ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

2539. [security] Update the interaction between recursion, allow-query,

Browse Source 
allow-query-cache and allow-recursion.  [RT #19198]
This commit is contained in:
Mark Andrews
2009-01-30 04:24:29 +00:00
parent ffeb8c81da
commit 41efe04c19
4 changed files with 31 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES
View File

@@ -1,3 +1,6 @@
2539. [security] Update the interaction between recursion, allow-query,
allow-query-cache and allow-recursion. [RT #19198]
2536. [cleanup] Silence some warnings when -Werror=format-security is
specified. [RT #19083]

15
README
View File

@@ -76,13 +76,14 @@ BIND 9.4.0
rndc now allows addresses to be set in the server clauses.
New option "allow-query-cache". This lets allow-query be
used to specify the default zone access level rather than
having to have every zone override the global value.
allow-query-cache can be set at both the options and view
levels. If allow-query-cache is not set then allow-recursion
is used if set, otherwise allow-query is used if set, otherwise
the default (localhost; localnets;) is used.
New option "allow-query-cache". This lets "allow-query"
be used to specify the default zone access level rather
than having to have every zone override the global value.
"allow-query-cache" can be set at both the options and view
levels. If "allow-query-cache" is not set then "allow-recursion"
is used if set, otherwise "allow-query" is used if set
unless "recursion no;" is set in which case "none;" is used,
otherwise the default (localhost; localnets;) is used.
rndc: the source address can now be specified.

23
bin/named/server.c
View File

@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: server.c,v 1.419.18.73 2009/01/19 00:36:26 marka Exp $ */
/* $Id: server.c,v 1.419.18.74 2009/01/30 04:24:29 marka Exp $ */
/*! \file */
@@ -1561,10 +1561,11 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
*/
if (view->queryacl == NULL && view->recursionacl != NULL)
dns_acl_attach(view->recursionacl, &view->queryacl);
if (view->queryacl == NULL)
if (view->queryacl == NULL && view->recursion)
CHECK(configure_view_acl(vconfig, config, "allow-query",
actx, ns_g_mctx, &view->queryacl));
if (view->recursionacl == NULL && view->queryacl != NULL)
if (view->recursion &&
view->recursionacl == NULL && view->queryacl != NULL)
dns_acl_attach(view->queryacl, &view->recursionacl);
/*
@@ -1573,10 +1574,18 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
if (view->recursionacl == NULL && view->recursion)
CHECK(configure_view_acl(NULL, ns_g_config, "allow-recursion",
actx, ns_g_mctx, &view->recursionacl));
if (view->queryacl == NULL)
CHECK(configure_view_acl(NULL, ns_g_config,
"allow-query-cache", actx,
ns_g_mctx, &view->queryacl));
if (view->queryacl == NULL) {
if (view->recursion)
CHECK(configure_view_acl(NULL, ns_g_config,
"allow-query-cache", actx,
ns_g_mctx, &view->queryacl));
else {
if (view->queryacl != NULL)
dns_acl_detach(&view->queryacl);
CHECK(dns_acl_none(ns_g_mctx, &view->queryacl));
}
}
CHECK(configure_view_acl(vconfig, config, "sortlist",
actx, ns_g_mctx, &view->sortlist));

7
doc/arm/Bv9ARM-book.xml
View File

@@ -18,7 +18,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
<!-- File: $Id: Bv9ARM-book.xml,v 1.241.18.100 2009/01/22 23:46:00 tbox Exp $ -->
<!-- File: $Id: Bv9ARM-book.xml,v 1.241.18.101 2009/01/30 04:24:29 marka Exp $ -->
<book xmlns:xi="http://www.w3.org/2001/XInclude">
<title>BIND 9 Administrator Reference Manual</title>
@@ -5884,8 +5884,9 @@ options {
from the cache. If <command>allow-query-cache</command>
is not set then <command>allow-recursion</command>
is used if set, otherwise <command>allow-query</command>
is used if set, otherwise the default
(<command>localnets;</command>
is used if set unless <command>recursion no;</command> is
set in which case <command>none;</command> is used,
otherwise the default (<command>localnets;</command>
<command>localhost;</command>) is used.
</para>
</listitem>