IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Query and transfer ACLs for DNS zones

Browse Source 
Provide a way to specify BIND allow-query and allow-transfer ACLs
for DNS zones.

IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To
avoid zone information leaks to unintended places, allow-transfer
ACL for every zone is by default set to none and has to be
explicitly enabled by an Administrator. This is done both for new
DNS zones and old DNS zones during RPM update via new DNS upgrade
plugin.

https://fedorahosted.org/freeipa/ticket/1211
This commit is contained in:
Martin Kosek
2012-02-24 09:30:39 +01:00
parent 2cf5893761
commit 8605790225
7 changed files with 264 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
ipapython/ipautil.py
View File

@@ -77,7 +77,9 @@ class CheckedIPAddress(netaddr.IPAddress):
# and don't allow IP addresses such as '1.1.1' in the same time
netaddr_ip_flags = netaddr.INET_PTON
def __init__(self, addr, match_local=False, parse_netmask=True):
def __init__(self, addr, match_local=False, parse_netmask=True,
allow_network=False, allow_loopback=False,
allow_broadcast=False, allow_multicast=False):
if isinstance(addr, CheckedIPAddress):
super(CheckedIPAddress, self).__init__(addr, flags=self.netaddr_ip_flags)
self.prefixlen = addr.prefixlen
@@ -98,20 +100,23 @@ class CheckedIPAddress(netaddr.IPAddress):
try:
addr = netaddr.IPAddress(addr, flags=self.netaddr_ip_flags)
except ValueError:
net = netaddr.IPNetwork(addr)
net = netaddr.IPNetwork(addr, flags=self.netaddr_ip_flags)
if not parse_netmask:
raise ValueError("netmask and prefix length not allowed here")
addr = net.ip
if addr.version not in (4, 6):
raise ValueError("unsupported IP version")
if addr.is_loopback():
if not allow_loopback and addr.is_loopback():
raise ValueError("cannot use loopback IP address")
if addr.is_reserved() or addr in netaddr.ip.IPV4_6TO4:
if (not addr.is_loopback() and addr.is_reserved()) \
or addr in netaddr.ip.IPV4_6TO4:
raise ValueError("cannot use IANA reserved IP address")
if addr.is_link_local():
raise ValueError("cannot use link-local IP address")
if addr.is_multicast():
if not allow_multicast and addr.is_multicast():
raise ValueError("cannot use multicast IP address")
if match_local:
@@ -143,9 +148,9 @@ class CheckedIPAddress(netaddr.IPAddress):
elif addr.version == 6:
net = netaddr.IPNetwork(str(addr) + '/64')
if addr == net.network:
if not allow_network and addr == net.network:
raise ValueError("cannot use IP network address")
if addr.version == 4 and addr == net.broadcast:
if not allow_broadcast and addr.version == 4 and addr == net.broadcast:
raise ValueError("cannot use broadcast IP address")
super(CheckedIPAddress, self).__init__(addr, flags=self.netaddr_ip_flags)