diff --git a/CHANGES b/CHANGES
index e022f605ab..d58c1882a1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,10 @@
+5037. [func] "allow-recursion-on" and "allow-query-cache-on"
+ each now default to the other if only one of them
+ is set, in order to be more consistent with the way
+ "allow-recursion" and "allow-query-cache" work.
+ Also we now ensure that both query-cache ACLs are
+ checked when determining cache access. [GL #319]
+
5036. [cleanup] Fixed a spacing/formatting error in some RPZ-related
error messages in the log. [GL !805]
diff --git a/bin/named/server.c b/bin/named/server.c
index 374a365ecb..8acdae9a26 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -4708,14 +4708,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
INSIST(result == ISC_R_SUCCESS);
view->root_key_sentinel = cfg_obj_asboolean(obj);
- CHECK(configure_view_acl(vconfig, config, named_g_config,
- "allow-query-cache-on", NULL, actx,
- named_g_mctx, &view->cacheonacl));
/*
* Set the "allow-query", "allow-query-cache", "allow-recursion",
- * and "allow-recursion-on" ACLs if configured in named.conf, but
- * NOT from the global defaults. This is done by leaving the third
- * argument to configure_view_acl() NULL.
+ * "allow-recursion-on" and "allow-query-cache-on" ACLs if
+ * configured in named.conf, but NOT from the global defaults.
+ * This is done by leaving the third argument to configure_view_acl()
+ * NULL.
*
* We ignore the global defaults here because these ACLs
* can inherit from each other. If any are still unset after
@@ -4732,6 +4730,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
CHECK(configure_view_acl(vconfig, config, NULL,
"allow-query-cache", NULL, actx,
named_g_mctx, &view->cacheacl));
+ /* named.conf only */
+ CHECK(configure_view_acl(vconfig, config, NULL,
+ "allow-query-cache-on", NULL, actx,
+ named_g_mctx, &view->cacheonacl));
if (strcmp(view->name, "_bind") != 0 &&
view->rdclass != dns_rdataclass_chaos)
@@ -4750,8 +4752,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
/*
* "allow-query-cache" inherits from "allow-recursion" if set,
* otherwise from "allow-query" if set.
- * "allow-recursion" inherits from "allow-query-cache" if set,
- * otherwise from "allow-query" if set.
*/
if (view->cacheacl == NULL) {
if (view->recursionacl != NULL) {
@@ -4762,6 +4762,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
&view->cacheacl);
}
}
+
+ /*
+ * "allow-recursion" inherits from "allow-query-cache" if set,
+ * otherwise from "allow-query" if set.
+ */
if (view->recursionacl == NULL) {
if (view->cacheacl != NULL) {
dns_acl_attach(view->cacheacl,
@@ -4773,10 +4778,32 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
}
/*
- * If any are still unset, we now get default "allow-recursion",
- * "allow-recursion-on" and "allow-query-cache" ACLs from
- * the global config.
+ * "allow-query-cache-on" inherits from "allow-recursion-on"
+ * if set.
*/
+ if (view->cacheonacl == NULL) {
+ if (view->recursiononacl != NULL) {
+ dns_acl_attach(view->recursiononacl,
+ &view->cacheonacl);
+ }
+ }
+
+ /*
+ * "allow-recursion-on" inherits from "allow-query-cache-on"
+ * if set.
+ */
+ if (view->recursiononacl == NULL) {
+ if (view->cacheonacl != NULL) {
+ dns_acl_attach(view->cacheonacl,
+ &view->recursiononacl);
+ }
+ }
+
+ /*
+ * If any are still unset at this point, we now get default
+ * values for from the global config.
+ */
+
if (view->recursionacl == NULL) {
/* global default only */
CHECK(configure_view_acl(NULL, NULL, named_g_config,
@@ -4798,14 +4825,30 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
actx, named_g_mctx,
&view->cacheacl));
}
- } else if (view->cacheacl == NULL) {
+ if (view->cacheonacl == NULL) {
+ /* global default only */
+ CHECK(configure_view_acl(NULL, NULL, named_g_config,
+ "allow-query-cache-on", NULL,
+ actx, named_g_mctx,
+ &view->cacheonacl));
+ }
+ } else {
/*
- * We're not recursive; if "allow-query-cache" hasn't been
- * set at the options/view level, set it to none.
+ * We're not recursive; if the query-cache ACLs haven't
+ * been set at the options/view level, set them to none.
*/
- CHECK(dns_acl_none(mctx, &view->cacheacl));
+ if (view->cacheacl == NULL) {
+ CHECK(dns_acl_none(mctx, &view->cacheacl));
+ }
+ if (view->cacheonacl == NULL) {
+ CHECK(dns_acl_none(mctx, &view->cacheonacl));
+ }
}
+ /*
+ * Finished setting recursion and query-cache ACLs, so now we
+ * can get the allow-query default if it wasn't set in named.conf
+ */
if (view->queryacl == NULL) {
/* global default only */
CHECK(configure_view_acl(NULL, NULL, named_g_config,
diff --git a/bin/tests/system/allow-query/ns2/generic.db b/bin/tests/system/allow-query/ns2/generic.db
index dc51ce244c..b5d176ae6a 100644
--- a/bin/tests/system/allow-query/ns2/generic.db
+++ b/bin/tests/system/allow-query/ns2/generic.db
@@ -22,3 +22,10 @@ ns2 A 10.53.0.2
a A 10.0.7.1
mail A 10.0.7.2
+b A 10.0.7.3
+c A 10.0.7.4
+d A 10.0.7.5
+e A 10.0.7.6
+f A 10.0.7.7
+g A 10.0.7.8
+h A 10.0.7.9
diff --git a/bin/tests/system/allow-query/ns3/named.conf.in b/bin/tests/system/allow-query/ns3/named1.conf.in
similarity index 79%
rename from bin/tests/system/allow-query/ns3/named.conf.in
rename to bin/tests/system/allow-query/ns3/named1.conf.in
index 6eace597bb..93db51303a 100644
--- a/bin/tests/system/allow-query/ns3/named.conf.in
+++ b/bin/tests/system/allow-query/ns3/named1.conf.in
@@ -18,6 +18,15 @@ options {
dnssec-validation no;
};
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+
+controls {
+ inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
zone "." {
type hint;
file "../../common/root.hint";
diff --git a/bin/tests/system/allow-query/ns3/named2.conf.in b/bin/tests/system/allow-query/ns3/named2.conf.in
new file mode 100644
index 0000000000..b1ebeda527
--- /dev/null
+++ b/bin/tests/system/allow-query/ns3/named2.conf.in
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { 10.53.0.3; };
+ listen-on-v6 { none; };
+ recursion yes;
+ allow-recursion { any; };
+ allow-recursion-on { none; };
+ allow-query-cache-on { 10.53.0.3; };
+ dnssec-validation no;
+};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+
+controls {
+ inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+ type hint;
+ file "../../common/root.hint";
+};
diff --git a/bin/tests/system/allow-query/ns3/named3.conf.in b/bin/tests/system/allow-query/ns3/named3.conf.in
new file mode 100644
index 0000000000..97124c02b1
--- /dev/null
+++ b/bin/tests/system/allow-query/ns3/named3.conf.in
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { 10.53.0.3; 10.53.1.2; };
+ listen-on-v6 { none; };
+ recursion yes;
+ allow-recursion { any; };
+ allow-query-cache { any; };
+ allow-query-cache-on { 10.53.0.3; }; # allow-recursion-on inherits
+ dnssec-validation no;
+};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+
+controls {
+ inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+ type hint;
+ file "../../common/root.hint";
+};
diff --git a/bin/tests/system/allow-query/ns3/named4.conf.in b/bin/tests/system/allow-query/ns3/named4.conf.in
new file mode 100644
index 0000000000..5f62658fda
--- /dev/null
+++ b/bin/tests/system/allow-query/ns3/named4.conf.in
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+ port @PORT@;
+ pid-file "named.pid";
+ listen-on { 10.53.0.3; 10.53.1.2; };
+ listen-on-v6 { none; };
+ recursion yes;
+ allow-recursion { any; };
+ allow-query-cache { any; };
+ allow-recursion-on { 10.53.0.3; }; # allow-query-cache-on inherits
+ dnssec-validation no;
+};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+
+controls {
+ inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+ type hint;
+ file "../../common/root.hint";
+};
diff --git a/bin/tests/system/allow-query/setup.sh b/bin/tests/system/allow-query/setup.sh
index 10b3c934a5..f0d71d4cbd 100644
--- a/bin/tests/system/allow-query/setup.sh
+++ b/bin/tests/system/allow-query/setup.sh
@@ -12,7 +12,9 @@
SYSTEMTESTTOP=..
. $SYSTEMTESTTOP/conf.sh
+$SHELL clean.sh
+
copy_setports ../common/controls.conf.in ns2/controls.conf
copy_setports ns1/named.conf.in ns1/named.conf
copy_setports ns2/named01.conf.in ns2/named.conf
-copy_setports ns3/named.conf.in ns3/named.conf
+copy_setports ns3/named1.conf.in ns3/named.conf
diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
index fb6059d5b8..a350c84332 100644
--- a/bin/tests/system/allow-query/tests.sh
+++ b/bin/tests/system/allow-query/tests.sh
@@ -56,9 +56,9 @@ SYSTEMTESTTOP=..
DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p ${PORT}"
rndc_reload() {
- echo_i "`$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 2>&1 | sed 's/^/ns2 /'`"
+ echo_i "`$RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} reload 2>&1 | sed 's/^/'$1' /'`"
for try in 0 1 2 3 4 5 6 7 8 9; do
- nextpart ns2/named.run | grep "reloading configuration succeeded" > /dev/null && break
+ nextpart $1/named.run | grep "reloading configuration succeeded" > /dev/null && break
sleep 1
done
}
@@ -81,7 +81,7 @@ status=`expr $status + $ret`
# Test 2 - explicit any, query allowed
n=`expr $n + 1`
copy_setports ns2/named02.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: explicit any - query allowed"
ret=0
@@ -94,7 +94,7 @@ status=`expr $status + $ret`
# Test 3 - none, query refused
n=`expr $n + 1`
copy_setports ns2/named03.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: none - query refused"
ret=0
@@ -107,7 +107,7 @@ status=`expr $status + $ret`
# Test 4 - address allowed, query allowed
n=`expr $n + 1`
copy_setports ns2/named04.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: address allowed - query allowed"
ret=0
@@ -120,7 +120,7 @@ status=`expr $status + $ret`
# Test 5 - address not allowed, query refused
n=`expr $n + 1`
copy_setports ns2/named05.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: address not allowed - query refused"
ret=0
@@ -133,7 +133,7 @@ status=`expr $status + $ret`
# Test 6 - address disallowed, query refused
n=`expr $n + 1`
copy_setports ns2/named06.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: address disallowed - query refused"
ret=0
@@ -146,7 +146,7 @@ status=`expr $status + $ret`
# Test 7 - acl allowed, query allowed
n=`expr $n + 1`
copy_setports ns2/named07.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: acl allowed - query allowed"
ret=0
@@ -159,7 +159,7 @@ status=`expr $status + $ret`
# Test 8 - acl not allowed, query refused
n=`expr $n + 1`
copy_setports ns2/named08.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: acl not allowed - query refused"
ret=0
@@ -173,7 +173,7 @@ status=`expr $status + $ret`
# Test 9 - acl disallowed, query refused
n=`expr $n + 1`
copy_setports ns2/named09.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: acl disallowed - query refused"
ret=0
@@ -186,7 +186,7 @@ status=`expr $status + $ret`
# Test 10 - key allowed, query allowed
n=`expr $n + 1`
copy_setports ns2/named10.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: key allowed - query allowed"
ret=0
@@ -199,7 +199,7 @@ status=`expr $status + $ret`
# Test 11 - key not allowed, query refused
n=`expr $n + 1`
copy_setports ns2/named11.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: key not allowed - query refused"
ret=0
@@ -212,7 +212,7 @@ status=`expr $status + $ret`
# Test 12 - key disallowed, query refused
n=`expr $n + 1`
copy_setports ns2/named12.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: key disallowed - query refused"
ret=0
@@ -228,7 +228,7 @@ n=20
# Test 21 - views default, query allowed
n=`expr $n + 1`
copy_setports ns2/named21.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views default - query allowed"
ret=0
@@ -241,7 +241,7 @@ status=`expr $status + $ret`
# Test 22 - views explicit any, query allowed
n=`expr $n + 1`
copy_setports ns2/named22.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views explicit any - query allowed"
ret=0
@@ -254,7 +254,7 @@ status=`expr $status + $ret`
# Test 23 - views none, query refused
n=`expr $n + 1`
copy_setports ns2/named23.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views none - query refused"
ret=0
@@ -267,7 +267,7 @@ status=`expr $status + $ret`
# Test 24 - views address allowed, query allowed
n=`expr $n + 1`
copy_setports ns2/named24.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views address allowed - query allowed"
ret=0
@@ -280,7 +280,7 @@ status=`expr $status + $ret`
# Test 25 - views address not allowed, query refused
n=`expr $n + 1`
copy_setports ns2/named25.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views address not allowed - query refused"
ret=0
@@ -293,7 +293,7 @@ status=`expr $status + $ret`
# Test 26 - views address disallowed, query refused
n=`expr $n + 1`
copy_setports ns2/named26.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views address disallowed - query refused"
ret=0
@@ -306,7 +306,7 @@ status=`expr $status + $ret`
# Test 27 - views acl allowed, query allowed
n=`expr $n + 1`
copy_setports ns2/named27.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views acl allowed - query allowed"
ret=0
@@ -319,7 +319,7 @@ status=`expr $status + $ret`
# Test 28 - views acl not allowed, query refused
n=`expr $n + 1`
copy_setports ns2/named28.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views acl not allowed - query refused"
ret=0
@@ -332,7 +332,7 @@ status=`expr $status + $ret`
# Test 29 - views acl disallowed, query refused
n=`expr $n + 1`
copy_setports ns2/named29.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views acl disallowed - query refused"
ret=0
@@ -345,7 +345,7 @@ status=`expr $status + $ret`
# Test 30 - views key allowed, query allowed
n=`expr $n + 1`
copy_setports ns2/named30.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views key allowed - query allowed"
ret=0
@@ -358,7 +358,7 @@ status=`expr $status + $ret`
# Test 31 - views key not allowed, query refused
n=`expr $n + 1`
copy_setports ns2/named31.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views key not allowed - query refused"
ret=0
@@ -371,7 +371,7 @@ status=`expr $status + $ret`
# Test 32 - views key disallowed, query refused
n=`expr $n + 1`
copy_setports ns2/named32.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views key disallowed - query refused"
ret=0
@@ -384,7 +384,7 @@ status=`expr $status + $ret`
# Test 33 - views over options, views allow, query allowed
n=`expr $n + 1`
copy_setports ns2/named33.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views over options, views allow - query allowed"
ret=0
@@ -397,7 +397,7 @@ status=`expr $status + $ret`
# Test 34 - views over options, views disallow, query refused
n=`expr $n + 1`
copy_setports ns2/named34.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views over options, views disallow - query refused"
ret=0
@@ -414,7 +414,7 @@ n=40
# Test 41 - zone default, query allowed
n=`expr $n + 1`
copy_setports ns2/named40.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: zone default - query allowed"
ret=0
@@ -537,7 +537,7 @@ status=`expr $status + $ret`
# Test 53 - zones over options, zones allow, query allowed
n=`expr $n + 1`
copy_setports ns2/named53.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views over options, views allow - query allowed"
ret=0
@@ -550,7 +550,7 @@ status=`expr $status + $ret`
# Test 54 - zones over options, zones disallow, query refused
n=`expr $n + 1`
copy_setports ns2/named54.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: views over options, views disallow - query refused"
ret=0
@@ -563,7 +563,7 @@ status=`expr $status + $ret`
# Test 55 - zones over views, zones allow, query allowed
n=`expr $n + 1`
copy_setports ns2/named55.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: zones over views, views allow - query allowed"
ret=0
@@ -576,7 +576,7 @@ status=`expr $status + $ret`
# Test 56 - zones over views, zones disallow, query refused
n=`expr $n + 1`
copy_setports ns2/named56.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: zones over views, views disallow - query refused"
ret=0
@@ -589,7 +589,7 @@ status=`expr $status + $ret`
# Test 57 - zones over views, zones disallow, query refused (allow-query-on)
n=`expr $n + 1`
copy_setports ns2/named57.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2
echo_i "test $n: zones over views, allow-query-on"
ret=0
@@ -602,9 +602,9 @@ grep '^a.aclnotallow.example' dig.out.ns2.2.$n > /dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
-# Test 58 - allow-recursion inheritance
+# Test 58 - allow-recursion default
n=`expr $n + 1`
-echo_i "test $n: default recursion configuration"
+echo_i "test $n: default allow-recursion configuration"
ret=0
$DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 a.normal.example a > dig.out.ns3.1.$n
grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1
@@ -613,5 +613,82 @@ grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
+# Test 59 - allow-query-cache default
+n=`expr $n + 1`
+echo_i "test $n: default allow-query-cache configuration"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 ns . > dig.out.ns3.1.$n
+grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1
+$DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 ns . > dig.out.ns3.2.$n
+grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+# Test 60 - block recursion-on, allow query-cache-on
+n=`expr $n + 1`
+copy_setports ns3/named2.conf.in ns3/named.conf
+rndc_reload ns3 10.53.0.3
+
+echo_i "test $n: block recursion-on, allow query-cache-on"
+ret=0
+# this should query the cache, and an answer should already be there
+$DIG -p ${PORT} @10.53.0.3 a.normal.example a > dig.out.ns3.1.$n
+grep 'recursion requested but not available' dig.out.ns3.1.$n > /dev/null || ret=1
+grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1
+# this should require recursion and therefore can't get an answer
+$DIG -p ${PORT} @10.53.0.3 b.normal.example a > dig.out.ns3.2.$n
+grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1
+grep 'ANSWER: 0' dig.out.ns3.2.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+# Test 61 - inheritance of allow-query-cache-on from allow-recursion-on
+n=`expr $n + 1`
+copy_setports ns3/named3.conf.in ns3/named.conf
+rndc_reload ns3 10.53.0.3
+
+echo_i "test $n: inheritance of allow-query-cache-on"
+ret=0
+# this should query the cache, an answer should already be there
+$DIG -p ${PORT} @10.53.0.3 a.normal.example a > dig.out.ns3.1.$n
+grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1
+# this should be refused due to allow-recursion-on/allow-query-cache-on
+$DIG -p ${PORT} @10.53.1.2 a.normal.example a > dig.out.ns3.2.$n
+grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1
+grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
+# this should require recursion and should be allowed
+$DIG -p ${PORT} @10.53.0.3 c.normal.example a > dig.out.ns3.3.$n
+grep 'ANSWER: 1' dig.out.ns3.3.$n > /dev/null || ret=1
+# this should require recursion and be refused
+$DIG -p ${PORT} @10.53.1.2 d.normal.example a > dig.out.ns3.4.$n
+grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1
+grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+# Test 62 - inheritance of allow-recursion-on from allow-query-cache-on
+n=`expr $n + 1`
+copy_setports ns3/named4.conf.in ns3/named.conf
+rndc_reload ns3 10.53.0.3
+
+echo_i "test $n: inheritance of allow-recursion-on"
+ret=0
+# this should query the cache, an answer should already be there
+$DIG -p ${PORT} @10.53.0.3 a.normal.example a > dig.out.ns3.1.$n
+grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1
+# this should be refused due to allow-recursion-on/allow-query-cache-on
+$DIG -p ${PORT} @10.53.1.2 a.normal.example a > dig.out.ns3.2.$n
+grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1
+grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
+# this should require recursion and should be allowed
+$DIG -p ${PORT} @10.53.0.3 e.normal.example a > dig.out.ns3.3.$n
+grep 'ANSWER: 1' dig.out.ns3.3.$n > /dev/null || ret=1
+# this should require recursion and be refused
+$DIG -p ${PORT} @10.53.1.2 f.normal.example a > dig.out.ns3.4.$n
+grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1
+grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index af15b64982..f34ac57b6b 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -7175,11 +7175,16 @@ options {
allow-query-cache-on
- Specifies which local addresses can give answers
- from the cache. If not specified, the default is
- to allow cache queries on any address,
- localnets and
- localhost.
+ Specifies which local addresses can send answers
+ from the cache. If allow-query-cache-on
+ is not set, then allow-recursion-on is
+ used if set. Otherwise, the default is
+ to allow cache responses to be sent from any address.
+ Note: Both allow-query-cache and
+ allow-query-cache-on must be
+ satisfied before a cache response can be sent;
+ a client that is blocked by one cannot be allowed
+ by the other.
@@ -7205,8 +7210,17 @@ options {
Specifies which local addresses can accept recursive
- queries. If not specified, the default is to allow
- recursive queries on all addresses.
+ queries. If allow-recursion-on
+ is not set, then allow-query-cache-on
+ is used if set; otherwise, the default is to allow
+ recursive queries on all addresses: Any client permitted
+ to send recursive queries can send them to any address
+ on which named is listening.
+ Note: Both allow-recursion and
+ allow-recursion-on must be
+ satisfied before recursion is allowed;
+ a client that is blocked by one cannot be allowed
+ by the other.
diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index a9f702a9ed..15d3a56609 100644
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -473,6 +473,15 @@
option. [GL #105]
+
+
+ allow-recursion-on and
+ allow-query-cache-on each now default to
+ the other if only one of them is set, in order to be consistent
+ with the way allow-recursion and
+ allow-query-cache work. [GL #319]
+
+
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 9bd98497ff..3c09fe3911 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -1029,7 +1029,9 @@ query_checkcacheaccess(ns_client_t *client, const dns_name_t *name,
if ((client->query.attributes & NS_QUERYATTR_CACHEACLOKVALID) == 0) {
/*
- * The view's cache ACL has not yet been evaluated. Do it now.
+ * The view's cache ACLs have not yet been evaluated.
+ * Do it now. Both allow-query-cache and
+ * allow-query-cache-on must be satsified.
*/
bool log = ((options & DNS_GETDB_NOLOG) == 0);
char msg[NS_CLIENT_ACLMSGSIZE("query (cache)")];
@@ -1037,6 +1039,12 @@ query_checkcacheaccess(ns_client_t *client, const dns_name_t *name,
result = ns_client_checkaclsilent(client, NULL,
client->view->cacheacl,
true);
+ if (result == ISC_R_SUCCESS) {
+ result = ns_client_checkaclsilent(client,
+ &client->destaddr,
+ client->view->cacheonacl,
+ true);
+ };
if (result == ISC_R_SUCCESS) {
/*
* We were allowed by the "allow-query-cache" ACL.
diff --git a/util/copyrights b/util/copyrights
index 489c688e9e..8b942e52a7 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -443,7 +443,10 @@
./bin/tests/system/allow-query/ns2/named56.conf.in CONF-C 2010,2016,2018
./bin/tests/system/allow-query/ns2/named57.conf.in CONF-C 2013,2016,2018
./bin/tests/system/allow-query/ns3/named.args X 2018
-./bin/tests/system/allow-query/ns3/named.conf.in CONF-C 2018
+./bin/tests/system/allow-query/ns3/named1.conf.in CONF-C 2018
+./bin/tests/system/allow-query/ns3/named2.conf.in CONF-C 2018
+./bin/tests/system/allow-query/ns3/named3.conf.in CONF-C 2018
+./bin/tests/system/allow-query/ns3/named4.conf.in CONF-C 2018
./bin/tests/system/allow-query/setup.sh SH 2010,2012,2016,2018
./bin/tests/system/allow-query/tests.sh SH 2010,2012,2013,2016,2018
./bin/tests/system/ans.pl PERL 2011,2012,2014,2016,2017,2018