From: Pieter Lexis <pieter.lexis@powerdns.com>
Date: Sun, 10 May 2015 08:32:21 +0000 (+0200)
Subject: Auth: use recursor option for secpoll if provided
X-Git-Tag: dnsdist-1.0.0-alpha1~248^2~28^2~38^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e6402e23c9260bffd8a7d9ac1ac6a8bc1db5d898;p=thirdparty%2Fpdns.git

Auth: use recursor option for secpoll if provided

Fixes #2453
---

diff --git a/pdns/common_startup.cc b/pdns/common_startup.cc
index 433c5cc0a2..16ccc7f50e 100644
--- a/pdns/common_startup.cc
+++ b/pdns/common_startup.cc
@@ -464,10 +464,7 @@ void mainthread()
    DNSPacket::s_udpTruncationThreshold = std::max(512, ::arg().asNum("udp-truncation-threshold"));
    DNSPacket::s_doEDNSSubnetProcessing = ::arg().mustDo("edns-subnet-processing");
 
-   try {
-     doSecPoll(true); // this must be BEFORE chroot
-   }
-   catch(...) {}
+   secPollParseResolveConf();
 
    if(!::arg()["chroot"].empty()) {  
      triggerLoadOfLibraries();
@@ -487,11 +484,18 @@ void mainthread()
   AuthWebServer webserver;
   Utility::dropUserPrivs(newuid);
 
+  // We need to start the Recursor Proxy before doing secpoll, see issue #2453
   if(::arg().mustDo("recursor")){
     DP=new DNSProxy(::arg()["recursor"]);
     DP->onlyFrom(::arg()["allow-recursion"]);
     DP->go();
   }
+
+  try {
+    doSecPoll(true);
+  }
+  catch(...) {}
+
   // NOW SAFE TO CREATE THREADS!
   dl->go();
 
diff --git a/pdns/secpoll-auth.cc b/pdns/secpoll-auth.cc
index 06a6453965..74e3cc6256 100644
--- a/pdns/secpoll-auth.cc
+++ b/pdns/secpoll-auth.cc
@@ -22,13 +22,13 @@
 string g_security_message;
 
 extern StatBag S;
+static vector<ComboAddress> s_servers;
 
-static vector<ComboAddress> parseResolveConf()
+void secPollParseResolveConf()
 {
-  vector<ComboAddress> ret;
   ifstream ifs("/etc/resolv.conf");
   if(!ifs)
-    return ret;
+    return;
 
   string line;
   while(std::getline(ifs, line)) {
@@ -45,7 +45,7 @@ static vector<ComboAddress> parseResolveConf()
       for(vector<string>::const_iterator iter = parts.begin()+1; iter != parts.end(); ++iter) {
 	
 	try {
-	  ret.push_back(ComboAddress(*iter, 53));
+	  s_servers.push_back(ComboAddress(*iter, 53));
 	}
 	catch(...)
 	{
@@ -54,11 +54,9 @@ static vector<ComboAddress> parseResolveConf()
     }
 
   }
-  if(ret.empty()) {
-    ret.push_back(ComboAddress("127.0.0.1", 53));
+  if(s_servers.empty()) {
+    s_servers.push_back(ComboAddress("127.0.0.1", 53));
   }
-
-  return ret;
 }
 
 int doResolve(const string& qname, uint16_t qtype, vector<DNSResourceRecord>& ret) 
@@ -69,13 +67,16 @@ int doResolve(const string& qname, uint16_t qtype, vector<DNSResourceRecord>& re
   pw.getHeader()->id=dns_random(0xffff);
   pw.getHeader()->rd=1;
 
-  static vector<ComboAddress> s_servers;
-  vector<ComboAddress> servers = parseResolveConf();
-  if(!servers.empty())
-    s_servers = servers; // in case we chrooted in the meantime
+  if (s_servers.empty()) {
+    L<<Logger::Warning<<"No recursors set, secpoll impossible."<<endl;
+    return RCode::ServFail;
+  }
 
-  if(s_servers.empty())
-    L<<Logger::Warning<<"Unable to poll PowerDNS security status, did not get any servers from resolv.conf"<<endl;
+  string msg ="Doing secpoll, using resolvers: ";
+  for (ComboAddress server : s_servers) {
+    msg += server.toString() + ", ";
+  }
+  L<<Logger::Debug<<msg.substr(0, msg.length() - 2)<<endl;
 
   BOOST_FOREACH(ComboAddress& dest, s_servers) {
     Socket sock(dest.sin4.sin_family, SOCK_DGRAM);
@@ -113,7 +114,7 @@ int doResolve(const string& qname, uint16_t qtype, vector<DNSResourceRecord>& re
 	ret.push_back(rr);
       }
     }
-   
+    L<<Logger::Debug<<"Secpoll got answered by "<<dest.toString()<<endl;
     return mdp.d_header.rcode;
   }
   return RCode::ServFail;
@@ -124,6 +125,9 @@ void doSecPoll(bool first)
   if(::arg()["security-poll-suffix"].empty())
     return;
 
+  if(::arg().mustDo("recursor") && first)
+    s_servers.push_back(ComboAddress(::arg()["recursor"], 53));
+
   struct timeval now;
   gettimeofday(&now, 0);
 
diff --git a/pdns/secpoll-auth.hh b/pdns/secpoll-auth.hh
index 1b0c7405ff..1baffe3e18 100644
--- a/pdns/secpoll-auth.hh
+++ b/pdns/secpoll-auth.hh
@@ -4,6 +4,7 @@
 #include "namespaces.hh"
 
 void doSecPoll(bool first);
+void secPollParseResolveConf();
 extern std::string g_security_message;
 
 #endif