Re: nsupdate ACL based on a key AND ip-subnet

2008-11-17 Thread Jonathan Petersson
, or no match, which means continue processing. When an ordinary ACL element matches and is negated (for example, the element is !10/8; and the address is 10.0.0.1) that means match and reject. But if the match is inside of a *nested* ACL, then it's treated differently: A negative result means

Re: nsupdate ACL based on a key AND ip-subnet

2008-11-17 Thread Jonathan Petersson
Yeah it would most likely be a feature request/change. IIRC update-policy cannot be used in congestion with the allow-update statement. Personally I prefer the usage of update-policy as I can assign different business units within my organization to take responsibility for certain records/record

Re: nsupdate ACL based on a key AND ip-subnet

2008-11-17 Thread Evan Hunt
.) It's probably not a high enough priority for ISC to devote engineering resources to it at this time, but if someone submitted a patch that added an ACL check to the update-policy syntax, I'm sure we'd consider it. -- Evan Hunt -- [EMAIL PROTECTED] Internet Systems Consortium, Inc

Re: nsupdate ACL based on a key AND ip-subnet

2008-11-17 Thread Jonathan Petersson
don't know why it was implemented this way--there's no protocol reason I can see. (There may be other reasons I don't know about.) It's probably not a high enough priority for ISC to devote engineering resources to it at this time, but if someone submitted a patch that added an ACL check

<    1   2