1422. [func] Log name/type/class when denying a query. [RT #4663]

diff --git a/CHANGES b/CHANGES
index 3329b771247dd9b5b73d7241fc361532e6d1b60f..546a0ffdd1391cb87b577226825a90d8fe9a5681 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+1422.  [func]          Log name/type/class when denying a query.  [RT #4663]
+
 1421.  [func]          Differentiate updates that don't succeed due to
                        prerequisites (unsuccessful) vs other reasons
                        (failed).

diff --git a/bin/named/client.c b/bin/named/client.c
index 304d589814a9f75c07081121ef8b432b3b42e468..5b24c684a2fc67fd4df1c3291cf47999cf6f4708 100644 (file)
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.c,v 1.213 2002/10/28 02:35:36 marka Exp $ */
+/* $Id: client.c,v 1.214 2003/01/21 06:11:45 marka Exp $ */
 
 #include <config.h>
 
@@ -2227,15 +2227,18 @@ ns_client_log(ns_client_t *client, isc_logcategory_t *category,
 }
 
 void
-ns_client_aclmsg(const char *msg, dns_name_t *name, dns_rdataclass_t rdclass,
-                char *buf, size_t len) 
+ns_client_aclmsg(const char *msg, dns_name_t *name, dns_rdatatype_t type,
+                dns_rdataclass_t rdclass, char *buf, size_t len) 
 {
         char namebuf[DNS_NAME_FORMATSIZE];
+        char typebuf[DNS_RDATATYPE_FORMATSIZE];
         char classbuf[DNS_RDATACLASS_FORMATSIZE];
 
         dns_name_format(name, namebuf, sizeof(namebuf));
+        dns_rdatatype_format(type, typebuf, sizeof(typebuf));
         dns_rdataclass_format(rdclass, classbuf, sizeof(classbuf));
-        (void)snprintf(buf, len, "%s '%s/%s'", msg, namebuf, classbuf);
+        (void)snprintf(buf, len, "%s '%s/%s/%s'", msg, namebuf, typebuf,
+                      classbuf);
 }
 
 static void

diff --git a/bin/named/include/named/client.h b/bin/named/include/named/client.h
index 13f963ac289ae8ef430285baeddcdd51ce31a066..b56bf2e03219a6d4e144605b6013e97b10a9e388 100644 (file)
--- a/bin/named/include/named/client.h
+++ b/bin/named/include/named/client.h
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.h,v 1.67 2002/09/10 04:45:54 marka Exp $ */
+/* $Id: client.h,v 1.68 2003/01/21 06:11:46 marka Exp $ */
 
 #ifndef NAMED_CLIENT_H
 #define NAMED_CLIENT_H 1
@@ -68,10 +68,13 @@
 #include <isc/stdtime.h>
 #include <isc/quota.h>
 
+#include <dns/fixedname.h>
 #include <dns/name.h>
-#include <dns/types.h>
+#include <dns/rdataclass.h>
+#include <dns/rdatatype.h>
 #include <dns/tcpmsg.h>
-#include <dns/fixedname.h>
+#include <dns/types.h>
+
 #include <named/types.h>
 #include <named/query.h>
 
@@ -310,8 +313,12 @@ ns_client_logv(ns_client_t *client, isc_logcategory_t *category,
               isc_logmodule_t *module, int level, const char *fmt, va_list ap) ISC_FORMAT_PRINTF(5, 0);
 
 void
-ns_client_aclmsg(const char *msg, dns_name_t *name, dns_rdataclass_t rdclass,
-                 char *buf, size_t len);
+ns_client_aclmsg(const char *msg, dns_name_t *name, dns_rdatatype_t type,
+                dns_rdataclass_t rdclass, char *buf, size_t len);
+
+#define NS_CLIENT_ACLMSGSIZE(x) \
+       (DNS_NAME_FORMATSIZE + DNS_RDATATYPE_FORMATSIZE + \
+        DNS_RDATACLASS_FORMATSIZE + sizeof(x) + sizeof("'/'"))
 
 void
 ns_client_recursing(ns_client_t *client, isc_boolean_t killoldest);

diff --git a/bin/named/query.c b/bin/named/query.c
index d6e7f6b5fc370d84dd392877e20da5ef1f20d41a..2217dc74eabab1bf7c97ed9c958aede1a4ef3362 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.240 2003/01/18 03:18:30 marka Exp $ */
+/* $Id: query.c,v 1.241 2003/01/21 06:11:45 marka Exp $ */
 
 #include <config.h>
 
@@ -536,7 +536,8 @@ query_findversion(ns_client_t *client, dns_db_t *db,
 
 static inline isc_result_t
 query_getzonedb(ns_client_t *client, dns_name_t *name, unsigned int options,
-               dns_zone_t **zonep, dns_db_t **dbp, dns_dbversion_t **versionp)
+               dns_rdatatype_t qtype, dns_zone_t **zonep, dns_db_t **dbp,
+               dns_dbversion_t **versionp)
 {
        isc_result_t result;
        isc_boolean_t check_acl, new_zone;
@@ -632,13 +633,12 @@ query_getzonedb(ns_client_t *client, dns_name_t *name, unsigned int options,
 
                result = ns_client_checkaclsilent(client, queryacl, ISC_TRUE);
                if (log) {
-                       char msg[DNS_NAME_FORMATSIZE + DNS_RDATACLASS_FORMATSIZE
-                               + sizeof("query '/'")];
+                       char msg[NS_CLIENT_ACLMSGSIZE("query")];
                        if (result == ISC_R_SUCCESS) {
                                if (isc_log_wouldlog(ns_g_lctx,
                                                     ISC_LOG_DEBUG(3)))
                                {
-                                       ns_client_aclmsg("query", name,
+                                       ns_client_aclmsg("query", name, qtype,
                                                         client->view->rdclass,
                                                         msg, sizeof(msg));
                                        ns_client_log(client,
@@ -648,7 +648,7 @@ query_getzonedb(ns_client_t *client, dns_name_t *name, unsigned int options,
                                                      "%s approved", msg);
                                }
                        } else {
-                               ns_client_aclmsg("query", name,
+                               ns_client_aclmsg("query", name, qtype,
                                                 client->view->rdclass,
                                                 msg, sizeof(msg));
                                ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
@@ -707,7 +707,8 @@ query_getzonedb(ns_client_t *client, dns_name_t *name, unsigned int options,
 }
 
 static inline isc_result_t
-query_getcachedb(ns_client_t *client, dns_db_t **dbp, unsigned int options)
+query_getcachedb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
+                dns_db_t **dbp, unsigned int options)
 {
        isc_result_t result;
        isc_boolean_t check_acl;
@@ -746,12 +747,11 @@ query_getcachedb(ns_client_t *client, dns_db_t **dbp, unsigned int options)
 
        if (check_acl) {
                isc_boolean_t log = ISC_TF((options & DNS_GETDB_NOLOG) == 0);
+               char msg[NS_CLIENT_ACLMSGSIZE("query (cache)")];
                
-               result = ns_client_checkacl(client, "query (cache)",
-                                           client->view->queryacl,
-                                           ISC_TRUE,
-                                           log ? ISC_LOG_INFO :
-                                                 ISC_LOG_DEBUG(3));
+               result = ns_client_checkaclsilent(client,
+                                                 client->view->queryacl,
+                                                 ISC_TRUE);
                if (result == ISC_R_SUCCESS) {
                        /*
                         * We were allowed by the default
@@ -760,6 +760,25 @@ query_getcachedb(ns_client_t *client, dns_db_t **dbp, unsigned int options)
                         */
                        client->query.attributes |=
                                NS_QUERYATTR_QUERYOK;
+                       if (log && isc_log_wouldlog(ns_g_lctx,
+                                                    ISC_LOG_DEBUG(3)))
+                       {
+                               ns_client_aclmsg("query (cache)", name, qtype,
+                                                client->view->rdclass,
+                                                msg, sizeof(msg));
+                               ns_client_log(client,
+                                             DNS_LOGCATEGORY_SECURITY,
+                                             NS_LOGMODULE_QUERY,
+                                             ISC_LOG_DEBUG(3),
+                                             "%s approved", msg);
+                       }
+               } else if (log) {
+                       ns_client_aclmsg("query (cache)", name, qtype,
+                                        client->view->rdclass, msg,
+                                        sizeof(msg));
+                       ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
+                                     NS_LOGMODULE_QUERY, ISC_LOG_INFO,
+                                     "%s denied", msg);
                }
                /*
                 * We've now evaluated the view's query ACL, and
@@ -789,17 +808,18 @@ query_getcachedb(ns_client_t *client, dns_db_t **dbp, unsigned int options)
 
 
 static inline isc_result_t
-query_getdb(ns_client_t *client, dns_name_t *name, unsigned int options,
-           dns_zone_t **zonep, dns_db_t **dbp, dns_dbversion_t **versionp,
-           isc_boolean_t *is_zonep)
+query_getdb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
+           unsigned int options, dns_zone_t **zonep, dns_db_t **dbp,
+           dns_dbversion_t **versionp, isc_boolean_t *is_zonep)
 {
        isc_result_t result;
 
-       result = query_getzonedb(client, name, options, zonep, dbp, versionp);
+       result = query_getzonedb(client, name, qtype, options,
+                                zonep, dbp, versionp);
        if (result == ISC_R_SUCCESS) {
                *is_zonep = ISC_TRUE;
        } else if (result == ISC_R_NOTFOUND) {
-               result = query_getcachedb(client, dbp, options);
+               result = query_getcachedb(client, name, qtype, dbp, options);
                *is_zonep = ISC_FALSE;
        }
        return (result);
@@ -919,7 +939,7 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
         * Look for a zone database that might contain authoritative
         * additional data.
         */
-       result = query_getzonedb(client, name, DNS_GETDB_NOLOG,
+       result = query_getzonedb(client, name, qtype, DNS_GETDB_NOLOG,
                                 &zone, &db, &version);
        if (result != ISC_R_SUCCESS)
                goto try_cache;
@@ -952,7 +972,7 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
         */
 
  try_cache:
-       result = query_getcachedb(client, &db, DNS_GETDB_NOLOG);
+       result = query_getcachedb(client, name, qtype, &db, DNS_GETDB_NOLOG);
        if (result != ISC_R_SUCCESS)
                /*
                 * Most likely the client isn't allowed to query the cache.
@@ -1606,8 +1626,8 @@ query_addbestns(ns_client_t *client) {
        /*
         * Find the right database.
         */
-       result = query_getdb(client, client->query.qname, 0, &zone, &db,
-                            &version, &is_zone);
+       result = query_getdb(client, client->query.qname, dns_rdatatype_ns, 0,
+                            &zone, &db, &version, &is_zone);
        if (result != ISC_R_SUCCESS)
                goto cleanup;
 
@@ -2345,8 +2365,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
        if (dns_rdatatype_atparent(qtype) &&
            !dns_name_equal(client->query.qname, dns_rootname))
                options |= DNS_GETDB_NOEXACT;
-       result = query_getdb(client, client->query.qname, options, &zone, &db,
-                            &version, &is_zone);
+       result = query_getdb(client, client->query.qname, qtype, options,
+                            &zone, &db, &version, &is_zone);
        if ((result != ISC_R_SUCCESS || !is_zone) && !RECURSIONOK(client) &&
            (options & DNS_GETDB_NOEXACT) != 0 && qtype == dns_rdatatype_ds) {
                /*
@@ -2358,7 +2378,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                dns_dbversion_t *tversion = NULL;
                isc_result_t tresult;
 
-               tresult = query_getzonedb(client, client->query.qname,
+               tresult = query_getzonedb(client, client->query.qname, qtype,
                                         DNS_GETDB_PARTIAL, &tzone, &tdb,
                                         &tversion);
                if (tresult == ISC_R_SUCCESS) {
@@ -2518,6 +2538,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                                dns_dbversion_t *tversion = NULL;
                                result = query_getzonedb(client,
                                                         client->query.qname,
+                                                        qtype,
                                                         DNS_GETDB_PARTIAL,
                                                         &tzone, &tdb,
                                                         &tversion);

diff --git a/bin/named/xfrout.c b/bin/named/xfrout.c
index 412ccfa36828fbbfb38f77a700c9f1c1463dc546..2dded4d9a5fb07fcc81d4932614db69398edc5fb 100644 (file)
--- a/bin/named/xfrout.c
+++ b/bin/named/xfrout.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: xfrout.c,v 1.109 2002/07/31 02:22:15 marka Exp $ */
+/* $Id: xfrout.c,v 1.110 2003/01/21 06:11:46 marka Exp $ */
 
 #include <config.h>
 
@@ -888,8 +888,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
        dns_peer_t *peer = NULL;
        isc_buffer_t *tsigbuf = NULL;
        char *journalfile;
-       char msg[DNS_RDATACLASS_FORMATSIZE + DNS_NAME_FORMATSIZE
-                + sizeof("zone transfer '/'")];
+       char msg[NS_CLIENT_ACLMSGSIZE("zone transfer")];
        char keyname[DNS_NAME_FORMATSIZE];
        isc_boolean_t is_poll = ISC_FALSE;
 
@@ -1011,7 +1010,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
         * Decide whether to allow this transfer.
         */
        ns_client_aclmsg("zone transfer", question_name,
-                        client->view->rdclass, msg, sizeof(msg));
+                        client->view->rdclass, reqtype, msg, sizeof(msg));
        CHECK(ns_client_checkacl(client, msg,
                                 dns_zone_getxfracl(zone), ISC_TRUE,
                                 ISC_LOG_ERROR));