git.openwrt.org Git - openwrt/staging/rmilecki.git/blob

   1 From 090856c7e6d483bc4d7ec41f55208a9842769c45 Mon Sep 17 00:00:00 2001
   2 From: Simon Kelley <simon@thekelleys.org.uk>
   3 Date: Sat, 2 Jun 2018 18:37:07 +0100
   4 Subject: [PATCH 13/17] Allow zone transfer in authoritative mode whenever
   5  auth-peer is specified.
   6
   7 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
   8 ---
   9  CHANGELOG     | 4 ++++
  10  man/dnsmasq.8 | 6 +++++-
  11  src/auth.c    | 5 +++--
  12  3 files changed, 12 insertions(+), 3 deletions(-)
  13
  14 --- a/CHANGELOG
  15 +++ b/CHANGELOG
  16 @@ -29,6 +29,10 @@ version 2.80
  17         have different parameters and avoids advertising the same
  18         prefix twice. Thanks to Luis Marsano for spotting this case.
  19
  20 +       Allow zone transfer in authoritative mode if auth-peer is specified,
  21 +       even if auth-sec-servers is not. Thanks to Raphaël Halimi for
  22 +       the suggestion.
  23 +
  24
  25  version 2.79
  26         Fix parsing of CNAME arguments, which are confused by extra spaces.
  27 --- a/man/dnsmasq.8
  28 +++ b/man/dnsmasq.8
  29 @@ -817,7 +817,11 @@ authoritative zones as dnsmasq.
  30  Specify the addresses of secondary servers which are allowed to
  31  initiate zone transfer (AXFR) requests for zones for which dnsmasq is
  32  authoritative. If this option is not given, then AXFR requests will be
  33 -accepted from any secondary.
  34 +accepted from any secondary. Specifying
  35 +.B auth-peer
  36 +without
  37 +.B auth-sec-servers
  38 +enables zone transfer but does not advertise the secondary in NS records returned by dnsmasq.
  39  .TP
  40  .B --conntrack
  41  Read the Linux connection track mark associated with incoming DNS
  42 --- a/src/auth.c
  43 +++ b/src/auth.c
  44 @@ -436,8 +436,9 @@ size_t answer_auth(struct dns_header *he
  45                 if (sockaddr_isequal(peer_addr, &peers->addr))
  46                   break;
  47
  48 -             /* Refuse all AXFR unless --auth-sec-servers is set */
  49 -             if ((!peers && daemon->auth_peers) || !daemon->secondary_forward_server)
  50 +             /* Refuse all AXFR unless --auth-sec-servers or auth-peers is set */
  51 +             if ((!daemon->secondary_forward_server && !daemon->auth_peers) ||
  52 +                 (daemon->auth_peers && !peers))
  53                 {
  54                   if (peer_addr->sa.sa_family == AF_INET)
  55                     inet_ntop(AF_INET, &peer_addr->in.sin_addr, daemon->addrbuff, ADDRSTRLEN);