{"action":"closed","issue":{"url":"https://api.github.com/repos/PowerDNS/pdns/issues/5855","repository_url":"https://api.github.com/repos/PowerDNS/pdns","labels_url":"https://api.github.com/repos/PowerDNS/pdns/issues/5855/labels{/name}","comments_url":"https://api.github.com/repos/PowerDNS/pdns/issues/5855/comments","events_url":"https://api.github.com/repos/PowerDNS/pdns/issues/5855/events","html_url":"https://github.com/PowerDNS/pdns/issues/5855","id":268664961,"number":5855,"title":"auth: dnsupdate: allow-dnsupdate-from ALLOW-DNSUPDATE-FROM differ in behavior","user":{"login":"jpmens","id":60706,"avatar_url":"https://avatars2.githubusercontent.com/u/60706?v=4","gravatar_id":"","url":"https://api.github.com/users/jpmens","html_url":"https://github.com/jpmens","followers_url":"https://api.github.com/users/jpmens/followers","following_url":"https://api.github.com/users/jpmens/following{/other_user}","gists_url":"https://api.github.com/users/jpmens/gists{/gist_id}","starred_url":"https://api.github.com/users/jpmens/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jpmens/subscriptions","organizations_url":"https://api.github.com/users/jpmens/orgs","repos_url":"https://api.github.com/users/jpmens/repos","events_url":"https://api.github.com/users/jpmens/events{/privacy}","received_events_url":"https://api.github.com/users/jpmens/received_events","type":"User","site_admin":false},"labels":[{"id":37445974,"url":"https://api.github.com/repos/PowerDNS/pdns/labels/auth","name":"auth","color":"eb6420","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-10-26T08:07:24Z","updated_at":"2017-10-31T13:09:50Z","closed_at":"2017-10-31T13:09:50Z","author_association":"CONTRIBUTOR","body":" - Program: Authoritative\r\n - Issue type: Bug report\r\n\r\n### Short description\r\n\r\n`allow-dnsupdate-from` (from configuration) and `ALLOW-DNSUPDATE-FROM` (from metadata) differ in behavior.\r\n\r\n\r\n\r\n\r\n### Environment\r\n - Operating system: CentOS\r\n - Software version: auth master `0.0.1909g0e9a0d5`\r\n - Software source: PowerDNS repository\r\n\r\n### Steps to reproduce\r\n\r\n\r\n#### pdns.conf\r\n\r\n```\r\ndnsupdate=yes\r\n# allow-dnsupdate-from=10.1.1.1/32\r\n```\r\n\r\n#### domains\r\n\r\n```\r\nsqlite> select * from domains;\r\n2|example.com|||NATIVE||\r\n```\r\n\r\n#### records\r\n\r\n```\r\nsqlite> select * from records;\r\n1|2|example.com|NS|jp.vm.local|3600|0||0||1\r\n6|2|www.example.com|A|1.1.1.2|10|0||0|www|1\r\n8|2|www.example.com|A|1.1.1.1|60|0||0|www|1\r\n9|2|example.com|SOA|jp.vm.local. jp.mens.de. 2017102624 10800 3600 604800 3600|3600|0||0||1\r\n```\r\n\r\n#### domainmetadata\r\n\r\n```\r\nsqlite> select * from domainmetadata;\r\n3|2|ALLOW-DNSUPDATE-FROM|10.0.12.1/32\r\n4|2|TSIG-ALLOW-DNSUPDATE|jpm-key\r\n```\r\n\r\n#### tsigkeys\r\n\r\n```\r\nsqlite> select * from tsigkeys;\r\n1|jpm-key|hmac-sha256|oi0NEmZkV4qvRMFVrNyNHjQnwwnw/Tp1WFiVqq/4VVktRlF1amrwevx+hnuhvX9vSZ9WQlU9KOoJ0Rq4B4zVMg==\r\n```\r\n\r\n#### update.sh\r\n\r\n```\r\nnsupdate -y 'hmac-sha256:jpm-key:oi0NEmZkV4qvRMFVrNyNHjQnwwnw/Tp1WFiVqq/4VVktRlF1amrwevx+hnuhvX9vSZ9WQlU9KOoJ0Rq4B4zVMg==' <<EOF\r\nserver 127.0.0.1\r\nzone example.com.\r\nupdate add www.example.com 60 A 1.1.1.1\r\nsend\r\nEOF\r\n```\r\n\r\n1. Update from 127.0.0.1 works although it should **not** because it's being restricted by `ALLOW-DNSUPDATE-FROM|10.0.12.1/32`.\r\n2. Enabling (i.e. removing comment symbol on) `allow-dnsupdate-from=10.1.1.1/32` above, makes update from 127.0.0.1 fail which is correct as updates are then allowed from 10.1.1.1 only (together with the TSIG key)\r\n\r\nThis means, to me, that `allow-dnsupdate-from` in config and `ALLOW-DNSUPDATE-FROM` differ in behavior.\r\n\r\n\r\n### Expected behaviour\r\n\r\nI expect both types of configuration to behave similarly.\r\n\r\n### Other information\r\n\r\n### Usecase\r\n\r\nThe use case is limiting updates to IP ranges together with TSIG keys.\r\n\r\n"}}
{"actor":{"display_login":"pieterlexis"}}