Changeset 1360

Timestamp:

05/30/09 22:18:11 (10 months ago)

Author:

ahu

Message:

add first stab at 'per-zone-axfr-acls'. Set that flag in the configuration table, and see  http://mailman.powerdns.com/pipermail/pdns-users/2006-March/003115.html
Also allows netmasks

Location:

trunk/pdns

Files:

• modules/gmysqlbackend/gmysqlbackend.cc (modified) (1 diff)
• modules/goraclebackend/goraclebackend.cc (modified) (1 diff)
• modules/gpgsqlbackend/gpgsqlbackend.cc (modified) (1 diff)
• modules/gsqlite3backend/gsqlite3backend.cc (modified) (1 diff)
• modules/gsqlitebackend/gsqlitebackend.cc (modified) (1 diff)
• pdns/backends/gsql/gsqlbackend.cc (modified) (4 diffs)
• pdns/backends/gsql/gsqlbackend.hh (modified) (2 diffs)
• pdns/common_startup.cc (modified) (1 diff)
• pdns/dnsbackend.hh (modified) (1 diff)
• pdns/tcpreceiver.cc (modified) (1 diff)

trunk/pdns/modules/gmysqlbackend/gmysqlbackend.cc

@@ -75 +75 @@
     declare(suffix,"info-all-master-query","", "select id,name,master,last_check,notified_serial,type from domains where type='MASTER'");
     declare(suffix,"delete-zone-query","", "delete from records where domain_id=%d");
-
-
+    declare(suffix,"check-acl-query","", "select value from acls where acl_type='%s' and acl_key='%s'");
   }
   

trunk/pdns/modules/goraclebackend/goraclebackend.cc

@@ -69 +69 @@
     declare(suffix,"info-all-master-query","", "select id,name,master,last_check,notified_serial,type from domains where type='MASTER'");
     declare(suffix,"delete-zone-query","", "delete from records where domain_id=%d");
-
-
+    declare(suffix,"check-acl-query","", "select value from acls where acl_type='%s' and acl_key='%s'");
   }
   

trunk/pdns/modules/gpgsqlbackend/gpgsqlbackend.cc

@@ -75 +75 @@
     declare(suffix,"info-all-master-query","", "select id,name,master,last_check,notified_serial,type from domains where type='MASTER'");
     declare(suffix,"delete-zone-query","", "delete from records where domain_id=%d");
+    declare(suffix,"check-acl-query","", "select value from acls where acl_type='%s' and acl_key='%s'");
 
 

trunk/pdns/modules/gsqlite3backend/gsqlite3backend.cc

@@ -76 +76 @@
     declare( suffix, "info-all-master-query", "", "select id,name,master,last_check,notified_serial,type from domains where type='MASTER'");
     declare( suffix, "delete-zone-query", "", "delete from records where domain_id=%d");
+    declare(suffix,"check-acl-query","", "select value from acls where acl_type='%s' and acl_key='%s'");
   }
   

trunk/pdns/modules/gsqlitebackend/gsqlitebackend.cc

@@ -76 +76 @@
     declare( suffix, "info-all-master-query", "", "select id,name,master,last_check,notified_serial,type from domains where type='MASTER'");
     declare( suffix, "delete-zone-query", "", "delete from records where domain_id=%d");
+    declare(suffix,"check-acl-query","", "select value from acls where acl_type='%s' and acl_key='%s'");
   }
   

trunk/pdns/pdns/backends/gsql/gsqlbackend.cc

@@ -122 +122 @@
   /* list all domains that need refreshing for which we are slave, and insert into SlaveDomain:
      id,name,master IP,serial */
-  char output[1024];
-  snprintf(output,sizeof(output)-1,d_InfoOfAllSlaveDomainsQuery.c_str());
-
-  try {
-    d_db->doQuery(output,d_result);
+
+  try {
+    d_db->doQuery(d_InfoOfAllSlaveDomainsQuery,d_result);
   }
   catch (SSqlException &e) {
@@ -161 +159 @@
   /* list all domains that need notifications for which we are master, and insert into updatedDomains
      id,name,master IP,serial */
-  char output[1024];
-  snprintf(output, sizeof(output)-1, d_InfoOfAllMasterDomainsQuery.c_str());
-
-  try {
-    d_db->doQuery(output,d_result);
+  try {
+    d_db->doQuery(d_InfoOfAllMasterDomainsQuery,d_result);
   }
   catch(SSqlException &e) {
@@ -240 +235 @@
   d_InfoOfAllMasterDomainsQuery=getArg("info-all-master-query");
   d_DeleteZoneQuery=getArg("delete-zone-query");
+  d_CheckACLQuery=getArg("check-acl-query");
 }
 
@@ -343 +339 @@
   }
   return false;
+}
+
+
+bool GSQLBackend::checkACL(const string &acl_type, const string &key, const string &value)
+{
+  string format;
+  char output[1024];
+  format = d_CheckACLQuery;
+  snprintf(output, sizeof(output)-1, format.c_str(), sqlEscape(acl_type).c_str(), sqlEscape(key).c_str());
+  try {
+    d_db->doQuery(output, d_result);
+  }
+  catch(SSqlException &e) {
+    throw AhuException("Database error trying to check ACL:"+acl_type+" with error: "+e.txtReason());
+  }
+  if(!d_result.empty()) {
+    for (unsigned int i = 0; i < d_result.size(); i++) {
+      Netmask nm(d_result[i][0]);
+      if (nm.match(value)) {
+        return true;
+      }
+    }
+  }  
+  return false; // default to false
 }
 

trunk/pdns/pdns/backends/gsql/gsqlbackend.hh

@@ -35 +35 @@
   bool superMasterBackend(const string &ip, const string &domain, const vector<DNSResourceRecord>&nsset, string *account, DNSBackend **db);
   void setFresh(uint32_t domain_id);
+  bool checkACL(const string &acl_type, const string &key, const string &value);
   void getUnfreshSlaveInfos(vector<DomainInfo> *domains);
   void getUpdatedMasters(vector<DomainInfo> *updatedDomains);
@@ -67 +68 @@
   string d_InfoOfAllMasterDomainsQuery;
   string d_DeleteZoneQuery;             
-
+  string d_CheckACLQuery;   
 };

trunk/pdns/pdns/common_startup.cc

@@ -120 +120 @@
   ::arg().set("max-tcp-connections","Maximum number of TCP connections")="10";
   ::arg().setSwitch("no-shuffle","Set this to prevent random shuffling of answers - for regression testing")="off";
+  ::arg().setSwitch("per-zone-axfr-acls","When set, backends that implement it perform per-zone AXFL ACL checks")="off";
 
   ::arg().setSwitch( "use-logfile", "Use a log file (Windows only)" )= "no";

trunk/pdns/pdns/dnsbackend.hh

@@ -167 +167 @@
   }
 
+  virtual bool checkACL(const string &acl_type, const string &key, const string &value)
+  {
+    return false;
+  }
+
 protected:
   bool mustDo(const string &key);

trunk/pdns/pdns/tcpreceiver.cc

@@ -350 +350 @@
     return false;
 
-  if( ::arg()["allow-axfr-ips"].empty() || d_ng.match( (ComboAddress *) &q->remote ) )
+  if(!::arg().mustDo("per-zone-axfr-acls") && (::arg()["allow-axfr-ips"].empty() || d_ng.match( (ComboAddress *) &q->remote )))
     return true;
+
+  if(::arg().mustDo("per-zone-axfr-acls")) {
+    SOAData sd;
+    sd.db=(DNSBackend *)-1;
+    if(s_P->getBackend()->getSOA(q->qdomain,sd)) {
+      DNSBackend *B=sd.db;
+      if (B->checkACL(string("allow-axfr"), q->qdomain, q->getRemote())) {
+        return true;
+      }
+    }  
+  }
 
   extern CommunicatorClass Communicator;