add only-notify option

fixes #454
closes #778
partial fix #949

diff --git a/pdns/common_startup.cc b/pdns/common_startup.cc
index 0fd923b765ee2af8730283c6b74d85a48f8d8d71..9d8d1f09a9922f202e1227dd55b22983ad9b1f93 100644 (file)
--- a/pdns/common_startup.cc
+++ b/pdns/common_startup.cc
@@ -92,6 +92,7 @@ void declareArguments()
   ::arg().set("launch","Which backends to launch and order to query them in")="";
   ::arg().setSwitch("disable-axfr","Disable zonetransfers but do allow TCP queries")="no";
   ::arg().set("allow-axfr-ips","Allow zonetransfers only to these subnets")="0.0.0.0/0,::/0";
+  ::arg().set("only-notify", "Only send AXFR NOTIFY to these IP addresses or netmasks")="0.0.0.0/0,::/0";
   ::arg().set("slave-cycle-interval","Reschedule failed SOA serial checks once every .. seconds")="60";
 
   ::arg().set("tcp-control-address","If set, PowerDNS can be controlled over TCP on this address")="";

diff --git a/pdns/communicator.cc b/pdns/communicator.cc
index c23c3a194d07a5a87c9f15f6015eb8bda4941e59..09323056e8bffbe7011a4d19db5df0c3490fa47e 100644 (file)
--- a/pdns/communicator.cc
+++ b/pdns/communicator.cc
@@ -62,7 +62,8 @@ void CommunicatorClass::go()
   for(int n=0; n < ::arg().asNum("retrieval-threads"); ++n)
     pthread_create(&tid, 0, &retrieveLaunchhelper, this); // Starts CommunicatorClass::retrievalLoopThread()
 
-  d_preventSelfNotification =::arg().mustDo("prevent-self-notification");
+  d_preventSelfNotification = ::arg().mustDo("prevent-self-notification");
+  d_onlyNotify.toMasks(::arg()["only-notify"]);
 }
 
 void CommunicatorClass::mainloop(void)

diff --git a/pdns/communicator.hh b/pdns/communicator.hh
index 1203ef267cb3751827b37367585cb7d25b323a0e..8e1910f308e7dd1212e3e726c873b3c7190f69ef 100644 (file)
--- a/pdns/communicator.hh
+++ b/pdns/communicator.hh
@@ -202,6 +202,8 @@ private:
   set<DomainInfo> d_tocheck;
   vector<DNSPacket> d_potentialsupermasters;
   bool d_preventSelfNotification;
+  NetmaskGroup d_onlyNotify;
+
 };
 
 #endif

diff --git a/pdns/docs/pdns.xml b/pdns/docs/pdns.xml
index a1e2a137516ff6684afe3dcd2843ea9596164e4d..224cf61c844ba3e3fc067bd27b7d6d9c94e3a87f 100644 (file)
--- a/pdns/docs/pdns.xml
+++ b/pdns/docs/pdns.xml
@@ -16055,7 +16055,15 @@ Tell PowerDNS to log all incoming DNS queries. This will lead to a lot of loggin
              </para>
            </listitem>
          </varlistentry>
-
+         <varlistentry>
+           <term>only-notify=...</term>
+           <listitem>
+             <para>
+               Only send AXFR NOTIFY to these IP addresses or netmasks. The default is to notify the world. The IP addresses or netmasks in <command>
+               also-notify</command> or ALSO-NOTIFY metadata always receive AXFR NOTIFY. Example (and default): <command>only-notify=0.0.0.0/0, ::/0</command>.
+             </para>
+           </listitem>
+         </varlistentry>
          <varlistentry><term>out-of-zone-additional-processing | --out-of-zone-additional-processing=yes | --out-of-zone-additional-processing=no</term>
            <listitem><para>
              Do out of zone additional processing. This means that if a malicious user adds a '.com' zone to your server, it is not used for 

diff --git a/pdns/mastercommunicator.cc b/pdns/mastercommunicator.cc
index a898cc00c0f8d62aba0fbde6c3fdffe773ac005d..2b2e8b52abb91fc7afb4950f0202a41c14b85bec 100644 (file)
--- a/pdns/mastercommunicator.cc
+++ b/pdns/mastercommunicator.cc
@@ -59,8 +59,12 @@ void CommunicatorClass::queueNotifyDomain(const string &domain, DNSBackend *B)
     else
       for(vector<string>::const_iterator k=nsips.begin();k!=nsips.end();++k) {
         const ComboAddress caIp(*k, 53);
-        if(!d_preventSelfNotification || !AddressIsUs(caIp))
-          ips.insert(caIp.toStringWithPort());
+        if(!d_preventSelfNotification || !AddressIsUs(caIp)) {
+          if(!d_onlyNotify.match(&caIp))
+            L<<Logger::Info<<"Skiped notification of domain '"<<domain<<"' to "<<*j<<" because it does not match only-notify."<<endl;
+          else
+            ips.insert(caIp.toStringWithPort());
+        }
       }
   }
 

diff --git a/pdns/pdns.conf-dist b/pdns/pdns.conf-dist
index 113817a362ad4d596fb97bc02b6308ddf0162692..75ddc76ae4926712585c33244cb3a2204aac5a2f 100644 (file)
--- a/pdns/pdns.conf-dist
+++ b/pdns/pdns.conf-dist
@@ -254,6 +254,11 @@
 #
 # no-shuffle=off
 
+#################################
+# only-notify  Only send AXFR NOTIFY to these IP addresses or netmasks
+#
+# only-notify=0.0.0.0/0,::/0
+
 #################################
 # out-of-zone-additional-processing    Do out of zone additional processing
 #