XPF, Rec: Rename Option Code to RR Code

diff --git a/pdns/pdns_recursor.cc b/pdns/pdns_recursor.cc
index a6f9f99db1b78425e6e827ea6e387fd5f66f7e92..699b389857faa4aa2a159084a2dc39159a9e8d1c 100644 (file)
--- a/pdns/pdns_recursor.cc
+++ b/pdns/pdns_recursor.cc
@@ -148,7 +148,7 @@ static unsigned int g_maxMThreads;
 static unsigned int g_numWorkerThreads;
 static int g_tcpTimeout;
 static uint16_t g_udpTruncationThreshold;
-static uint16_t g_xpfOptionCode{0};
+static uint16_t g_xpfRRCode{0};
 static std::atomic<bool> statsWanted;
 static std::atomic<bool> g_quiet;
 static bool g_logCommonErrors;
@@ -1385,7 +1385,7 @@ static void getQNameAndSubnet(const std::string& question, DNSName* dnsname, uin
                               bool& foundECS, EDNSSubnetOpts* ednssubnet, std::map<uint16_t, EDNSOptionView>* options,
                               bool& foundXPF, ComboAddress* xpfSource, ComboAddress* xpfDest)
 {
-  const bool lookForXPF = xpfSource != nullptr && g_xpfOptionCode != 0;
+  const bool lookForXPF = xpfSource != nullptr && g_xpfRRCode != 0;
   const bool lookForECS = ednssubnet != nullptr;
   const struct dnsheader* dh = reinterpret_cast<const struct dnsheader*>(question.c_str());
   size_t questionLen = question.length();
@@ -1440,7 +1440,7 @@ static void getQNameAndSubnet(const std::string& question, DNSName* dnsname, uin
         }
       }
     }
-    else if (lookForXPF && ntohs(drh->d_type) == g_xpfOptionCode && ntohs(drh->d_class) == QClass::IN && drh->d_ttl == 0) {
+    else if (lookForXPF && ntohs(drh->d_type) == g_xpfRRCode && ntohs(drh->d_class) == QClass::IN && drh->d_ttl == 0) {
       if ((questionLen - pos) < ntohs(drh->d_clen)) {
         return;
       }
@@ -3065,7 +3065,7 @@ static int serviceMain(int argc, char*argv[])
   g_useIncomingECS = ::arg().mustDo("use-incoming-edns-subnet");
 
   g_XPFAcl.toMasks(::arg()["xpf-allow-from"]);
-  g_xpfOptionCode = ::arg().asNum("xpf-option-code");
+  g_xpfRRCode = ::arg().asNum("xpf-rr-code");
 
   g_networkTimeoutMsec = ::arg().asNum("network-timeout");
 
@@ -3500,7 +3500,7 @@ int main(int argc, char **argv)
     ::arg().setSwitch("log-rpz-changes", "Log additions and removals to RPZ zones at Info level")="no";
 
     ::arg().set("xpf-allow-from","XPF information is only processed from these subnets")="";
-    ::arg().set("xpf-option-code","XPF option code to use")="0";
+    ::arg().set("xpf-rr-code","XPF option code to use")="0";
 
     ::arg().setCmd("help","Provide a helpful message");
     ::arg().setCmd("version","Print version string");

diff --git a/pdns/recursordist/docs/settings.rst b/pdns/recursordist/docs/settings.rst
index 67eb4d311e590526493393970feae5266b16247f..ab3047b06bcbd6bdf38f3d193b28b39b677d3337 100644 (file)
--- a/pdns/recursordist/docs/settings.rst
+++ b/pdns/recursordist/docs/settings.rst
@@ -1163,26 +1163,35 @@ TCP port where the webserver should listen on.
 
 If a PID file should be written to `socket-dir`_
 
+.. _setting-xpf-allow-from:
+
 ``xpf-allow-from``
--------------
-.. versionadded:: 4.1.0
+------------------
+.. versionadded:: 4.2.0
 
 -  IP ranges, separated by commas
 -  Default: empty
 
-This is an experimental implementation of `draft-bellis-dnsop-xpf`.
+.. note::
+  This is an experimental implementation of `draft-bellis-dnsop-xpf <https://datatracker.ietf.org/doc/draft-bellis-dnsop-xpf/>`_.
+
 The server will trust XPF records found in queries sent from those netmasks (both IPv4 and IPv6),
 and will adjust queries' source and destination accordingly. This is especially useful when the recursor
-is placed behind a proxy like dnsdist.
-Note that the `allow-from`_ setting is still applied to the original source address, and thus access restriction
+is placed behind a proxy like `dnsdist <https://dnsdist.org>`_.
+Note that the ref:`setting-allow-from` setting is still applied to the original source address, and thus access restriction
 should be done on the proxy.
 
-``xpf-option-code``
--------------
-.. versionadded:: 4.1.0
+.. _setting-xpf-rr-code:
+
+``xpf-rr-code``
+-------------------
+.. versionadded:: 4.2.0
 
 -  Integer
 -  Default: 0
 
-This is an experimental implementation of `draft-bellis-dnsop-xpf`.
-The option code to use for XPF records, as long as an official code has not been assigned to it. 0 means disabled.
+.. note::
+  This is an experimental implementation of `draft-bellis-dnsop-xpf <https://datatracker.ietf.org/doc/draft-bellis-dnsop-xpf/>`_.
+
+This option sets the resource record code to use for XPF records, as long as an official code has not been assigned to it.
+0 means that XPF is disabled.

diff --git a/pdns/recursordist/docs/upgrade.rst b/pdns/recursordist/docs/upgrade.rst
index aab2fed0bb0f559a810de7107ac195274576764b..ad68e1e57b4476d93b0646213d7e6045351aaeae 100644 (file)
--- a/pdns/recursordist/docs/upgrade.rst
+++ b/pdns/recursordist/docs/upgrade.rst
@@ -4,6 +4,14 @@ Upgrade Guide
 Before upgrading, it is advised to read the :doc:`changelog/index`.
 When upgrading several versions, please read **all** notes applying to the upgrade.
 
+4.1.x to 4.2.0 or master
+------------------------
+
+Two new settings have been added:
+
+- :ref:`setting-xpf-allow-from` can contain a list of IP addresses ranges from which `XPF (X-Proxied-For) <https://datatracker.ietf.org/doc/draft-bellis-dnsop-xpf/>`_ records will be trusted.
+- :ref:`setting-xpf-rr-code` should list the number of the XPF record to use (in lieu of an assigned code).
+
 4.0.x to 4.1.0
 --------------