This patch extends the `--address` option to accept two new special
address, `!A` and `!AAAA`, which will cause the server to block A or
AAAA queries for the specified domain(s), respectively. This can be
useful in situations where IPv6 connectivity is broken, but only to
certain domains.
Signed-off-by: Peter Tirsek <pe...@tirsek.com>
---
v3: Changed NXDOMAIN to NODATA response, and the !4/!6 config syntax to
!A/!AAAA. Rebased to the newest master branch, and hopefully I
remembered to send it non-flowed this time.
v2: Fixed a few more u16->int fields.
man/dnsmasq.8 | 9 +++++++++
src/dbus.c | 2 +-
src/dnsmasq.h | 15 ++++++++++-----
src/domain-match.c | 8 +++++---
src/option.c | 27 +++++++++++++++++++++++----
5 files changed, 48 insertions(+), 13 deletions(-)
diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
index 2495ed1..8ec2d44 100644
--- a/man/dnsmasq.8
+++ b/man/dnsmasq.8
@@ -570,6 +570,15 @@ its subdomains. This is partly syntactic sugar for
\fB--address=/example.com/0.0
and \fB--address=/example.com/::\fP but is also more efficient than including
both
as separate configuration lines. Note that NULL addresses normally work in the
same way as localhost, so beware that clients looking up these names are likely
to end up talking to themselves.
+As a special case, an address specified as \fB!A\fP causes the server to
+return NODATA for all A (IPv4) queries, but AAAA (IPv6) queries are
+processed as normal. Conversely, specifying \fB!AAAA\fP as the address
+causes AAAA (IPv6) queries to return NODATA, but A (IPv4) queries are
+processed as normal. This can be useful in situations where IPv6
+connectivity is broken, but only to certain domains. If you want to block
+either A or AAAA records for ALL domains, use the \fB--filter-A\fP or
+\fB--filter-AAAA\fP options instead.
+
Note that the behaviour for queries which don't match the specified address
literal changed in version 2.86.
Previous versions, configured with (eg) --address=/example.com/1.2.3.4 and
then queried for a RR type other than
A would return a NoData answer. From 2.86, the query is sent upstream. To
restore the pre-2.86 behaviour,
diff --git a/src/dbus.c b/src/dbus.c
index fd5d1ca..ec550ed 100644
--- a/src/dbus.c
+++ b/src/dbus.c
@@ -289,7 +289,7 @@ static DBusMessage* dbus_read_servers_ex(DBusMessage
*message, int strings)
{
const char *str = NULL;
union mysockaddr addr, source_addr;
- u16 flags = 0;
+ int flags = 0;
char interface[IF_NAMESIZE];
char *str_addr, *str_domain = NULL;
struct server_details sdetails = { 0 };
diff --git a/src/dnsmasq.h b/src/dnsmasq.h
index aaa6d62..a2e7c6a 100644
--- a/src/dnsmasq.h
+++ b/src/dnsmasq.h
@@ -554,6 +554,7 @@ union mysockaddr {
#define SERV_LOOP 8192 /* server causes forwarding loop */
#define SERV_DO_DNSSEC 16384 /* Validate DNSSEC when using this server */
#define SERV_GOT_TCP 32768 /* Got some data from the TCP connection */
+#define SERV_NODATA 65536 /* Force a NoData answer */
struct serverfd {
int fd;
@@ -576,7 +577,8 @@ struct randfd_list {
struct server {
- u16 flags, domain_len;
+ int flags;
+ u16 domain_len;
char *domain;
struct server *next;
int serial, arrayposn;
@@ -598,21 +600,24 @@ struct server {
/* First four fields must match struct server in next three definitions.. */
struct serv_addr4 {
- u16 flags, domain_len;
+ int flags;
+ u16 domain_len;
char *domain;
struct server *next;
struct in_addr addr;
};
struct serv_addr6 {
- u16 flags, domain_len;
+ int flags;
+ int domain_len;
char *domain;
struct server *next;
struct in6_addr addr;
};
struct serv_local {
- u16 flags, domain_len;
+ int flags;
+ u16 domain_len;
char *domain;
struct server *next;
};
@@ -1298,7 +1303,7 @@ struct server_details {
struct addrinfo *hostinfo, *orig_hostinfo;
char *interface, *source, *scope_id, *interface_opt;
int serv_port, source_port, addr_type, scope_index, valid;
- u16 *flags;
+ int *flags;
};
/* cache.c */
diff --git a/src/domain-match.c b/src/domain-match.c
index fe8e25a..4703dff 100644
--- a/src/domain-match.c
+++ b/src/domain-match.c
@@ -21,7 +21,7 @@ static int order_qsort(const void *a, const void *b);
static int order_servers(struct server *s, struct server *s2);
/* If the server is USE_RESOLV or LITERAL_ADDRES, it lives on the
local_domains chain. */
-#define SERV_IS_LOCAL (SERV_USE_RESOLV | SERV_LITERAL_ADDRESS)
+#define SERV_IS_LOCAL (SERV_USE_RESOLV | SERV_LITERAL_ADDRESS | SERV_NODATA)
void build_server_array(void)
{
@@ -370,9 +370,11 @@ int is_local_answer(time_t now, int first, char *name)
int flags = 0;
int rc = 0;
- if ((flags = daemon->serverarray[first]->flags) & SERV_LITERAL_ADDRESS)
+ if ((flags = daemon->serverarray[first]->flags) & (SERV_LITERAL_ADDRESS |
SERV_NODATA))
{
- if (flags & SERV_4ADDR)
+ if (flags & SERV_NODATA)
+ rc = F_NOERR;
+ else if (flags & SERV_4ADDR)
rc = F_IPV4;
else if (flags & SERV_6ADDR)
rc = F_IPV6;
diff --git a/src/option.c b/src/option.c
index 8e61a6b..6fe53a4 100644
--- a/src/option.c
+++ b/src/option.c
@@ -1095,7 +1095,7 @@ static char *domain_rev4(int from_file, char *server,
struct in_addr *addr4, int
int i, j;
char *string;
int msize;
- u16 flags = 0;
+ int flags = 0;
char domain[29]; /* strlen("xxx.yyy.zzz.ttt.in-addr.arpa")+1 */
union mysockaddr serv_addr, source_addr;
char interface[IF_NAMESIZE+1];
@@ -1178,7 +1178,7 @@ static char *domain_rev6(int from_file, char *server,
struct in6_addr *addr6, in
int i, j;
char *string;
int msize;
- u16 flags = 0;
+ int flags = 0;
char domain[73]; /* strlen("32*<n.>ip6.arpa")+1 */
union mysockaddr serv_addr, source_addr;
char interface[IF_NAMESIZE+1];
@@ -2966,7 +2966,7 @@ static int one_opt(int option, char *arg, char *errstr,
char *gen_err, int comma
case 'A': /* --address */
{
char *lastdomain = NULL, *domain = "", *cur_domain;
- u16 flags = 0;
+ int flags = 0;
char *err;
union all_addr addr;
union mysockaddr serv_addr, source_addr;
@@ -3002,6 +3002,12 @@ static int one_opt(int option, char *arg, char *errstr,
char *gen_err, int comma
/* # as literal address means return zero address for 4 and 6 */
if (strcmp(arg, "#") == 0)
flags = SERV_ALL_ZEROS | SERV_LITERAL_ADDRESS;
+ /* `!A` means return NODATA for A queries */
+ else if (strcmp(arg, "!A") == 0)
+ flags = SERV_4ADDR | SERV_NODATA;
+ /* `!AAAA` means return NODATA for AAAA queries */
+ else if (strcmp(arg, "!AAAA") == 0)
+ flags = SERV_6ADDR | SERV_NODATA;
else if (inet_pton(AF_INET, arg, &addr.addr4) > 0)
flags = SERV_4ADDR | SERV_LITERAL_ADDRESS;
else if (inet_pton(AF_INET6, arg, &addr.addr6) > 0)
@@ -3019,7 +3025,20 @@ static int one_opt(int option, char *arg, char *errstr,
char *gen_err, int comma
flags |= SERV_FROM_FILE;
cur_domain = domain;
- while ((flags & SERV_LITERAL_ADDRESS) || parse_server_next(&sdetails))
+ if (flags & SERV_NODATA)
+ {
+ while (1)
+ {
+ if (!add_update_server(flags, sdetails.addr,
sdetails.source_addr, sdetails.interface, cur_domain, &addr))
+ ret_err(gen_err);
+
+ if (!lastdomain || cur_domain == lastdomain)
+ break;
+
+ cur_domain += strlen(cur_domain) + 1;
+ }
+ }
+ else while ((flags & SERV_LITERAL_ADDRESS) ||
parse_server_next(&sdetails))
{
cur_domain = domain;
--
2.39.0
_______________________________________________
Dnsmasq-discuss mailing list
Dnsmasq-discuss@lists.thekelleys.org.uk
https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss
