name change from "hook modules" to "plugins"
- "hook" is now used only for hook points and hook actions - the "hook" statement in named.conf is now "plugin" - ns_module and ns_modlist are now ns_plugin and ns_plugins - ns_module_load is renamed ns_plugin_register - the mandatory functions in plugin modules (hook_register, hook_check, hook_version, hook_destroy) have been renamed
This commit is contained in:
Evan Hunt
72
bin/plugins/Makefile.in
Normal file
72
bin/plugins/Makefile.in
Normal file
@@ -0,0 +1,72 @@
|
||||
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
#
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
#
|
||||
# See the COPYRIGHT file distributed with this work for additional
|
||||
# information regarding copyright ownership.
|
||||
|
||||
srcdir = @srcdir@
|
||||
VPATH = @srcdir@
|
||||
top_srcdir = @top_srcdir@
|
||||
|
||||
@BIND9_MAKE_INCLUDES@
|
||||
|
||||
CINCLUDES = -I${srcdir}/include -I${srcdir}/unix/include -I. \
|
||||
${NS_INCLUDES} ${DNS_INCLUDES} \
|
||||
${ISCCFG_INCLUDES} ${ISC_INCLUDES}
|
||||
|
||||
DNSLIBS = ../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
|
||||
ISCCFGLIBS = ../../lib/isccfg/libisccfg.@A@
|
||||
ISCLIBS = ../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
|
||||
NSLIBS = ../../lib/ns/libns.@A@
|
||||
|
||||
LIBS =
|
||||
|
||||
SO_TARGETS = lib/filter-aaaa.@SO@
|
||||
TARGETS = @SO_TARGETS@
|
||||
|
||||
SO_OBJS = filter-aaaa.@O@
|
||||
SO_SRCS = filter-aaaa.c
|
||||
|
||||
CFLAGS = @CFLAGS@ @SO_CFLAGS@
|
||||
SO_LDFLAGS = @LDFLAGS@ @SO_LDFLAGS@
|
||||
|
||||
MANPAGES = filter-aaaa.8
|
||||
|
||||
HTMLPAGES = filter-aaaa.html
|
||||
|
||||
MANOBJS = ${MANPAGES} ${HTMLPAGES}
|
||||
|
||||
@BIND9_MAKE_RULES@
|
||||
|
||||
lib/filter-aaaa.@SO@: filter-aaaa.@SO@
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs `pwd`/lib
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL} filter-aaaa.@SO@ `pwd`/lib
|
||||
|
||||
filter-aaaa.@SO@: filter-aaaa.@O@
|
||||
${LIBTOOL_MODE_LINK} @SO_LD@ ${SO_LDFLAGS} -o $@ \
|
||||
filter-aaaa.@O@ ${LIBS}
|
||||
|
||||
doc man:: ${MANOBJS}
|
||||
|
||||
docclean manclean maintainer-clean::
|
||||
rm -f ${MANOBJS}
|
||||
|
||||
clean distclean::
|
||||
rm -f filter-aaaa.so
|
||||
rm -f ${TARGETS} ${OBJS}
|
||||
|
||||
installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
|
||||
|
||||
install:: filter-aaaa.@SO@ installdirs
|
||||
${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} filter-aaaa.@SO@ \
|
||||
${DESTDIR}${libdir}
|
||||
${INSTALL_DATA} ${srcdir}/filter-aaaa.8 ${DESTDIR}${mandir}/man8
|
||||
|
||||
uninstall::
|
||||
${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/filter-aaaa.@SO@
|
||||
rm -f ${DESTDIR}${mandir}/man8/filter-aaaa.8
|
||||
116
bin/plugins/filter-aaaa.8
Normal file
116
bin/plugins/filter-aaaa.8
Normal file
@@ -0,0 +1,116 @@
|
||||
.\" Copyright (C) 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
.\" file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
.\"
|
||||
.hy 0
|
||||
.ad l
|
||||
'\" t
|
||||
.\" Title: filter-aaaa.so
|
||||
.\" Author:
|
||||
.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
|
||||
.\" Date: 2018-08-13
|
||||
.\" Manual: BIND9
|
||||
.\" Source: ISC
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "FILTER\-AAAA\&.SO" "8" "2018\-08\-13" "ISC" "BIND9"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
filter-aaaa.so \- filter AAAA in DNS responses when A is present
|
||||
.SH "SYNOPSIS"
|
||||
.HP 28
|
||||
\fBhook query "filter\-aaaa\&.so"\fR [\fI{\ parameters\ }\fR];
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
\fBfilter\-aaaa\&.so\fR
|
||||
is a query hook module for
|
||||
\fBnamed\fR, enabling
|
||||
\fBnamed\fR
|
||||
to omit some IPv6 addresses when responding to clients\&.
|
||||
.PP
|
||||
Until BIND 9\&.12, this feature was implemented natively in
|
||||
\fBnamed\fR
|
||||
and enabled with the
|
||||
\fBfilter\-aaaa\fR
|
||||
ACL and the
|
||||
\fBfilter\-aaaa\-on\-v4\fR
|
||||
and
|
||||
\fBfilter\-aaaa\-on\-v6\fR
|
||||
options\&. These options are now deprecated in
|
||||
named\&.conf, but can be passed as parameters to the
|
||||
\fBfilter\-aaaa\&.so\fR
|
||||
hook module, for example:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
hook query "/usr/local/lib/filter\-aaaa\&.so" {
|
||||
filter\-aaaa\-on\-v4 yes;
|
||||
filter\-aaaa\-on\-v6 yes;
|
||||
filter\-aaaa { 192\&.0\&.2\&.1; 2001:db8:2::1; };
|
||||
};
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
This module is intended to aid transition from IPv4 to IPv6 by withholding IPv6 addresses from DNS clients which are not connected to the IPv6 Internet, when the name being looked up has an IPv4 address available\&. Use of this module is not recommended unless absolutely necessary\&.
|
||||
.PP
|
||||
Note: This mechanism can erroneously cause other servers not to give AAAA records to their clients\&. If a recursing server with both IPv6 and IPv4 network connections queries an authoritative server using this mechanism via IPv4, it will be denied AAAA records even if its client is using IPv6\&.
|
||||
.SH "OPTIONS"
|
||||
.PP
|
||||
\fBfilter\-aaaa\fR
|
||||
.RS 4
|
||||
Specifies a list of client addresses for which AAAA filtering is to be applied\&. The default is
|
||||
\fBany\fR\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBfilter\-aaaa\-on\-v4\fR
|
||||
.RS 4
|
||||
If set to
|
||||
\fByes\fR, the DNS client is at an IPv4 address, in
|
||||
\fBfilter\-aaaa\fR, and if the response does not include DNSSEC signatures, then all AAAA records are deleted from the response\&. This filtering applies to all responses and not only authoritative responses\&.
|
||||
.sp
|
||||
If set to
|
||||
\fBbreak\-dnssec\fR, then AAAA records are deleted even when DNSSEC is enabled\&. As suggested by the name, this causes the response to fail to verify, because the DNSSEC protocol is designed to detect deletions\&.
|
||||
.sp
|
||||
This mechanism can erroneously cause other servers not to give AAAA records to their clients\&. A recursing server with both IPv6 and IPv4 network connections that queries an authoritative server using this mechanism via IPv4 will be denied AAAA records even if its client is using IPv6\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBfilter\-aaaa\-on\-v6\fR
|
||||
.RS 4
|
||||
Identical to
|
||||
\fBfilter\-aaaa\-on\-v4\fR, except it filters AAAA responses to queries from IPv6 clients instead of IPv4 clients\&. To filter all responses, set both options to
|
||||
\fByes\fR\&.
|
||||
.RE
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
BIND 9 Administrator Reference Manual\&.
|
||||
.SH "AUTHOR"
|
||||
.PP
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
925
bin/plugins/filter-aaaa.c
Normal file
925
bin/plugins/filter-aaaa.c
Normal file
@@ -0,0 +1,925 @@
|
||||
/*
|
||||
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
*/
|
||||
|
||||
/*! \file */
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#include <inttypes.h>
|
||||
#include <stdbool.h>
|
||||
#include <string.h>
|
||||
|
||||
#include <isc/buffer.h>
|
||||
#include <isc/hash.h>
|
||||
#include <isc/ht.h>
|
||||
#include <isc/lib.h>
|
||||
#include <isc/log.h>
|
||||
#include <isc/mem.h>
|
||||
#include <isc/netaddr.h>
|
||||
#include <isc/result.h>
|
||||
#include <isc/types.h>
|
||||
#include <isc/util.h>
|
||||
|
||||
#include <isccfg/aclconf.h>
|
||||
#include <isccfg/cfg.h>
|
||||
#include <isccfg/grammar.h>
|
||||
|
||||
#include <ns/client.h>
|
||||
#include <ns/hooks.h>
|
||||
#include <ns/log.h>
|
||||
#include <ns/query.h>
|
||||
#include <ns/types.h>
|
||||
|
||||
#include <dns/acl.h>
|
||||
#include <dns/db.h>
|
||||
#include <dns/enumtype.h>
|
||||
#include <dns/log.h>
|
||||
#include <dns/message.h>
|
||||
#include <dns/rdataset.h>
|
||||
#include <dns/result.h>
|
||||
#include <dns/types.h>
|
||||
#include <dns/view.h>
|
||||
|
||||
#define CHECK(op) \
|
||||
do { \
|
||||
result = (op); \
|
||||
if (result != ISC_R_SUCCESS) { \
|
||||
goto cleanup; \
|
||||
} \
|
||||
} while (0)
|
||||
|
||||
/*
|
||||
* Possible values for the settings of filter-aaaa-on-v4 and
|
||||
* filter-aaaa-on-v6: "no" is NONE, "yes" is FILTER, "break-dnssec"
|
||||
* is BREAK_DNSSEC.
|
||||
*/
|
||||
typedef enum {
|
||||
NONE = 0,
|
||||
FILTER = 1,
|
||||
BREAK_DNSSEC = 2
|
||||
} filter_aaaa_t;
|
||||
|
||||
/*
|
||||
* Persistent data for use by this module. This will be associated
|
||||
* with client object address in the hash table, and will remain
|
||||
* accessible until the client object is detached.
|
||||
*/
|
||||
typedef struct filter_data {
|
||||
filter_aaaa_t mode;
|
||||
uint32_t flags;
|
||||
} filter_data_t;
|
||||
|
||||
typedef struct filter_instance {
|
||||
ns_plugin_t *module;
|
||||
isc_mem_t *mctx;
|
||||
|
||||
/*
|
||||
* Memory pool for use with persistent data.
|
||||
*/
|
||||
isc_mempool_t *datapool;
|
||||
|
||||
/*
|
||||
* Hash table associating a client object with its persistent data.
|
||||
*/
|
||||
isc_ht_t *ht;
|
||||
|
||||
/*
|
||||
* Values configured when the module is loaded.
|
||||
*/
|
||||
filter_aaaa_t v4_aaaa;
|
||||
filter_aaaa_t v6_aaaa;
|
||||
dns_acl_t *aaaa_acl;
|
||||
} filter_instance_t;
|
||||
|
||||
/*
|
||||
* Per-client flags set by this module
|
||||
*/
|
||||
#define FILTER_AAAA_RECURSING 0x0001 /* Recursing for A */
|
||||
#define FILTER_AAAA_FILTERED 0x0002 /* AAAA was removed from answer */
|
||||
|
||||
/*
|
||||
* Client attribute tests.
|
||||
*/
|
||||
#define WANTDNSSEC(c) (((c)->attributes & NS_CLIENTATTR_WANTDNSSEC) != 0)
|
||||
#define RECURSIONOK(c) (((c)->query.attributes & \
|
||||
NS_QUERYATTR_RECURSIONOK) != 0)
|
||||
|
||||
/*
|
||||
* Forward declarations of functions referenced in install_hooks().
|
||||
*/
|
||||
static bool
|
||||
filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp);
|
||||
static bool
|
||||
filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp);
|
||||
static bool
|
||||
filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp);
|
||||
static bool
|
||||
filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp);
|
||||
static bool
|
||||
filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp);
|
||||
static bool
|
||||
filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp);
|
||||
|
||||
/*%
|
||||
* Register the functions to be called at each hook point in 'hooktable', using
|
||||
* memory context 'mctx' for allocating copies of stack-allocated structures
|
||||
* passed to ns_hook_add(). Make sure 'inst' will be passed as the 'cbdata'
|
||||
* argument to every callback.
|
||||
*/
|
||||
static void
|
||||
install_hooks(ns_hooktable_t *hooktable, isc_mem_t *mctx,
|
||||
filter_instance_t *inst)
|
||||
{
|
||||
const ns_hook_t filter_init = {
|
||||
.action = filter_qctx_initialize,
|
||||
.action_data = inst,
|
||||
};
|
||||
|
||||
const ns_hook_t filter_respbegin = {
|
||||
.action = filter_respond_begin,
|
||||
.action_data = inst,
|
||||
};
|
||||
|
||||
const ns_hook_t filter_respanyfound = {
|
||||
.action = filter_respond_any_found,
|
||||
.action_data = inst,
|
||||
};
|
||||
|
||||
const ns_hook_t filter_prepresp = {
|
||||
.action = filter_prep_response_begin,
|
||||
.action_data = inst,
|
||||
};
|
||||
|
||||
const ns_hook_t filter_donesend = {
|
||||
.action = filter_query_done_send,
|
||||
.action_data = inst,
|
||||
};
|
||||
|
||||
const ns_hook_t filter_destroy = {
|
||||
.action = filter_qctx_destroy,
|
||||
.action_data = inst,
|
||||
};
|
||||
|
||||
ns_hook_add(hooktable, mctx, -
|
||||
NS_QUERY_QCTX_INITIALIZED, &filter_init);
|
||||
ns_hook_add(hooktable, mctx,
|
||||
NS_QUERY_RESPOND_BEGIN, &filter_respbegin);
|
||||
ns_hook_add(hooktable, mctx,
|
||||
NS_QUERY_RESPOND_ANY_FOUND, &filter_respanyfound);
|
||||
ns_hook_add(hooktable, mctx,
|
||||
NS_QUERY_PREP_RESPONSE_BEGIN, &filter_prepresp);
|
||||
ns_hook_add(hooktable, mctx,
|
||||
NS_QUERY_DONE_SEND, &filter_donesend);
|
||||
ns_hook_add(hooktable, mctx,
|
||||
NS_QUERY_QCTX_DESTROYED, &filter_destroy);
|
||||
}
|
||||
|
||||
/**
|
||||
** Support for parsing of parameters and configuration of the module.
|
||||
**/
|
||||
|
||||
/*
|
||||
* Support for parsing of parameters.
|
||||
*/
|
||||
static const char *filter_aaaa_enums[] = { "break-dnssec", NULL };
|
||||
|
||||
static isc_result_t
|
||||
parse_filter_aaaa(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
|
||||
return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
|
||||
}
|
||||
|
||||
static void
|
||||
doc_filter_aaaa(cfg_printer_t *pctx, const cfg_type_t *type) {
|
||||
cfg_doc_enum_or_other(pctx, type, &cfg_type_boolean);
|
||||
}
|
||||
|
||||
static cfg_type_t cfg_type_filter_aaaa = {
|
||||
"filter_aaaa", parse_filter_aaaa, cfg_print_ustring,
|
||||
doc_filter_aaaa, &cfg_rep_string, filter_aaaa_enums,
|
||||
};
|
||||
|
||||
static cfg_clausedef_t param_clauses[] = {
|
||||
{ "filter-aaaa", &cfg_type_bracketed_aml, 0 },
|
||||
{ "filter-aaaa-on-v4", &cfg_type_filter_aaaa, 0 },
|
||||
{ "filter-aaaa-on-v6", &cfg_type_filter_aaaa, 0 },
|
||||
};
|
||||
|
||||
static cfg_clausedef_t *param_clausesets[] = {
|
||||
param_clauses,
|
||||
NULL
|
||||
};
|
||||
|
||||
static cfg_type_t cfg_type_parameters = {
|
||||
"filter-aaaa-params", cfg_parse_mapbody, cfg_print_mapbody,
|
||||
cfg_doc_mapbody, &cfg_rep_map, param_clausesets
|
||||
};
|
||||
|
||||
static isc_result_t
|
||||
parse_filter_aaaa_on(const cfg_obj_t *param_obj, const char *param_name,
|
||||
filter_aaaa_t *dstp)
|
||||
{
|
||||
const cfg_obj_t *obj = NULL;
|
||||
isc_result_t result;
|
||||
|
||||
result = cfg_map_get(param_obj, param_name, &obj);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
if (cfg_obj_isboolean(obj)) {
|
||||
if (cfg_obj_asboolean(obj)) {
|
||||
*dstp = FILTER;
|
||||
} else {
|
||||
*dstp = NONE;
|
||||
}
|
||||
} else if (strcasecmp(cfg_obj_asstring(obj), "break-dnssec") == 0) {
|
||||
*dstp = BREAK_DNSSEC;
|
||||
} else {
|
||||
result = ISC_R_UNEXPECTED;
|
||||
}
|
||||
|
||||
return (result);
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
check_syntax(cfg_obj_t *fmap, const void *cfg,
|
||||
isc_mem_t *mctx, isc_log_t *lctx, void *actx)
|
||||
{
|
||||
isc_result_t result = ISC_R_SUCCESS;
|
||||
const cfg_obj_t *aclobj = NULL;
|
||||
dns_acl_t *acl = NULL;
|
||||
filter_aaaa_t f4 = NONE, f6 = NONE;
|
||||
|
||||
cfg_map_get(fmap, "filter-aaaa", &aclobj);
|
||||
if (aclobj == NULL) {
|
||||
return (result);
|
||||
}
|
||||
|
||||
CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *) cfg,
|
||||
lctx, (cfg_aclconfctx_t *) actx,
|
||||
mctx, 0, &acl));
|
||||
|
||||
CHECK(parse_filter_aaaa_on(fmap, "filter-aaaa-on-v4", &f4));
|
||||
CHECK(parse_filter_aaaa_on(fmap, "filter-aaaa-on-v6", &f6));
|
||||
|
||||
if ((f4 != NONE || f6 != NONE) && dns_acl_isnone(acl)) {
|
||||
cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
|
||||
"\"filter-aaaa\" is 'none;' but "
|
||||
"either filter-aaaa-on-v4 or filter-aaaa-on-v6 "
|
||||
"is enabled");
|
||||
result = ISC_R_FAILURE;
|
||||
} else if (f4 == NONE && f6 == NONE && !dns_acl_isnone(acl)) {
|
||||
cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
|
||||
"\"filter-aaaa\" is set but "
|
||||
"neither filter-aaaa-on-v4 or filter-aaaa-on-v6 "
|
||||
"is enabled");
|
||||
result = ISC_R_FAILURE;
|
||||
}
|
||||
|
||||
cleanup:
|
||||
if (acl != NULL) {
|
||||
dns_acl_detach(&acl);
|
||||
}
|
||||
|
||||
return (result);
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
parse_parameters(filter_instance_t *inst, const char *parameters,
|
||||
const void *cfg, const char *cfg_file, unsigned long cfg_line,
|
||||
isc_mem_t *mctx, isc_log_t *lctx, void *actx)
|
||||
{
|
||||
isc_result_t result = ISC_R_SUCCESS;
|
||||
cfg_parser_t *parser = NULL;
|
||||
cfg_obj_t *param_obj = NULL;
|
||||
const cfg_obj_t *obj = NULL;
|
||||
isc_buffer_t b;
|
||||
|
||||
CHECK(cfg_parser_create(mctx, lctx, &parser));
|
||||
|
||||
isc_buffer_constinit(&b, parameters, strlen(parameters));
|
||||
isc_buffer_add(&b, strlen(parameters));
|
||||
CHECK(cfg_parse_buffer4(parser, &b, cfg_file, cfg_line,
|
||||
&cfg_type_parameters, 0, ¶m_obj));
|
||||
|
||||
CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
|
||||
|
||||
CHECK(parse_filter_aaaa_on(param_obj, "filter-aaaa-on-v4",
|
||||
&inst->v4_aaaa));
|
||||
CHECK(parse_filter_aaaa_on(param_obj, "filter-aaaa-on-v6",
|
||||
&inst->v6_aaaa));
|
||||
|
||||
result = cfg_map_get(param_obj, "filter-aaaa", &obj);
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *) cfg,
|
||||
lctx, (cfg_aclconfctx_t *) actx,
|
||||
mctx, 0, &inst->aaaa_acl));
|
||||
} else {
|
||||
CHECK(dns_acl_any(mctx, &inst->aaaa_acl));
|
||||
}
|
||||
|
||||
cleanup:
|
||||
if (param_obj != NULL) {
|
||||
cfg_obj_destroy(parser, ¶m_obj);
|
||||
}
|
||||
if (parser != NULL) {
|
||||
cfg_parser_destroy(&parser);
|
||||
}
|
||||
return (result);
|
||||
}
|
||||
|
||||
/**
|
||||
** Mandatory plugin API functions:
|
||||
**
|
||||
** - plugin_destroy
|
||||
** - plugin_register
|
||||
** - plugin_version
|
||||
** - plugin_check
|
||||
**/
|
||||
|
||||
/*
|
||||
* Called by ns_plugin_register() to initialize the plugin and
|
||||
* register hook functions into the view hook table.
|
||||
*/
|
||||
isc_result_t
|
||||
plugin_register(const char *parameters,
|
||||
const void *cfg, const char *cfg_file, unsigned long cfg_line,
|
||||
isc_mem_t *mctx, isc_log_t *lctx, void *actx,
|
||||
ns_hooktable_t *hooktable, void **instp)
|
||||
{
|
||||
filter_instance_t *inst = NULL;
|
||||
isc_result_t result;
|
||||
|
||||
|
||||
isc_log_write(lctx, NS_LOGCATEGORY_GENERAL,
|
||||
NS_LOGMODULE_HOOKS, ISC_LOG_INFO,
|
||||
"registering 'filter-aaaa' "
|
||||
"module from %s:%lu, %s parameters",
|
||||
cfg_file, cfg_line, parameters != NULL ? "with" : "no");
|
||||
|
||||
inst = isc_mem_get(mctx, sizeof(*inst));
|
||||
memset(inst, 0, sizeof(*inst));
|
||||
isc_mem_attach(mctx, &inst->mctx);
|
||||
|
||||
if (parameters != NULL) {
|
||||
CHECK(parse_parameters(inst, parameters, cfg, cfg_file,
|
||||
cfg_line, mctx, lctx, actx));
|
||||
}
|
||||
|
||||
CHECK(isc_mempool_create(mctx, sizeof(filter_data_t),
|
||||
&inst->datapool));
|
||||
CHECK(isc_ht_init(&inst->ht, mctx, 16));
|
||||
|
||||
/*
|
||||
* Fill the mempool with 1K filter_aaaa state objects at
|
||||
* a time; ideally after a single allocation, the mempool will
|
||||
* have enough to handle all the simultaneous queries the system
|
||||
* requires and it won't be necessary to allocate more.
|
||||
*
|
||||
* We don't set any limit on the number of free state objects
|
||||
* so that they'll always be returned to the pool and not
|
||||
* freed until the pool is destroyed on shutdown.
|
||||
*/
|
||||
isc_mempool_setfillcount(inst->datapool, 1024);
|
||||
isc_mempool_setfreemax(inst->datapool, UINT_MAX);
|
||||
|
||||
/*
|
||||
* Set hook points in the view's hooktable.
|
||||
*/
|
||||
install_hooks(hooktable, mctx, inst);
|
||||
|
||||
*instp = inst;
|
||||
|
||||
cleanup:
|
||||
if (result != ISC_R_SUCCESS && inst != NULL) {
|
||||
plugin_destroy((void **) &inst);
|
||||
}
|
||||
|
||||
return (result);
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
plugin_check(const char *parameters,
|
||||
const void *cfg, const char *cfg_file, unsigned long cfg_line,
|
||||
isc_mem_t *mctx, isc_log_t *lctx, void *actx)
|
||||
{
|
||||
isc_result_t result = ISC_R_SUCCESS;
|
||||
cfg_parser_t *parser = NULL;
|
||||
cfg_obj_t *param_obj = NULL;
|
||||
isc_buffer_t b;
|
||||
|
||||
CHECK(cfg_parser_create(mctx, lctx, &parser));
|
||||
|
||||
isc_buffer_constinit(&b, parameters, strlen(parameters));
|
||||
isc_buffer_add(&b, strlen(parameters));
|
||||
CHECK(cfg_parse_buffer4(parser, &b, cfg_file, cfg_line,
|
||||
&cfg_type_parameters, 0, ¶m_obj));
|
||||
|
||||
CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
|
||||
|
||||
cleanup:
|
||||
if (param_obj != NULL) {
|
||||
cfg_obj_destroy(parser, ¶m_obj);
|
||||
}
|
||||
if (parser != NULL) {
|
||||
cfg_parser_destroy(&parser);
|
||||
}
|
||||
return (result);
|
||||
}
|
||||
|
||||
/*
|
||||
* Called by ns_plugins_free(); frees memory allocated by
|
||||
* the module when it was registered.
|
||||
*/
|
||||
void
|
||||
plugin_destroy(void **instp) {
|
||||
filter_instance_t *inst = (filter_instance_t *) *instp;
|
||||
|
||||
if (inst->ht != NULL) {
|
||||
isc_ht_destroy(&inst->ht);
|
||||
}
|
||||
if (inst->datapool != NULL) {
|
||||
isc_mempool_destroy(&inst->datapool);
|
||||
}
|
||||
if (inst->aaaa_acl != NULL) {
|
||||
dns_acl_detach(&inst->aaaa_acl);
|
||||
}
|
||||
|
||||
isc_mem_putanddetach(&inst->mctx, inst, sizeof(*inst));
|
||||
*instp = NULL;
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
/*
|
||||
* Returns hook module API version for compatibility checks.
|
||||
*/
|
||||
int
|
||||
plugin_version(void) {
|
||||
return (NS_PLUGIN_VERSION);
|
||||
}
|
||||
|
||||
/**
|
||||
** "filter-aaaa" feature implementation begins here.
|
||||
**/
|
||||
|
||||
/*%
|
||||
* Structure describing the filtering to be applied by process_section().
|
||||
*/
|
||||
typedef struct section_filter {
|
||||
query_ctx_t * qctx;
|
||||
filter_aaaa_t mode;
|
||||
dns_section_t section;
|
||||
const dns_name_t * name;
|
||||
dns_rdatatype_t type;
|
||||
bool only_if_a_exists;
|
||||
} section_filter_t;
|
||||
|
||||
/*
|
||||
* Check whether this is an IPv4 client.
|
||||
*/
|
||||
static bool
|
||||
is_v4_client(ns_client_t *client) {
|
||||
if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) {
|
||||
return (true);
|
||||
}
|
||||
if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
|
||||
IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
|
||||
{
|
||||
return (true);
|
||||
}
|
||||
return (false);
|
||||
}
|
||||
|
||||
/*
|
||||
* Check whether this is an IPv6 client.
|
||||
*/
|
||||
static bool
|
||||
is_v6_client(ns_client_t *client) {
|
||||
if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
|
||||
!IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
|
||||
{
|
||||
return (true);
|
||||
}
|
||||
return (false);
|
||||
}
|
||||
|
||||
static filter_data_t *
|
||||
client_state_get(const query_ctx_t *qctx, filter_instance_t *inst) {
|
||||
filter_data_t *client_state = NULL;
|
||||
isc_result_t result;
|
||||
|
||||
result = isc_ht_find(inst->ht, (const unsigned char *)&qctx->client,
|
||||
sizeof(qctx->client), (void **)&client_state);
|
||||
|
||||
return (result == ISC_R_SUCCESS ? client_state : NULL);
|
||||
}
|
||||
|
||||
static void
|
||||
client_state_create(const query_ctx_t *qctx, filter_instance_t *inst) {
|
||||
filter_data_t *client_state;
|
||||
isc_result_t result;
|
||||
|
||||
client_state = isc_mempool_get(inst->datapool);
|
||||
if (client_state == NULL) {
|
||||
return;
|
||||
}
|
||||
|
||||
client_state->mode = NONE;
|
||||
client_state->flags = 0;
|
||||
|
||||
result = isc_ht_add(inst->ht, (const unsigned char *)&qctx->client,
|
||||
sizeof(qctx->client), client_state);
|
||||
RUNTIME_CHECK(result == ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
static void
|
||||
client_state_destroy(const query_ctx_t *qctx, filter_instance_t *inst) {
|
||||
filter_data_t *client_state = client_state_get(qctx, inst);
|
||||
isc_result_t result;
|
||||
|
||||
if (client_state == NULL) {
|
||||
return;
|
||||
}
|
||||
|
||||
result = isc_ht_delete(inst->ht, (const unsigned char *)&qctx->client,
|
||||
sizeof(qctx->client));
|
||||
RUNTIME_CHECK(result == ISC_R_SUCCESS);
|
||||
|
||||
isc_mempool_put(inst->datapool, client_state);
|
||||
}
|
||||
|
||||
/*%
|
||||
* Mark 'rdataset' and 'sigrdataset' as rendered, gracefully handling NULL
|
||||
* pointers and non-associated rdatasets.
|
||||
*/
|
||||
static void
|
||||
mark_as_rendered(dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
|
||||
if (rdataset != NULL && dns_rdataset_isassociated(rdataset)) {
|
||||
rdataset->attributes |= DNS_RDATASETATTR_RENDERED;
|
||||
}
|
||||
if (sigrdataset != NULL && dns_rdataset_isassociated(sigrdataset)) {
|
||||
sigrdataset->attributes |= DNS_RDATASETATTR_RENDERED;
|
||||
}
|
||||
}
|
||||
|
||||
/*%
|
||||
* Check whether an RRset of given 'type' is present at given 'name'. If
|
||||
* it is found and either it is not signed or the combination of query
|
||||
* flags and configured processing 'mode' allows it, mark the RRset and its
|
||||
* associated signatures as already rendered to prevent them from appearing
|
||||
* in the response message stored in 'qctx'. If 'only_if_a_exists' is
|
||||
* true, an RRset of type A must also exist at 'name' in order for the
|
||||
* above processing to happen.
|
||||
*/
|
||||
static bool
|
||||
process_name(query_ctx_t *qctx, filter_aaaa_t mode, const dns_name_t *name,
|
||||
dns_rdatatype_t type, bool only_if_a_exists)
|
||||
{
|
||||
dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
|
||||
isc_result_t result;
|
||||
bool modified = false;
|
||||
|
||||
if (only_if_a_exists) {
|
||||
CHECK(dns_message_findtype(name, dns_rdatatype_a, 0, NULL));
|
||||
}
|
||||
|
||||
dns_message_findtype(name, type, 0, &rdataset);
|
||||
dns_message_findtype(name, dns_rdatatype_rrsig, type, &sigrdataset);
|
||||
|
||||
if (rdataset != NULL &&
|
||||
(sigrdataset == NULL || !WANTDNSSEC(qctx->client) ||
|
||||
mode == BREAK_DNSSEC))
|
||||
{
|
||||
/*
|
||||
* An RRset of given 'type' was found at 'name' and at least
|
||||
* one of the following is true:
|
||||
*
|
||||
* - the RRset is not signed,
|
||||
* - the client did not set the DO bit in its request,
|
||||
* - configuration allows us to tamper with signed responses.
|
||||
*
|
||||
* This means it is okay to filter out this RRset and its
|
||||
* signatures, if any, from the response.
|
||||
*/
|
||||
mark_as_rendered(rdataset, sigrdataset);
|
||||
modified = true;
|
||||
}
|
||||
|
||||
cleanup:
|
||||
return (modified);
|
||||
}
|
||||
|
||||
/*%
|
||||
* Apply the requested section filter, i.e. prevent (when possible, as
|
||||
* determined by process_name()) RRsets of given 'type' from being rendered
|
||||
* in the given 'section' of the response message stored in 'qctx'. Clear
|
||||
* the AD bit if the answer and/or authority section was modified. If
|
||||
* 'name' is NULL, all names in the given 'section' are processed;
|
||||
* otherwise, only 'name' is. 'only_if_a_exists' is passed through to
|
||||
* process_name().
|
||||
*/
|
||||
static void
|
||||
process_section(const section_filter_t *filter) {
|
||||
query_ctx_t *qctx = filter->qctx;
|
||||
filter_aaaa_t mode = filter->mode;
|
||||
dns_section_t section = filter->section;
|
||||
const dns_name_t *name = filter->name;
|
||||
dns_rdatatype_t type = filter->type;
|
||||
bool only_if_a_exists = filter->only_if_a_exists;
|
||||
|
||||
dns_message_t *message = qctx->client->message;
|
||||
isc_result_t result;
|
||||
|
||||
for (result = dns_message_firstname(message, section);
|
||||
result == ISC_R_SUCCESS;
|
||||
result = dns_message_nextname(message, section))
|
||||
{
|
||||
dns_name_t *cur = NULL;
|
||||
dns_message_currentname(message, section, &cur);
|
||||
if (name != NULL && !dns_name_equal(name, cur)) {
|
||||
/*
|
||||
* We only want to process 'name' and this is not it.
|
||||
*/
|
||||
continue;
|
||||
}
|
||||
|
||||
if (!process_name(qctx, mode, cur, type, only_if_a_exists)) {
|
||||
/*
|
||||
* Response was not modified, do not touch the AD bit.
|
||||
*/
|
||||
continue;
|
||||
}
|
||||
|
||||
if (section == DNS_SECTION_ANSWER ||
|
||||
section == DNS_SECTION_AUTHORITY)
|
||||
{
|
||||
message->flags &= ~DNS_MESSAGEFLAG_AD;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Initialize filter state, fetching it from a memory pool and storing it
|
||||
* in a hash table keyed according to the client object; this enables us to
|
||||
* retrieve persistent data related to a client query for as long as the
|
||||
* object persists.
|
||||
*/
|
||||
static bool
|
||||
filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
|
||||
query_ctx_t *qctx = (query_ctx_t *) arg;
|
||||
filter_instance_t *inst = (filter_instance_t *) cbdata;
|
||||
filter_data_t *client_state;
|
||||
|
||||
*resp = ISC_R_UNSET;
|
||||
|
||||
client_state = client_state_get(qctx, inst);
|
||||
if (client_state == NULL) {
|
||||
client_state_create(qctx, inst);
|
||||
}
|
||||
|
||||
return (false);
|
||||
}
|
||||
|
||||
/*
|
||||
* Determine whether this client should have AAAA filtered or not, based on
|
||||
* the client address family and the settings of filter-aaaa-on-v4 and
|
||||
* filter-aaaa-on-v6.
|
||||
*/
|
||||
static bool
|
||||
filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
|
||||
query_ctx_t *qctx = (query_ctx_t *) arg;
|
||||
filter_instance_t *inst = (filter_instance_t *) cbdata;
|
||||
filter_data_t *client_state = client_state_get(qctx, inst);
|
||||
isc_result_t result;
|
||||
|
||||
*resp = ISC_R_UNSET;
|
||||
|
||||
if (client_state == NULL) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
if (inst->v4_aaaa != NONE || inst->v6_aaaa != NONE) {
|
||||
result = ns_client_checkaclsilent(qctx->client, NULL,
|
||||
inst->aaaa_acl, true);
|
||||
if (result == ISC_R_SUCCESS &&
|
||||
inst->v4_aaaa != NONE &&
|
||||
is_v4_client(qctx->client))
|
||||
{
|
||||
client_state->mode = inst->v4_aaaa;
|
||||
} else if (result == ISC_R_SUCCESS &&
|
||||
inst->v6_aaaa != NONE &&
|
||||
is_v6_client(qctx->client))
|
||||
{
|
||||
client_state->mode = inst->v6_aaaa;
|
||||
}
|
||||
}
|
||||
|
||||
return (false);
|
||||
}
|
||||
|
||||
/*
|
||||
* Hide AAAA rrsets if there is a matching A. Trigger recursion if
|
||||
* necessary to find out whether an A exists.
|
||||
*
|
||||
* (This version is for processing answers to explicit AAAA queries; ANY
|
||||
* queries are handled in filter_respond_any_found().)
|
||||
*/
|
||||
static bool
|
||||
filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
|
||||
query_ctx_t *qctx = (query_ctx_t *) arg;
|
||||
filter_instance_t *inst = (filter_instance_t *) cbdata;
|
||||
filter_data_t *client_state = client_state_get(qctx, inst);
|
||||
isc_result_t result = ISC_R_UNSET;
|
||||
|
||||
*resp = ISC_R_UNSET;
|
||||
|
||||
if (client_state == NULL) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
if (client_state->mode != BREAK_DNSSEC &&
|
||||
(client_state->mode != FILTER ||
|
||||
(WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
|
||||
dns_rdataset_isassociated(qctx->sigrdataset))))
|
||||
{
|
||||
return (false);
|
||||
}
|
||||
|
||||
if (qctx->qtype == dns_rdatatype_aaaa) {
|
||||
dns_rdataset_t *trdataset;
|
||||
trdataset = ns_client_newrdataset(qctx->client);
|
||||
result = dns_db_findrdataset(qctx->db, qctx->node,
|
||||
qctx->version,
|
||||
dns_rdatatype_a, 0,
|
||||
qctx->client->now,
|
||||
trdataset, NULL);
|
||||
if (dns_rdataset_isassociated(trdataset)) {
|
||||
dns_rdataset_disassociate(trdataset);
|
||||
}
|
||||
ns_client_putrdataset(qctx->client, &trdataset);
|
||||
|
||||
/*
|
||||
* We found an AAAA. If we also found an A, then the AAAA
|
||||
* must not be rendered.
|
||||
*
|
||||
* If the A is not in our cache, then any result other than
|
||||
* DNS_R_DELEGATION or ISC_R_NOTFOUND means there is no A,
|
||||
* and so AAAAs are okay.
|
||||
*
|
||||
* We assume there is no A if we can't recurse for this
|
||||
* client. That might be the wrong answer, but what else
|
||||
* can we do? Besides, the fact that we have the AAAA and
|
||||
* are using this mechanism in the first place suggests
|
||||
* that we care more about As than AAAAs, and would have
|
||||
* cached an A if it existed.
|
||||
*/
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
mark_as_rendered(qctx->rdataset, qctx->sigrdataset);
|
||||
qctx->client->message->flags &= ~DNS_MESSAGEFLAG_AD;
|
||||
client_state->flags |= FILTER_AAAA_FILTERED;
|
||||
} else if (!qctx->authoritative &&
|
||||
RECURSIONOK(qctx->client) &&
|
||||
(result == DNS_R_DELEGATION ||
|
||||
result == ISC_R_NOTFOUND))
|
||||
{
|
||||
/*
|
||||
* This is an ugly kludge to recurse
|
||||
* for the A and discard the result.
|
||||
*
|
||||
* Continue to add the AAAA now.
|
||||
* We'll make a note to not render it
|
||||
* if the recursion for the A succeeds.
|
||||
*/
|
||||
result = ns_query_recurse(qctx->client,
|
||||
dns_rdatatype_a,
|
||||
qctx->client->query.qname,
|
||||
NULL, NULL, qctx->resuming);
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
client_state->flags |= FILTER_AAAA_RECURSING;
|
||||
qctx->client->query.attributes |=
|
||||
NS_QUERYATTR_RECURSING;
|
||||
}
|
||||
}
|
||||
} else if (qctx->qtype == dns_rdatatype_a &&
|
||||
(client_state->flags & FILTER_AAAA_RECURSING) != 0)
|
||||
{
|
||||
const section_filter_t filter_answer = {
|
||||
.qctx = qctx,
|
||||
.mode = client_state->mode,
|
||||
.section = DNS_SECTION_ANSWER,
|
||||
.name = qctx->fname,
|
||||
.type = dns_rdatatype_aaaa,
|
||||
};
|
||||
process_section(&filter_answer);
|
||||
|
||||
client_state->flags &= ~FILTER_AAAA_RECURSING;
|
||||
|
||||
result = ns_query_done(qctx);
|
||||
|
||||
*resp = result;
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
*resp = result;
|
||||
return (false);
|
||||
}
|
||||
|
||||
/*
|
||||
* When answering an ANY query, remove AAAA if A is present.
|
||||
*/
|
||||
static bool
|
||||
filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp) {
|
||||
query_ctx_t *qctx = (query_ctx_t *) arg;
|
||||
filter_instance_t *inst = (filter_instance_t *) cbdata;
|
||||
filter_data_t *client_state = client_state_get(qctx, inst);
|
||||
|
||||
*resp = ISC_R_UNSET;
|
||||
|
||||
if (client_state != NULL && client_state->mode != NONE) {
|
||||
/*
|
||||
* If we are authoritative, require an A record to be
|
||||
* present before filtering out AAAA records; otherwise,
|
||||
* just assume an A record exists even if it was not in the
|
||||
* cache (and therefore is not in the response message),
|
||||
* thus proceeding with filtering out AAAA records.
|
||||
*/
|
||||
const section_filter_t filter_answer = {
|
||||
.qctx = qctx,
|
||||
.mode = client_state->mode,
|
||||
.section = DNS_SECTION_ANSWER,
|
||||
.name = qctx->tname,
|
||||
.type = dns_rdatatype_aaaa,
|
||||
.only_if_a_exists = qctx->authoritative,
|
||||
};
|
||||
process_section(&filter_answer);
|
||||
}
|
||||
|
||||
return (false);
|
||||
}
|
||||
|
||||
/*
|
||||
* Hide AAAA rrsets in the additional section if there is a matching A, and
|
||||
* hide NS in the authority section if AAAA was filtered in the answer
|
||||
* section.
|
||||
*/
|
||||
static bool
|
||||
filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp) {
|
||||
query_ctx_t *qctx = (query_ctx_t *) arg;
|
||||
filter_instance_t *inst = (filter_instance_t *) cbdata;
|
||||
filter_data_t *client_state = client_state_get(qctx, inst);
|
||||
|
||||
*resp = ISC_R_UNSET;
|
||||
|
||||
if (client_state != NULL && client_state->mode != NONE) {
|
||||
const section_filter_t filter_additional = {
|
||||
.qctx = qctx,
|
||||
.mode = client_state->mode,
|
||||
.section = DNS_SECTION_ADDITIONAL,
|
||||
.type = dns_rdatatype_aaaa,
|
||||
.only_if_a_exists = true,
|
||||
};
|
||||
process_section(&filter_additional);
|
||||
|
||||
if ((client_state->flags & FILTER_AAAA_FILTERED) != 0) {
|
||||
const section_filter_t filter_authority = {
|
||||
.qctx = qctx,
|
||||
.mode = client_state->mode,
|
||||
.section = DNS_SECTION_AUTHORITY,
|
||||
.type = dns_rdatatype_ns,
|
||||
};
|
||||
process_section(&filter_authority);
|
||||
}
|
||||
}
|
||||
|
||||
return (false);
|
||||
}
|
||||
|
||||
/*
|
||||
* If the client is being detached, then we can delete our persistent data
|
||||
* from hash table and return it to the memory pool.
|
||||
*/
|
||||
static bool
|
||||
filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
|
||||
query_ctx_t *qctx = (query_ctx_t *) arg;
|
||||
filter_instance_t *inst = (filter_instance_t *) cbdata;
|
||||
|
||||
*resp = ISC_R_UNSET;
|
||||
|
||||
if (!qctx->detach_client) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
client_state_destroy(qctx, inst);
|
||||
|
||||
return (false);
|
||||
}
|
||||
146
bin/plugins/filter-aaaa.docbook
Normal file
146
bin/plugins/filter-aaaa.docbook
Normal file
@@ -0,0 +1,146 @@
|
||||
<!--
|
||||
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
-->
|
||||
|
||||
<!-- Converted by db4-upgrade version 1.0 -->
|
||||
<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.filter-aaaa">
|
||||
<info>
|
||||
<date>2018-08-13</date>
|
||||
</info>
|
||||
<refentryinfo>
|
||||
<corpname>ISC</corpname>
|
||||
<corpauthor>Internet Systems Consortium, Inc.</corpauthor>
|
||||
</refentryinfo>
|
||||
<refmeta>
|
||||
<refentrytitle><application>filter-aaaa.so</application></refentrytitle>
|
||||
<manvolnum>8</manvolnum>
|
||||
<refmiscinfo>BIND9</refmiscinfo>
|
||||
</refmeta>
|
||||
|
||||
<refnamediv>
|
||||
<refname><application>filter-aaaa.so</application></refname>
|
||||
<refpurpose>filter AAAA in DNS responses when A is present</refpurpose>
|
||||
</refnamediv>
|
||||
|
||||
<docinfo>
|
||||
<copyright>
|
||||
<year>2018</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
|
||||
<refsynopsisdiv>
|
||||
<cmdsynopsis sepchar=" ">
|
||||
<command>plugin query "filter-aaaa.so"</command>
|
||||
<arg choice="opt" rep="norepeat"><replaceable class="parameter">{ parameters }</replaceable></arg>;
|
||||
</cmdsynopsis>
|
||||
</refsynopsisdiv>
|
||||
|
||||
<refsection><info><title>DESCRIPTION</title></info>
|
||||
<para>
|
||||
<command>filter-aaaa.so</command> is a query plugin module for
|
||||
<command>named</command>, enabling <command>named</command>
|
||||
to omit some IPv6 addresses when responding to clients.
|
||||
</para>
|
||||
<para>
|
||||
Until BIND 9.12, this feature was implemented natively in
|
||||
<command>named</command> and enabled with the
|
||||
<command>filter-aaaa</command> ACL and the
|
||||
<command>filter-aaaa-on-v4</command> and
|
||||
<command>filter-aaaa-on-v6</command> options. These options are
|
||||
now deprecated in <filename>named.conf</filename>, but can be
|
||||
passed as parameters to the <command>filter-aaaa.so</command>
|
||||
plugin, for example:
|
||||
</para>
|
||||
<programlisting>
|
||||
plugin query "/usr/local/lib/filter-aaaa.so" {
|
||||
filter-aaaa-on-v4 yes;
|
||||
filter-aaaa-on-v6 yes;
|
||||
filter-aaaa { 192.0.2.1; 2001:db8:2::1; };
|
||||
};
|
||||
</programlisting>
|
||||
<para>
|
||||
This module is intended to aid transition from IPv4 to IPv6 by
|
||||
withholding IPv6 addresses from DNS clients which are not connected
|
||||
to the IPv6 Internet, when the name being looked up has an IPv4
|
||||
address available. Use of this module is not recommended unless
|
||||
absolutely necessary.
|
||||
</para>
|
||||
<para>
|
||||
Note: This mechanism can erroneously cause other servers not to
|
||||
give AAAA records to their clients. If a recursing server with
|
||||
both IPv6 and IPv4 network connections queries an authoritative
|
||||
server using this mechanism via IPv4, it will be denied AAAA
|
||||
records even if its client is using IPv6.
|
||||
</para>
|
||||
</refsection>
|
||||
|
||||
<refsection><info><title>OPTIONS</title></info>
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term><command>filter-aaaa</command></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Specifies a list of client addresses for which AAAA
|
||||
filtering is to be applied. The default is
|
||||
<userinput>any</userinput>.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><command>filter-aaaa-on-v4</command></term>
|
||||
<listitem>
|
||||
<para>
|
||||
If set to <userinput>yes</userinput>, the DNS client is
|
||||
at an IPv4 address, in <command>filter-aaaa</command>,
|
||||
and if the response does not include DNSSEC signatures,
|
||||
then all AAAA records are deleted from the response.
|
||||
This filtering applies to all responses and not only
|
||||
authoritative responses.
|
||||
</para>
|
||||
<para>
|
||||
If set to <userinput>break-dnssec</userinput>,
|
||||
then AAAA records are deleted even when DNSSEC is
|
||||
enabled. As suggested by the name, this causes the
|
||||
response to fail to verify, because the DNSSEC protocol is
|
||||
designed to detect deletions.
|
||||
</para>
|
||||
<para>
|
||||
This mechanism can erroneously cause other servers not to
|
||||
give AAAA records to their clients. A recursing server with
|
||||
both IPv6 and IPv4 network connections that queries an
|
||||
authoritative server using this mechanism via IPv4 will be
|
||||
denied AAAA records even if its client is using IPv6.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><command>filter-aaaa-on-v6</command></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Identical to <command>filter-aaaa-on-v4</command>,
|
||||
except it filters AAAA responses to queries from IPv6
|
||||
clients instead of IPv4 clients. To filter all
|
||||
responses, set both options to <userinput>yes</userinput>.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
</refsection>
|
||||
|
||||
<refsection><info><title>SEE ALSO</title></info>
|
||||
<para>
|
||||
<citetitle>BIND 9 Administrator Reference Manual</citetitle>.
|
||||
</para>
|
||||
</refsection>
|
||||
|
||||
</refentry>
|
||||
115
bin/plugins/filter-aaaa.html
Normal file
115
bin/plugins/filter-aaaa.html
Normal file
@@ -0,0 +1,115 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-->
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
<title>filter-aaaa.so</title>
|
||||
<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
|
||||
</head>
|
||||
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
|
||||
<a name="man.filter-aaaa"></a><div class="titlepage"></div>
|
||||
<div class="refnamediv">
|
||||
<h2>Name</h2>
|
||||
<p><span class="application">filter-aaaa.so</span> — filter AAAA in DNS responses when A is present</p>
|
||||
</div>
|
||||
<div class="refsynopsisdiv">
|
||||
<h2>Synopsis</h2>
|
||||
<div class="cmdsynopsis"><p><code class="command">hook query "filter-aaaa.so"</code> [<em class="replaceable"><code>{ parameters }</code></em>];
|
||||
</p></div>
|
||||
</div>
|
||||
<div class="refsection">
|
||||
<a name="id-1.7"></a><h2>DESCRIPTION</h2>
|
||||
<p>
|
||||
<span class="command"><strong>filter-aaaa.so</strong></span> is a query hook module for
|
||||
<span class="command"><strong>named</strong></span>, enabling <span class="command"><strong>named</strong></span>
|
||||
to omit some IPv6 addresses when responding to clients.
|
||||
</p>
|
||||
<p>
|
||||
Until BIND 9.12, this feature was implemented natively in
|
||||
<span class="command"><strong>named</strong></span> and enabled with the
|
||||
<span class="command"><strong>filter-aaaa</strong></span> ACL and the
|
||||
<span class="command"><strong>filter-aaaa-on-v4</strong></span> and
|
||||
<span class="command"><strong>filter-aaaa-on-v6</strong></span> options. These options are
|
||||
now deprecated in <code class="filename">named.conf</code>, but can be
|
||||
passed as parameters to the <span class="command"><strong>filter-aaaa.so</strong></span>
|
||||
hook module, for example:
|
||||
</p>
|
||||
<pre class="programlisting">
|
||||
hook query "/usr/local/lib/filter-aaaa.so" {
|
||||
filter-aaaa-on-v4 yes;
|
||||
filter-aaaa-on-v6 yes;
|
||||
filter-aaaa { 192.0.2.1; 2001:db8:2::1; };
|
||||
};
|
||||
</pre>
|
||||
<p>
|
||||
This module is intended to aid transition from IPv4 to IPv6 by
|
||||
withholding IPv6 addresses from DNS clients which are not connected
|
||||
to the IPv6 Internet, when the name being looked up has an IPv4
|
||||
address available. Use of this module is not recommended unless
|
||||
absolutely necessary.
|
||||
</p>
|
||||
<p>
|
||||
Note: This mechanism can erroneously cause other servers not to
|
||||
give AAAA records to their clients. If a recursing server with
|
||||
both IPv6 and IPv4 network connections queries an authoritative
|
||||
server using this mechanism via IPv4, it will be denied AAAA
|
||||
records even if its client is using IPv6.
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsection">
|
||||
<a name="id-1.8"></a><h2>OPTIONS</h2>
|
||||
<div class="variablelist"><dl class="variablelist">
|
||||
<dt><span class="term"><span class="command"><strong>filter-aaaa</strong></span></span></dt>
|
||||
<dd><p>
|
||||
Specifies a list of client addresses for which AAAA
|
||||
filtering is to be applied. The default is
|
||||
<strong class="userinput"><code>any</code></strong>.
|
||||
</p></dd>
|
||||
<dt><span class="term"><span class="command"><strong>filter-aaaa-on-v4</strong></span></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
If set to <strong class="userinput"><code>yes</code></strong>, the DNS client is
|
||||
at an IPv4 address, in <span class="command"><strong>filter-aaaa</strong></span>,
|
||||
and if the response does not include DNSSEC signatures,
|
||||
then all AAAA records are deleted from the response.
|
||||
This filtering applies to all responses and not only
|
||||
authoritative responses.
|
||||
</p>
|
||||
<p>
|
||||
If set to <strong class="userinput"><code>break-dnssec</code></strong>,
|
||||
then AAAA records are deleted even when DNSSEC is
|
||||
enabled. As suggested by the name, this causes the
|
||||
response to fail to verify, because the DNSSEC protocol is
|
||||
designed to detect deletions.
|
||||
</p>
|
||||
<p>
|
||||
This mechanism can erroneously cause other servers not to
|
||||
give AAAA records to their clients. A recursing server with
|
||||
both IPv6 and IPv4 network connections that queries an
|
||||
authoritative server using this mechanism via IPv4 will be
|
||||
denied AAAA records even if its client is using IPv6.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>filter-aaaa-on-v6</strong></span></span></dt>
|
||||
<dd><p>
|
||||
Identical to <span class="command"><strong>filter-aaaa-on-v4</strong></span>,
|
||||
except it filters AAAA responses to queries from IPv6
|
||||
clients instead of IPv4 clients. To filter all
|
||||
responses, set both options to <strong class="userinput"><code>yes</code></strong>.
|
||||
</p></dd>
|
||||
</dl></div>
|
||||
</div>
|
||||
<div class="refsection">
|
||||
<a name="id-1.9"></a><h2>SEE ALSO</h2>
|
||||
<p>
|
||||
<em class="citetitle">BIND 9 Administrator Reference Manual</em>.
|
||||
</p>
|
||||
</div>
|
||||
</div></body>
|
||||
</html>
|
||||
Reference in New Issue
Block a user