BIND backend support for 'allow-query' ACL to restrict zone lookups by source IP

[anon]

Attached patch will enable support in the BIND backend to read a list of subnets in an 'allow-query' directive in a zone definition in the named.conf, and not perform a lookup on that zone if the source of the query is not found in the listed subnets. Similar in concept and function to 'allow-recursion' directive in pdns.conf, and largely based on it.

[anon]

I've updated (replaced) the patch to correct some shortcomings, specifically, it now:

• Issues SERVFAIL rather than NXDOMAIN
  • Which also prevents denied lookups from being cached
• Does not check the connecting IP when there isn't one, i.e. for internal lookups
  • This caused a signal 11, e.g., when preparing to do zone notifications
• Logs the connecting IP

[anon]

I just want to add a vote for this functionality...I really need it. The patch still applies and works with 2.9.21. The only thing missing is the ability to use acls with allow-query, and I haven't had a chance to look into the code for adding that myself yet.

[anon]

my patch is use the checkacl functions from [1360]