ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Add a none parameter to query-source[-v6]

Browse Source 
This change adds a "none" parameter to the query-source[-v6]
options in named.conf, which forbid the usage of IPv4 or IPv6
addresses when doing upstream queries.
This commit is contained in:
Colin Vidal
2024-11-26 08:45:50 +01:00
committed by Colin Vidal
parent b2ffa5845b
commit bcf24ca07e
27 changed files with 717 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/isccfg/check.c
+29 -20
View File
@@ -1315,24 +1315,21 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
* Warn if query-source or query-source-v6 options specify
* a port, and fail if they specify the DNS port.
*/
unsigned int none_found = false;
for (i = 0; i < ARRAY_SIZE(sources); i++) {
obj = NULL;
(void)cfg_map_get(options, sources[i], &obj);
if (obj != NULL) {
const isc_sockaddr_t *sa =
cfg_obj_assockaddr(obj);
in_port_t port = isc_sockaddr_getport(sa);
if (port == dnsport) {
if (obj != NULL && cfg_obj_isvoid(obj)) {
none_found++;
if (none_found > 1) {
cfg_obj_log(obj, ISC_LOG_ERROR,
"'%s' cannot specify the "
"DNS listener port (%d)",
sources[i], port);
"query-source and "
"query-source-v6 can't be "
"none at the same time.");
result = ISC_R_FAILURE;
} else if (port != 0) {
cfg_obj_log(obj, ISC_LOG_WARNING,
"'%s': specifying a port "
"is not recommended",
sources[i]);
break;
}
}
}
@@ -4419,14 +4416,26 @@ check_servers(const cfg_obj_t *config, const cfg_obj_t *voptions,
}
(void)cfg_map_get(v1, xfr, &obj);
if (obj != NULL) {
const isc_sockaddr_t *sa =
cfg_obj_assockaddr(obj);
in_port_t port = isc_sockaddr_getport(sa);
if (port == dnsport) {
if (cfg_obj_issockaddr(obj)) {
const isc_sockaddr_t *sa =
cfg_obj_assockaddr(obj);
in_port_t port =
isc_sockaddr_getport(sa);
if (port == dnsport) {
cfg_obj_log(obj, ISC_LOG_ERROR,
"'%s' cannot "
"specify the "
"DNS listener port "
"(%d)",
xfr, port);
result = ISC_R_FAILURE;
}
} else {
cfg_obj_log(obj, ISC_LOG_ERROR,
"'%s' cannot specify the "
"DNS listener port (%d)",
xfr, port);
"'none' is not a legal "
"'%s' parameter in a "
"server block",
xfr);
result = ISC_R_FAILURE;
}
}
lib/isccfg/namedconf.c
+55 -9
View File
@@ -131,6 +131,8 @@ static cfg_type_t cfg_type_printtime;
static cfg_type_t cfg_type_qminmethod;
static cfg_type_t cfg_type_querysource4;
static cfg_type_t cfg_type_querysource6;
static cfg_type_t cfg_type_server_querysource4;
static cfg_type_t cfg_type_server_querysource6;
static cfg_type_t cfg_type_querysource;
static cfg_type_t cfg_type_server;
static cfg_type_t cfg_type_server_key_kludge;
@@ -2603,8 +2605,8 @@ static cfg_clausedef_t server_clauses[] = {
{ "notify-source-v6", &cfg_type_sockaddr6wild, 0 },
{ "padding", &cfg_type_uint32, 0 },
{ "provide-ixfr", &cfg_type_boolean, 0 },
{ "query-source", &cfg_type_querysource4, 0 },
{ "query-source-v6", &cfg_type_querysource6, 0 },
{ "query-source", &cfg_type_server_querysource4, 0 },
{ "query-source-v6", &cfg_type_server_querysource6, 0 },
{ "request-expire", &cfg_type_boolean, 0 },
{ "request-ixfr", &cfg_type_boolean, 0 },
{ "request-ixfr-max-diffs", &cfg_type_uint32, 0 },
@@ -3218,14 +3220,33 @@ static cfg_type_t cfg_type_optional_class = { "optional_class",
static isc_result_t
parse_querysource(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
REQUIRE(type != NULL);
isc_result_t result;
isc_result_t result = cfg_parse_sockaddr_generic(
pctx, &cfg_type_querysource, type, ret);
/* Preserve legacy query-source logging. */
REQUIRE(type != NULL);
CHECK(cfg_peektoken(pctx, 0));
if (pctx->token.type == isc_tokentype_string &&
strcasecmp(TOKEN_STRING(pctx), "address") == 0)
{
CHECK(cfg_gettoken(pctx, 0));
CHECK(cfg_peektoken(pctx, 0));
}
if (pctx->token.type == isc_tokentype_string &&
strcasecmp(TOKEN_STRING(pctx), "none") == 0)
{
CHECK(cfg_gettoken(pctx, 0));
CHECK(cfg_create_obj(pctx, &cfg_type_none, ret));
} else {
CHECK(cfg_parse_sockaddr_generic(pctx, &cfg_type_querysource,
type, ret));
}
cleanup:
if (result != ISC_R_SUCCESS) {
cfg_parser_error(pctx, CFG_LOG_NEAR, "invalid query source");
}
return result;
}
@@ -3233,15 +3254,15 @@ static void
print_querysource(cfg_printer_t *pctx, const cfg_obj_t *obj) {
isc_netaddr_t na;
isc_netaddr_fromsockaddr(&na, &obj->value.sockaddr);
cfg_print_cstr(pctx, "address ");
cfg_print_rawaddr(pctx, &na);
}
static void
doc_querysource(cfg_printer_t *pctx, const cfg_type_t *type) {
doc__querysource(cfg_printer_t *pctx, const cfg_type_t *type, bool has_none) {
const unsigned int *flagp = type->of;
cfg_print_cstr(pctx, "[ address ] ( ");
if ((*flagp & CFG_ADDR_V4OK) != 0) {
cfg_print_cstr(pctx, "<ipv4_address>");
} else if ((*flagp & CFG_ADDR_V6OK) != 0) {
@@ -3249,7 +3270,22 @@ doc_querysource(cfg_printer_t *pctx, const cfg_type_t *type) {
} else {
UNREACHABLE();
}
cfg_print_cstr(pctx, " | * )");
cfg_print_cstr(pctx, " | *");
if (has_none) {
cfg_print_cstr(pctx, " | none");
}
cfg_print_cstr(pctx, " )");
}
static void
doc_querysource(cfg_printer_t *pctx, const cfg_type_t *type) {
doc__querysource(pctx, type, true);
}
static void
doc_serverquerysource(cfg_printer_t *pctx, const cfg_type_t *type) {
doc__querysource(pctx, type, false);
}
static unsigned int sockaddr4wild_flags = CFG_ADDR_WILDOK | CFG_ADDR_V4OK;
@@ -3270,6 +3306,16 @@ static cfg_type_t cfg_type_querysource6 = {
NULL, &querysource6wild_flags
};
static cfg_type_t cfg_type_server_querysource4 = {
"querysource4", parse_querysource, NULL, doc_serverquerysource,
NULL, &querysource4wild_flags
};
static cfg_type_t cfg_type_server_querysource6 = {
"querysource6", parse_querysource, NULL, doc_serverquerysource,
NULL, &querysource6wild_flags
};
static cfg_type_t cfg_type_querysource = { "querysource", NULL,
print_querysource, NULL,
&cfg_rep_sockaddr, NULL };