Commit 5a7212c7 authored by Vladislav Grishenko's avatar Vladislav Grishenko Committed by Simon Kelley

Make --rev-server work in the presence of --bogus-priv.

parent 3a8b0f6f
...@@ -99,7 +99,11 @@ version 2.77 ...@@ -99,7 +99,11 @@ version 2.77
when the script accidentally emits error messages. when the script accidentally emits error messages.
Thanks to Petr Mensik for the patch. Thanks to Petr Mensik for the patch.
Make --rev-server for an RFC1918 subnet work even in the
presence of the --bogus-priv flag. Thanks to
Vladislav Grishenko for the patch.
version 2.76 version 2.76
Include 0.0.0.0/8 in DNS rebind checks. This range Include 0.0.0.0/8 in DNS rebind checks. This range
translates to hosts on the local network, or, at translates to hosts on the local network, or, at
......
...@@ -1459,13 +1459,39 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen, ...@@ -1459,13 +1459,39 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
#endif #endif
(is_arpa == F_IPV4 && private_net(addr.addr.addr4, 1)))) (is_arpa == F_IPV4 && private_net(addr.addr.addr4, 1))))
{ {
/* if not in cache, enabled and private IPV4 address, return NXDOMAIN */ struct server *serv;
ans = 1; unsigned int namelen = strlen(name);
sec_data = 0; char *nameend = name + namelen;
nxdomain = 1;
if (!dryrun) /* see if have rev-server set */
log_query(F_CONFIG | F_REVERSE | is_arpa | F_NEG | F_NXDOMAIN, for (serv = daemon->servers; serv; serv = serv->next)
name, &addr, NULL); {
unsigned int domainlen;
char *matchstart;
if ((serv->flags & (SERV_HAS_DOMAIN | SERV_NO_ADDR)) != SERV_HAS_DOMAIN)
continue;
domainlen = strlen(serv->domain);
if (domainlen == 0 || domainlen > namelen)
continue;
matchstart = nameend - domainlen;
if (hostname_isequal(matchstart, serv->domain) &&
(namelen == domainlen || *(matchstart-1) == '.' ))
break;
}
/* if no configured server, not in cache, enabled and private IPV4 address, return NXDOMAIN */
if (!serv)
{
ans = 1;
sec_data = 0;
nxdomain = 1;
if (!dryrun)
log_query(F_CONFIG | F_REVERSE | is_arpa | F_NEG | F_NXDOMAIN,
name, &addr, NULL);
}
} }
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment