From: Mark Andrews Date: Thu, 21 Oct 2004 00:58:33 +0000 (+0000) Subject: 1676. [func] New option "allow-query-cache". This lets X-Git-Tag: v9.2.5rc1~28^2~72 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=49210da3fb6a9268725b2a7db864ade531e5d403;p=thirdparty%2Fbind9.git 1676. [func] New option "allow-query-cache". This lets allow-query be used to specify the default zone access level rather than having to have every zone override the global value. allow-query-cache can be set at both the options and view levels. If allow-query-cache is not set allow-query applies. --- diff --git a/CHANGES b/CHANGES index 66007a172ec..4f389e2cf84 100644 --- a/CHANGES +++ b/CHANGES @@ -208,7 +208,12 @@ 1677. [bug] dig: +aaonly didn't work, +aaflag undocumented. -1676. [placeholder] rt10864 +1676. [func] New option "allow-query-cache". This lets + allow-query be used to specify the default zone + access level rather than having to have every + zone override the global value. allow-query-cache + can be set at both the options and view levels. + If allow-query-cache is not set allow-query applies. 1675. [bug] named would sometimes add extra NSEC records to the authority section. diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook index 2f7f81a49c2..55e4d08c03f 100644 --- a/bin/named/named.conf.docbook +++ b/bin/named/named.conf.docbook @@ -15,7 +15,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -250,6 +250,7 @@ options { ixfr-from-differences ixfrdiff; allow-query { address_match_element; ... }; + allow-query-cache { address_match_element; ... }; allow-transfer { address_match_element; ... }; allow-update-forwarding { address_match_element; ... }; @@ -377,6 +378,7 @@ view string optional_class ixfr-from-differences ixfrdiff; allow-query { address_match_element; ... }; + allow-query-cache { address_match_element; ... }; allow-transfer { address_match_element; ... }; allow-update-forwarding { address_match_element; ... }; diff --git a/bin/named/server.c b/bin/named/server.c index c20ed69db89..8aec68203c7 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: server.c,v 1.431 2004/10/11 05:30:16 marka Exp $ */ +/* $Id: server.c,v 1.432 2004/10/21 00:54:03 marka Exp $ */ #include @@ -1135,8 +1135,11 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, view->additionalfromcache = ISC_TRUE; } - CHECK(configure_view_acl(vconfig, config, "allow-query", + CHECK(configure_view_acl(vconfig, config, "allow-query-cache", actx, ns_g_mctx, &view->queryacl)); + if (view->queryacl == NULL) + CHECK(configure_view_acl(vconfig, config, "allow-query", + actx, ns_g_mctx, &view->queryacl)); if (strcmp(view->name, "_bind") != 0) CHECK(configure_view_acl(vconfig, config, "allow-recursion", diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 36c5d00769c..2bf3b26d00c 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -2,7 +2,7 @@ - + BIND 9 Administrator Reference Manual @@ -460,6 +460,7 @@ and a slave for the subdomain "eng.example.com". options { directory "/etc/namedb"; // Working directory + allow-query-cache { none; }; // Do not allow access to cache allow-query { any; }; // This is the default recursion no; // Do not provide recursive service }; @@ -1227,7 +1228,8 @@ options { ... ... allow-transfer { none; }; // sample allow-transfer (no one) - allow-query { internals; externals; }; // restrict query access + allow-query { any; }; // default query access + allow-query-cache { internals; externals; }; // restrict cache access allow-recursion { internals; externals; }; // restrict recursion ... ... @@ -1236,7 +1238,6 @@ options { zone "site1.example.com" { // sample slave zone type master; file "m/site1.foo.com"; - allow-query { any; }; allow-transfer { internals; externals; }; }; @@ -1244,7 +1245,6 @@ zone "site2.example.com" { type slave; file "s/site2.foo.com"; masters { another_bastion_host_maybe; }; - allow-query { any; }; allow-transfer { internals; externals; } }; @@ -1855,12 +1855,13 @@ and whether the element was negated. When used as an access control list, a non-negated match allows access and a negated match denies access. If there is no match, access is denied. The clauses allow-notify, -allow-query, allow-transfer, +allow-query, allow-query-cache, +allow-transfer, allow-update, allow-update-forwarding, -and blackhole all -use address match lists this. Similarly, the listen-on option will cause -the server to not accept queries on any of the machine's addresses -which do not match the list. +and blackhole all use address match lists. +Similarly, the listen-on option will cause the server to not accept +queries on any of the machine's addresses which do not match the +list. Because of the first-match aspect of the algorithm, an element that defines a subset of another element in the list should come @@ -2729,6 +2730,7 @@ statement in the named.conf file: check-names ( master | slave | response )( warn | fail | ignore ); allow-notify { address_match_list }; allow-query { address_match_list }; + allow-query-cache { address_match_list }; allow-transfer { address_match_list }; allow-recursion { address_match_list }; allow-update-forwarding { address_match_list }; @@ -3450,10 +3452,27 @@ only from a zone's master. Specifies which hosts are allowed to ask ordinary DNS questions. allow-query may also be specified in the zone statement, in which -case it overrides the options allow-query statement. If -not specified, the default is to allow queries from all hosts. +case it overrides the options allow-query statement. +allow-query-cache may also be specified and will +overrides access to the cache. +If not specified, the default is to allow queries from all hosts. +allow-query-cache +Specifies which hosts are allowed to get answers +from the cache. If not set allow-query applies. + +The recommended way to set query access to the cache is now via +allow-query-cache rather than allow-query. +Inheritance from allow-query has been retained for +backwards compatability. + +If allow-query-cache is set at the options +level and not set in the view it will still override a +allow-query set at the view level. + + + allow-recursion Specifies which hosts are allowed to diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c index 99c317aa0b4..ee919100b1b 100644 --- a/lib/isccfg/namedconf.c +++ b/lib/isccfg/namedconf.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: namedconf.c,v 1.39 2004/10/17 23:11:29 marka Exp $ */ +/* $Id: namedconf.c,v 1.40 2004/10/21 00:54:05 marka Exp $ */ #include @@ -690,6 +690,7 @@ static cfg_type_t cfg_type_lookaside = { static cfg_clausedef_t view_clauses[] = { + { "allow-query-cache", &cfg_type_bracketed_aml, 0 }, { "allow-recursion", &cfg_type_bracketed_aml, 0 }, { "allow-v6-synthesis", &cfg_type_bracketed_aml, CFG_CLAUSEFLAG_OBSOLETE },