PowerDNS Forward-Notify Patch:

This patch will allow you to redirect inbound notifications to a proxy server.  It's intended use is in anycast environments where it might be necessary for a proxy server to preform the AXFR.

The configuration option "forward-notify" has been added to the pdns.conf parser. The option accepts multiple IPv4 and IPv6 address values.

diff --git a/docs/markdown/authoritative/settings.md b/docs/markdown/authoritative/settings.md
index a1bb83ce85e022a864fc6c239b336442d28f1199..4bfa49097f96f56ff466125155ae1a21d2d884ad 100644 (file)
--- a/docs/markdown/authoritative/settings.md
+++ b/docs/markdown/authoritative/settings.md
@@ -361,6 +361,15 @@ If this is disabled (the default), ALIAS records will not expanded and the serve
 
 Forward DNS updates sent to a slave to the master.
 
+## `forward-notify`
+* IP addresses, separated by commas
+
+IP addresses to send received notifications to regardless of master or slave settings.
+
+Note: The intended use is in anycast environments where it might be necessary for a
+proxy server to preform the AXFR.  The usual checks are preformed before any received
+notification is forwarded.
+
 ## `guardian`
 * Boolean
 * Default: no

diff --git a/pdns/common_startup.cc b/pdns/common_startup.cc
index 4089cee68c770d6d5891359db6b37bdbee00109e..1a4432897766acb3729c21954ff71bda37f24abe 100644 (file)
--- a/pdns/common_startup.cc
+++ b/pdns/common_startup.cc
@@ -159,6 +159,7 @@ void declareArguments()
 
   ::arg().set("trusted-notification-proxy", "IP address of incoming notification proxy")="";
   ::arg().set("slave-renotify", "If we should send out notifications for slaved updates")="no";
+  ::arg().set("forward-notify", "IP addresses to send received notifications to regardless of master or slave settings")="";
 
   ::arg().set("default-ttl","Seconds a result is valid if not set otherwise")="3600";
   ::arg().set("max-tcp-connections","Maximum number of TCP connections")="20";
@@ -545,7 +546,7 @@ void mainthread()
   if(::arg().mustDo("webserver") || ::arg().mustDo("api"))
     webserver.go();
 
-  if(::arg().mustDo("slave") || ::arg().mustDo("master"))
+  if(::arg().mustDo("slave") || ::arg().mustDo("master") || !::arg()["forward-notify"].empty())
     Communicator.go(); 
 
   if(!::arg()["experimental-lua-policy-script"].empty()){

diff --git a/pdns/communicator.cc b/pdns/communicator.cc
index 48f481dcf5c131a5fda113cb847cefa70a3da857..eff4f2bb74ef7785be7b6e5c270ec7aeaca54b89 100644 (file)
--- a/pdns/communicator.cc
+++ b/pdns/communicator.cc
@@ -92,6 +92,19 @@ void CommunicatorClass::go()
       exit(1);
     }
   }
+
+  vector<string> forwards;
+  stringtok(forwards, ::arg()["forward-notify"], ", \t");
+  for (vector<string>::const_iterator iter = forwards.begin(); iter != forwards.end(); ++iter) {
+    try {
+      ComboAddress caIp(*iter, 53);
+      PacketHandler::s_forwardNotify.insert(caIp.toStringWithPort());
+    }
+    catch(PDNSException &e) {
+      L<<Logger::Error<<"Unparseable IP in forward-notify. Error: "<<e.reason<<endl;
+      exit(1);
+    }
+  }
 }
 
 void CommunicatorClass::mainloop(void)

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 3a9dc7a2510fa44ffcf76a1738296d2acf72bdff..d90faa547111c0c615f7769d2d5226ef7ba6c719 100644 (file)
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -53,6 +53,8 @@
  
 AtomicCounter PacketHandler::s_count;
 NetmaskGroup PacketHandler::s_allowNotifyFrom;
+set<string> PacketHandler::s_forwardNotify;
+
 extern string s_programname;
 
 PacketHandler::PacketHandler():B(s_programname), d_dk(&B)
@@ -831,7 +833,7 @@ int PacketHandler::processNotify(DNSPacket *p)
   */
   vector<string> meta;
 
-  if(!::arg().mustDo("slave")) {
+  if(!::arg().mustDo("slave") && s_forwardNotify.empty()) {
     L<<Logger::Error<<"Received NOTIFY for "<<p->qdomain<<" from "<<p->getRemote()<<" but slave support is disabled in the configuration"<<endl;
     return RCode::NotImp;
   }
@@ -886,7 +888,17 @@ int PacketHandler::processNotify(DNSPacket *p)
     
   // ok, we've done our checks
   di.backend = 0;
-  Communicator.addSlaveCheckRequest(di, p->d_remote);
+
+  if(!s_forwardNotify.empty()) {
+    set<string> forwardNotify(s_forwardNotify);
+    for(set<string>::const_iterator j=forwardNotify.begin();j!=forwardNotify.end();++j) {
+      L<<Logger::Warning<<"Relaying notification of domain "<<p->qdomain<<" from "<<p->getRemote()<<" to "<<*j<<endl;
+      Communicator.notify(p->qdomain,*j);
+    }
+  }
+
+  if(::arg().mustDo("slave"))
+    Communicator.addSlaveCheckRequest(di, p->d_remote);
   return 0;
 }
 

diff --git a/pdns/packethandler.hh b/pdns/packethandler.hh
index 77a4c3788196025e1450b002986bf89bc2072cb2..b2dcd3fd041e4586766f93747f64330f06617e18 100644 (file)
--- a/pdns/packethandler.hh
+++ b/pdns/packethandler.hh
@@ -66,6 +66,7 @@ public:
 
   int trySuperMasterSynchronous(DNSPacket *p, const DNSName& tsigkeyname);
   static NetmaskGroup s_allowNotifyFrom;
+  static set<string> s_forwardNotify;
 
 private:
   int trySuperMaster(DNSPacket *p, const DNSName& tsigkeyname);