[Pdns-users] [Patch] Using ACL for per-zone AXFR
Florent Lerat
flow at k-ribou.com
Tue Oct 12 10:04:18 UTC 2010
Hi everybody,
This is an updated version of an old patch posted by Derrik Pates based on an older one (details here : http://mailman.powerdns.com/pipermail/pdns-users/2006-March/003115.html ). I use it on pdns2.9.22-x-3.
With this patch, you can allow per-zone AXFR. In order to do this, you must create a new table in your database :
CREATE TABLE acls (
acl_type enum('allow-axfr') NOT NULL default 'allow-axfr',
acl_key varchar(64) NOT NULL default '',
value varchar(64) NOT NULL default '',
KEY type_key_index (acl_type,acl_key)
) TYPE=InnoDB;
acl_key contains the domain name
value contains the IPv4 address to allow
The patch can be found here : http://pastebin.com/rGeQaHEG
Or below this e-mail.
Florent
-------------------------------------------------------------------------------------------------------------------------------------------------------
diff -ru pdns-2.9.22.x/modules/gmysqlbackend/gmysqlbackend.cc pdns-2.9.22.x-3-acls-patched/modules/gmysqlbackend/gmysqlbackend.cc
--- pdns-2.9.22.x/modules/gmysqlbackend/gmysqlbackend.cc 2010-07-03 15:51:55.000000000 +0200
+++ pdns-2.9.22.x-3-acls-patched/modules/gmysqlbackend/gmysqlbackend.cc 2010-10-08 15:27:15.177611077 +0200
@@ -74,6 +74,7 @@
declare(suffix,"update-lastcheck-query","", "update domains set last_check=%d where id=%d");
declare(suffix,"info-all-master-query","", "select id,name,master,last_check,notified_serial,type from domains where type='MASTER'");
declare(suffix,"delete-zone-query","", "delete from records where domain_id=%d");
+ declare(suffix,"check-acl-query","", "select value from acls where acl_type='%s' and acl_key='%s'");
}
diff -ru pdns-2.9.22.x/modules/gpgsqlbackend/gpgsqlbackend.cc pdns-2.9.22.x-3-acls-patched/modules/gpgsqlbackend/gpgsqlbackend.cc
--- pdns-2.9.22.x/modules/gpgsqlbackend/gpgsqlbackend.cc 2010-07-03 15:51:55.000000000 +0200
+++ pdns-2.9.22.x-3-acls-patched/modules/gpgsqlbackend/gpgsqlbackend.cc 2010-10-08 15:27:43.889609460 +0200
@@ -74,7 +74,7 @@
declare(suffix,"update-lastcheck-query","", "update domains set last_check=%d where id=%d");
declare(suffix,"info-all-master-query","", "select id,name,master,last_check,notified_serial,type from domains where type='MASTER'");
declare(suffix,"delete-zone-query","", "delete from records where domain_id=%d");
-
+ declare(suffix,"check-acl-query","", "select value from acls where acl_type='%s' and acl_key='%s'");
}
diff -ru pdns-2.9.22.x/modules/gsqlitebackend/gsqlitebackend.cc pdns-2.9.22.x-3-acls-patched/modules/gsqlitebackend/gsqlitebackend.cc
--- pdns-2.9.22.x/modules/gsqlitebackend/gsqlitebackend.cc 2010-07-03 15:51:55.000000000 +0200
+++ pdns-2.9.22.x-3-acls-patched/modules/gsqlitebackend/gsqlitebackend.cc 2010-10-08 15:28:09.506611340 +0200
@@ -75,6 +75,7 @@
declare( suffix, "update-lastcheck-query", "", "update domains set last_check=%d where id=%d");
declare( suffix, "info-all-master-query", "", "select id,name,master,last_check,notified_serial,type from domains where type='MASTER'");
declare( suffix, "delete-zone-query", "", "delete from records where domain_id=%d");
+ declare( suffix, "check-acl-query", "", "select value from acls where acl_type='%s' and acl_key='%s'");
}
//! Constructs a new gSQLiteBackend object.
diff -ru pdns-2.9.22.x/pdns/backends/gsql/gsqlbackend.cc pdns-2.9.22.x-3-acls-patched/pdns/backends/gsql/gsqlbackend.cc
--- pdns-2.9.22.x/pdns/backends/gsql/gsqlbackend.cc 2010-07-03 21:11:02.000000000 +0200
+++ pdns-2.9.22.x-3-acls-patched/pdns/backends/gsql/gsqlbackend.cc 2010-10-08 15:30:08.714608738 +0200
@@ -252,6 +252,8 @@
d_UpdateLastCheckofZoneQuery=getArg("update-lastcheck-query");
d_InfoOfAllMasterDomainsQuery=getArg("info-all-master-query");
d_DeleteZoneQuery=getArg("delete-zone-query");
+ // Ajout ACL-acl VDU
+ d_CheckACLQuery=getArg("check-acl-query");
}
@@ -357,6 +359,29 @@
return false;
}
+// Ajout ACL-acl VDU
+bool GSQLBackend::checkACL(const string &acl_type, const string &key, const string &value)
+{
+
+ string format;
+ char output[1024];
+ format = d_CheckACLQuery;
+ snprintf(output, sizeof(output)-1, format.c_str(), sqlEscape(acl_type).c_str(), sqlEscape(key).c_str());
+ try {
+ d_db->doQuery(output, d_result);
+ }
+ catch(SSqlException &e) {
+ throw AhuException("Database error trying to check ACL:"+acl_type+" with error: "+e.txtReason());
+ }
+ if(!d_result.empty()) {
+ for (int i = 0; i < d_result.size(); i++) {
+ if (d_result[i][0] == value)
+ return true;
+ }
+ }
+ return false; // default to false
+}
+
bool GSQLBackend::createSlaveDomain(const string &ip, const string &domain, const string &account)
{
string format;
diff -ru pdns-2.9.22.x/pdns/backends/gsql/gsqlbackend.hh pdns-2.9.22.x-3-acls-patched/pdns/backends/gsql/gsqlbackend.hh
--- pdns-2.9.22.x/pdns/backends/gsql/gsqlbackend.hh 2010-07-03 15:51:55.000000000 +0200
+++ pdns-2.9.22.x-3-acls-patched/pdns/backends/gsql/gsqlbackend.hh 2010-10-08 15:31:08.621608499 +0200
@@ -38,6 +38,8 @@
void getUpdatedMasters(vector<DomainInfo> *updatedDomains);
bool getDomainInfo(const string &domain, DomainInfo &di);
void setNotified(uint32_t domain_id, uint32_t serial);
+ // Ajout ACL-acl VDU
+ bool checkACL(const string &acl_type, const string &key, const string &value);
private:
string d_qname;
QType d_qtype;
@@ -65,6 +67,8 @@
string d_UpdateSerialOfZoneQuery;
string d_UpdateLastCheckofZoneQuery;
string d_InfoOfAllMasterDomainsQuery;
- string d_DeleteZoneQuery;
+ string d_DeleteZoneQuery;
+ // Ajout ACL-acl VDU
+ string d_CheckACLQuery;
};
diff -ru pdns-2.9.22.x/pdns/dnsbackend.hh pdns-2.9.22.x-3-acls-patched/pdns/dnsbackend.hh
--- pdns-2.9.22.x/pdns/dnsbackend.hh 2010-07-03 15:51:55.000000000 +0200
+++ pdns-2.9.22.x-3-acls-patched/pdns/dnsbackend.hh 2010-10-08 15:32:09.406607497 +0200
@@ -165,6 +165,12 @@
{
return false;
}
+
+ // Ajout ACL-acl VDU
+ virtual bool checkACL(const string &acl_type, const string &key, const string &value)
+ {
+ return false;
+ }
protected:
bool mustDo(const string &key);
diff -ru pdns-2.9.22.x/pdns/tcpreceiver.cc pdns-2.9.22.x-3-acls-patched/pdns/tcpreceiver.cc
--- pdns-2.9.22.x/pdns/tcpreceiver.cc 2010-07-03 21:11:02.000000000 +0200
+++ pdns-2.9.22.x-3-acls-patched/pdns/tcpreceiver.cc 2010-10-08 15:33:22.402609216 +0200
@@ -351,6 +351,16 @@
if( ::arg()["allow-axfr-ips"].empty() || d_ng.match( (ComboAddress *) &q->remote ) )
return true;
+
+ SOAData sd;
+ sd.db=(DNSBackend *)-1;
+ Lock l(&s_plock);
+ if(s_P->getBackend()->getSOA(q->qdomain,sd)) {
+ DNSBackend *B=sd.db;
+ if (B->checkACL(string("allow-axfr"), q->qdomain, q->getRemote())) {
+ return true;
+ }
+ }
extern CommunicatorClass Communicator;
More information about the Pdns-users
mailing list