Add allow-insecure-notify

diff --git a/pdns/common_startup.cc b/pdns/common_startup.cc
index 253c90f3b8c305a05a2ad4b5f197cb8f41242a4d..1532d5050648d8ea12fa93544a8370c8f6a2cbec 100644 (file)
--- a/pdns/common_startup.cc
+++ b/pdns/common_startup.cc
@@ -56,6 +56,7 @@ void declareArguments()
   ::arg().setSwitch("dnsupdate","Enable/Disable DNS update (RFC2136) support. Default is no.")="no";
   ::arg().setSwitch("write-pid","Write a PID file")="yes";
   ::arg().set("allow-dnsupdate-from","A global setting to allow DNS updates from these IP ranges.")="127.0.0.0/8,::1";
+  ::arg().set("allow-insecure-notify","Allow unsigned notifications for TSIG secured domains")="yes"; //FIXME: change to 'no' later
   ::arg().setSwitch("forward-dnsupdate","A global setting to allow DNS update packages that are for a Slave domain, to be forwarded to the master.")="yes";
   ::arg().setSwitch("log-dns-details","If PDNS should log DNS non-erroneous details")="no";
   ::arg().setSwitch("log-dns-queries","If PDNS should log all incoming DNS queries")="no";

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index ba4e774f8cbf5b208eb9ebada95239a1260d5d30..f35c0d7c148dc7ba232c36cf0a320008a4e315bf 100644 (file)
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -868,7 +868,13 @@ int PacketHandler::processNotify(DNSPacket *p)
 
   meta.clear();
   if (B.getDomainMetadata(p->qdomain,"AXFR-MASTER-TSIG",meta) && meta.size() > 0) {
-    if (!p->d_havetsig || meta[0] != p->getTSIGKeyname().toStringNoDot()) {
+    if (!p->d_havetsig) {
+     if (::arg().mustDo("allow-insecure-notify")) {
+       L<<Logger::Warning<<"Received unsigned NOTIFY for "<<p->qdomain<<" from "<<p->getRemote()<<": permitting because allow-insecure-notify is turned on."<<endl;
+     } else {
+       L<<Logger::Warning<<"Received unsigned NOTIFY for "<<p->qdomain<<" from "<<p->getRemote()<<": refused because allow-insecure-notify is turned off."<<endl;
+     }
+    } else if (meta[0] != p->getTSIGKeyname().toStringNoDot()) {
       L<<Logger::Error<<"Received NOTIFY for "<<p->qdomain<<" from "<<p->getRemote()<<": expected TSIG key '"<<meta[0]<<", got '"<<p->getTSIGKeyname()<<"'"<<endl;
       return RCode::Refused;
     }