383d168e9

Moving to ON_QA, I probably forgot to change bug status.

verified using bind-dyndb-ldap-3.5-3.el7.x86_64, ipa-server-3.3.3-15.el7.x86_64

Steps taken:

1> Add a new zone:
# ipa dnszone-add bz915792
Authoritative nameserver: cloud-qe-4.testrelm.com.
Administrator e-mail address [hostmaster.bz915792.]: 
  Zone name: bz915792
  Authoritative nameserver: cloud-qe-4.testrelm.com.
  Administrator e-mail address: hostmaster.bz915792.
  SOA serial: 1391113628
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  BIND update policy: grant TESTRELM.COM krb5-self * A; grant TESTRELM.COM krb5-self * AAAA; grant TESTRELM.COM krb5-self * SSHFP;
  Active zone: TRUE
  Dynamic update: FALSE
  Allow query: any;
  Allow transfer: none;


2> Update its `idnsAllowTransfer` attribute to be `xnone;`
# ipa dnszone-mod --allow-transfer="xnone" bz915792
ipa: ERROR: invalid 'allow_transfer': failed to detect a valid IP address from 'xnone'

There was no crash, because validation did not allow the attribute to have an invalid value.

(In reply to Namita Soman from comment #7)
> 2> Update its `idnsAllowTransfer` attribute to be `xnone;`
> # ipa dnszone-mod --allow-transfer="xnone" bz915792
> ipa: ERROR: invalid 'allow_transfer': failed to detect a valid IP address
> from 'xnone'
> 
> There was no crash, because validation did not allow the attribute to have
> an invalid value.

Namita, you have to use ldapmodify to insert the value to LDAP to test this bug. This tests only IPA validators but not bind-dyndb-ldap.

# ipa dnszone-add
Authoritative nameserver: cloud-qe-4.testrelm.com.
Zone name: bz915792
Administrator e-mail address [hostmaster.bz915792.]: 
  Zone name: bz915792
  Authoritative nameserver: cloud-qe-4.testrelm.com.
  Administrator e-mail address: hostmaster.bz915792.
  SOA serial: 1391457719
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  BIND update policy: grant TESTRELM.COM krb5-self * A; grant TESTRELM.COM krb5-self * AAAA; grant TESTRELM.COM krb5-self * SSHFP;
  Active zone: TRUE
  Dynamic update: FALSE
  Allow query: any;
  Allow transfer: none;


# ipa dnszone-show bz915792 --all --raw
  dn: idnsname=bz915792,cn=dns,dc=testrelm,dc=com
  idnsAllowDynUpdate: FALSE
  idnsAllowQuery: any;
  idnsAllowTransfer: none;
  idnsName: bz915792
  idnsSOAexpire: 1209600
  idnsSOAmName: cloud-qe-4.testrelm.com.
  idnsSOAminimum: 3600
  idnsSOArName: hostmaster.bz915792.
  idnsSOArefresh: 3600
  idnsSOAretry: 900
  idnsSOAserial: 1391457721
  idnsUpdatePolicy: grant TESTRELM.COM krb5-self * A; grant TESTRELM.COM krb5-self * AAAA; grant TESTRELM.COM krb5-self * SSHFP;
  idnsZoneActive: TRUE
  nSRecord: cloud-qe-4.testrelm.com.
  objectClass: top
  objectClass: idnsrecord
  objectClass: idnszone

# cat badValue.ldif 
dn: idnsname=bz915792,cn=dns,dc=testrelm,dc=com
changetype: modify
replace: idnsAllowTransfer
idnsAllowTransfer: xnone


# systemctl status named
named.service - Berkeley Internet Name Domain (DNS)
   Loaded: loaded (/usr/lib/systemd/system/named.service; disabled)
   Active: active (running) since Mon 2014-02-03 11:28:42 EST; 3h 34min ago
<..snip..>


# ldapmodify  -D "cn=Directory Manager" -w Secret123  -f badValue.ldif 
modifying entry "idnsname=bz915792,cn=dns,dc=testrelm,dc=com"

# ipa dnszone-show bz915792 --all --raw
  dn: idnsname=bz915792,cn=dns,dc=testrelm,dc=com
  idnsAllowDynUpdate: FALSE
  idnsAllowQuery: any;
  idnsAllowTransfer: xnone   <<<<<<
  idnsName: bz915792
  idnsSOAexpire: 1209600
  idnsSOAmName: cloud-qe-4.testrelm.com.
  idnsSOAminimum: 3600
  idnsSOArName: hostmaster.bz915792.
  idnsSOArefresh: 3600
  idnsSOAretry: 900
  idnsSOAserial: 1391457796
  idnsUpdatePolicy: grant TESTRELM.COM krb5-self * A; grant TESTRELM.COM krb5-self * AAAA; grant TESTRELM.COM krb5-self * SSHFP;
  idnsZoneActive: TRUE
  nSRecord: cloud-qe-4.testrelm.com.
  objectClass: top
  objectClass: idnsrecord
  objectClass: idnszone



# systemctl status named
named.service - Berkeley Internet Name Domain (DNS)
   Loaded: loaded (/usr/lib/systemd/system/named.service; disabled)
   Active: active (running) since Mon 2014-02-03 15:03:06 EST; 47s ago
<..snip..>
Feb 03 15:03:32 cloud-qe-4.testrelm.com named[18926]: transfer ACL parsing failed: 'xnone': failure
Feb 03 15:03:32 cloud-qe-4.testrelm.com named[18926]: zone bz915792/IN: transfer policy is invalid: failure; configuring most restrictive transfer policy as possible
Feb 03 15:03:32 cloud-qe-4.testrelm.com named[18926]: update_zone (psearch) failed for 'idnsname=bz915792,cn=dns,dc=testrelm,dc=com'. Zones can be outdated, run `rndc reload`: failure
Hint: Some lines were ellipsized, use -l to show in full.


bind didn't crash with this invalid value, and status indicates - it is still running.

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.