Changeset 1211

Show
Ignore:
Timestamp:
06/20/08 21:45:08 (4 months ago)
Author:
ahu
Message:

make sure forward-zones pierces dont-query

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/pdns/pdns/docs/pdns.sgml

    r1205 r1211  
    143143              <command>rec_control wipe-cache</command> now also wipes domains from the negative cache, hurrying up the expiry 
    144144              of negatively cached records. Suggested by Simon Kirby, implemented in c1204. 
     145            </para> 
     146          </listitem> 
     147          <listitem> 
     148            <para> 
     149              When a forwarder server is configured for a domain, using the <command>forward-zones</command> setting, this server IP address was 
     150              filtered using the <command>dont-query</command> setting, which is generally not what is desired: the server to which queries are 
     151              forwarded will often live in private IP space, and the operator should be trusted to know what he is doing. Reported and argued by Simon 
     152              Kirby, fix in c1211. 
    145153            </para> 
    146154          </listitem> 

  • trunk/pdns/pdns/syncres.cc

    r1189 r1211  
    625625      bool doTCP=false; 
    626626      int resolveret; 
     627      bool pierceDontQuery=false; 
    627628 
    628629      LWResult lwr; 
    …… 
    635636      else { 
    636637        LOG<<prefix<<qname<<": Trying to resolve NS '"<<*tns<<"' ("<<1+tns-rnameservers.begin()<<"/"<<(unsigned int)rnameservers.size()<<")"<<endl; 
     638 
    637639        if(!isCanonical(*tns)) { 
    638640          LOG<<prefix<<qname<<": Domain has hardcoded nameserver(s)"<<endl; 
    …… 
    640642          pair<string,string> ipport=splitField(*tns, ':'); 
    641643          ComboAddress addr(ipport.first, ipport.second.empty() ? 53 : lexical_cast<uint16_t>(ipport.second)); 
    642  
     644           
    643645          remoteIPs.push_back(addr); 
    644         } 
    645         else 
     646          pierceDontQuery=true; 
     647        } 
     648        else { 
    646649          remoteIPs=getAs(*tns, depth+1, beenthere); 
     650          pierceDontQuery=false; 
     651        } 
    647652 
    648653        if(remoteIPs.empty()) { 
    …… 
    671676            continue; 
    672677          }  
    673           else if(g_dontQuery && g_dontQuery->match(&*remoteIP)) { 
     678          else if(!pierceDontQuery && g_dontQuery && g_dontQuery->match(&*remoteIP)) { 
    674679            LOG<<prefix<<qname<<": not sending query to " << remoteIP->toString() << ", blocked by 'dont-query' setting" << endl; 
    675680            continue;