From: Mark Andrews Date: Tue, 21 Jan 2003 06:11:46 +0000 (+0000) Subject: 1422. [func] Log name/type/class when denying a query. [RT #4663] X-Git-Tag: v9.2.3rc1~104^2~145 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=838d608e6f37038f2fb43980a7a9d6b6a490db36;p=thirdparty%2Fbind9.git 1422. [func] Log name/type/class when denying a query. [RT #4663] --- diff --git a/CHANGES b/CHANGES index 3329b771247..546a0ffdd13 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,5 @@ +1422. [func] Log name/type/class when denying a query. [RT #4663] + 1421. [func] Differentiate updates that don't succeed due to prerequisites (unsuccessful) vs other reasons (failed). diff --git a/bin/named/client.c b/bin/named/client.c index 304d589814a..5b24c684a2f 100644 --- a/bin/named/client.c +++ b/bin/named/client.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: client.c,v 1.213 2002/10/28 02:35:36 marka Exp $ */ +/* $Id: client.c,v 1.214 2003/01/21 06:11:45 marka Exp $ */ #include @@ -2227,15 +2227,18 @@ ns_client_log(ns_client_t *client, isc_logcategory_t *category, } void -ns_client_aclmsg(const char *msg, dns_name_t *name, dns_rdataclass_t rdclass, - char *buf, size_t len) +ns_client_aclmsg(const char *msg, dns_name_t *name, dns_rdatatype_t type, + dns_rdataclass_t rdclass, char *buf, size_t len) { char namebuf[DNS_NAME_FORMATSIZE]; + char typebuf[DNS_RDATATYPE_FORMATSIZE]; char classbuf[DNS_RDATACLASS_FORMATSIZE]; dns_name_format(name, namebuf, sizeof(namebuf)); + dns_rdatatype_format(type, typebuf, sizeof(typebuf)); dns_rdataclass_format(rdclass, classbuf, sizeof(classbuf)); - (void)snprintf(buf, len, "%s '%s/%s'", msg, namebuf, classbuf); + (void)snprintf(buf, len, "%s '%s/%s/%s'", msg, namebuf, typebuf, + classbuf); } static void diff --git a/bin/named/include/named/client.h b/bin/named/include/named/client.h index 13f963ac289..b56bf2e0321 100644 --- a/bin/named/include/named/client.h +++ b/bin/named/include/named/client.h @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: client.h,v 1.67 2002/09/10 04:45:54 marka Exp $ */ +/* $Id: client.h,v 1.68 2003/01/21 06:11:46 marka Exp $ */ #ifndef NAMED_CLIENT_H #define NAMED_CLIENT_H 1 @@ -68,10 +68,13 @@ #include #include +#include #include -#include +#include +#include #include -#include +#include + #include #include @@ -310,8 +313,12 @@ ns_client_logv(ns_client_t *client, isc_logcategory_t *category, isc_logmodule_t *module, int level, const char *fmt, va_list ap) ISC_FORMAT_PRINTF(5, 0); void -ns_client_aclmsg(const char *msg, dns_name_t *name, dns_rdataclass_t rdclass, - char *buf, size_t len); +ns_client_aclmsg(const char *msg, dns_name_t *name, dns_rdatatype_t type, + dns_rdataclass_t rdclass, char *buf, size_t len); + +#define NS_CLIENT_ACLMSGSIZE(x) \ + (DNS_NAME_FORMATSIZE + DNS_RDATATYPE_FORMATSIZE + \ + DNS_RDATACLASS_FORMATSIZE + sizeof(x) + sizeof("'/'")) void ns_client_recursing(ns_client_t *client, isc_boolean_t killoldest); diff --git a/bin/named/query.c b/bin/named/query.c index d6e7f6b5fc3..2217dc74eab 100644 --- a/bin/named/query.c +++ b/bin/named/query.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: query.c,v 1.240 2003/01/18 03:18:30 marka Exp $ */ +/* $Id: query.c,v 1.241 2003/01/21 06:11:45 marka Exp $ */ #include @@ -536,7 +536,8 @@ query_findversion(ns_client_t *client, dns_db_t *db, static inline isc_result_t query_getzonedb(ns_client_t *client, dns_name_t *name, unsigned int options, - dns_zone_t **zonep, dns_db_t **dbp, dns_dbversion_t **versionp) + dns_rdatatype_t qtype, dns_zone_t **zonep, dns_db_t **dbp, + dns_dbversion_t **versionp) { isc_result_t result; isc_boolean_t check_acl, new_zone; @@ -632,13 +633,12 @@ query_getzonedb(ns_client_t *client, dns_name_t *name, unsigned int options, result = ns_client_checkaclsilent(client, queryacl, ISC_TRUE); if (log) { - char msg[DNS_NAME_FORMATSIZE + DNS_RDATACLASS_FORMATSIZE - + sizeof("query '/'")]; + char msg[NS_CLIENT_ACLMSGSIZE("query")]; if (result == ISC_R_SUCCESS) { if (isc_log_wouldlog(ns_g_lctx, ISC_LOG_DEBUG(3))) { - ns_client_aclmsg("query", name, + ns_client_aclmsg("query", name, qtype, client->view->rdclass, msg, sizeof(msg)); ns_client_log(client, @@ -648,7 +648,7 @@ query_getzonedb(ns_client_t *client, dns_name_t *name, unsigned int options, "%s approved", msg); } } else { - ns_client_aclmsg("query", name, + ns_client_aclmsg("query", name, qtype, client->view->rdclass, msg, sizeof(msg)); ns_client_log(client, DNS_LOGCATEGORY_SECURITY, @@ -707,7 +707,8 @@ query_getzonedb(ns_client_t *client, dns_name_t *name, unsigned int options, } static inline isc_result_t -query_getcachedb(ns_client_t *client, dns_db_t **dbp, unsigned int options) +query_getcachedb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype, + dns_db_t **dbp, unsigned int options) { isc_result_t result; isc_boolean_t check_acl; @@ -746,12 +747,11 @@ query_getcachedb(ns_client_t *client, dns_db_t **dbp, unsigned int options) if (check_acl) { isc_boolean_t log = ISC_TF((options & DNS_GETDB_NOLOG) == 0); + char msg[NS_CLIENT_ACLMSGSIZE("query (cache)")]; - result = ns_client_checkacl(client, "query (cache)", - client->view->queryacl, - ISC_TRUE, - log ? ISC_LOG_INFO : - ISC_LOG_DEBUG(3)); + result = ns_client_checkaclsilent(client, + client->view->queryacl, + ISC_TRUE); if (result == ISC_R_SUCCESS) { /* * We were allowed by the default @@ -760,6 +760,25 @@ query_getcachedb(ns_client_t *client, dns_db_t **dbp, unsigned int options) */ client->query.attributes |= NS_QUERYATTR_QUERYOK; + if (log && isc_log_wouldlog(ns_g_lctx, + ISC_LOG_DEBUG(3))) + { + ns_client_aclmsg("query (cache)", name, qtype, + client->view->rdclass, + msg, sizeof(msg)); + ns_client_log(client, + DNS_LOGCATEGORY_SECURITY, + NS_LOGMODULE_QUERY, + ISC_LOG_DEBUG(3), + "%s approved", msg); + } + } else if (log) { + ns_client_aclmsg("query (cache)", name, qtype, + client->view->rdclass, msg, + sizeof(msg)); + ns_client_log(client, DNS_LOGCATEGORY_SECURITY, + NS_LOGMODULE_QUERY, ISC_LOG_INFO, + "%s denied", msg); } /* * We've now evaluated the view's query ACL, and @@ -789,17 +808,18 @@ query_getcachedb(ns_client_t *client, dns_db_t **dbp, unsigned int options) static inline isc_result_t -query_getdb(ns_client_t *client, dns_name_t *name, unsigned int options, - dns_zone_t **zonep, dns_db_t **dbp, dns_dbversion_t **versionp, - isc_boolean_t *is_zonep) +query_getdb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype, + unsigned int options, dns_zone_t **zonep, dns_db_t **dbp, + dns_dbversion_t **versionp, isc_boolean_t *is_zonep) { isc_result_t result; - result = query_getzonedb(client, name, options, zonep, dbp, versionp); + result = query_getzonedb(client, name, qtype, options, + zonep, dbp, versionp); if (result == ISC_R_SUCCESS) { *is_zonep = ISC_TRUE; } else if (result == ISC_R_NOTFOUND) { - result = query_getcachedb(client, dbp, options); + result = query_getcachedb(client, name, qtype, dbp, options); *is_zonep = ISC_FALSE; } return (result); @@ -919,7 +939,7 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { * Look for a zone database that might contain authoritative * additional data. */ - result = query_getzonedb(client, name, DNS_GETDB_NOLOG, + result = query_getzonedb(client, name, qtype, DNS_GETDB_NOLOG, &zone, &db, &version); if (result != ISC_R_SUCCESS) goto try_cache; @@ -952,7 +972,7 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { */ try_cache: - result = query_getcachedb(client, &db, DNS_GETDB_NOLOG); + result = query_getcachedb(client, name, qtype, &db, DNS_GETDB_NOLOG); if (result != ISC_R_SUCCESS) /* * Most likely the client isn't allowed to query the cache. @@ -1606,8 +1626,8 @@ query_addbestns(ns_client_t *client) { /* * Find the right database. */ - result = query_getdb(client, client->query.qname, 0, &zone, &db, - &version, &is_zone); + result = query_getdb(client, client->query.qname, dns_rdatatype_ns, 0, + &zone, &db, &version, &is_zone); if (result != ISC_R_SUCCESS) goto cleanup; @@ -2345,8 +2365,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) if (dns_rdatatype_atparent(qtype) && !dns_name_equal(client->query.qname, dns_rootname)) options |= DNS_GETDB_NOEXACT; - result = query_getdb(client, client->query.qname, options, &zone, &db, - &version, &is_zone); + result = query_getdb(client, client->query.qname, qtype, options, + &zone, &db, &version, &is_zone); if ((result != ISC_R_SUCCESS || !is_zone) && !RECURSIONOK(client) && (options & DNS_GETDB_NOEXACT) != 0 && qtype == dns_rdatatype_ds) { /* @@ -2358,7 +2378,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) dns_dbversion_t *tversion = NULL; isc_result_t tresult; - tresult = query_getzonedb(client, client->query.qname, + tresult = query_getzonedb(client, client->query.qname, qtype, DNS_GETDB_PARTIAL, &tzone, &tdb, &tversion); if (tresult == ISC_R_SUCCESS) { @@ -2518,6 +2538,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) dns_dbversion_t *tversion = NULL; result = query_getzonedb(client, client->query.qname, + qtype, DNS_GETDB_PARTIAL, &tzone, &tdb, &tversion); diff --git a/bin/named/xfrout.c b/bin/named/xfrout.c index 412ccfa3682..2dded4d9a5f 100644 --- a/bin/named/xfrout.c +++ b/bin/named/xfrout.c @@ -15,7 +15,7 @@ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: xfrout.c,v 1.109 2002/07/31 02:22:15 marka Exp $ */ +/* $Id: xfrout.c,v 1.110 2003/01/21 06:11:46 marka Exp $ */ #include @@ -888,8 +888,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) { dns_peer_t *peer = NULL; isc_buffer_t *tsigbuf = NULL; char *journalfile; - char msg[DNS_RDATACLASS_FORMATSIZE + DNS_NAME_FORMATSIZE - + sizeof("zone transfer '/'")]; + char msg[NS_CLIENT_ACLMSGSIZE("zone transfer")]; char keyname[DNS_NAME_FORMATSIZE]; isc_boolean_t is_poll = ISC_FALSE; @@ -1011,7 +1010,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) { * Decide whether to allow this transfer. */ ns_client_aclmsg("zone transfer", question_name, - client->view->rdclass, msg, sizeof(msg)); + client->view->rdclass, reqtype, msg, sizeof(msg)); CHECK(ns_client_checkacl(client, msg, dns_zone_getxfracl(zone), ISC_TRUE, ISC_LOG_ERROR));