aboutsummaryrefslogtreecommitdiff
path: root/bin/named
diff options
context:
space:
mode:
Diffstat (limited to 'bin/named')
-rw-r--r--bin/named/client.c8
-rw-r--r--bin/named/include/named/query.h6
-rw-r--r--bin/named/query.c25
-rw-r--r--bin/named/server.c41
4 files changed, 42 insertions, 38 deletions
diff --git a/bin/named/client.c b/bin/named/client.c
index ae5386cb4893..a0e034ae2d27 100644
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: client.c,v 1.259.12.3 2009/01/29 22:40:33 jinmei Exp $ */
+/* $Id: client.c,v 1.259.12.3.24.2 2010/09/29 23:46:31 tbox Exp $ */
#include <config.h>
@@ -1859,13 +1859,13 @@ client_request(isc_task_t *task, isc_event_t *event) {
client->view->recursionacl,
ISC_TRUE) == ISC_R_SUCCESS &&
ns_client_checkaclsilent(client, NULL,
- client->view->queryacl,
+ client->view->cacheacl,
ISC_TRUE) == ISC_R_SUCCESS &&
ns_client_checkaclsilent(client, &client->interface->addr,
client->view->recursiononacl,
ISC_TRUE) == ISC_R_SUCCESS &&
ns_client_checkaclsilent(client, &client->interface->addr,
- client->view->queryonacl,
+ client->view->cacheonacl,
ISC_TRUE) == ISC_R_SUCCESS)
ra = ISC_TRUE;
diff --git a/bin/named/include/named/query.h b/bin/named/include/named/query.h
index 500b57714e4f..3f019a3da691 100644
--- a/bin/named/include/named/query.h
+++ b/bin/named/include/named/query.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2010 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2002 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: query.h,v 1.40 2007/06/19 23:46:59 tbox Exp $ */
+/* $Id: query.h,v 1.40.626.2 2010/09/29 23:46:31 tbox Exp $ */
#ifndef NAMED_QUERY_H
#define NAMED_QUERY_H 1
@@ -71,6 +71,8 @@ struct ns_query {
#define NS_QUERYATTR_SECURE 0x0200
#define NS_QUERYATTR_NOAUTHORITY 0x0400
#define NS_QUERYATTR_NOADDITIONAL 0x0800
+#define NS_QUERYATTR_CACHEACLOKVALID 0x1000
+#define NS_QUERYATTR_CACHEACLOK 0x2000
isc_result_t
ns_query_init(ns_client_t *client);
diff --git a/bin/named/query.c b/bin/named/query.c
index 73ed1a6b9095..0ba708bf7c06 100644
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: query.c,v 1.313.20.16.10.2 2010/06/26 23:46:14 tbox Exp $ */
+/* $Id: query.c,v 1.313.20.16.10.3 2010/09/29 00:03:32 marka Exp $ */
/*! \file */
@@ -820,17 +820,15 @@ query_getcachedb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
return (DNS_R_REFUSED);
dns_db_attach(client->view->cachedb, &db);
- if ((client->query.attributes &
- NS_QUERYATTR_QUERYOKVALID) != 0) {
+ if ((client->query.attributes & NS_QUERYATTR_CACHEACLOKVALID) != 0) {
/*
- * We've evaluated the view's queryacl already. If
- * NS_QUERYATTR_QUERYOK is set, then the client is
+ * We've evaluated the view's cacheacl already. If
+ * NS_QUERYATTR_CACHEACLOK is set, then the client is
* allowed to make queries, otherwise the query should
* be refused.
*/
check_acl = ISC_FALSE;
- if ((client->query.attributes &
- NS_QUERYATTR_QUERYOK) == 0)
+ if ((client->query.attributes & NS_QUERYATTR_CACHEACLOK) == 0)
goto refuse;
} else {
/*
@@ -844,16 +842,15 @@ query_getcachedb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
char msg[NS_CLIENT_ACLMSGSIZE("query (cache)")];
result = ns_client_checkaclsilent(client, NULL,
- client->view->queryacl,
+ client->view->cacheacl,
ISC_TRUE);
if (result == ISC_R_SUCCESS) {
/*
- * We were allowed by the default
- * "allow-query" ACL. Remember this so we
- * don't have to check again.
+ * We were allowed by the "allow-query-cache" ACL.
+ * Remember this so we don't have to check again.
*/
client->query.attributes |=
- NS_QUERYATTR_QUERYOK;
+ NS_QUERYATTR_CACHEACLOK;
if (log && isc_log_wouldlog(ns_g_lctx,
ISC_LOG_DEBUG(3)))
{
@@ -876,9 +873,9 @@ query_getcachedb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
}
/*
* We've now evaluated the view's query ACL, and
- * the NS_QUERYATTR_QUERYOK attribute is now valid.
+ * the NS_QUERYATTR_CACHEACLOKVALID attribute is now valid.
*/
- client->query.attributes |= NS_QUERYATTR_QUERYOKVALID;
+ client->query.attributes |= NS_QUERYATTR_CACHEACLOKVALID;
if (result != ISC_R_SUCCESS)
goto refuse;
diff --git a/bin/named/server.c b/bin/named/server.c
index 8f6778666a07..5fbe043e644a 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: server.c,v 1.520.12.11.10.1 2010/03/03 22:06:36 marka Exp $ */
+/* $Id: server.c,v 1.520.12.11.10.4 2010/11/16 22:42:03 marka Exp $ */
/*! \file */
@@ -1132,6 +1132,14 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
dns_acache_setcachesize(view->acache, max_acache_size);
}
+ CHECK(configure_view_acl(vconfig, config, "allow-query", actx,
+ ns_g_mctx, &view->queryacl));
+
+ if (view->queryacl == NULL) {
+ CHECK(configure_view_acl(NULL, ns_g_config, "allow-query", actx,
+ ns_g_mctx, &view->queryacl));
+ }
+
/*
* Configure the zones.
*/
@@ -1606,13 +1614,13 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
* configured in named.conf.
*/
CHECK(configure_view_acl(vconfig, config, "allow-query-cache",
- actx, ns_g_mctx, &view->queryacl));
+ actx, ns_g_mctx, &view->cacheacl));
CHECK(configure_view_acl(vconfig, config, "allow-query-cache-on",
- actx, ns_g_mctx, &view->queryonacl));
- if (view->queryonacl == NULL)
+ actx, ns_g_mctx, &view->cacheonacl));
+ if (view->cacheonacl == NULL)
CHECK(configure_view_acl(NULL, ns_g_config,
"allow-query-cache-on", actx,
- ns_g_mctx, &view->queryonacl));
+ ns_g_mctx, &view->cacheonacl));
if (strcmp(view->name, "_bind") != 0) {
CHECK(configure_view_acl(vconfig, config, "allow-recursion",
actx, ns_g_mctx,
@@ -1628,14 +1636,14 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
* "allow-recursion" inherits from "allow-query-cache" if set,
* otherwise from "allow-query" if set.
*/
- if (view->queryacl == NULL && view->recursionacl != NULL)
- dns_acl_attach(view->recursionacl, &view->queryacl);
- if (view->queryacl == NULL && view->recursion)
+ if (view->cacheacl == NULL && view->recursionacl != NULL)
+ dns_acl_attach(view->recursionacl, &view->cacheacl);
+ if (view->cacheacl == NULL && view->recursion)
CHECK(configure_view_acl(vconfig, config, "allow-query",
- actx, ns_g_mctx, &view->queryacl));
+ actx, ns_g_mctx, &view->cacheacl));
if (view->recursion &&
- view->recursionacl == NULL && view->queryacl != NULL)
- dns_acl_attach(view->queryacl, &view->recursionacl);
+ view->recursionacl == NULL && view->cacheacl != NULL)
+ dns_acl_attach(view->cacheacl, &view->recursionacl);
/*
* Set default "allow-recursion", "allow-recursion-on" and
@@ -1651,16 +1659,13 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
"allow-recursion-on",
actx, ns_g_mctx,
&view->recursiononacl));
- if (view->queryacl == NULL) {
+ if (view->cacheacl == NULL) {
if (view->recursion)
CHECK(configure_view_acl(NULL, ns_g_config,
"allow-query-cache", actx,
- ns_g_mctx, &view->queryacl));
- else {
- if (view->queryacl != NULL)
- dns_acl_detach(&view->queryacl);
- CHECK(dns_acl_none(ns_g_mctx, &view->queryacl));
- }
+ ns_g_mctx, &view->cacheacl));
+ else
+ CHECK(dns_acl_none(ns_g_mctx, &view->cacheacl));
}
/*
generated by cgit v1.2.3 (git 2.25.1) at 2026-02-09 23:32:09 +0000