Make --rev-server work in the presence of --bogus-priv.

This commit is contained in:
Vladislav Grishenko
2017-04-24 22:19:57 +01:00
committed by Simon Kelley
parent 3a8b0f6fcc
commit 5a7212c70e
2 changed files with 37 additions and 7 deletions

View File

@@ -99,6 +99,10 @@ version 2.77
when the script accidentally emits error messages. when the script accidentally emits error messages.
Thanks to Petr Mensik for the patch. Thanks to Petr Mensik for the patch.
Make --rev-server for an RFC1918 subnet work even in the
presence of the --bogus-priv flag. Thanks to
Vladislav Grishenko for the patch.
version 2.76 version 2.76
Include 0.0.0.0/8 in DNS rebind checks. This range Include 0.0.0.0/8 in DNS rebind checks. This range

View File

@@ -1459,7 +1459,32 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
#endif #endif
(is_arpa == F_IPV4 && private_net(addr.addr.addr4, 1)))) (is_arpa == F_IPV4 && private_net(addr.addr.addr4, 1))))
{ {
/* if not in cache, enabled and private IPV4 address, return NXDOMAIN */ struct server *serv;
unsigned int namelen = strlen(name);
char *nameend = name + namelen;
/* see if have rev-server set */
for (serv = daemon->servers; serv; serv = serv->next)
{
unsigned int domainlen;
char *matchstart;
if ((serv->flags & (SERV_HAS_DOMAIN | SERV_NO_ADDR)) != SERV_HAS_DOMAIN)
continue;
domainlen = strlen(serv->domain);
if (domainlen == 0 || domainlen > namelen)
continue;
matchstart = nameend - domainlen;
if (hostname_isequal(matchstart, serv->domain) &&
(namelen == domainlen || *(matchstart-1) == '.' ))
break;
}
/* if no configured server, not in cache, enabled and private IPV4 address, return NXDOMAIN */
if (!serv)
{
ans = 1; ans = 1;
sec_data = 0; sec_data = 0;
nxdomain = 1; nxdomain = 1;
@@ -1468,6 +1493,7 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
name, &addr, NULL); name, &addr, NULL);
} }
} }
}
for (flag = F_IPV4; flag; flag = (flag == F_IPV4) ? F_IPV6 : 0) for (flag = F_IPV4; flag; flag = (flag == F_IPV4) ? F_IPV6 : 0)
{ {