search

icann-dns / puppet-nsd

puppet module to manage nsd
Apache License 2.0
1 stars 2 forks source link

Feature: remove notify for remotes if server is localhost #17

Open mave007 opened 4 years ago

mave007 commented 4 years ago

If we define into the YAML the following:

dns::daemon: nsd
dns::remotes:
  localhost:
    address4: 127.0.0.1
    address6: '0::1'
    tsig_name: 'NOKEY'

The output for nsd.conf will be:

pattern:
  name: localhost-master
  allow-notify: 127.0.0.1 NOKEY
  request-xfr: AXFR 127.0.0.1 NOKEY
  allow-notify: 0::1 NOKEY
  request-xfr: AXFR 0::1 NOKEY

It would be useful to have somehow allow-notify parameter on NSD to be empty if it is localhost.

b4ldr commented 4 years ago

It can be useful to use ldns-notify from localhost to forge a NOTIFY and trigger an AXFR. is it causing a problem?