Attachment 155820 Details for Bug 241745 – Proposed patch

[patch] Proposed patch

bind-9.2.4-query-log.patch (text/plain), 2.93 KB, created by Adam Tkac on 2007-05-31 14:29:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Adam Tkac

Created: 2007-05-31 14:29:01 UTC

Size: 2.93 KB

patch

obsolete

>--- bind-9.2.4/bin/named/query.c.log	2007-05-31 16:14:02.000000000 +0200
>+++ bind-9.2.4/bin/named/query.c	2007-05-31 16:17:06.000000000 +0200
>@@ -729,7 +729,8 @@ query_getzonedb(ns_client_t *client, dns
> }
> 
> static inline isc_result_t
>-query_getcachedb(ns_client_t *client, dns_db_t **dbp, unsigned int options)
>+query_getcachedb(ns_client_t *client, dns_name_t *name,
>+		 dns_db_t **dbp, unsigned int options)
> {
> 	isc_result_t result;
> 	isc_boolean_t check_acl;
>@@ -768,12 +769,11 @@ query_getcachedb(ns_client_t *client, dn
> 
> 	if (check_acl) {
> 		isc_boolean_t log = ISC_TF((options & DNS_GETDB_NOLOG) == 0);
>-		
>-		result = ns_client_checkacl(client, "query (cache)",
>-					    client->view->queryacl,
>-					    ISC_TRUE,
>-					    log ? ISC_LOG_INFO :
>-						  ISC_LOG_DEBUG(3));
>+	        char msg[DNS_NAME_FORMATSIZE + DNS_RDATACLASS_FORMATSIZE
>+	                + sizeof "query(cache) '/'"];
>+
>+		result = ns_client_checkaclsilent(client, client->view->queryacl, ISC_TRUE);
>+
> 		if (result == ISC_R_SUCCESS) {
> 			/*
> 			 * We were allowed by the default
>@@ -782,7 +782,25 @@ query_getcachedb(ns_client_t *client, dn
> 			 */
> 			client->query.attributes |=
> 				NS_QUERYATTR_QUERYOK;
>-		}
>+
>+	                if (log && isc_log_wouldlog(ns_g_lctx, ISC_LOG_DEBUG(3))) {
>+	                        ns_client_aclmsg("query(cache)", name,
>+	                                         client->view->rdclass,
>+	                                         msg, sizeof(msg));
>+	                        ns_client_log(client,
>+	                                      DNS_LOGCATEGORY_SECURITY,
>+	                                      NS_LOGMODULE_QUERY,
>+	                                      ISC_LOG_DEBUG(3),
>+	                                      "%s approved", msg);
>+	                } 
>+		} else {
>+	                                ns_client_aclmsg("query(cache)", name,
>+	                                                 client->view->rdclass,
>+	                                                 msg, sizeof(msg));
>+	                                ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
>+	                                              NS_LOGMODULE_QUERY, ISC_LOG_INFO,
>+	                                              "%s denied", msg);
>+	        }
> 		/*
> 		 * We've now evaluated the view's query ACL, and
> 		 * the NS_QUERYATTR_QUERYOK attribute is now valid.
>@@ -821,7 +839,7 @@ query_getdb(ns_client_t *client, dns_nam
> 	if (result == ISC_R_SUCCESS) {
> 		*is_zonep = ISC_TRUE;
> 	} else if (result == ISC_R_NOTFOUND) {
>-		result = query_getcachedb(client, dbp, options);
>+		result = query_getcachedb(client, name, dbp, options);
> 		*is_zonep = ISC_FALSE;
> 	}
> 	return (result);
>@@ -1108,7 +1126,7 @@ query_addadditional(void *arg, dns_name_
> 	 */
> 
>  try_cache:
>-	result = query_getcachedb(client, &db, DNS_GETDB_NOLOG);
>+	result = query_getcachedb(client, name, &db, DNS_GETDB_NOLOG);
> 	if (result != ISC_R_SUCCESS)
> 		/*
> 		 * Most likely the client isn't allowed to query the cache.

Actions: View | Diff

Attachments on bug 241745: 155820