diff --git a/images/maas-rack-controller-focal/3.0_transfer_trusted_only.patch b/images/maas-rack-controller-focal/3.0_transfer_trusted_only.patch new file mode 100755 index 0000000..f772e79 --- /dev/null +++ b/images/maas-rack-controller-focal/3.0_transfer_trusted_only.patch @@ -0,0 +1,9 @@ +diff --git a/src/provisioningserver/templates/dns/named.conf.options.inside.maas.template b/src/provisioningserver/templates/dns/named.conf.options.inside.maas.template +index d76fcfa9a..0cca0fe8d 100644 +--- a/src/provisioningserver/templates/dns/named.conf.options.inside.maas.template ++++ b/src/provisioningserver/templates/dns/named.conf.options.inside.maas.template +@@ -18,3 +18,4 @@ allow-recursion { trusted; }; + {{if not upstream_allow_query_cache}} + allow-query-cache { trusted; }; + {{endif}} ++allow-transfer { trusted; }; diff --git a/images/maas-rack-controller-focal/Dockerfile b/images/maas-rack-controller-focal/Dockerfile index b4b826a..cb4a6cf 100644 --- a/images/maas-rack-controller-focal/Dockerfile +++ b/images/maas-rack-controller-focal/Dockerfile @@ -63,13 +63,17 @@ COPY 3.0_ipmi_error.patch /tmp/3.0_ipmi_error.patch # Patch to space redfish request retries apart a bit, to avoid overwhelming the BMC COPY 3.0_redfish_retries.patch /tmp/3.0_redfish_retries.patch # Patch to allow any recursion and cache queries -COPY 3.0_allow_query.patch /tmp/3.0_allow_query.patch +#COPY 3.0_allow_query.patch /tmp/3.0_allow_query.patch +COPY 3.0_transfer_trusted_only.patch /tmp/3.0_transfer_trusted_only.patch +COPY logging.patch /tmp/logging.patch RUN cd /usr/lib/python3/dist-packages/provisioningserver/utils && patch network.py < /tmp/3.0_nic_filter.patch RUN cd /usr/lib/python3/dist-packages/twisted/web && patch server.py < /tmp/3.0_secure_headers.patch RUN cd /usr/lib/python3/dist-packages/provisioningserver/drivers/power && patch ipmi.py < /tmp/3.0_ipmi_error.patch RUN cd /usr/lib/python3/dist-packages/provisioningserver/drivers/power && patch redfish.py < /tmp/3.0_redfish_retries.patch -RUN cd /usr/lib/python3/dist-packages/provisioningserver/templates/dns && patch named.conf.options.inside.maas.template < /tmp/3.0_allow_query.patch +#RUN cd /usr/lib/python3/dist-packages/provisioningserver/templates/dns && patch named.conf.options.inside.maas.template < /tmp/3.0_allow_query.patch +RUN cd /usr/lib/python3/dist-packages/provisioningserver/templates/dns && patch named.conf.options.inside.maas.template < /tmp/3.0_transfer_trusted_only.patch +RUN cd /usr/lib/python3/dist-packages/provisioningserver/templates/dns && patch named.conf.template < /tmp/logging.patch # echo journalctl logs to the container's stdout COPY scripts/journalctl-to-tty.service /etc/systemd/system/journalctl-to-tty.service diff --git a/images/maas-rack-controller-focal/logging.patch b/images/maas-rack-controller-focal/logging.patch new file mode 100755 index 0000000..f947c67 --- /dev/null +++ b/images/maas-rack-controller-focal/logging.patch @@ -0,0 +1,18 @@ +diff --git a/src/provisioningserver/templates/dns/named.conf.template b/src/provisioningserver/templates/dns/named.conf.template +index a9095600e..a58369546 100644 +--- a/src/provisioningserver/templates/dns/named.conf.template ++++ b/src/provisioningserver/templates/dns/named.conf.template +@@ -36,3 +36,13 @@ acl "trusted" { + localnets; + localhost; + }; ++ ++logging { ++ ++ category queries { default_syslog; }; ++ category client { default_syslog; }; ++ category notify { default_syslog; }; ++ category query-errors { default_syslog; }; ++ category security { default_syslog; }; ++ category xfer-out { default_syslog; }; ++}; diff --git a/images/maas-rack-controller/Dockerfile b/images/maas-rack-controller/Dockerfile index 24e5ed5..28987d3 100644 --- a/images/maas-rack-controller/Dockerfile +++ b/images/maas-rack-controller/Dockerfile @@ -62,13 +62,13 @@ COPY 2.8_ipmi_error.patch /tmp/2.8_ipmi_error.patch # Patch to space redfish request retries apart a bit, to avoid overwhelming the BMC COPY 2.8_redfish_retries.patch /tmp/2.8_redfish_retries.patch # Patch to allow any recursion and cache queries -COPY 2.8_allow_query.patch /tmp/2.8_allow_query.patch +#COPY 2.8_allow_query.patch /tmp/2.8_allow_query.patch RUN cd /usr/lib/python3/dist-packages/provisioningserver/utils && patch network.py < /tmp/2.8_nic_filter.patch RUN cd /usr/lib/python3/dist-packages/twisted/web && patch server.py < /tmp/2.8_secure_headers.patch RUN cd /usr/lib/python3/dist-packages/provisioningserver/drivers/power && patch ipmi.py < /tmp/2.8_ipmi_error.patch RUN cd /usr/lib/python3/dist-packages/provisioningserver/drivers/power && patch redfish.py < /tmp/2.8_redfish_retries.patch -RUN cd /usr/lib/python3/dist-packages/provisioningserver/templates/dns && patch named.conf.options.inside.maas.template < /tmp/2.8_allow_query.patch +#RUN cd /usr/lib/python3/dist-packages/provisioningserver/templates/dns && patch named.conf.options.inside.maas.template < /tmp/2.8_allow_query.patch # echo journalctl logs to the container's stdout COPY scripts/journalctl-to-tty.service /etc/systemd/system/journalctl-to-tty.service diff --git a/images/maas-region-controller-focal/3.0_transfer_trusted_only.patch b/images/maas-region-controller-focal/3.0_transfer_trusted_only.patch new file mode 100755 index 0000000..f772e79 --- /dev/null +++ b/images/maas-region-controller-focal/3.0_transfer_trusted_only.patch @@ -0,0 +1,9 @@ +diff --git a/src/provisioningserver/templates/dns/named.conf.options.inside.maas.template b/src/provisioningserver/templates/dns/named.conf.options.inside.maas.template +index d76fcfa9a..0cca0fe8d 100644 +--- a/src/provisioningserver/templates/dns/named.conf.options.inside.maas.template ++++ b/src/provisioningserver/templates/dns/named.conf.options.inside.maas.template +@@ -18,3 +18,4 @@ allow-recursion { trusted; }; + {{if not upstream_allow_query_cache}} + allow-query-cache { trusted; }; + {{endif}} ++allow-transfer { trusted; }; diff --git a/images/maas-region-controller-focal/Dockerfile b/images/maas-region-controller-focal/Dockerfile index 2d9a463..9a6570e 100644 --- a/images/maas-region-controller-focal/Dockerfile +++ b/images/maas-region-controller-focal/Dockerfile @@ -66,7 +66,9 @@ COPY 3.0_partitiontable_does_not_exist.patch /tmp/3.0_partitiontable_does_not_ex # Allow tags with '/' symbols COPY 3.0_regex_tags.patch /tmp/3.0_regex_tags.patch # Patch to allow any recursion and cache queries -COPY 3.0_allow_query.patch /tmp/3.0_allow_query.patch +#COPY 3.0_allow_query.patch /tmp/3.0_allow_query.patch +COPY 3.0_transfer_trusted_only.patch /tmp/3.0_transfer_trusted_only.patch +COPY logging.patch /tmp/logging.patch RUN cd /usr/lib/python3/dist-packages/maasserver && patch preseed_network.py < /tmp/3.0_route.patch RUN cd /usr/lib/python3/dist-packages/maasserver && patch preseed.py < /tmp/3.0_kernel_package.patch @@ -77,7 +79,9 @@ RUN cd /usr/lib/python3/dist-packages/provisioningserver/templates/proxy && patc RUN cd /usr/lib/python3/dist-packages/twisted/web && patch server.py < /tmp/3.0_secure_headers.patch RUN cd /usr/lib/python3/dist-packages/maasserver/api && patch partitions.py < /tmp/3.0_partitiontable_does_not_exist.patch RUN cd /usr/lib/python3/dist-packages/maasserver/models && patch ownerdata.py < /tmp/3.0_regex_tags.patch -RUN cd /usr/lib/python3/dist-packages/provisioningserver/templates/dns && patch named.conf.options.inside.maas.template < /tmp/3.0_allow_query.patch +#RUN cd /usr/lib/python3/dist-packages/provisioningserver/templates/dns && patch named.conf.options.inside.maas.template < /tmp/3.0_allow_query.patch +RUN cd /usr/lib/python3/dist-packages/provisioningserver/templates/dns && patch named.conf.options.inside.maas.template < /tmp/3.0_transfer_trusted_only.patch +RUN cd /usr/lib/python3/dist-packages/provisioningserver/templates/dns && patch named.conf.template < /tmp/logging.patch # echo journalctl logs to the container's stdout COPY journalctl-to-tty.service /etc/systemd/system/journalctl-to-tty.service diff --git a/images/maas-region-controller-focal/logging.patch b/images/maas-region-controller-focal/logging.patch new file mode 100755 index 0000000..f947c67 --- /dev/null +++ b/images/maas-region-controller-focal/logging.patch @@ -0,0 +1,18 @@ +diff --git a/src/provisioningserver/templates/dns/named.conf.template b/src/provisioningserver/templates/dns/named.conf.template +index a9095600e..a58369546 100644 +--- a/src/provisioningserver/templates/dns/named.conf.template ++++ b/src/provisioningserver/templates/dns/named.conf.template +@@ -36,3 +36,13 @@ acl "trusted" { + localnets; + localhost; + }; ++ ++logging { ++ ++ category queries { default_syslog; }; ++ category client { default_syslog; }; ++ category notify { default_syslog; }; ++ category query-errors { default_syslog; }; ++ category security { default_syslog; }; ++ category xfer-out { default_syslog; }; ++}; diff --git a/images/maas-region-controller/2.8_transfer_trusted_only.patch b/images/maas-region-controller/2.8_transfer_trusted_only.patch new file mode 100755 index 0000000..3b31661 --- /dev/null +++ b/images/maas-region-controller/2.8_transfer_trusted_only.patch @@ -0,0 +1,9 @@ +diff --git a/src/provisioningserver/templates/dns/named.conf.options.inside.maas.template b/src/provisioningserver/templates/dns/named.conf.options.inside.maas.template +index ba1aee316..6eda771b0 100644 +--- a/src/provisioningserver/templates/dns/named.conf.options.inside.maas.template ++++ b/src/provisioningserver/templates/dns/named.conf.options.inside.maas.template +@@ -18,3 +18,4 @@ allow-recursion { trusted; }; + {{if not upstream_allow_query_cache}} + allow-query-cache { trusted; }; + {{endif}} ++allow-transfer { trusted; }; \ No newline at end of file diff --git a/images/maas-region-controller/Dockerfile b/images/maas-region-controller/Dockerfile index 955b33d..f8c5f95 100644 --- a/images/maas-region-controller/Dockerfile +++ b/images/maas-region-controller/Dockerfile @@ -65,7 +65,8 @@ COPY 2.8_partitiontable_does_not_exist.patch /tmp/2.8_partitiontable_does_not_ex # Avoid enlistment failures due to exceptions during moonshot detect attempts COPY 2.8_maas_ipmi_autodetect_tool.patch /tmp/2.8_maas_ipmi_autodetect_tool.patch # Patch to allow any recursion and cache queries -COPY 2.8_allow_query.patch /tmp/2.8_allow_query.patch +#COPY 2.8_allow_query.patch /tmp/2.8_allow_query.patch +COPY 2.8_transfer_trusted_only.patch /tmp/2.8_transfer_trusted_only.patch RUN cd /usr/lib/python3/dist-packages/maasserver && patch preseed_network.py < /tmp/2.8_route.patch RUN cd /usr/lib/python3/dist-packages/maasserver && patch preseed.py < /tmp/2.8_kernel_package.patch @@ -76,7 +77,8 @@ RUN cd /usr/lib/python3/dist-packages/provisioningserver/templates/proxy && patc RUN cd /usr/lib/python3/dist-packages/twisted/web && patch server.py < /tmp/2.8_secure_headers.patch RUN cd /usr/lib/python3/dist-packages/maasserver/api && patch partitions.py < /tmp/2.8_partitiontable_does_not_exist.patch RUN cd /usr/lib/python3/dist-packages/metadataserver/user_data/templates/snippets/ && patch maas_ipmi_autodetect_tool.py < /tmp/2.8_maas_ipmi_autodetect_tool.patch -RUN cd /usr/lib/python3/dist-packages/provisioningserver/templates/dns && patch named.conf.options.inside.maas.template < /tmp/2.8_allow_query.patch +#RUN cd /usr/lib/python3/dist-packages/provisioningserver/templates/dns && patch named.conf.options.inside.maas.template < /tmp/2.8_allow_query.patch +RUN cd /usr/lib/python3/dist-packages/provisioningserver/templates/dns && patch named.conf.options.inside.maas.template < /tmp/2.8_transfer_trusted_only.patch # echo journalctl logs to the container's stdout COPY journalctl-to-tty.service /etc/systemd/system/journalctl-to-tty.service