auth: add 'supermaster' option to enable/disable supermaster support

diff --git a/docs/modes-of-operation.rst b/docs/modes-of-operation.rst
index 365eab4b66a26be3640d60266216fdabd7e13f0e..658b2bfd6563684fb23104ab10059b55e3adb918 100644 (file)
--- a/docs/modes-of-operation.rst
+++ b/docs/modes-of-operation.rst
@@ -196,6 +196,7 @@ itself as a slave for that zone.
 Before a supermaster notification succeeds, the following conditions
 must be met:
 
+ - :ref:`setting-supermaster` support must be enabled
  - The supermaster must carry a SOA record for the notified domain
  - The supermaster IP must be present in the 'supermaster' table
  - The set of NS records for the domain, as retrieved by the slave from the supermaster, must include the name that goes with the IP address in the supermaster table

diff --git a/docs/settings.rst b/docs/settings.rst
index 11ddba12f55e9b542c40010e46df2b7e276420d3..6b26758d366a5d441cf4e377ca8e7b2764815ddb 100644 (file)
--- a/docs/settings.rst
+++ b/docs/settings.rst
@@ -1325,6 +1325,18 @@ This path will also contain the pidfile for this instance of PowerDNS
 called ``pdns.pid`` by default. See :ref:`setting-config-name`
 and :doc:`Virtual Hosting <guides/virtual-instances>` how this can differ.
 
+.. _setting-supermaster:
+
+``supermaster``
+------------
+
+-  Boolean
+-  Default: no
+
+.. versionadded:: 4.2.0
+
+Turn on supermaster support. See :ref:`supemaster-operation`.
+
 .. _setting-tcp-control-address:
 
 ``tcp-control-address``

diff --git a/pdns/common_startup.cc b/pdns/common_startup.cc
index f7a902ad4ef75d58edea5be1ef281748a8883383..63309857ced31d4d43e589414e505411f2cf6321 100644 (file)
--- a/pdns/common_startup.cc
+++ b/pdns/common_startup.cc
@@ -124,6 +124,7 @@ void declareArguments()
   
   ::arg().setSwitch("slave","Act as a slave")="no";
   ::arg().setSwitch("master","Act as a master")="no";
+  ::arg().setSwitch("supermaster", "Act as a supermaster")="no";
   ::arg().setSwitch("disable-axfr-rectify","Disable the rectify step during an outgoing AXFR. Only required for regression testing.")="no";
   ::arg().setSwitch("guardian","Run within a guardian process")="no";
   ::arg().setSwitch("prevent-self-notification","Don't send notifications to what we think is ourself")="yes";

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index b63f32c77db6d0ac10ef472453ca007054bffa27..3f7acd272615cb02f5006a526b962f60c5142e4c 100644 (file)
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -836,8 +836,12 @@ int PacketHandler::processNotify(DNSPacket *p)
   //
   DomainInfo di;
   if(!B.getDomainInfo(p->qdomain, di, false) || !di.backend) {
-    g_log<<Logger::Warning<<"Received NOTIFY for "<<p->qdomain<<" from "<<p->getRemote()<<" for which we are not authoritative, trying supermaster"<<endl;
-    return trySuperMaster(p, p->getTSIGKeyname()); // FIXME a global 'off' switch for supermaster support will save some resources in setups without supermasters
+    if(::arg().mustDo("supermaster")) {
+      g_log<<Logger::Warning<<"Received NOTIFY for "<<p->qdomain<<" from "<<p->getRemote()<<" for which we are not authoritative, trying supermaster"<<endl;
+      return trySuperMaster(p, p->getTSIGKeyname());
+    }
+    g_log<<Logger::Notice<<"Received NOTIFY for "<<p->qdomain<<" from "<<p->getRemote()<<" for which we are not authoritative (Refused)"<<endl;
+    return RCode::Refused;
   }
 
   if(::arg().contains("trusted-notification-proxy", p->getRemote().toString())) {
@@ -855,7 +859,7 @@ int PacketHandler::processNotify(DNSPacket *p)
     g_log<<Logger::Warning<<"Received NOTIFY for "<<p->qdomain<<" from "<<p->getRemote()<<" which is not a master (Refused)"<<endl;
     return RCode::Refused;
   }
-    
+
   if(!s_forwardNotify.empty()) {
     set<string> forwardNotify(s_forwardNotify);
     for(set<string>::const_iterator j=forwardNotify.begin();j!=forwardNotify.end();++j) {

diff --git a/regression-tests.nobackend/supermaster-signed/command b/regression-tests.nobackend/supermaster-signed/command
index 5c88e5a2df54f773384a8a2200fafe5ed7c93fc3..6eb46127f0852d39414a3db71afaba7fd024f570 100755 (executable)
--- a/regression-tests.nobackend/supermaster-signed/command
+++ b/regression-tests.nobackend/supermaster-signed/command
@@ -94,7 +94,7 @@ start_slave()
 
         $RUNWRAPPER $PDNS2 --daemon=no --local-port=$slaveport --config-dir=. --module-dir=../regression-tests/modules \
                 --config-name=gsqlite3-slave --socket-dir=./ --no-shuffle --local-address=127.0.0.2 --local-ipv6='' \
-                --slave --retrieval-threads=4 --slave=yes --query-local-address=127.0.0.2 \
+                --slave --retrieval-threads=4 --slave=yes --supermaster=yes --query-local-address=127.0.0.2 \
                 --slave-cycle-interval=300 --allow-unsigned-notify=no --allow-unsigned-supermaster=no &
 }
 

diff --git a/regression-tests.nobackend/supermaster-unsigned/command b/regression-tests.nobackend/supermaster-unsigned/command
index 1e9f0c7faa87a44b27734a5911d1e0a7e8d3ef9e..86dde039276fabc4de0d2a65cef9e922ee7c79d0 100755 (executable)
--- a/regression-tests.nobackend/supermaster-unsigned/command
+++ b/regression-tests.nobackend/supermaster-unsigned/command
@@ -85,7 +85,7 @@ start_slave()
 
         $RUNWRAPPER $PDNS2 --daemon=no --local-port=$slaveport --config-dir=. --module-dir=../regression-tests/modules \
                 --config-name=gsqlite3-slave --socket-dir=./ --no-shuffle --local-address=127.0.0.2 --local-ipv6= \
-                --slave --retrieval-threads=4 --slave=yes --query-local-address=127.0.0.2 \
+                --slave --retrieval-threads=4 --slave=yes --supermaster=yes --query-local-address=127.0.0.2 \
                 --slave-cycle-interval=300 --dname-processing &
 }