From 5752645e60eaced3c84c0d9f290bd1e8d5a04ebf Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Wed, 6 Jun 2018 16:20:23 -0700 Subject: [PATCH 1/5] allow-recursion-on and allow-query-cache-on should inherit from each other --- bin/named/server.c | 73 ++++++++++++++++++++++++++++++++++++---------- 1 file changed, 58 insertions(+), 15 deletions(-) diff --git a/bin/named/server.c b/bin/named/server.c index 374a365ecb..8acdae9a26 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -4708,14 +4708,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, INSIST(result == ISC_R_SUCCESS); view->root_key_sentinel = cfg_obj_asboolean(obj); - CHECK(configure_view_acl(vconfig, config, named_g_config, - "allow-query-cache-on", NULL, actx, - named_g_mctx, &view->cacheonacl)); /* * Set the "allow-query", "allow-query-cache", "allow-recursion", - * and "allow-recursion-on" ACLs if configured in named.conf, but - * NOT from the global defaults. This is done by leaving the third - * argument to configure_view_acl() NULL. + * "allow-recursion-on" and "allow-query-cache-on" ACLs if + * configured in named.conf, but NOT from the global defaults. + * This is done by leaving the third argument to configure_view_acl() + * NULL. * * We ignore the global defaults here because these ACLs * can inherit from each other. If any are still unset after @@ -4732,6 +4730,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache", NULL, actx, named_g_mctx, &view->cacheacl)); + /* named.conf only */ + CHECK(configure_view_acl(vconfig, config, NULL, + "allow-query-cache-on", NULL, actx, + named_g_mctx, &view->cacheonacl)); if (strcmp(view->name, "_bind") != 0 && view->rdclass != dns_rdataclass_chaos) @@ -4750,8 +4752,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, /* * "allow-query-cache" inherits from "allow-recursion" if set, * otherwise from "allow-query" if set. - * "allow-recursion" inherits from "allow-query-cache" if set, - * otherwise from "allow-query" if set. */ if (view->cacheacl == NULL) { if (view->recursionacl != NULL) { @@ -4762,6 +4762,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, &view->cacheacl); } } + + /* + * "allow-recursion" inherits from "allow-query-cache" if set, + * otherwise from "allow-query" if set. + */ if (view->recursionacl == NULL) { if (view->cacheacl != NULL) { dns_acl_attach(view->cacheacl, @@ -4773,10 +4778,32 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, } /* - * If any are still unset, we now get default "allow-recursion", - * "allow-recursion-on" and "allow-query-cache" ACLs from - * the global config. + * "allow-query-cache-on" inherits from "allow-recursion-on" + * if set. */ + if (view->cacheonacl == NULL) { + if (view->recursiononacl != NULL) { + dns_acl_attach(view->recursiononacl, + &view->cacheonacl); + } + } + + /* + * "allow-recursion-on" inherits from "allow-query-cache-on" + * if set. + */ + if (view->recursiononacl == NULL) { + if (view->cacheonacl != NULL) { + dns_acl_attach(view->cacheonacl, + &view->recursiononacl); + } + } + + /* + * If any are still unset at this point, we now get default + * values for from the global config. + */ + if (view->recursionacl == NULL) { /* global default only */ CHECK(configure_view_acl(NULL, NULL, named_g_config, @@ -4798,14 +4825,30 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, actx, named_g_mctx, &view->cacheacl)); } - } else if (view->cacheacl == NULL) { + if (view->cacheonacl == NULL) { + /* global default only */ + CHECK(configure_view_acl(NULL, NULL, named_g_config, + "allow-query-cache-on", NULL, + actx, named_g_mctx, + &view->cacheonacl)); + } + } else { /* - * We're not recursive; if "allow-query-cache" hasn't been - * set at the options/view level, set it to none. + * We're not recursive; if the query-cache ACLs haven't + * been set at the options/view level, set them to none. */ - CHECK(dns_acl_none(mctx, &view->cacheacl)); + if (view->cacheacl == NULL) { + CHECK(dns_acl_none(mctx, &view->cacheacl)); + } + if (view->cacheonacl == NULL) { + CHECK(dns_acl_none(mctx, &view->cacheonacl)); + } } + /* + * Finished setting recursion and query-cache ACLs, so now we + * can get the allow-query default if it wasn't set in named.conf + */ if (view->queryacl == NULL) { /* global default only */ CHECK(configure_view_acl(NULL, NULL, named_g_config, From 2b61b8319931375af596b78d3b3d0722b3e28b52 Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Thu, 26 Jul 2018 11:33:39 -0700 Subject: [PATCH 2/5] check both allow-query-cache and allow-query-cache-on --- lib/ns/query.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/lib/ns/query.c b/lib/ns/query.c index 9bd98497ff..3c09fe3911 100644 --- a/lib/ns/query.c +++ b/lib/ns/query.c @@ -1029,7 +1029,9 @@ query_checkcacheaccess(ns_client_t *client, const dns_name_t *name, if ((client->query.attributes & NS_QUERYATTR_CACHEACLOKVALID) == 0) { /* - * The view's cache ACL has not yet been evaluated. Do it now. + * The view's cache ACLs have not yet been evaluated. + * Do it now. Both allow-query-cache and + * allow-query-cache-on must be satsified. */ bool log = ((options & DNS_GETDB_NOLOG) == 0); char msg[NS_CLIENT_ACLMSGSIZE("query (cache)")]; @@ -1037,6 +1039,12 @@ query_checkcacheaccess(ns_client_t *client, const dns_name_t *name, result = ns_client_checkaclsilent(client, NULL, client->view->cacheacl, true); + if (result == ISC_R_SUCCESS) { + result = ns_client_checkaclsilent(client, + &client->destaddr, + client->view->cacheonacl, + true); + }; if (result == ISC_R_SUCCESS) { /* * We were allowed by the "allow-query-cache" ACL. From 72b49ce86938e4d320f98cb94c8c0f09a227b52c Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Thu, 7 Jun 2018 09:07:15 -0700 Subject: [PATCH 3/5] tests for allow-recursion-on and allow-query-cache-on, default and inherited --- bin/tests/system/allow-query/ns2/generic.db | 7 + .../ns3/{named.conf.in => named1.conf.in} | 9 ++ .../system/allow-query/ns3/named2.conf.in | 36 +++++ .../system/allow-query/ns3/named3.conf.in | 36 +++++ .../system/allow-query/ns3/named4.conf.in | 36 +++++ bin/tests/system/allow-query/setup.sh | 4 +- bin/tests/system/allow-query/tests.sh | 147 +++++++++++++----- 7 files changed, 239 insertions(+), 36 deletions(-) rename bin/tests/system/allow-query/ns3/{named.conf.in => named1.conf.in} (79%) create mode 100644 bin/tests/system/allow-query/ns3/named2.conf.in create mode 100644 bin/tests/system/allow-query/ns3/named3.conf.in create mode 100644 bin/tests/system/allow-query/ns3/named4.conf.in diff --git a/bin/tests/system/allow-query/ns2/generic.db b/bin/tests/system/allow-query/ns2/generic.db index dc51ce244c..b5d176ae6a 100644 --- a/bin/tests/system/allow-query/ns2/generic.db +++ b/bin/tests/system/allow-query/ns2/generic.db @@ -22,3 +22,10 @@ ns2 A 10.53.0.2 a A 10.0.7.1 mail A 10.0.7.2 +b A 10.0.7.3 +c A 10.0.7.4 +d A 10.0.7.5 +e A 10.0.7.6 +f A 10.0.7.7 +g A 10.0.7.8 +h A 10.0.7.9 diff --git a/bin/tests/system/allow-query/ns3/named.conf.in b/bin/tests/system/allow-query/ns3/named1.conf.in similarity index 79% rename from bin/tests/system/allow-query/ns3/named.conf.in rename to bin/tests/system/allow-query/ns3/named1.conf.in index 6eace597bb..93db51303a 100644 --- a/bin/tests/system/allow-query/ns3/named.conf.in +++ b/bin/tests/system/allow-query/ns3/named1.conf.in @@ -18,6 +18,15 @@ options { dnssec-validation no; }; +key rndc_key { + secret "1234abcd8765"; + algorithm hmac-sha256; +}; + +controls { + inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + zone "." { type hint; file "../../common/root.hint"; diff --git a/bin/tests/system/allow-query/ns3/named2.conf.in b/bin/tests/system/allow-query/ns3/named2.conf.in new file mode 100644 index 0000000000..b1ebeda527 --- /dev/null +++ b/bin/tests/system/allow-query/ns3/named2.conf.in @@ -0,0 +1,36 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.3; }; + listen-on-v6 { none; }; + recursion yes; + allow-recursion { any; }; + allow-recursion-on { none; }; + allow-query-cache-on { 10.53.0.3; }; + dnssec-validation no; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm hmac-sha256; +}; + +controls { + inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + +zone "." { + type hint; + file "../../common/root.hint"; +}; diff --git a/bin/tests/system/allow-query/ns3/named3.conf.in b/bin/tests/system/allow-query/ns3/named3.conf.in new file mode 100644 index 0000000000..97124c02b1 --- /dev/null +++ b/bin/tests/system/allow-query/ns3/named3.conf.in @@ -0,0 +1,36 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.3; 10.53.1.2; }; + listen-on-v6 { none; }; + recursion yes; + allow-recursion { any; }; + allow-query-cache { any; }; + allow-query-cache-on { 10.53.0.3; }; # allow-recursion-on inherits + dnssec-validation no; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm hmac-sha256; +}; + +controls { + inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + +zone "." { + type hint; + file "../../common/root.hint"; +}; diff --git a/bin/tests/system/allow-query/ns3/named4.conf.in b/bin/tests/system/allow-query/ns3/named4.conf.in new file mode 100644 index 0000000000..5f62658fda --- /dev/null +++ b/bin/tests/system/allow-query/ns3/named4.conf.in @@ -0,0 +1,36 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.3; 10.53.1.2; }; + listen-on-v6 { none; }; + recursion yes; + allow-recursion { any; }; + allow-query-cache { any; }; + allow-recursion-on { 10.53.0.3; }; # allow-query-cache-on inherits + dnssec-validation no; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm hmac-sha256; +}; + +controls { + inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + +zone "." { + type hint; + file "../../common/root.hint"; +}; diff --git a/bin/tests/system/allow-query/setup.sh b/bin/tests/system/allow-query/setup.sh index 10b3c934a5..f0d71d4cbd 100644 --- a/bin/tests/system/allow-query/setup.sh +++ b/bin/tests/system/allow-query/setup.sh @@ -12,7 +12,9 @@ SYSTEMTESTTOP=.. . $SYSTEMTESTTOP/conf.sh +$SHELL clean.sh + copy_setports ../common/controls.conf.in ns2/controls.conf copy_setports ns1/named.conf.in ns1/named.conf copy_setports ns2/named01.conf.in ns2/named.conf -copy_setports ns3/named.conf.in ns3/named.conf +copy_setports ns3/named1.conf.in ns3/named.conf diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh index fb6059d5b8..a350c84332 100644 --- a/bin/tests/system/allow-query/tests.sh +++ b/bin/tests/system/allow-query/tests.sh @@ -56,9 +56,9 @@ SYSTEMTESTTOP=.. DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p ${PORT}" rndc_reload() { - echo_i "`$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 2>&1 | sed 's/^/ns2 /'`" + echo_i "`$RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} reload 2>&1 | sed 's/^/'$1' /'`" for try in 0 1 2 3 4 5 6 7 8 9; do - nextpart ns2/named.run | grep "reloading configuration succeeded" > /dev/null && break + nextpart $1/named.run | grep "reloading configuration succeeded" > /dev/null && break sleep 1 done } @@ -81,7 +81,7 @@ status=`expr $status + $ret` # Test 2 - explicit any, query allowed n=`expr $n + 1` copy_setports ns2/named02.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: explicit any - query allowed" ret=0 @@ -94,7 +94,7 @@ status=`expr $status + $ret` # Test 3 - none, query refused n=`expr $n + 1` copy_setports ns2/named03.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: none - query refused" ret=0 @@ -107,7 +107,7 @@ status=`expr $status + $ret` # Test 4 - address allowed, query allowed n=`expr $n + 1` copy_setports ns2/named04.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: address allowed - query allowed" ret=0 @@ -120,7 +120,7 @@ status=`expr $status + $ret` # Test 5 - address not allowed, query refused n=`expr $n + 1` copy_setports ns2/named05.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: address not allowed - query refused" ret=0 @@ -133,7 +133,7 @@ status=`expr $status + $ret` # Test 6 - address disallowed, query refused n=`expr $n + 1` copy_setports ns2/named06.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: address disallowed - query refused" ret=0 @@ -146,7 +146,7 @@ status=`expr $status + $ret` # Test 7 - acl allowed, query allowed n=`expr $n + 1` copy_setports ns2/named07.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: acl allowed - query allowed" ret=0 @@ -159,7 +159,7 @@ status=`expr $status + $ret` # Test 8 - acl not allowed, query refused n=`expr $n + 1` copy_setports ns2/named08.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: acl not allowed - query refused" ret=0 @@ -173,7 +173,7 @@ status=`expr $status + $ret` # Test 9 - acl disallowed, query refused n=`expr $n + 1` copy_setports ns2/named09.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: acl disallowed - query refused" ret=0 @@ -186,7 +186,7 @@ status=`expr $status + $ret` # Test 10 - key allowed, query allowed n=`expr $n + 1` copy_setports ns2/named10.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: key allowed - query allowed" ret=0 @@ -199,7 +199,7 @@ status=`expr $status + $ret` # Test 11 - key not allowed, query refused n=`expr $n + 1` copy_setports ns2/named11.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: key not allowed - query refused" ret=0 @@ -212,7 +212,7 @@ status=`expr $status + $ret` # Test 12 - key disallowed, query refused n=`expr $n + 1` copy_setports ns2/named12.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: key disallowed - query refused" ret=0 @@ -228,7 +228,7 @@ n=20 # Test 21 - views default, query allowed n=`expr $n + 1` copy_setports ns2/named21.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views default - query allowed" ret=0 @@ -241,7 +241,7 @@ status=`expr $status + $ret` # Test 22 - views explicit any, query allowed n=`expr $n + 1` copy_setports ns2/named22.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views explicit any - query allowed" ret=0 @@ -254,7 +254,7 @@ status=`expr $status + $ret` # Test 23 - views none, query refused n=`expr $n + 1` copy_setports ns2/named23.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views none - query refused" ret=0 @@ -267,7 +267,7 @@ status=`expr $status + $ret` # Test 24 - views address allowed, query allowed n=`expr $n + 1` copy_setports ns2/named24.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views address allowed - query allowed" ret=0 @@ -280,7 +280,7 @@ status=`expr $status + $ret` # Test 25 - views address not allowed, query refused n=`expr $n + 1` copy_setports ns2/named25.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views address not allowed - query refused" ret=0 @@ -293,7 +293,7 @@ status=`expr $status + $ret` # Test 26 - views address disallowed, query refused n=`expr $n + 1` copy_setports ns2/named26.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views address disallowed - query refused" ret=0 @@ -306,7 +306,7 @@ status=`expr $status + $ret` # Test 27 - views acl allowed, query allowed n=`expr $n + 1` copy_setports ns2/named27.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views acl allowed - query allowed" ret=0 @@ -319,7 +319,7 @@ status=`expr $status + $ret` # Test 28 - views acl not allowed, query refused n=`expr $n + 1` copy_setports ns2/named28.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views acl not allowed - query refused" ret=0 @@ -332,7 +332,7 @@ status=`expr $status + $ret` # Test 29 - views acl disallowed, query refused n=`expr $n + 1` copy_setports ns2/named29.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views acl disallowed - query refused" ret=0 @@ -345,7 +345,7 @@ status=`expr $status + $ret` # Test 30 - views key allowed, query allowed n=`expr $n + 1` copy_setports ns2/named30.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views key allowed - query allowed" ret=0 @@ -358,7 +358,7 @@ status=`expr $status + $ret` # Test 31 - views key not allowed, query refused n=`expr $n + 1` copy_setports ns2/named31.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views key not allowed - query refused" ret=0 @@ -371,7 +371,7 @@ status=`expr $status + $ret` # Test 32 - views key disallowed, query refused n=`expr $n + 1` copy_setports ns2/named32.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views key disallowed - query refused" ret=0 @@ -384,7 +384,7 @@ status=`expr $status + $ret` # Test 33 - views over options, views allow, query allowed n=`expr $n + 1` copy_setports ns2/named33.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views over options, views allow - query allowed" ret=0 @@ -397,7 +397,7 @@ status=`expr $status + $ret` # Test 34 - views over options, views disallow, query refused n=`expr $n + 1` copy_setports ns2/named34.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views over options, views disallow - query refused" ret=0 @@ -414,7 +414,7 @@ n=40 # Test 41 - zone default, query allowed n=`expr $n + 1` copy_setports ns2/named40.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: zone default - query allowed" ret=0 @@ -537,7 +537,7 @@ status=`expr $status + $ret` # Test 53 - zones over options, zones allow, query allowed n=`expr $n + 1` copy_setports ns2/named53.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views over options, views allow - query allowed" ret=0 @@ -550,7 +550,7 @@ status=`expr $status + $ret` # Test 54 - zones over options, zones disallow, query refused n=`expr $n + 1` copy_setports ns2/named54.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: views over options, views disallow - query refused" ret=0 @@ -563,7 +563,7 @@ status=`expr $status + $ret` # Test 55 - zones over views, zones allow, query allowed n=`expr $n + 1` copy_setports ns2/named55.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: zones over views, views allow - query allowed" ret=0 @@ -576,7 +576,7 @@ status=`expr $status + $ret` # Test 56 - zones over views, zones disallow, query refused n=`expr $n + 1` copy_setports ns2/named56.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: zones over views, views disallow - query refused" ret=0 @@ -589,7 +589,7 @@ status=`expr $status + $ret` # Test 57 - zones over views, zones disallow, query refused (allow-query-on) n=`expr $n + 1` copy_setports ns2/named57.conf.in ns2/named.conf -rndc_reload +rndc_reload ns2 10.53.0.2 echo_i "test $n: zones over views, allow-query-on" ret=0 @@ -602,9 +602,9 @@ grep '^a.aclnotallow.example' dig.out.ns2.2.$n > /dev/null && ret=1 if [ $ret != 0 ]; then echo_i "failed"; fi status=`expr $status + $ret` -# Test 58 - allow-recursion inheritance +# Test 58 - allow-recursion default n=`expr $n + 1` -echo_i "test $n: default recursion configuration" +echo_i "test $n: default allow-recursion configuration" ret=0 $DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 a.normal.example a > dig.out.ns3.1.$n grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1 @@ -613,5 +613,82 @@ grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1 if [ $ret != 0 ]; then echo_i "failed"; fi status=`expr $status + $ret` +# Test 59 - allow-query-cache default +n=`expr $n + 1` +echo_i "test $n: default allow-query-cache configuration" +ret=0 +$DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 ns . > dig.out.ns3.1.$n +grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1 +$DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 ns . > dig.out.ns3.2.$n +grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=`expr $status + $ret` + +# Test 60 - block recursion-on, allow query-cache-on +n=`expr $n + 1` +copy_setports ns3/named2.conf.in ns3/named.conf +rndc_reload ns3 10.53.0.3 + +echo_i "test $n: block recursion-on, allow query-cache-on" +ret=0 +# this should query the cache, and an answer should already be there +$DIG -p ${PORT} @10.53.0.3 a.normal.example a > dig.out.ns3.1.$n +grep 'recursion requested but not available' dig.out.ns3.1.$n > /dev/null || ret=1 +grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1 +# this should require recursion and therefore can't get an answer +$DIG -p ${PORT} @10.53.0.3 b.normal.example a > dig.out.ns3.2.$n +grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1 +grep 'ANSWER: 0' dig.out.ns3.2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=`expr $status + $ret` + +# Test 61 - inheritance of allow-query-cache-on from allow-recursion-on +n=`expr $n + 1` +copy_setports ns3/named3.conf.in ns3/named.conf +rndc_reload ns3 10.53.0.3 + +echo_i "test $n: inheritance of allow-query-cache-on" +ret=0 +# this should query the cache, an answer should already be there +$DIG -p ${PORT} @10.53.0.3 a.normal.example a > dig.out.ns3.1.$n +grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1 +# this should be refused due to allow-recursion-on/allow-query-cache-on +$DIG -p ${PORT} @10.53.1.2 a.normal.example a > dig.out.ns3.2.$n +grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1 +grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1 +# this should require recursion and should be allowed +$DIG -p ${PORT} @10.53.0.3 c.normal.example a > dig.out.ns3.3.$n +grep 'ANSWER: 1' dig.out.ns3.3.$n > /dev/null || ret=1 +# this should require recursion and be refused +$DIG -p ${PORT} @10.53.1.2 d.normal.example a > dig.out.ns3.4.$n +grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1 +grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=`expr $status + $ret` + +# Test 62 - inheritance of allow-recursion-on from allow-query-cache-on +n=`expr $n + 1` +copy_setports ns3/named4.conf.in ns3/named.conf +rndc_reload ns3 10.53.0.3 + +echo_i "test $n: inheritance of allow-recursion-on" +ret=0 +# this should query the cache, an answer should already be there +$DIG -p ${PORT} @10.53.0.3 a.normal.example a > dig.out.ns3.1.$n +grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1 +# this should be refused due to allow-recursion-on/allow-query-cache-on +$DIG -p ${PORT} @10.53.1.2 a.normal.example a > dig.out.ns3.2.$n +grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1 +grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1 +# this should require recursion and should be allowed +$DIG -p ${PORT} @10.53.0.3 e.normal.example a > dig.out.ns3.3.$n +grep 'ANSWER: 1' dig.out.ns3.3.$n > /dev/null || ret=1 +# this should require recursion and be refused +$DIG -p ${PORT} @10.53.1.2 f.normal.example a > dig.out.ns3.4.$n +grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1 +grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=`expr $status + $ret` + echo_i "exit status: $status" [ $status -eq 0 ] || exit 1 From cea9ff573c4ab8e286ec3a00df3595ddda7bb97d Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Thu, 26 Jul 2018 14:55:18 -0700 Subject: [PATCH 4/5] clarify documentation --- doc/arm/Bv9ARM-book.xml | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index af15b64982..f34ac57b6b 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -7175,11 +7175,16 @@ options { allow-query-cache-on - Specifies which local addresses can give answers - from the cache. If not specified, the default is - to allow cache queries on any address, - localnets and - localhost. + Specifies which local addresses can send answers + from the cache. If allow-query-cache-on + is not set, then allow-recursion-on is + used if set. Otherwise, the default is + to allow cache responses to be sent from any address. + Note: Both allow-query-cache and + allow-query-cache-on must be + satisfied before a cache response can be sent; + a client that is blocked by one cannot be allowed + by the other. @@ -7205,8 +7210,17 @@ options { Specifies which local addresses can accept recursive - queries. If not specified, the default is to allow - recursive queries on all addresses. + queries. If allow-recursion-on + is not set, then allow-query-cache-on + is used if set; otherwise, the default is to allow + recursive queries on all addresses: Any client permitted + to send recursive queries can send them to any address + on which named is listening. + Note: Both allow-recursion and + allow-recursion-on must be + satisfied before recursion is allowed; + a client that is blocked by one cannot be allowed + by the other. From be8713a1e8d490d8d41eb6245a663e29a39167ef Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Thu, 26 Jul 2018 14:38:19 -0700 Subject: [PATCH 5/5] CHANGES, release note, copyrights --- CHANGES | 7 +++++++ doc/arm/notes.xml | 9 +++++++++ util/copyrights | 5 ++++- 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/CHANGES b/CHANGES index e022f605ab..d58c1882a1 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,10 @@ +5037. [func] "allow-recursion-on" and "allow-query-cache-on" + each now default to the other if only one of them + is set, in order to be more consistent with the way + "allow-recursion" and "allow-query-cache" work. + Also we now ensure that both query-cache ACLs are + checked when determining cache access. [GL #319] + 5036. [cleanup] Fixed a spacing/formatting error in some RPZ-related error messages in the log. [GL !805] diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml index a9f702a9ed..15d3a56609 100644 --- a/doc/arm/notes.xml +++ b/doc/arm/notes.xml @@ -473,6 +473,15 @@ option. [GL #105] + + + allow-recursion-on and + allow-query-cache-on each now default to + the other if only one of them is set, in order to be consistent + with the way allow-recursion and + allow-query-cache work. [GL #319] + + diff --git a/util/copyrights b/util/copyrights index 489c688e9e..8b942e52a7 100644 --- a/util/copyrights +++ b/util/copyrights @@ -443,7 +443,10 @@ ./bin/tests/system/allow-query/ns2/named56.conf.in CONF-C 2010,2016,2018 ./bin/tests/system/allow-query/ns2/named57.conf.in CONF-C 2013,2016,2018 ./bin/tests/system/allow-query/ns3/named.args X 2018 -./bin/tests/system/allow-query/ns3/named.conf.in CONF-C 2018 +./bin/tests/system/allow-query/ns3/named1.conf.in CONF-C 2018 +./bin/tests/system/allow-query/ns3/named2.conf.in CONF-C 2018 +./bin/tests/system/allow-query/ns3/named3.conf.in CONF-C 2018 +./bin/tests/system/allow-query/ns3/named4.conf.in CONF-C 2018 ./bin/tests/system/allow-query/setup.sh SH 2010,2012,2016,2018 ./bin/tests/system/allow-query/tests.sh SH 2010,2012,2013,2016,2018 ./bin/tests/system/ans.pl PERL 2011,2012,2014,2016,2017,2018