xref: /src/external/mpl/bind/dist/bin/named/zoneconf.c

/*	$NetBSD: zoneconf.c,v 1.10 2021/04/05 11:27:00 rillig Exp $	*/

/*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */

#include <inttypes.h>
#include <stdbool.h>

#include <isc/buffer.h>
#include <isc/file.h>
#include <isc/mem.h>
#include <isc/print.h>
#include <isc/stats.h>
#include <isc/string.h> /* Required for HP/UX (and others?) */
#include <isc/util.h>

#include <dns/acl.h>
#include <dns/db.h>
#include <dns/fixedname.h>
#include <dns/ipkeylist.h>
#include <dns/journal.h>
#include <dns/kasp.h>
#include <dns/log.h>
#include <dns/masterdump.h>
#include <dns/name.h>
#include <dns/nsec3.h>
#include <dns/rdata.h>
#include <dns/rdatalist.h>
#include <dns/rdataset.h>
#include <dns/rdatatype.h>
#include <dns/result.h>
#include <dns/sdlz.h>
#include <dns/ssu.h>
#include <dns/stats.h>
#include <dns/tsig.h>
#include <dns/view.h>
#include <dns/zone.h>

#include <ns/client.h>

#include <named/config.h>
#include <named/globals.h>
#include <named/log.h>
#include <named/server.h>
#include <named/zoneconf.h>

/* ACLs associated with zone */
typedef enum {
	allow_notify,
	allow_query,
	allow_query_on,
	allow_transfer,
	allow_update,
	allow_update_forwarding
} acl_type_t;

#define RETERR(x)                        \
	do {                             \
		isc_result_t _r = (x);   \
		if (_r != ISC_R_SUCCESS) \
			return ((_r));   \
	} while (0)

#define CHECK(x)                             \
	do {                                 \
		result = (x);                \
		if (result != ISC_R_SUCCESS) \
			goto cleanup;        \
	} while (0)

/*%
 * Convenience function for configuring a single zone ACL.
 */
static isc_result_t
configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
		   const cfg_obj_t *config, acl_type_t acltype,
		   cfg_aclconfctx_t *actx, dns_zone_t *zone,
		   void (*setzacl)(dns_zone_t *, dns_acl_t *),
		   void (*clearzacl)(dns_zone_t *)) {
	isc_result_t result;
	const cfg_obj_t *maps[5] = { NULL, NULL, NULL, NULL, NULL };
	const cfg_obj_t *aclobj = NULL;
	int i = 0;
	dns_acl_t **aclp = NULL, *acl = NULL;
	const char *aclname;
	dns_view_t *view;

	view = dns_zone_getview(zone);

	switch (acltype) {
	case allow_notify:
		if (view != NULL) {
			aclp = &view->notifyacl;
		}
		aclname = "allow-notify";
		break;
	case allow_query:
		if (view != NULL) {
			aclp = &view->queryacl;
		}
		aclname = "allow-query";
		break;
	case allow_query_on:
		if (view != NULL) {
			aclp = &view->queryonacl;
		}
		aclname = "allow-query-on";
		break;
	case allow_transfer:
		if (view != NULL) {
			aclp = &view->transferacl;
		}
		aclname = "allow-transfer";
		break;
	case allow_update:
		if (view != NULL) {
			aclp = &view->updateacl;
		}
		aclname = "allow-update";
		break;
	case allow_update_forwarding:
		if (view != NULL) {
			aclp = &view->upfwdacl;
		}
		aclname = "allow-update-forwarding";
		break;
	default:
		INSIST(0);
		ISC_UNREACHABLE();
	}

	/* First check to see if ACL is defined within the zone */
	if (zconfig != NULL) {
		maps[0] = cfg_tuple_get(zconfig, "options");
		(void)named_config_get(maps, aclname, &aclobj);
		if (aclobj != NULL) {
			aclp = NULL;
			goto parse_acl;
		}
	}

	/* Failing that, see if there's a default ACL already in the view */
	if (aclp != NULL && *aclp != NULL) {
		(*setzacl)(zone, *aclp);
		return (ISC_R_SUCCESS);
	}

	/* Check for default ACLs that haven't been parsed yet */
	if (vconfig != NULL) {
		const cfg_obj_t *options = cfg_tuple_get(vconfig, "options");
		if (options != NULL) {
			maps[i++] = options;
		}
	}
	if (config != NULL) {
		const cfg_obj_t *options = NULL;
		(void)cfg_map_get(config, "options", &options);
		if (options != NULL) {
			maps[i++] = options;
		}
	}
	maps[i++] = named_g_defaults;
	maps[i] = NULL;

	(void)named_config_get(maps, aclname, &aclobj);
	if (aclobj == NULL) {
		(*clearzacl)(zone);
		return (ISC_R_SUCCESS);
	}

parse_acl:
	result = cfg_acl_fromconfig(aclobj, config, named_g_lctx, actx,
				    named_g_mctx, 0, &acl);
	if (result != ISC_R_SUCCESS) {
		return (result);
	}
	(*setzacl)(zone, acl);

	/* Set the view default now */
	if (aclp != NULL) {
		dns_acl_attach(acl, aclp);
	}

	dns_acl_detach(&acl);
	return (ISC_R_SUCCESS);
}

/*%
 * Parse the zone update-policy statement.
 */
static isc_result_t
configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
			const char *zname) {
	const cfg_obj_t *updatepolicy = NULL;
	const cfg_listelt_t *element, *element2;
	dns_ssutable_t *table = NULL;
	isc_mem_t *mctx = dns_zone_getmctx(zone);
	bool autoddns = false;
	isc_result_t result;

	(void)cfg_map_get(zconfig, "update-policy", &updatepolicy);

	if (updatepolicy == NULL) {
		dns_zone_setssutable(zone, NULL);
		return (ISC_R_SUCCESS);
	}

	if (cfg_obj_isstring(updatepolicy) &&
	    strcmp("local", cfg_obj_asstring(updatepolicy)) == 0)
	{
		autoddns = true;
		updatepolicy = NULL;
	}

	result = dns_ssutable_create(mctx, &table);
	if (result != ISC_R_SUCCESS) {
		return (result);
	}

	for (element = cfg_list_first(updatepolicy); element != NULL;
	     element = cfg_list_next(element))
	{
		const cfg_obj_t *stmt = cfg_listelt_value(element);
		const cfg_obj_t *mode = cfg_tuple_get(stmt, "mode");
		const cfg_obj_t *identity = cfg_tuple_get(stmt, "identity");
		const cfg_obj_t *matchtype = cfg_tuple_get(stmt, "matchtype");
		const cfg_obj_t *dname = cfg_tuple_get(stmt, "name");
		const cfg_obj_t *typelist = cfg_tuple_get(stmt, "types");
		const char *str;
		bool grant = false;
		bool usezone = false;
		dns_ssumatchtype_t mtype = dns_ssumatchtype_name;
		dns_fixedname_t fname, fident;
		isc_buffer_t b;
		dns_rdatatype_t *types;
		unsigned int i, n;

		str = cfg_obj_asstring(mode);
		if (strcasecmp(str, "grant") == 0) {
			grant = true;
		} else if (strcasecmp(str, "deny") == 0) {
			grant = false;
		} else {
			INSIST(0);
			ISC_UNREACHABLE();
		}

		str = cfg_obj_asstring(matchtype);
		CHECK(dns_ssu_mtypefromstring(str, &mtype));
		if (mtype == dns_ssumatchtype_subdomain &&
		    strcasecmp(str, "zonesub") == 0) {
			usezone = true;
		}

		dns_fixedname_init(&fident);
		str = cfg_obj_asstring(identity);
		isc_buffer_constinit(&b, str, strlen(str));
		isc_buffer_add(&b, strlen(str));
		result = dns_name_fromtext(dns_fixedname_name(&fident), &b,
					   dns_rootname, 0, NULL);
		if (result != ISC_R_SUCCESS) {
			cfg_obj_log(identity, named_g_lctx, ISC_LOG_ERROR,
				    "'%s' is not a valid name", str);
			goto cleanup;
		}

		dns_fixedname_init(&fname);
		if (usezone) {
			dns_name_copynf(dns_zone_getorigin(zone),
					dns_fixedname_name(&fname));
		} else {
			str = cfg_obj_asstring(dname);
			isc_buffer_constinit(&b, str, strlen(str));
			isc_buffer_add(&b, strlen(str));
			result = dns_name_fromtext(dns_fixedname_name(&fname),
						   &b, dns_rootname, 0, NULL);
			if (result != ISC_R_SUCCESS) {
				cfg_obj_log(identity, named_g_lctx,
					    ISC_LOG_ERROR,
					    "'%s' is not a valid name", str);
				goto cleanup;
			}
		}

		n = named_config_listcount(typelist);
		if (n == 0) {
			types = NULL;
		} else {
			types = isc_mem_get(mctx, n * sizeof(dns_rdatatype_t));
		}

		i = 0;
		for (element2 = cfg_list_first(typelist); element2 != NULL;
		     element2 = cfg_list_next(element2))
		{
			const cfg_obj_t *typeobj;
			isc_textregion_t r;

			INSIST(i < n);

			typeobj = cfg_listelt_value(element2);
			str = cfg_obj_asstring(typeobj);
			DE_CONST(str, r.base);
			r.length = strlen(str);

			result = dns_rdatatype_fromtext(&types[i++], &r);
			if (result != ISC_R_SUCCESS) {
				cfg_obj_log(identity, named_g_lctx,
					    ISC_LOG_ERROR,
					    "'%s' is not a valid type", str);
				isc_mem_put(mctx, types,
					    n * sizeof(dns_rdatatype_t));
				goto cleanup;
			}
		}
		INSIST(i == n);

		result = dns_ssutable_addrule(
			table, grant, dns_fixedname_name(&fident), mtype,
			dns_fixedname_name(&fname), n, types);
		if (types != NULL) {
			isc_mem_put(mctx, types, n * sizeof(dns_rdatatype_t));
		}
		if (result != ISC_R_SUCCESS) {
			goto cleanup;
		}
	}

	/*
	 * If "update-policy local;" and a session key exists,
	 * then use the default policy, which is equivalent to:
	 * update-policy { grant <session-keyname> zonesub any; };
	 */
	if (autoddns) {
		dns_rdatatype_t any = dns_rdatatype_any;

		if (named_g_server->session_keyname == NULL) {
			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
				      "failed to enable auto DDNS policy "
				      "for zone %s: session key not found",
				      zname);
			result = ISC_R_NOTFOUND;
			goto cleanup;
		}

		result = dns_ssutable_addrule(
			table, true, named_g_server->session_keyname,
			dns_ssumatchtype_local, dns_zone_getorigin(zone), 1,
			&any);

		if (result != ISC_R_SUCCESS) {
			goto cleanup;
		}
	}

	result = ISC_R_SUCCESS;
	dns_zone_setssutable(zone, table);

cleanup:
	dns_ssutable_detach(&table);
	return (result);
}

/*
 * This is the TTL used for internally generated RRsets for static-stub zones.
 * The value doesn't matter because the mapping is static, but needs to be
 * defined for the sake of implementation.
 */
#define STATICSTUB_SERVER_TTL 86400

/*%
 * Configure an apex NS with glues for a static-stub zone.
 * For example, for the zone named "example.com", the following RRs will be
 * added to the zone DB:
 * example.com. NS example.com.
 * example.com. A 192.0.2.1
 * example.com. AAAA 2001:db8::1
 */
static isc_result_t
configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
				 dns_rdatalist_t *rdatalist_ns,
				 dns_rdatalist_t *rdatalist_a,
				 dns_rdatalist_t *rdatalist_aaaa) {
	const cfg_listelt_t *element;
	isc_mem_t *mctx = dns_zone_getmctx(zone);
	isc_region_t region, sregion;
	dns_rdata_t *rdata;
	isc_result_t result = ISC_R_SUCCESS;

	for (element = cfg_list_first(zconfig); element != NULL;
	     element = cfg_list_next(element))
	{
		const isc_sockaddr_t *sa;
		isc_netaddr_t na;
		const cfg_obj_t *address = cfg_listelt_value(element);
		dns_rdatalist_t *rdatalist;

		sa = cfg_obj_assockaddr(address);
		if (isc_sockaddr_getport(sa) != 0) {
			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
				    "port is not configurable for "
				    "static stub server-addresses");
			return (ISC_R_FAILURE);
		}
		isc_netaddr_fromsockaddr(&na, sa);
		if (isc_netaddr_getzone(&na) != 0) {
			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
				    "scoped address is not allowed "
				    "for static stub "
				    "server-addresses");
			return (ISC_R_FAILURE);
		}

		switch (na.family) {
		case AF_INET:
			region.length = sizeof(na.type.in);
			rdatalist = rdatalist_a;
			break;
		default:
			INSIST(na.family == AF_INET6);
			region.length = sizeof(na.type.in6);
			rdatalist = rdatalist_aaaa;
			break;
		}

		rdata = isc_mem_get(mctx, sizeof(*rdata) + region.length);
		region.base = (unsigned char *)(rdata + 1);
		memmove(region.base, &na.type, region.length);
		dns_rdata_init(rdata);
		dns_rdata_fromregion(rdata, dns_zone_getclass(zone),
				     rdatalist->type, &region);
		ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
	}

	/*
	 * If no address is specified (unlikely in this context, but possible),
	 * there's nothing to do anymore.
	 */
	if (ISC_LIST_EMPTY(rdatalist_a->rdata) &&
	    ISC_LIST_EMPTY(rdatalist_aaaa->rdata)) {
		return (ISC_R_SUCCESS);
	}

	/* Add to the list an apex NS with the ns name being the origin name */
	dns_name_toregion(dns_zone_getorigin(zone), &sregion);
	rdata = isc_mem_get(mctx, sizeof(*rdata) + sregion.length);
	region.length = sregion.length;
	region.base = (unsigned char *)(rdata + 1);
	memmove(region.base, sregion.base, region.length);
	dns_rdata_init(rdata);
	dns_rdata_fromregion(rdata, dns_zone_getclass(zone), dns_rdatatype_ns,
			     &region);
	ISC_LIST_APPEND(rdatalist_ns->rdata, rdata, link);

	return (result);
}

/*%
 * Configure an apex NS with an out-of-zone NS names for a static-stub zone.
 * For example, for the zone named "example.com", something like the following
 * RRs will be added to the zone DB:
 * example.com. NS ns.example.net.
 */
static isc_result_t
configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,
				 dns_rdatalist_t *rdatalist,
				 const char *zname) {
	const cfg_listelt_t *element;
	isc_mem_t *mctx = dns_zone_getmctx(zone);
	dns_rdata_t *rdata;
	isc_region_t sregion, region;
	isc_result_t result = ISC_R_SUCCESS;

	for (element = cfg_list_first(zconfig); element != NULL;
	     element = cfg_list_next(element))
	{
		const cfg_obj_t *obj;
		const char *str;
		dns_fixedname_t fixed_name;
		dns_name_t *nsname;
		isc_buffer_t b;

		obj = cfg_listelt_value(element);
		str = cfg_obj_asstring(obj);

		nsname = dns_fixedname_initname(&fixed_name);

		isc_buffer_constinit(&b, str, strlen(str));
		isc_buffer_add(&b, strlen(str));
		result = dns_name_fromtext(nsname, &b, dns_rootname, 0, NULL);
		if (result != ISC_R_SUCCESS) {
			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
				    "server-name '%s' is not a valid "
				    "name",
				    str);
			return (result);
		}
		if (dns_name_issubdomain(nsname, dns_zone_getorigin(zone))) {
			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
				    "server-name '%s' must not be a "
				    "subdomain of zone name '%s'",
				    str, zname);
			return (ISC_R_FAILURE);
		}

		dns_name_toregion(nsname, &sregion);
		rdata = isc_mem_get(mctx, sizeof(*rdata) + sregion.length);
		region.length = sregion.length;
		region.base = (unsigned char *)(rdata + 1);
		memmove(region.base, sregion.base, region.length);
		dns_rdata_init(rdata);
		dns_rdata_fromregion(rdata, dns_zone_getclass(zone),
				     dns_rdatatype_ns, &region);
		ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
	}

	return (result);
}

/*%
 * Configure static-stub zone.
 */
static isc_result_t
configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
		     const char *zname, const char *dbtype) {
	int i = 0;
	const cfg_obj_t *obj;
	isc_mem_t *mctx = dns_zone_getmctx(zone);
	dns_db_t *db = NULL;
	dns_dbversion_t *dbversion = NULL;
	dns_dbnode_t *apexnode = NULL;
	dns_name_t apexname;
	isc_result_t result;
	dns_rdataset_t rdataset;
	dns_rdatalist_t rdatalist_ns, rdatalist_a, rdatalist_aaaa;
	dns_rdatalist_t *rdatalists[] = { &rdatalist_ns, &rdatalist_a,
					  &rdatalist_aaaa, NULL };
	dns_rdata_t *rdata;
	isc_region_t region;

	/* Create the DB beforehand */
	RETERR(dns_db_create(mctx, dbtype, dns_zone_getorigin(zone),
			     dns_dbtype_stub, dns_zone_getclass(zone), 0, NULL,
			     &db));

	dns_rdataset_init(&rdataset);

	dns_rdatalist_init(&rdatalist_ns);
	rdatalist_ns.rdclass = dns_zone_getclass(zone);
	rdatalist_ns.type = dns_rdatatype_ns;
	rdatalist_ns.ttl = STATICSTUB_SERVER_TTL;

	dns_rdatalist_init(&rdatalist_a);
	rdatalist_a.rdclass = dns_zone_getclass(zone);
	rdatalist_a.type = dns_rdatatype_a;
	rdatalist_a.ttl = STATICSTUB_SERVER_TTL;

	dns_rdatalist_init(&rdatalist_aaaa);
	rdatalist_aaaa.rdclass = dns_zone_getclass(zone);
	rdatalist_aaaa.type = dns_rdatatype_aaaa;
	rdatalist_aaaa.ttl = STATICSTUB_SERVER_TTL;

	/* Prepare zone RRs from the configuration */
	obj = NULL;
	result = cfg_map_get(zconfig, "server-addresses", &obj);
	if (result == ISC_R_SUCCESS) {
		INSIST(obj != NULL);
		CHECK(configure_staticstub_serveraddrs(obj, zone, &rdatalist_ns,
						       &rdatalist_a,
						       &rdatalist_aaaa));
	}

	obj = NULL;
	result = cfg_map_get(zconfig, "server-names", &obj);
	if (result == ISC_R_SUCCESS) {
		INSIST(obj != NULL);
		CHECK(configure_staticstub_servernames(obj, zone, &rdatalist_ns,
						       zname));
	}

	/*
	 * Sanity check: there should be at least one NS RR at the zone apex
	 * to trigger delegation.
	 */
	if (ISC_LIST_EMPTY(rdatalist_ns.rdata)) {
		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
			      "No NS record is configured for a "
			      "static-stub zone '%s'",
			      zname);
		result = ISC_R_FAILURE;
		goto cleanup;
	}

	/*
	 * Now add NS and glue A/AAAA RRsets to the zone DB.
	 * First open a new version for the add operation and get a pointer
	 * to the apex node (all RRs are of the apex name).
	 */
	CHECK(dns_db_newversion(db, &dbversion));

	dns_name_init(&apexname, NULL);
	dns_name_clone(dns_zone_getorigin(zone), &apexname);
	CHECK(dns_db_findnode(db, &apexname, false, &apexnode));

	/* Add NS RRset */
	RUNTIME_CHECK(dns_rdatalist_tordataset(&rdatalist_ns, &rdataset) ==
		      ISC_R_SUCCESS);
	CHECK(dns_db_addrdataset(db, apexnode, dbversion, 0, &rdataset, 0,
				 NULL));
	dns_rdataset_disassociate(&rdataset);

	/* Add glue A RRset, if any */
	if (!ISC_LIST_EMPTY(rdatalist_a.rdata)) {
		RUNTIME_CHECK(
			dns_rdatalist_tordataset(&rdatalist_a, &rdataset) ==
			ISC_R_SUCCESS);
		CHECK(dns_db_addrdataset(db, apexnode, dbversion, 0, &rdataset,
					 0, NULL));
		dns_rdataset_disassociate(&rdataset);
	}

	/* Add glue AAAA RRset, if any */
	if (!ISC_LIST_EMPTY(rdatalist_aaaa.rdata)) {
		RUNTIME_CHECK(
			dns_rdatalist_tordataset(&rdatalist_aaaa, &rdataset) ==
			ISC_R_SUCCESS);
		CHECK(dns_db_addrdataset(db, apexnode, dbversion, 0, &rdataset,
					 0, NULL));
		dns_rdataset_disassociate(&rdataset);
	}

	dns_db_closeversion(db, &dbversion, true);
	dns_zone_setdb(zone, db);

	result = ISC_R_SUCCESS;

cleanup:
	if (dns_rdataset_isassociated(&rdataset)) {
		dns_rdataset_disassociate(&rdataset);
	}
	if (apexnode != NULL) {
		dns_db_detachnode(db, &apexnode);
	}
	if (dbversion != NULL) {
		dns_db_closeversion(db, &dbversion, false);
	}
	if (db != NULL) {
		dns_db_detach(&db);
	}
	for (i = 0; rdatalists[i] != NULL; i++) {
		while ((rdata = ISC_LIST_HEAD(rdatalists[i]->rdata)) != NULL) {
			ISC_LIST_UNLINK(rdatalists[i]->rdata, rdata, link);
			dns_rdata_toregion(rdata, &region);
			isc_mem_put(mctx, rdata,
				    sizeof(*rdata) + region.length);
		}
	}

	INSIST(dbversion == NULL);

	return (result);
}

/*%
 * Convert a config file zone type into a server zone type.
 */
static inline dns_zonetype_t
zonetype_fromconfig(const cfg_obj_t *map) {
	const cfg_obj_t *obj = NULL;
	isc_result_t result;

	result = cfg_map_get(map, "type", &obj);
	INSIST(result == ISC_R_SUCCESS && obj != NULL);
	return (named_config_getzonetype(obj));
}

/*%
 * Helper function for strtoargv().  Pardon the gratuitous recursion.
 */
static isc_result_t
strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp,
	     unsigned int n) {
	isc_result_t result;

	/* Discard leading whitespace. */
	while (*s == ' ' || *s == '\t') {
		s++;
	}

	if (*s == '\0') {
		/* We have reached the end of the string. */
		*argcp = n;
		*argvp = isc_mem_get(mctx, n * sizeof(char *));
	} else {
		char *p = s;
		while (*p != ' ' && *p != '\t' && *p != '\0') {
			p++;
		}
		if (*p != '\0') {
			*p++ = '\0';
		}

		result = strtoargvsub(mctx, p, argcp, argvp, n + 1);
		if (result != ISC_R_SUCCESS) {
			return (result);
		}
		(*argvp)[n] = s;
	}
	return (ISC_R_SUCCESS);
}

/*%
 * Tokenize the string "s" into whitespace-separated words,
 * return the number of words in '*argcp' and an array
 * of pointers to the words in '*argvp'.  The caller
 * must free the array using isc_mem_put().  The string
 * is modified in-place.
 */
static isc_result_t
strtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp) {
	return (strtoargvsub(mctx, s, argcp, argvp, 0));
}

static void
checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
	   const cfg_obj_t **objp) {
	isc_result_t result;

	switch (ztype) {
	case dns_zone_slave:
	case dns_zone_mirror:
		result = named_checknames_get(maps, "secondary", objp);
		if (result != ISC_R_SUCCESS) {
			result = named_checknames_get(maps, "slave", objp);
		}
		break;
	case dns_zone_master:
		result = named_checknames_get(maps, "primary", objp);
		if (result != ISC_R_SUCCESS) {
			result = named_checknames_get(maps, "master", objp);
		}
		break;
	default:
		INSIST(0);
		ISC_UNREACHABLE();
	}

	INSIST(result == ISC_R_SUCCESS && objp != NULL && *objp != NULL);
}

/*
 * Callback to see if a non-recursive query coming from 'srcaddr' to
 * 'destaddr', with optional key 'mykey' for class 'rdclass' would be
 * delivered to 'myview'.
 *
 * We run this unlocked as both the view list and the interface list
 * are updated when the appropriate task has exclusivity.
 */
static bool
isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
       const isc_sockaddr_t *dstaddr, dns_rdataclass_t rdclass, void *arg) {
	ns_interfacemgr_t *interfacemgr = (ns_interfacemgr_t *)arg;
	dns_aclenv_t *env = ns_interfacemgr_getaclenv(interfacemgr);
	dns_view_t *view;
	dns_tsigkey_t *key = NULL;
	isc_netaddr_t netsrc;
	isc_netaddr_t netdst;

	if (interfacemgr == NULL) {
		return (true);
	}

	if (!ns_interfacemgr_listeningon(interfacemgr, dstaddr)) {
		return (false);
	}

	isc_netaddr_fromsockaddr(&netsrc, srcaddr);
	isc_netaddr_fromsockaddr(&netdst, dstaddr);

	for (view = ISC_LIST_HEAD(named_g_server->viewlist); view != NULL;
	     view = ISC_LIST_NEXT(view, link))
	{
		const dns_name_t *tsig = NULL;

		if (view->matchrecursiveonly) {
			continue;
		}

		if (rdclass != view->rdclass) {
			continue;
		}

		if (mykey != NULL) {
			bool match;
			isc_result_t result;

			result = dns_view_gettsig(view, &mykey->name, &key);
			if (result != ISC_R_SUCCESS) {
				continue;
			}
			match = dst_key_compare(mykey->key, key->key);
			dns_tsigkey_detach(&key);
			if (!match) {
				continue;
			}
			tsig = dns_tsigkey_identity(mykey);
		}

		if (dns_acl_allowed(&netsrc, tsig, view->matchclients, env) &&
		    dns_acl_allowed(&netdst, tsig, view->matchdestinations,
				    env))
		{
			break;
		}
	}
	return (view == myview);
}

/*%
 * For mirror zones, change "notify yes;" to "notify explicit;", informing the
 * user only if "notify" was explicitly configured rather than inherited from
 * default configuration.
 */
static dns_notifytype_t
process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
		   const char *zname, const cfg_obj_t **maps) {
	const cfg_obj_t *obj = NULL;

	/*
	 * Return the original setting if this is not a mirror zone or if the
	 * zone is configured with something else than "notify yes;".
	 */
	if (ztype != dns_zone_mirror || ntype != dns_notifytype_yes) {
		return (ntype);
	}

	/*
	 * Only log a message if "notify" was set in the configuration
	 * hierarchy supplied in 'maps'.
	 */
	if (named_config_get(maps, "notify", &obj) == ISC_R_SUCCESS) {
		cfg_obj_log(obj, named_g_lctx, ISC_LOG_INFO,
			    "'notify explicit;' will be used for mirror zone "
			    "'%s'",
			    zname);
	}

	return (dns_notifytype_explicit);
}

isc_result_t
named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
		     dns_kasplist_t *kasplist, dns_zone_t *zone,
		     dns_zone_t *raw) {
	isc_result_t result;
	const char *zname;
	dns_rdataclass_t zclass;
	dns_rdataclass_t vclass;
	const cfg_obj_t *maps[5];
	const cfg_obj_t *nodefault[4];
	const cfg_obj_t *zoptions = NULL;
	const cfg_obj_t *options = NULL;
	const cfg_obj_t *obj;
	const char *filename = NULL;
	const char *kaspname = NULL;
	const char *dupcheck;
	dns_notifytype_t notifytype = dns_notifytype_yes;
	uint32_t count;
	unsigned int dbargc;
	char **dbargv;
	static char default_dbtype[] = "rbt";
	static char dlz_dbtype[] = "dlz";
	char *cpval = default_dbtype;
	isc_mem_t *mctx = dns_zone_getmctx(zone);
	dns_dialuptype_t dialup = dns_dialuptype_no;
	dns_zonetype_t ztype;
	int i;
	int32_t journal_size;
	bool multi;
	bool alt;
	dns_view_t *view = NULL;
	dns_kasp_t *kasp = NULL;
	bool check = false, fail = false;
	bool warn = false, ignore = false;
	bool ixfrdiff;
	bool use_kasp = false;
	dns_masterformat_t masterformat;
	const dns_master_style_t *masterstyle = &dns_master_style_default;
	isc_stats_t *zoneqrystats;
	dns_stats_t *rcvquerystats;
	dns_stats_t *dnssecsignstats;
	dns_zonestat_level_t statlevel = dns_zonestat_none;
	int seconds;
	dns_zone_t *mayberaw = (raw != NULL) ? raw : zone;
	isc_dscp_t dscp;

	i = 0;
	if (zconfig != NULL) {
		zoptions = cfg_tuple_get(zconfig, "options");
		nodefault[i] = maps[i] = zoptions;
		i++;
	}
	if (vconfig != NULL) {
		nodefault[i] = maps[i] = cfg_tuple_get(vconfig, "options");
		i++;
	}
	if (config != NULL) {
		(void)cfg_map_get(config, "options", &options);
		if (options != NULL) {
			nodefault[i] = maps[i] = options;
			i++;
		}
	}
	nodefault[i] = NULL;
	maps[i++] = named_g_defaults;
	maps[i] = NULL;

	if (vconfig != NULL) {
		RETERR(named_config_getclass(cfg_tuple_get(vconfig, "class"),
					     dns_rdataclass_in, &vclass));
	} else {
		vclass = dns_rdataclass_in;
	}

	/*
	 * Configure values common to all zone types.
	 */

	zname = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));

	RETERR(named_config_getclass(cfg_tuple_get(zconfig, "class"), vclass,
				     &zclass));
	dns_zone_setclass(zone, zclass);
	if (raw != NULL) {
		dns_zone_setclass(raw, zclass);
	}

	ztype = zonetype_fromconfig(zoptions);
	if (raw != NULL) {
		dns_zone_settype(raw, ztype);
		dns_zone_settype(zone, dns_zone_master);
	} else {
		dns_zone_settype(zone, ztype);
	}

	obj = NULL;
	result = cfg_map_get(zoptions, "database", &obj);
	if (result == ISC_R_SUCCESS) {
		cpval = isc_mem_strdup(mctx, cfg_obj_asstring(obj));
	}
	if (cpval == NULL) {
		return (ISC_R_NOMEMORY);
	}

	obj = NULL;
	result = cfg_map_get(zoptions, "dlz", &obj);
	if (result == ISC_R_SUCCESS) {
		const char *dlzname = cfg_obj_asstring(obj);
		size_t len;

		if (cpval != default_dbtype) {
			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
				      "zone '%s': both 'database' and 'dlz' "
				      "specified",
				      zname);
			return (ISC_R_FAILURE);
		}

		len = strlen(dlzname) + 5;
		cpval = isc_mem_allocate(mctx, len);
		snprintf(cpval, len, "dlz %s", dlzname);
	}

	result = strtoargv(mctx, cpval, &dbargc, &dbargv);
	if (result != ISC_R_SUCCESS && cpval != default_dbtype) {
		isc_mem_free(mctx, cpval);
		return (result);
	}

	/*
	 * ANSI C is strange here.  There is no logical reason why (char **)
	 * cannot be promoted automatically to (const char * const *) by the
	 * compiler w/o generating a warning.
	 */
	dns_zone_setdbtype(zone, dbargc, (const char *const *)dbargv);
	isc_mem_put(mctx, dbargv, dbargc * sizeof(*dbargv));
	if (cpval != default_dbtype && cpval != dlz_dbtype) {
		isc_mem_free(mctx, cpval);
	}

	obj = NULL;
	result = cfg_map_get(zoptions, "file", &obj);
	if (result == ISC_R_SUCCESS) {
		filename = cfg_obj_asstring(obj);
	}

	/*
	 * Unless we're using some alternative database, a master zone
	 * will be needing a master file.
	 */
	if (ztype == dns_zone_master && cpval == default_dbtype &&
	    filename == NULL) {
		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
			      "zone '%s': 'file' not specified", zname);
		return (ISC_R_FAILURE);
	}

	if (ztype == dns_zone_slave || ztype == dns_zone_mirror) {
		masterformat = dns_masterformat_raw;
	} else {
		masterformat = dns_masterformat_text;
	}
	obj = NULL;
	result = named_config_get(maps, "masterfile-format", &obj);
	if (result == ISC_R_SUCCESS) {
		const char *masterformatstr = cfg_obj_asstring(obj);

		if (strcasecmp(masterformatstr, "text") == 0) {
			masterformat = dns_masterformat_text;
		} else if (strcasecmp(masterformatstr, "raw") == 0) {
			masterformat = dns_masterformat_raw;
		} else if (strcasecmp(masterformatstr, "map") == 0) {
			masterformat = dns_masterformat_map;
		} else {
			INSIST(0);
			ISC_UNREACHABLE();
		}
	}

	obj = NULL;
	result = named_config_get(maps, "masterfile-style", &obj);
	if (result == ISC_R_SUCCESS) {
		const char *masterstylestr = cfg_obj_asstring(obj);

		if (masterformat != dns_masterformat_text) {
			cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
				    "zone '%s': 'masterfile-style' "
				    "can only be used with "
				    "'masterfile-format text'",
				    zname);
			return (ISC_R_FAILURE);
		}

		if (strcasecmp(masterstylestr, "full") == 0) {
			masterstyle = &dns_master_style_full;
		} else if (strcasecmp(masterstylestr, "relative") == 0) {
			masterstyle = &dns_master_style_default;
		} else {
			INSIST(0);
			ISC_UNREACHABLE();
		}
	}

	obj = NULL;
	result = named_config_get(maps, "max-zone-ttl", &obj);
	if (result == ISC_R_SUCCESS && masterformat == dns_masterformat_map) {
		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
			      "zone '%s': 'max-zone-ttl' is not compatible "
			      "with 'masterfile-format map'",
			      zname);
		return (ISC_R_FAILURE);
	} else if (result == ISC_R_SUCCESS) {
		dns_ttl_t maxttl = 0; /* unlimited */

		if (cfg_obj_isduration(obj)) {
			maxttl = cfg_obj_asduration(obj);
		}
		dns_zone_setmaxttl(zone, maxttl);
		if (raw != NULL) {
			dns_zone_setmaxttl(raw, maxttl);
		}
	}

	obj = NULL;
	result = named_config_get(maps, "max-records", &obj);
	INSIST(result == ISC_R_SUCCESS && obj != NULL);
	dns_zone_setmaxrecords(mayberaw, cfg_obj_asuint32(obj));
	if (zone != mayberaw) {
		dns_zone_setmaxrecords(zone, 0);
	}

	if (raw != NULL && filename != NULL) {
#define SIGNED ".signed"
		size_t signedlen = strlen(filename) + sizeof(SIGNED);
		char *signedname;

		RETERR(dns_zone_setfile(raw, filename, masterformat,
					masterstyle));
		signedname = isc_mem_get(mctx, signedlen);

		(void)snprintf(signedname, signedlen, "%s" SIGNED, filename);
		result = dns_zone_setfile(zone, signedname,
					  dns_masterformat_raw, NULL);
		isc_mem_put(mctx, signedname, signedlen);
		if (result != ISC_R_SUCCESS) {
			return (result);
		}
	} else {
		RETERR(dns_zone_setfile(zone, filename, masterformat,
					masterstyle));
	}

	obj = NULL;
	result = cfg_map_get(zoptions, "journal", &obj);
	if (result == ISC_R_SUCCESS) {
		RETERR(dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj)));
	}

	/*
	 * Notify messages are processed by the raw zone if it exists.
	 */
	if (ztype == dns_zone_slave || ztype == dns_zone_mirror) {
		RETERR(configure_zone_acl(
			zconfig, vconfig, config, allow_notify, ac, mayberaw,
			dns_zone_setnotifyacl, dns_zone_clearnotifyacl));
	}

	/*
	 * XXXAG This probably does not make sense for stubs.
	 */
	RETERR(configure_zone_acl(zconfig, vconfig, config, allow_query, ac,
				  zone, dns_zone_setqueryacl,
				  dns_zone_clearqueryacl));

	RETERR(configure_zone_acl(zconfig, vconfig, config, allow_query_on, ac,
				  zone, dns_zone_setqueryonacl,
				  dns_zone_clearqueryonacl));

	obj = NULL;
	result = named_config_get(maps, "dialup", &obj);
	INSIST(result == ISC_R_SUCCESS && obj != NULL);
	if (cfg_obj_isboolean(obj)) {
		if (cfg_obj_asboolean(obj)) {
			dialup = dns_dialuptype_yes;
		} else {
			dialup = dns_dialuptype_no;
		}
	} else {
		const char *dialupstr = cfg_obj_asstring(obj);
		if (strcasecmp(dialupstr, "notify") == 0) {
			dialup = dns_dialuptype_notify;
		} else if (strcasecmp(dialupstr, "notify-passive") == 0) {
			dialup = dns_dialuptype_notifypassive;
		} else if (strcasecmp(dialupstr, "refresh") == 0) {
			dialup = dns_dialuptype_refresh;
		} else if (strcasecmp(dialupstr, "passive") == 0) {
			dialup = dns_dialuptype_passive;
		} else {
			INSIST(0);
			ISC_UNREACHABLE();
		}
	}
	if (raw != NULL) {
		dns_zone_setdialup(raw, dialup);
	}
	dns_zone_setdialup(zone, dialup);

	obj = NULL;
	result = named_config_get(maps, "zone-statistics", &obj);
	INSIST(result == ISC_R_SUCCESS && obj != NULL);
	if (cfg_obj_isboolean(obj)) {
		if (cfg_obj_asboolean(obj)) {
			statlevel = dns_zonestat_full;
		} else {
			statlevel = dns_zonestat_none;
		}
	} else {
		const char *levelstr = cfg_obj_asstring(obj);
		if (strcasecmp(levelstr, "full") == 0) {
			statlevel = dns_zonestat_full;
		} else if (strcasecmp(levelstr, "terse") == 0) {
			statlevel = dns_zonestat_terse;
		} else if (strcasecmp(levelstr, "none") == 0) {
			statlevel = dns_zonestat_none;
		} else {
			INSIST(0);
			ISC_UNREACHABLE();
		}
	}
	dns_zone_setstatlevel(zone, statlevel);

	zoneqrystats = NULL;
	rcvquerystats = NULL;
	dnssecsignstats = NULL;
	if (statlevel == dns_zonestat_full) {
		RETERR(isc_stats_create(mctx, &zoneqrystats,
					ns_statscounter_max));
		RETERR(dns_rdatatypestats_create(mctx, &rcvquerystats));
		RETERR(dns_dnssecsignstats_create(mctx, &dnssecsignstats));
	}
	dns_zone_setrequeststats(zone, zoneqrystats);
	dns_zone_setrcvquerystats(zone, rcvquerystats);
	dns_zone_setdnssecsignstats(zone, dnssecsignstats);

	if (zoneqrystats != NULL) {
		isc_stats_detach(&zoneqrystats);
	}

	if (rcvquerystats != NULL) {
		dns_stats_detach(&rcvquerystats);
	}

	if (dnssecsignstats != NULL) {
		dns_stats_detach(&dnssecsignstats);
	}

	/*
	 * Configure master functionality.  This applies
	 * to primary servers (type "primary") and secondaries
	 * acting as primaries (type "secondary"), but not to stubs.
	 */
	if (ztype != dns_zone_stub && ztype != dns_zone_staticstub &&
	    ztype != dns_zone_redirect)
	{
		obj = NULL;
		result = named_config_get(maps, "dnssec-policy", &obj);
		if (result == ISC_R_SUCCESS) {
			kaspname = cfg_obj_asstring(obj);
			result = dns_kasplist_find(kasplist, kaspname, &kasp);
			if (result != ISC_R_SUCCESS) {
				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
					    "'dnssec-policy '%s' not found ",
					    kaspname);
				RETERR(result);
			}
			dns_zone_setkasp(zone, kasp);
			use_kasp = dns_zone_use_kasp(zone);
		}

		obj = NULL;
		result = named_config_get(maps, "notify", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		if (cfg_obj_isboolean(obj)) {
			if (cfg_obj_asboolean(obj)) {
				notifytype = dns_notifytype_yes;
			} else {
				notifytype = dns_notifytype_no;
			}
		} else {
			const char *str = cfg_obj_asstring(obj);
			if (strcasecmp(str, "explicit") == 0) {
				notifytype = dns_notifytype_explicit;
			} else if (strcasecmp(str, "master-only") == 0 ||
				   strcasecmp(str, "primary-only") == 0)
			{
				notifytype = dns_notifytype_masteronly;
			} else {
				INSIST(0);
				ISC_UNREACHABLE();
			}
		}
		notifytype = process_notifytype(notifytype, ztype, zname,
						nodefault);
		if (raw != NULL) {
			dns_zone_setnotifytype(raw, dns_notifytype_no);
		}
		dns_zone_setnotifytype(zone, notifytype);

		obj = NULL;
		result = named_config_get(maps, "also-notify", &obj);
		if (result == ISC_R_SUCCESS &&
		    (notifytype == dns_notifytype_yes ||
		     notifytype == dns_notifytype_explicit ||
		     (notifytype == dns_notifytype_masteronly &&
		      ztype == dns_zone_master)))
		{
			dns_ipkeylist_t ipkl;
			dns_ipkeylist_init(&ipkl);

			RETERR(named_config_getipandkeylist(config, obj, mctx,
							    &ipkl));
			result = dns_zone_setalsonotifydscpkeys(
				zone, ipkl.addrs, ipkl.dscps, ipkl.keys,
				ipkl.count);
			dns_ipkeylist_clear(mctx, &ipkl);
			RETERR(result);
		} else {
			RETERR(dns_zone_setalsonotify(zone, NULL, 0));
		}

		obj = NULL;
		result = named_config_get(maps, "notify-source", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		RETERR(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
		dscp = cfg_obj_getdscp(obj);
		if (dscp == -1) {
			dscp = named_g_dscp;
		}
		RETERR(dns_zone_setnotifysrc4dscp(zone, dscp));
		named_add_reserved_dispatch(named_g_server,
					    cfg_obj_assockaddr(obj));

		obj = NULL;
		result = named_config_get(maps, "notify-source-v6", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		RETERR(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
		dscp = cfg_obj_getdscp(obj);
		if (dscp == -1) {
			dscp = named_g_dscp;
		}
		RETERR(dns_zone_setnotifysrc6dscp(zone, dscp));
		named_add_reserved_dispatch(named_g_server,
					    cfg_obj_assockaddr(obj));

		obj = NULL;
		result = named_config_get(maps, "notify-to-soa", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setoption(zone, DNS_ZONEOPT_NOTIFYTOSOA,
				   cfg_obj_asboolean(obj));

		dns_zone_setisself(zone, isself, named_g_server->interfacemgr);

		RETERR(configure_zone_acl(
			zconfig, vconfig, config, allow_transfer, ac, zone,
			dns_zone_setxfracl, dns_zone_clearxfracl));

		obj = NULL;
		result = named_config_get(maps, "max-transfer-time-out", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setmaxxfrout(zone, cfg_obj_asuint32(obj) * 60);

		obj = NULL;
		result = named_config_get(maps, "max-transfer-idle-out", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setidleout(zone, cfg_obj_asuint32(obj) * 60);

		obj = NULL;
		result = named_config_get(maps, "max-journal-size", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		if (raw != NULL) {
			dns_zone_setjournalsize(raw, -1);
		}
		dns_zone_setjournalsize(zone, -1);
		if (cfg_obj_isstring(obj)) {
			const char *str = cfg_obj_asstring(obj);
			if (strcasecmp(str, "unlimited") == 0) {
				journal_size = DNS_JOURNAL_SIZE_MAX;
			} else {
				INSIST(strcasecmp(str, "default") == 0);
				journal_size = -1;
			}
		} else {
			isc_resourcevalue_t value;
			value = cfg_obj_asuint64(obj);
			if (value > DNS_JOURNAL_SIZE_MAX) {
				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
					    "'max-journal-size "
					    "%" PRId64 "' "
					    "is too large",
					    value);
				RETERR(ISC_R_RANGE);
			}
			journal_size = (uint32_t)value;
		}
		if (raw != NULL) {
			dns_zone_setjournalsize(raw, journal_size);
		}
		dns_zone_setjournalsize(zone, journal_size);

		obj = NULL;
		result = named_config_get(maps, "ixfr-from-differences", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		if (cfg_obj_isboolean(obj)) {
			ixfrdiff = cfg_obj_asboolean(obj);
		} else if ((strcasecmp(cfg_obj_asstring(obj), "primary") == 0 ||
			    strcasecmp(cfg_obj_asstring(obj), "master") == 0) &&
			   ztype == dns_zone_master)
		{
			ixfrdiff = true;
		} else if ((strcasecmp(cfg_obj_asstring(obj), "secondary") ==
				    0 ||
			    strcasecmp(cfg_obj_asstring(obj), "slave") == 0) &&
			   ztype == dns_zone_slave)
		{
			ixfrdiff = true;
		} else {
			ixfrdiff = false;
		}
		if (raw != NULL) {
			dns_zone_setoption(raw, DNS_ZONEOPT_IXFRFROMDIFFS,
					   true);
			dns_zone_setoption(zone, DNS_ZONEOPT_IXFRFROMDIFFS,
					   false);
		} else {
			dns_zone_setoption(zone, DNS_ZONEOPT_IXFRFROMDIFFS,
					   ixfrdiff);
		}

		obj = NULL;
		result = named_config_get(maps, "max-ixfr-ratio", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		if (cfg_obj_isstring(obj)) {
			dns_zone_setixfrratio(zone, 0);
		} else {
			dns_zone_setixfrratio(zone, cfg_obj_aspercentage(obj));
		}

		obj = NULL;
		result = named_config_get(maps, "request-expire", &obj);
		INSIST(result == ISC_R_SUCCESS);
		dns_zone_setrequestexpire(zone, cfg_obj_asboolean(obj));

		obj = NULL;
		result = named_config_get(maps, "request-ixfr", &obj);
		INSIST(result == ISC_R_SUCCESS);
		dns_zone_setrequestixfr(zone, cfg_obj_asboolean(obj));

		obj = NULL;
		checknames(ztype, maps, &obj);
		INSIST(obj != NULL);
		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
			fail = false;
			check = true;
		} else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
			fail = check = true;
		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
			fail = check = false;
		} else {
			INSIST(0);
			ISC_UNREACHABLE();
		}
		if (raw != NULL) {
			dns_zone_setoption(raw, DNS_ZONEOPT_CHECKNAMES, check);
			dns_zone_setoption(raw, DNS_ZONEOPT_CHECKNAMESFAIL,
					   fail);
			dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMES, false);
			dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMESFAIL,
					   false);
		} else {
			dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMES, check);
			dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMESFAIL,
					   fail);
		}

		obj = NULL;
		result = named_config_get(maps, "notify-delay", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setnotifydelay(zone, cfg_obj_asuint32(obj));

		obj = NULL;
		result = named_config_get(maps, "check-sibling", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSIBLING,
				   cfg_obj_asboolean(obj));

		obj = NULL;
		result = named_config_get(maps, "check-spf", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
			check = true;
		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
			check = false;
		} else {
			INSIST(0);
			ISC_UNREACHABLE();
		}
		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSPF, check);

		obj = NULL;
		result = named_config_get(maps, "zero-no-soa-ttl", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setzeronosoattl(zone, cfg_obj_asboolean(obj));

		obj = NULL;
		result = named_config_get(maps, "nsec3-test-zone", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setoption(zone, DNS_ZONEOPT_NSEC3TESTZONE,
				   cfg_obj_asboolean(obj));
	} else if (ztype == dns_zone_redirect) {
		dns_zone_setnotifytype(zone, dns_notifytype_no);

		obj = NULL;
		result = named_config_get(maps, "max-journal-size", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setjournalsize(zone, -1);
		if (cfg_obj_isstring(obj)) {
			const char *str = cfg_obj_asstring(obj);
			if (strcasecmp(str, "unlimited") == 0) {
				journal_size = DNS_JOURNAL_SIZE_MAX;
			} else {
				INSIST(strcasecmp(str, "default") == 0);
				journal_size = -1;
			}
		} else {
			isc_resourcevalue_t value;
			value = cfg_obj_asuint64(obj);
			if (value > DNS_JOURNAL_SIZE_MAX) {
				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
					    "'max-journal-size "
					    "%" PRId64 "' "
					    "is too large",
					    value);
				RETERR(ISC_R_RANGE);
			}
			journal_size = (uint32_t)value;
		}
		dns_zone_setjournalsize(zone, journal_size);
	}

	/*
	 * Configure update-related options.  These apply to
	 * primary servers only.
	 */
	if (ztype == dns_zone_master) {
		dns_acl_t *updateacl;

		RETERR(configure_zone_acl(
			zconfig, vconfig, config, allow_update, ac, mayberaw,
			dns_zone_setupdateacl, dns_zone_clearupdateacl));

		updateacl = dns_zone_getupdateacl(mayberaw);
		if (updateacl != NULL && dns_acl_isinsecure(updateacl)) {
			isc_log_write(named_g_lctx, DNS_LOGCATEGORY_SECURITY,
				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
				      "zone '%s' allows unsigned updates "
				      "from remote hosts, which is insecure",
				      zname);
		}

		RETERR(configure_zone_ssutable(zoptions, mayberaw, zname));
	}

	if (ztype == dns_zone_master || raw != NULL) {
		const cfg_obj_t *validity, *resign;
		bool allow = false, maint = false;
		bool sigvalinsecs;

		if (use_kasp) {
			if (dns_kasp_nsec3(kasp)) {
				result = dns_zone_setnsec3param(
					zone, 1, dns_kasp_nsec3flags(kasp),
					dns_kasp_nsec3iter(kasp),
					dns_kasp_nsec3saltlen(kasp), NULL, true,
					false);
			} else {
				result = dns_zone_setnsec3param(
					zone, 0, 0, 0, 0, NULL, true, false);
			}
			INSIST(result == ISC_R_SUCCESS);
		}

		if (use_kasp) {
			seconds = (uint32_t)dns_kasp_sigvalidity_dnskey(kasp);
		} else {
			obj = NULL;
			result = named_config_get(maps, "dnskey-sig-validity",
						  &obj);
			INSIST(result == ISC_R_SUCCESS && obj != NULL);
			seconds = cfg_obj_asuint32(obj) * 86400;
		}
		dns_zone_setkeyvalidityinterval(zone, seconds);

		if (use_kasp) {
			seconds = (uint32_t)dns_kasp_sigvalidity(kasp);
			dns_zone_setsigvalidityinterval(zone, seconds);
			seconds = (uint32_t)dns_kasp_sigrefresh(kasp);
			dns_zone_setsigresigninginterval(zone, seconds);
		} else {
			obj = NULL;
			result = named_config_get(maps, "sig-validity-interval",
						  &obj);
			INSIST(result == ISC_R_SUCCESS && obj != NULL);

			sigvalinsecs = ns_server_getoption(
				named_g_server->sctx, NS_SERVER_SIGVALINSECS);
			validity = cfg_tuple_get(obj, "validity");
			seconds = cfg_obj_asuint32(validity);
			if (!sigvalinsecs) {
				seconds *= 86400;
			}
			dns_zone_setsigvalidityinterval(zone, seconds);

			resign = cfg_tuple_get(obj, "re-sign");
			if (cfg_obj_isvoid(resign)) {
				seconds /= 4;
			} else if (!sigvalinsecs) {
				uint32_t r = cfg_obj_asuint32(resign);
				if (seconds > 7 * 86400) {
					seconds = r * 86400;
				} else {
					seconds = r * 3600;
				}
			} else {
				seconds = cfg_obj_asuint32(resign);
			}
			dns_zone_setsigresigninginterval(zone, seconds);
		}

		obj = NULL;
		result = named_config_get(maps, "key-directory", &obj);
		if (result == ISC_R_SUCCESS) {
			filename = cfg_obj_asstring(obj);
			RETERR(dns_zone_setkeydirectory(zone, filename));
		}

		obj = NULL;
		result = named_config_get(maps, "sig-signing-signatures", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setsignatures(zone, cfg_obj_asuint32(obj));

		obj = NULL;
		result = named_config_get(maps, "sig-signing-nodes", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setnodes(zone, cfg_obj_asuint32(obj));

		obj = NULL;
		result = named_config_get(maps, "sig-signing-type", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setprivatetype(zone, cfg_obj_asuint32(obj));

		obj = NULL;
		result = named_config_get(maps, "update-check-ksk", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
				   cfg_obj_asboolean(obj));
		/*
		 * This setting will be ignored if dnssec-policy is used.
		 * named-checkconf will error if both are configured.
		 */

		obj = NULL;
		result = named_config_get(maps, "dnssec-dnskey-kskonly", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setoption(zone, DNS_ZONEOPT_DNSKEYKSKONLY,
				   cfg_obj_asboolean(obj));
		/*
		 * This setting will be ignored if dnssec-policy is used.
		 * named-checkconf will error if both are configured.
		 */

		obj = NULL;
		result = named_config_get(maps, "dnssec-loadkeys-interval",
					  &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		RETERR(dns_zone_setrefreshkeyinterval(zone,
						      cfg_obj_asuint32(obj)));

		obj = NULL;
		result = cfg_map_get(zoptions, "auto-dnssec", &obj);
		if (kasp != NULL && strcmp(dns_kasp_getname(kasp), "none") != 0)
		{
			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, true);
			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, true);
			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, true);
		} else if (result == ISC_R_SUCCESS) {
			const char *arg = cfg_obj_asstring(obj);
			if (strcasecmp(arg, "allow") == 0) {
				allow = true;
			} else if (strcasecmp(arg, "maintain") == 0) {
				allow = maint = true;
			} else if (strcasecmp(arg, "off") == 0) {
				/* Default */
			} else {
				INSIST(0);
				ISC_UNREACHABLE();
			}
			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, false);
			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
		} else {
			bool s2i = dns_zone_secure_to_insecure(zone, false);
			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, s2i);
			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, false);
			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, s2i);
		}
	}

	if (ztype == dns_zone_slave || ztype == dns_zone_mirror) {
		RETERR(configure_zone_acl(zconfig, vconfig, config,
					  allow_update_forwarding, ac, mayberaw,
					  dns_zone_setforwardacl,
					  dns_zone_clearforwardacl));
	}

	/*%
	 * Primary master functionality.
	 */
	if (ztype == dns_zone_master) {
		obj = NULL;
		result = named_config_get(maps, "check-wildcard", &obj);
		if (result == ISC_R_SUCCESS) {
			check = cfg_obj_asboolean(obj);
		} else {
			check = false;
		}
		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKWILDCARD, check);

		/*
		 * With map files, the default is ignore duplicate
		 * records.  With other master formats, the default is
		 * taken from the global configuration.
		 */
		obj = NULL;
		if (masterformat != dns_masterformat_map) {
			result = named_config_get(maps, "check-dup-records",
						  &obj);
			INSIST(result == ISC_R_SUCCESS && obj != NULL);
			dupcheck = cfg_obj_asstring(obj);
		} else {
			result = named_config_get(nodefault,
						  "check-dup-records", &obj);
			if (result == ISC_R_SUCCESS) {
				dupcheck = cfg_obj_asstring(obj);
			} else {
				dupcheck = "ignore";
			}
		}
		if (strcasecmp(dupcheck, "warn") == 0) {
			fail = false;
			check = true;
		} else if (strcasecmp(dupcheck, "fail") == 0) {
			fail = check = true;
		} else if (strcasecmp(dupcheck, "ignore") == 0) {
			fail = check = false;
		} else {
			INSIST(0);
			ISC_UNREACHABLE();
		}
		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRR, check);
		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRRFAIL, fail);

		obj = NULL;
		result = named_config_get(maps, "check-mx", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
			fail = false;
			check = true;
		} else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
			fail = check = true;
		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
			fail = check = false;
		} else {
			INSIST(0);
			ISC_UNREACHABLE();
		}
		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMX, check);
		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMXFAIL, fail);

		/*
		 * With map files, the default is *not* to check
		 * integrity.  With other master formats, the default is
		 * taken from the global configuration.
		 */
		obj = NULL;
		if (masterformat != dns_masterformat_map) {
			result = named_config_get(maps, "check-integrity",
						  &obj);
			INSIST(result == ISC_R_SUCCESS && obj != NULL);
			dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKINTEGRITY,
					   cfg_obj_asboolean(obj));
		} else {
			check = false;
			result = named_config_get(nodefault, "check-integrity",
						  &obj);
			if (result == ISC_R_SUCCESS) {
				check = cfg_obj_asboolean(obj);
			}
			dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKINTEGRITY,
					   check);
		}

		obj = NULL;
		result = named_config_get(maps, "check-mx-cname", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
			warn = true;
			ignore = false;
		} else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
			warn = ignore = false;
		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
			warn = ignore = true;
		} else {
			INSIST(0);
			ISC_UNREACHABLE();
		}
		dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNMXCNAME, warn);
		dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNOREMXCNAME, ignore);

		obj = NULL;
		result = named_config_get(maps, "check-srv-cname", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
			warn = true;
			ignore = false;
		} else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
			warn = ignore = false;
		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
			warn = ignore = true;
		} else {
			INSIST(0);
			ISC_UNREACHABLE();
		}
		dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNSRVCNAME, warn);
		dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNORESRVCNAME,
				   ignore);

		obj = NULL;
		result = named_config_get(maps, "dnssec-secure-to-insecure",
					  &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setoption(mayberaw, DNS_ZONEOPT_SECURETOINSECURE,
				   cfg_obj_asboolean(obj));

		obj = NULL;
		result = cfg_map_get(zoptions, "dnssec-update-mode", &obj);
		if (result == ISC_R_SUCCESS) {
			const char *arg = cfg_obj_asstring(obj);
			if (strcasecmp(arg, "no-resign") == 0) {
				dns_zone_setkeyopt(zone, DNS_ZONEKEY_NORESIGN,
						   true);
			} else if (strcasecmp(arg, "maintain") == 0) {
				/* Default */
			} else {
				INSIST(0);
				ISC_UNREACHABLE();
			}
		}

		obj = NULL;
		result = named_config_get(maps, "serial-update-method", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		if (strcasecmp(cfg_obj_asstring(obj), "unixtime") == 0) {
			dns_zone_setserialupdatemethod(
				zone, dns_updatemethod_unixtime);
		} else if (strcasecmp(cfg_obj_asstring(obj), "date") == 0) {
			dns_zone_setserialupdatemethod(zone,
						       dns_updatemethod_date);
		} else {
			dns_zone_setserialupdatemethod(
				zone, dns_updatemethod_increment);
		}
	}

	/*
	 * Configure slave functionality.
	 */
	switch (ztype) {
	case dns_zone_mirror:
		/*
		 * Disable outgoing zone transfers for mirror zones unless they
		 * are explicitly enabled by zone configuration.
		 */
		obj = NULL;
		(void)cfg_map_get(zoptions, "allow-transfer", &obj);
		if (obj == NULL) {
			dns_acl_t *none;
			RETERR(dns_acl_none(mctx, &none));
			dns_zone_setxfracl(zone, none);
			dns_acl_detach(&none);
		}
	/* FALLTHROUGH */
	case dns_zone_slave:
	case dns_zone_stub:
	case dns_zone_redirect:
		count = 0;
		obj = NULL;
		(void)cfg_map_get(zoptions, "primaries", &obj);
		if (obj == NULL) {
			(void)cfg_map_get(zoptions, "masters", &obj);
		}

		/*
		 * Use the built-in primary server list if one was not
		 * explicitly specified and this is a root zone mirror.
		 */
		if (obj == NULL && ztype == dns_zone_mirror &&
		    dns_name_equal(dns_zone_getorigin(zone), dns_rootname))
		{
			result = named_config_getprimariesdef(
				named_g_config,
				DEFAULT_IANA_ROOT_ZONE_PRIMARIES, &obj);
			RETERR(result);
		}
		if (obj != NULL) {
			dns_ipkeylist_t ipkl;
			dns_ipkeylist_init(&ipkl);

			RETERR(named_config_getipandkeylist(config, obj, mctx,
							    &ipkl));
			result = dns_zone_setprimarieswithkeys(
				mayberaw, ipkl.addrs, ipkl.keys, ipkl.count);
			count = ipkl.count;
			dns_ipkeylist_clear(mctx, &ipkl);
			RETERR(result);
		} else {
			result = dns_zone_setprimaries(mayberaw, NULL, 0);
		}
		RETERR(result);

		multi = false;
		if (count > 1) {
			obj = NULL;
			result = named_config_get(maps, "multi-master", &obj);
			INSIST(result == ISC_R_SUCCESS && obj != NULL);
			multi = cfg_obj_asboolean(obj);
		}
		dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi);

		obj = NULL;
		result = named_config_get(maps, "max-transfer-time-in", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setmaxxfrin(mayberaw, cfg_obj_asuint32(obj) * 60);

		obj = NULL;
		result = named_config_get(maps, "max-transfer-idle-in", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setidlein(mayberaw, cfg_obj_asuint32(obj) * 60);

		obj = NULL;
		result = named_config_get(maps, "max-refresh-time", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setmaxrefreshtime(mayberaw, cfg_obj_asuint32(obj));

		obj = NULL;
		result = named_config_get(maps, "min-refresh-time", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setminrefreshtime(mayberaw, cfg_obj_asuint32(obj));

		obj = NULL;
		result = named_config_get(maps, "max-retry-time", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setmaxretrytime(mayberaw, cfg_obj_asuint32(obj));

		obj = NULL;
		result = named_config_get(maps, "min-retry-time", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		dns_zone_setminretrytime(mayberaw, cfg_obj_asuint32(obj));

		obj = NULL;
		result = named_config_get(maps, "transfer-source", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		RETERR(dns_zone_setxfrsource4(mayberaw,
					      cfg_obj_assockaddr(obj)));
		dscp = cfg_obj_getdscp(obj);
		if (dscp == -1) {
			dscp = named_g_dscp;
		}
		RETERR(dns_zone_setxfrsource4dscp(mayberaw, dscp));
		named_add_reserved_dispatch(named_g_server,
					    cfg_obj_assockaddr(obj));

		obj = NULL;
		result = named_config_get(maps, "transfer-source-v6", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		RETERR(dns_zone_setxfrsource6(mayberaw,
					      cfg_obj_assockaddr(obj)));
		dscp = cfg_obj_getdscp(obj);
		if (dscp == -1) {
			dscp = named_g_dscp;
		}
		RETERR(dns_zone_setxfrsource6dscp(mayberaw, dscp));
		named_add_reserved_dispatch(named_g_server,
					    cfg_obj_assockaddr(obj));

		obj = NULL;
		result = named_config_get(maps, "alt-transfer-source", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		RETERR(dns_zone_setaltxfrsource4(mayberaw,
						 cfg_obj_assockaddr(obj)));
		dscp = cfg_obj_getdscp(obj);
		if (dscp == -1) {
			dscp = named_g_dscp;
		}
		RETERR(dns_zone_setaltxfrsource4dscp(mayberaw, dscp));

		obj = NULL;
		result = named_config_get(maps, "alt-transfer-source-v6", &obj);
		INSIST(result == ISC_R_SUCCESS && obj != NULL);
		RETERR(dns_zone_setaltxfrsource6(mayberaw,
						 cfg_obj_assockaddr(obj)));
		dscp = cfg_obj_getdscp(obj);
		if (dscp == -1) {
			dscp = named_g_dscp;
		}
		RETERR(dns_zone_setaltxfrsource6dscp(mayberaw, dscp));

		obj = NULL;
		(void)named_config_get(maps, "use-alt-transfer-source", &obj);
		if (obj == NULL) {
			/*
			 * Default off when views are in use otherwise
			 * on for BIND 8 compatibility.
			 */
			view = dns_zone_getview(zone);
			if (view != NULL && strcmp(view->name, "_default") == 0)
			{
				alt = true;
			} else {
				alt = false;
			}
		} else {
			alt = cfg_obj_asboolean(obj);
		}
		dns_zone_setoption(mayberaw, DNS_ZONEOPT_USEALTXFRSRC, alt);

		obj = NULL;
		(void)named_config_get(maps, "try-tcp-refresh", &obj);
		dns_zone_setoption(mayberaw, DNS_ZONEOPT_TRYTCPREFRESH,
				   cfg_obj_asboolean(obj));
		break;

	case dns_zone_staticstub:
		RETERR(configure_staticstub(zoptions, zone, zname,
					    default_dbtype));
		break;

	default:
		break;
	}

	return (ISC_R_SUCCESS);
}

/*
 * Set up a DLZ zone as writeable
 */
isc_result_t
named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
				   dns_rdataclass_t rdclass, dns_name_t *name) {
	dns_db_t *db = NULL;
	isc_time_t now;
	isc_result_t result;

	TIME_NOW(&now);

	dns_zone_settype(zone, dns_zone_dlz);
	result = dns_sdlz_setdb(dlzdatabase, rdclass, name, &db);
	if (result != ISC_R_SUCCESS) {
		return (result);
	}
	result = dns_zone_dlzpostload(zone, db);
	dns_db_detach(&db);
	return (result);
}

bool
named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
		    const cfg_obj_t *vconfig, const cfg_obj_t *config,
		    cfg_aclconfctx_t *actx) {
	const cfg_obj_t *zoptions = NULL;
	const cfg_obj_t *obj = NULL;
	const char *cfilename;
	const char *zfilename;
	dns_zone_t *raw = NULL;
	bool has_raw, inline_signing;
	dns_zonetype_t ztype;

	zoptions = cfg_tuple_get(zconfig, "options");

	/*
	 * We always reconfigure a static-stub zone for simplicity, assuming
	 * the amount of data to be loaded is small.
	 */
	if (zonetype_fromconfig(zoptions) == dns_zone_staticstub) {
		dns_zone_log(zone, ISC_LOG_DEBUG(1),
			     "not reusable: staticstub");
		return (false);
	}

	/* If there's a raw zone, use that for filename and type comparison */
	dns_zone_getraw(zone, &raw);
	if (raw != NULL) {
		zfilename = dns_zone_getfile(raw);
		ztype = dns_zone_gettype(raw);
		dns_zone_detach(&raw);
		has_raw = true;
	} else {
		zfilename = dns_zone_getfile(zone);
		ztype = dns_zone_gettype(zone);
		has_raw = false;
	}

	inline_signing = named_zone_inlinesigning(zone, zconfig, vconfig,
						  config, actx);
	if (!inline_signing && has_raw) {
		dns_zone_log(zone, ISC_LOG_DEBUG(1),
			     "not reusable: old zone was inline-signing");
		return (false);
	} else if (inline_signing && !has_raw) {
		dns_zone_log(zone, ISC_LOG_DEBUG(1),
			     "not reusable: old zone was not inline-signing");
		return (false);
	}

	if (zonetype_fromconfig(zoptions) != ztype) {
		dns_zone_log(zone, ISC_LOG_DEBUG(1),
			     "not reusable: type mismatch");
		return (false);
	}

	obj = NULL;
	(void)cfg_map_get(zoptions, "file", &obj);
	if (obj != NULL) {
		cfilename = cfg_obj_asstring(obj);
	} else {
		cfilename = NULL;
	}
	if (!((cfilename == NULL && zfilename == NULL) ||
	      (cfilename != NULL && zfilename != NULL &&
	       strcmp(cfilename, zfilename) == 0)))
	{
		dns_zone_log(zone, ISC_LOG_DEBUG(1),
			     "not reusable: filename mismatch");
		return (false);
	}

	return (true);
}

bool
named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
			 const cfg_obj_t *vconfig, const cfg_obj_t *config,
			 cfg_aclconfctx_t *actx) {
	isc_result_t res;
	const cfg_obj_t *zoptions = NULL;
	const cfg_obj_t *voptions = NULL;
	const cfg_obj_t *options = NULL;
	const cfg_obj_t *signing = NULL;
	const cfg_obj_t *allowupdate = NULL;
	const cfg_obj_t *updatepolicy = NULL;
	bool zone_is_dynamic = false;
	bool inline_signing = false;

	(void)cfg_map_get(config, "options", &options);

	zoptions = cfg_tuple_get(zconfig, "options");
	if (vconfig != NULL) {
		voptions = cfg_tuple_get(vconfig, "options");
	}

	inline_signing = (cfg_map_get(zoptions, "inline-signing", &signing) ==
				  ISC_R_SUCCESS &&
			  cfg_obj_asboolean(signing));
	if (inline_signing) {
		return (true);
	}

	if (cfg_map_get(zoptions, "update-policy", &updatepolicy) ==
	    ISC_R_SUCCESS) {
		zone_is_dynamic = true;
	} else {
		res = cfg_map_get(zoptions, "allow-update", &allowupdate);
		if (res != ISC_R_SUCCESS && voptions != NULL) {
			res = cfg_map_get(voptions, "allow-update",
					  &allowupdate);
		}
		if (res != ISC_R_SUCCESS && options != NULL) {
			res = cfg_map_get(options, "allow-update",
					  &allowupdate);
		}
		if (res == ISC_R_SUCCESS) {
			dns_acl_t *acl = NULL;
			res = cfg_acl_fromconfig(
				allowupdate, config, named_g_lctx, actx,
				dns_zone_getmctx(zone), 0, &acl);
			if (res == ISC_R_SUCCESS && acl != NULL &&
			    !dns_acl_isnone(acl)) {
				zone_is_dynamic = true;
			}
			if (acl != NULL) {
				dns_acl_detach(&acl);
			}
		}
	}

	/*
	 * If inline-signing is not set, perhaps implictly through a
	 * dnssec-policy.  Since automated DNSSEC maintenance requires
	 * a dynamic zone, or inline-siging to be enabled, check if
	 * the zone with dnssec-policy allows updates.  If not, enable
	 * inline-signing.
	 */
	signing = NULL;
	if (!inline_signing && !zone_is_dynamic &&
	    cfg_map_get(zoptions, "dnssec-policy", &signing) == ISC_R_SUCCESS &&
	    signing != NULL)
	{
		if (strcmp(cfg_obj_asstring(signing), "none") != 0) {
			inline_signing = true;
			dns_zone_log(zone, ISC_LOG_DEBUG(1),
				     "inline-signing: "
				     "implicitly through dnssec-policy");
		} else {
			inline_signing = dns_zone_secure_to_insecure(zone,
								     true);
			dns_zone_log(
				zone, ISC_LOG_DEBUG(1), "inline-signing: %s",
				inline_signing ? "transitioning to insecure"
					       : "no");
		}
	}

	return (inline_signing);
}