Pi-Hole/dnsmasq
1
0
Fork 0
mirror of https://github.com/pi-hole/dnsmasq.git synced 2025-12-19 10:18:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow zone transfer in authoritative mode whenever auth-peer is specified.

Browse Source
This commit is contained in:
Simon Kelley
2018-06-02 18:37:07 +01:00
parent cc5cc8f1e0
commit 090856c7e6
3 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGELOG
View File

@@ -29,6 +29,10 @@ version 2.80
have different parameters and avoids advertising the same have different parameters and avoids advertising the same
prefix twice. Thanks to Luis Marsano for spotting this case. prefix twice. Thanks to Luis Marsano for spotting this case.
Allow zone transfer in authoritative mode if auth-peer is specified,
even if auth-sec-servers is not. Thanks to Raphaël Halimi for
the suggestion.
version 2.79 version 2.79
Fix parsing of CNAME arguments, which are confused by extra spaces. Fix parsing of CNAME arguments, which are confused by extra spaces.

6
man/dnsmasq.8
View File

@@ -817,7 +817,11 @@ authoritative zones as dnsmasq.
Specify the addresses of secondary servers which are allowed to Specify the addresses of secondary servers which are allowed to
initiate zone transfer (AXFR) requests for zones for which dnsmasq is initiate zone transfer (AXFR) requests for zones for which dnsmasq is
authoritative. If this option is not given, then AXFR requests will be authoritative. If this option is not given, then AXFR requests will be
accepted from any secondary. accepted from any secondary. Specifying
.B auth-peer
without
.B auth-sec-servers
enables zone transfer but does not advertise the secondary in NS records returned by dnsmasq.
.TP .TP
.B --conntrack .B --conntrack
Read the Linux connection track mark associated with incoming DNS Read the Linux connection track mark associated with incoming DNS

5
src/auth.c
View File

@@ -436,8 +436,9 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n
if (sockaddr_isequal(peer_addr, &peers->addr)) if (sockaddr_isequal(peer_addr, &peers->addr))
break; break;
/* Refuse all AXFR unless --auth-sec-servers is set */ /* Refuse all AXFR unless --auth-sec-servers or auth-peers is set */
if ((!peers && daemon->auth_peers) || !daemon->secondary_forward_server) if ((!daemon->secondary_forward_server && !daemon->auth_peers) ||
(daemon->auth_peers && !peers))
{ {
if (peer_addr->sa.sa_family == AF_INET) if (peer_addr->sa.sa_family == AF_INET)
inet_ntop(AF_INET, &peer_addr->in.sin_addr, daemon->addrbuff, ADDRSTRLEN); inet_ntop(AF_INET, &peer_addr->in.sin_addr, daemon->addrbuff, ADDRSTRLEN);