I would prefer to use --filter- and expand it to accept also
/domain/ modifier, just like --address or --server. Reusing --address
seems confusing, especially with negated ! syntax. I think --address
serves already too many different purposes. I would not add a new one if
we have already better option present. Similar way with --filter-A. I
think it would be easier to document and more intuitive at the same time.
Does this code handle differences between NXDOMAIN and empty NOERROR
answers? It seems to me it does not. It would make every name under
/domain/ existing but empty. Do we want that this way? It may confuse
some caching software.
Cheers,
Petr
On 1/20/23 06:26, Peter Tirsek wrote:
This patch extends the `--address` option to accept two new special
address, `!A` and `!`, which will cause the server to block A or
queries for the specified domain(s), respectively. This can be
useful in situations where IPv6 connectivity is broken, but only to
certain domains.
Signed-off-by: Peter Tirsek
---
v3: Changed NXDOMAIN to NODATA response, and the !4/!6 config syntax to
!A/!. Rebased to the newest master branch, and hopefully I
remembered to send it non-flowed this time.
v2: Fixed a few more u16->int fields.
man/dnsmasq.8 | 9 +
src/dbus.c | 2 +-
src/dnsmasq.h | 15 ++-
src/domain-match.c | 8 +---
src/option.c | 27 +++
5 files changed, 48 insertions(+), 13 deletions(-)
diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
index 2495ed1..8ec2d44 100644
--- a/man/dnsmasq.8
+++ b/man/dnsmasq.8
@@ -570,6 +570,15 @@ its subdomains. This is partly syntactic sugar for
\fB--address=/example.com/0.0
and \fB--address=/example.com/::\fP but is also more efficient than including
both
as separate configuration lines. Note that NULL addresses normally work in
the same way as localhost, so beware that clients looking up these names are
likely to end up talking to themselves.
+As a special case, an address specified as \fB!A\fP causes the server to
+return NODATA for all A (IPv4) queries, but (IPv6) queries are
+processed as normal. Conversely, specifying \fB!\fP as the address
+causes (IPv6) queries to return NODATA, but A (IPv4) queries are
+processed as normal. This can be useful in situations where IPv6
+connectivity is broken, but only to certain domains. If you want to block
+either A or records for ALL domains, use the \fB--filter-A\fP or
+\fB--filter-\fP options instead.
+
Note that the behaviour for queries which don't match the specified address
literal changed in version 2.86.
Previous versions, configured with (eg) --address=/example.com/1.2.3.4 and
then queried for a RR type other than
A would return a NoData answer. From 2.86, the query is sent upstream. To
restore the pre-2.86 behaviour,
diff --git a/src/dbus.c b/src/dbus.c
index fd5d1ca..ec550ed 100644
--- a/src/dbus.c
+++ b/src/dbus.c
@@ -289,7 +289,7 @@ static DBusMessage* dbus_read_servers_ex(DBusMessage
*message, int strings)
{
const char *str = NULL;
union mysockaddr addr, source_addr;
- u16 flags = 0;
+ int flags = 0;
char interface[IF_NAMESIZE];
char *str_addr, *str_domain = NULL;
struct server_details sdetails = { 0 };
diff --git a/src/dnsmasq.h b/src/dnsmasq.h
index aaa6d62..a2e7c6a 100644
--- a/src/dnsmasq.h
+++ b/src/dnsmasq.h
@@ -554,6 +554,7 @@ union mysockaddr {
#define SERV_LOOP8192 /* server causes forwarding loop */
#define SERV_DO_DNSSEC 16384 /* Validate DNSSEC when using this server
*/
#define SERV_GOT_TCP32768 /* Got some data from the TCP connection */
+#define SERV_NODATA 65536 /* Force a NoData answer */
struct serverfd {
int fd;
@@ -576,7 +577,8 @@ struct randfd_list {
struct server {
- u16 flags, domain_len;
+ int flags;
+ u16 domain_len;
char *domain;
struct server *next;
int serial, arrayposn;
@@ -598,21 +600,24 @@ struct server {
/* First four fields must match struct server in next three definitions.. */
struct serv_addr4 {
- u16 flags, domain_len;
+ int flags;
+ u16 domain_len;
char *domain;
struct server *next;
struct in_addr addr;
};
struct serv_addr6 {
- u16 flags, domain_len;
+ int flags;
+ int domain_len;
char *domain;
struct server *next;
struct in6_addr addr;
};
struct serv_local {
- u16 flags, domain_len;
+ int flags;
+ u16 domain_len;
char *domain;
struct server *next;
};
@@ -1298,7 +1303,7 @@ struct server_details {
struct addrinfo *hostinfo, *orig_hostinfo;
char *interface, *source, *scope_id, *interface_opt;
int serv_port, source_port, addr_type, scope_index, valid;
- u16 *flags;
+ int *flags;
};
/* cache.c */
diff --git a/src/domain-match.c b/src/domain-match.c
index fe8e25a..4703dff 100644
--- a/src/domain-match.c
+++ b/src/domain-match.c
@@ -21,7 +21
