2570. [func] Log the destination address the query was sent to.

                        [RT #19209]

diff --git a/CHANGES b/CHANGES
index 730c57a9deb02ef38e537209c235b25b84da50d6..b503df000bd8c86bb4e3bf758dfc9fa28f7c275e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2570.  [func]          Log the destination address the query was sent to.
+                       [RT #19209]
+
 2569.  [func]          Move journalprint, nsec3hash, and genrandom
                        commands from bin/tests into bin/tools; 
                        "make install" will put them in $sbindir. [RT #19301]

diff --git a/bin/named/client.c b/bin/named/client.c
index 71b8c52fb9f7af00dc9297bf6e1dcc398c86ca81..29abaadae4bcb4592fad469ce354880d8a7d37e9 100644 (file)
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.c,v 1.262 2009/01/27 22:29:58 jinmei Exp $ */
+/* $Id: client.c,v 1.263 2009/03/03 01:36:17 marka Exp $ */
 
 #include <config.h>
 
@@ -1355,7 +1355,6 @@ client_request(isc_task_t *task, isc_event_t *event) {
        dns_name_t *signame;
        isc_boolean_t ra;       /* Recursion available. */
        isc_netaddr_t netaddr;
-       isc_netaddr_t destaddr;
        int match;
        dns_messageid_t id;
        unsigned int flags;
@@ -1647,24 +1646,20 @@ client_request(isc_task_t *task, isc_event_t *event) {
         * etc), we regard this as an error for safety.
         */
        if ((client->interface->flags & NS_INTERFACEFLAG_ANYADDR) == 0)
-               isc_netaddr_fromsockaddr(&destaddr, &client->interface->addr);
+               isc_netaddr_fromsockaddr(&client->destaddr,
+                                        &client->interface->addr);
        else {
+               isc_sockaddr_t sockaddr;
                result = ISC_R_FAILURE;
 
-               if (TCP_CLIENT(client)) {
-                       isc_sockaddr_t destsockaddr;
-
+               if (TCP_CLIENT(client))
                        result = isc_socket_getsockname(client->tcpsocket,
-                                                       &destsockaddr);
-                       if (result == ISC_R_SUCCESS)
-                               isc_netaddr_fromsockaddr(&destaddr,
-                                                        &destsockaddr);
-               }
+                                                       &sockaddr);
+               if (result == ISC_R_SUCCESS)
+                       isc_netaddr_fromsockaddr(&client->destaddr, &sockaddr);
                if (result != ISC_R_SUCCESS &&
                    client->interface->addr.type.sa.sa_family == AF_INET6 &&
                    (client->attributes & NS_CLIENTATTR_PKTINFO) != 0) {
-                       isc_uint32_t zone = 0;
-
                        /*
                         * XXXJT technically, we should convert the receiving
                         * interface ID to a proper scope zone ID.  However,
@@ -1673,12 +1668,11 @@ client_request(isc_task_t *task, isc_event_t *event) {
                         * interface index as link ID.  Despite the assumption,
                         * it should cover most typical cases.
                         */
-                       if (IN6_IS_ADDR_LINKLOCAL(&client->pktinfo.ipi6_addr))
-                               zone = (isc_uint32_t)client->pktinfo.ipi6_ifindex;
-
-                       isc_netaddr_fromin6(&destaddr,
+                       isc_netaddr_fromin6(&client->destaddr,
                                            &client->pktinfo.ipi6_addr);
-                       isc_netaddr_setzone(&destaddr, zone);
+                       if (IN6_IS_ADDR_LINKLOCAL(&client->pktinfo.ipi6_addr))
+                               isc_netaddr_setzone(&client->destaddr,
+                                               client->pktinfo.ipi6_ifindex);
                        result = ISC_R_SUCCESS;
                }
                if (result != ISC_R_SUCCESS) {
@@ -1708,7 +1702,8 @@ client_request(isc_task_t *task, isc_event_t *event) {
                                tsig = dns_tsigkey_identity(client->message->tsigkey);
 
                        if (allowed(&netaddr, tsig, view->matchclients) &&
-                           allowed(&destaddr, tsig, view->matchdestinations) &&
+                           allowed(&client->destaddr, tsig,
+                                   view->matchdestinations) &&
                            !((client->message->flags & DNS_MESSAGEFLAG_RD)
                              == 0 && view->matchrecursiveonly))
                        {
@@ -1861,10 +1856,10 @@ client_request(isc_task_t *task, isc_event_t *event) {
            ns_client_checkaclsilent(client, NULL,
                                     client->view->queryacl,
                                     ISC_TRUE) == ISC_R_SUCCESS &&
-           ns_client_checkaclsilent(client, &client->interface->addr,
+           ns_client_checkaclsilent(client, &client->destaddr,
                                     client->view->recursiononacl,
                                     ISC_TRUE) == ISC_R_SUCCESS &&
-           ns_client_checkaclsilent(client, &client->interface->addr,
+           ns_client_checkaclsilent(client, &client->destaddr,
                                     client->view->queryonacl,
                                     ISC_TRUE) == ISC_R_SUCCESS)
                ra = ISC_TRUE;
@@ -2600,12 +2595,12 @@ ns_client_getsockaddr(ns_client_t *client) {
 }
 
 isc_result_t
-ns_client_checkaclsilent(ns_client_t *client, isc_sockaddr_t *sockaddr,
+ns_client_checkaclsilent(ns_client_t *client, isc_netaddr_t *netaddr,
                         dns_acl_t *acl, isc_boolean_t default_allow)
 {
        isc_result_t result;
+       isc_netaddr_t tmpnetaddr;
        int match;
-       isc_netaddr_t netaddr;
 
        if (acl == NULL) {
                if (default_allow)
@@ -2614,15 +2609,13 @@ ns_client_checkaclsilent(ns_client_t *client, isc_sockaddr_t *sockaddr,
                        goto deny;
        }
 
+       if (netaddr == NULL) {
+               isc_netaddr_fromsockaddr(&tmpnetaddr, &client->peeraddr);
+               netaddr = &tmpnetaddr;
+       }
 
-       if (sockaddr == NULL)
-               isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
-       else
-               isc_netaddr_fromsockaddr(&netaddr, sockaddr);
-
-       result = dns_acl_match(&netaddr, client->signer, acl,
-                              &ns_g_server->aclenv,
-                              &match, NULL);
+       result = dns_acl_match(netaddr, client->signer, acl,
+                              &ns_g_server->aclenv, &match, NULL);
 
        if (result != ISC_R_SUCCESS)
                goto deny; /* Internal error, already logged. */
@@ -2642,8 +2635,14 @@ ns_client_checkacl(ns_client_t *client, isc_sockaddr_t *sockaddr,
                   const char *opname, dns_acl_t *acl,
                   isc_boolean_t default_allow, int log_level)
 {
-       isc_result_t result =
-               ns_client_checkaclsilent(client, sockaddr, acl, default_allow);
+       isc_result_t result;
+       isc_netaddr_t netaddr;
+       
+       if (sockaddr != NULL)
+               isc_netaddr_fromsockaddr(&netaddr, sockaddr);
+
+       result = ns_client_checkaclsilent(client, sockaddr ? &netaddr : NULL,
+                                         acl, default_allow);
 
        if (result == ISC_R_SUCCESS)
                ns_client_log(client, DNS_LOGCATEGORY_SECURITY,

diff --git a/bin/named/include/named/client.h b/bin/named/include/named/client.h
index 640901d698be02d9a023f547c2e14d0ced8a3e28..1267972d077fbc906a464b63889459c4c793d758 100644 (file)
--- a/bin/named/include/named/client.h
+++ b/bin/named/include/named/client.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.h,v 1.88 2009/01/17 23:47:42 tbox Exp $ */
+/* $Id: client.h,v 1.89 2009/03/03 01:36:17 marka Exp $ */
 
 #ifndef NAMED_CLIENT_H
 #define NAMED_CLIENT_H 1
@@ -138,6 +138,7 @@ struct ns_client {
        ns_interface_t          *interface;
        isc_sockaddr_t          peeraddr;
        isc_boolean_t           peeraddr_valid;
+       isc_netaddr_t           destaddr;
        struct in6_pktinfo      pktinfo;
        isc_event_t             ctlevent;
        /*%
@@ -274,10 +275,8 @@ ns_client_getsockaddr(ns_client_t *client);
  */
 
 isc_result_t
-ns_client_checkaclsilent(ns_client_t *client,
-                        isc_sockaddr_t *sockaddr,
-                        dns_acl_t *acl,
-                        isc_boolean_t default_allow);
+ns_client_checkaclsilent(ns_client_t *client, isc_netaddr_t *netaddr,
+                        dns_acl_t *acl, isc_boolean_t default_allow);
 
 /*%
  * Convenience function for client request ACL checking.
@@ -296,7 +295,7 @@ ns_client_checkaclsilent(ns_client_t *client,
  *
  * Requires:
  *\li  'client' points to a valid client.
- *\li  'sockaddr' points to a valid address, or is NULL.
+ *\li  'netaddr' points to a valid address, or is NULL.
  *\li  'acl' points to a valid ACL, or is NULL.
  *
  * Returns:

diff --git a/bin/named/query.c b/bin/named/query.c
index c35b6cf392185537afd9ca8588999fa24a40c50b..2d6cfd9319e0c33bd18b1cb380d85e1ecf33f551 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.320 2009/02/15 23:04:38 marka Exp $ */
+/* $Id: query.c,v 1.321 2009/03/03 01:36:17 marka Exp $ */
 
 /*! \file */
 
@@ -4927,6 +4927,7 @@ log_query(ns_client_t *client, unsigned int flags, unsigned int extflags) {
        char namebuf[DNS_NAME_FORMATSIZE];
        char typename[DNS_RDATATYPE_FORMATSIZE];
        char classname[DNS_RDATACLASS_FORMATSIZE];
+       char onbuf[ISC_NETADDR_FORMATSIZE];
        dns_rdataset_t *rdataset;
        int level = ISC_LOG_INFO;
 
@@ -4938,14 +4939,16 @@ log_query(ns_client_t *client, unsigned int flags, unsigned int extflags) {
        dns_name_format(client->query.qname, namebuf, sizeof(namebuf));
        dns_rdataclass_format(rdataset->rdclass, classname, sizeof(classname));
        dns_rdatatype_format(rdataset->type, typename, sizeof(typename));
+       isc_netaddr_format(&client->destaddr, onbuf, sizeof(onbuf));
 
        ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
-                     level, "query: %s %s %s %s%s%s%s%s", namebuf, classname,
-                     typename, WANTRECURSION(client) ? "+" : "-",
+                     level, "query: %s %s %s %s%s%s%s%s (%s)", namebuf,
+                     classname, typename, WANTRECURSION(client) ? "+" : "-",
                      (client->signer != NULL) ? "S": "",
                      (client->opt != NULL) ? "E" : "",
                      ((extflags & DNS_MESSAGEEXTFLAG_DO) != 0) ? "D" : "",
-                     ((flags & DNS_MESSAGEFLAG_CD) != 0) ? "C" : "");
+                     ((flags & DNS_MESSAGEFLAG_CD) != 0) ? "C" : "",
+                     onbuf);
 }
 
 static inline void

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index c265eacb0b800222f2df483fba09097ffc98f02e..2532cc9a6b3841d4cc13387536ce06c07d4a8113 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- File: $Id: Bv9ARM-book.xml,v 1.399 2009/02/25 17:39:30 jreed Exp $ -->
+<!-- File: $Id: Bv9ARM-book.xml,v 1.400 2009/03/03 01:36:17 marka Exp $ -->
 <book xmlns:xi="http://www.w3.org/2001/XInclude">
   <title>BIND 9 Administrator Reference Manual</title>
 
@@ -4268,12 +4268,13 @@ category notify { null; };
                    <para>
                      The query log entry reports the client's IP
                      address and port number, and the query name,
-                     class and type.  It also reports whether the
+                     class and type.  Next it reports whether the
                      Recursion Desired flag was set (+ if set, -
                      if not set), if the query was signed (S),
                      EDNS was in use (E), if DO (DNSSEC Ok) was
                      set (D), or if CD (Checking Disabled) was set
-                     (C).
+                     (C).  After this the destination address the
+                     query was sent to is reported.
                    </para>
 
                     <para>