zoneconf.c revision 1.13
1 /* $NetBSD: zoneconf.c,v 1.13 2023/01/25 21:43:23 christos Exp $ */ 2 3 /* 4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC") 5 * 6 * SPDX-License-Identifier: MPL-2.0 7 * 8 * This Source Code Form is subject to the terms of the Mozilla Public 9 * License, v. 2.0. If a copy of the MPL was not distributed with this 10 * file, you can obtain one at https://mozilla.org/MPL/2.0/. 11 * 12 * See the COPYRIGHT file distributed with this work for additional 13 * information regarding copyright ownership. 14 */ 15 16 #include <inttypes.h> 17 #include <stdbool.h> 18 19 #include <isc/buffer.h> 20 #include <isc/file.h> 21 #include <isc/mem.h> 22 #include <isc/print.h> 23 #include <isc/stats.h> 24 #include <isc/string.h> /* Required for HP/UX (and others?) */ 25 #include <isc/util.h> 26 27 #include <dns/acl.h> 28 #include <dns/db.h> 29 #include <dns/fixedname.h> 30 #include <dns/ipkeylist.h> 31 #include <dns/journal.h> 32 #include <dns/kasp.h> 33 #include <dns/log.h> 34 #include <dns/masterdump.h> 35 #include <dns/name.h> 36 #include <dns/nsec3.h> 37 #include <dns/rdata.h> 38 #include <dns/rdatalist.h> 39 #include <dns/rdataset.h> 40 #include <dns/rdatatype.h> 41 #include <dns/result.h> 42 #include <dns/sdlz.h> 43 #include <dns/ssu.h> 44 #include <dns/stats.h> 45 #include <dns/tsig.h> 46 #include <dns/view.h> 47 #include <dns/zone.h> 48 49 #include <ns/client.h> 50 51 #include <named/config.h> 52 #include <named/globals.h> 53 #include <named/log.h> 54 #include <named/server.h> 55 #include <named/zoneconf.h> 56 57 /* ACLs associated with zone */ 58 typedef enum { 59 allow_notify, 60 allow_query, 61 allow_query_on, 62 allow_transfer, 63 allow_update, 64 allow_update_forwarding 65 } acl_type_t; 66 67 #define RETERR(x) \ 68 do { \ 69 isc_result_t _r = (x); \ 70 if (_r != ISC_R_SUCCESS) \ 71 return ((_r)); \ 72 } while (0) 73 74 #define CHECK(x) \ 75 do { \ 76 result = (x); \ 77 if (result != ISC_R_SUCCESS) \ 78 goto cleanup; \ 79 } while (0) 80 81 /*% 82 * Convenience function for configuring a single zone ACL. 83 */ 84 static isc_result_t 85 configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig, 86 const cfg_obj_t *config, acl_type_t acltype, 87 cfg_aclconfctx_t *actx, dns_zone_t *zone, 88 void (*setzacl)(dns_zone_t *, dns_acl_t *), 89 void (*clearzacl)(dns_zone_t *)) { 90 isc_result_t result; 91 const cfg_obj_t *maps[5] = { NULL, NULL, NULL, NULL, NULL }; 92 const cfg_obj_t *aclobj = NULL; 93 int i = 0; 94 dns_acl_t **aclp = NULL, *acl = NULL; 95 const char *aclname; 96 dns_view_t *view; 97 98 view = dns_zone_getview(zone); 99 100 switch (acltype) { 101 case allow_notify: 102 if (view != NULL) { 103 aclp = &view->notifyacl; 104 } 105 aclname = "allow-notify"; 106 break; 107 case allow_query: 108 if (view != NULL) { 109 aclp = &view->queryacl; 110 } 111 aclname = "allow-query"; 112 break; 113 case allow_query_on: 114 if (view != NULL) { 115 aclp = &view->queryonacl; 116 } 117 aclname = "allow-query-on"; 118 break; 119 case allow_transfer: 120 if (view != NULL) { 121 aclp = &view->transferacl; 122 } 123 aclname = "allow-transfer"; 124 break; 125 case allow_update: 126 if (view != NULL) { 127 aclp = &view->updateacl; 128 } 129 aclname = "allow-update"; 130 break; 131 case allow_update_forwarding: 132 if (view != NULL) { 133 aclp = &view->upfwdacl; 134 } 135 aclname = "allow-update-forwarding"; 136 break; 137 default: 138 UNREACHABLE(); 139 } 140 141 /* First check to see if ACL is defined within the zone */ 142 if (zconfig != NULL) { 143 maps[0] = cfg_tuple_get(zconfig, "options"); 144 (void)named_config_get(maps, aclname, &aclobj); 145 if (aclobj != NULL) { 146 aclp = NULL; 147 goto parse_acl; 148 } 149 } 150 151 /* Failing that, see if there's a default ACL already in the view */ 152 if (aclp != NULL && *aclp != NULL) { 153 (*setzacl)(zone, *aclp); 154 return (ISC_R_SUCCESS); 155 } 156 157 /* Check for default ACLs that haven't been parsed yet */ 158 if (vconfig != NULL) { 159 const cfg_obj_t *options = cfg_tuple_get(vconfig, "options"); 160 if (options != NULL) { 161 maps[i++] = options; 162 } 163 } 164 if (config != NULL) { 165 const cfg_obj_t *options = NULL; 166 (void)cfg_map_get(config, "options", &options); 167 if (options != NULL) { 168 maps[i++] = options; 169 } 170 } 171 maps[i++] = named_g_defaults; 172 maps[i] = NULL; 173 174 (void)named_config_get(maps, aclname, &aclobj); 175 if (aclobj == NULL) { 176 (*clearzacl)(zone); 177 return (ISC_R_SUCCESS); 178 } 179 180 parse_acl: 181 result = cfg_acl_fromconfig(aclobj, config, named_g_lctx, actx, 182 named_g_mctx, 0, &acl); 183 if (result != ISC_R_SUCCESS) { 184 return (result); 185 } 186 (*setzacl)(zone, acl); 187 188 /* Set the view default now */ 189 if (aclp != NULL) { 190 dns_acl_attach(acl, aclp); 191 } 192 193 dns_acl_detach(&acl); 194 return (ISC_R_SUCCESS); 195 } 196 197 /*% 198 * Parse the zone update-policy statement. 199 */ 200 static isc_result_t 201 configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone, 202 const char *zname) { 203 const cfg_obj_t *updatepolicy = NULL; 204 const cfg_listelt_t *element, *element2; 205 dns_ssutable_t *table = NULL; 206 isc_mem_t *mctx = dns_zone_getmctx(zone); 207 bool autoddns = false; 208 isc_result_t result; 209 210 (void)cfg_map_get(zconfig, "update-policy", &updatepolicy); 211 212 if (updatepolicy == NULL) { 213 dns_zone_setssutable(zone, NULL); 214 return (ISC_R_SUCCESS); 215 } 216 217 if (cfg_obj_isstring(updatepolicy) && 218 strcmp("local", cfg_obj_asstring(updatepolicy)) == 0) 219 { 220 autoddns = true; 221 updatepolicy = NULL; 222 } 223 224 result = dns_ssutable_create(mctx, &table); 225 if (result != ISC_R_SUCCESS) { 226 return (result); 227 } 228 229 for (element = cfg_list_first(updatepolicy); element != NULL; 230 element = cfg_list_next(element)) 231 { 232 const cfg_obj_t *stmt = cfg_listelt_value(element); 233 const cfg_obj_t *mode = cfg_tuple_get(stmt, "mode"); 234 const cfg_obj_t *identity = cfg_tuple_get(stmt, "identity"); 235 const cfg_obj_t *matchtype = cfg_tuple_get(stmt, "matchtype"); 236 const cfg_obj_t *dname = cfg_tuple_get(stmt, "name"); 237 const cfg_obj_t *typelist = cfg_tuple_get(stmt, "types"); 238 const char *str; 239 bool grant = false; 240 bool usezone = false; 241 dns_ssumatchtype_t mtype = dns_ssumatchtype_name; 242 dns_fixedname_t fname, fident; 243 isc_buffer_t b; 244 dns_rdatatype_t *types; 245 unsigned int i, n; 246 247 str = cfg_obj_asstring(mode); 248 if (strcasecmp(str, "grant") == 0) { 249 grant = true; 250 } else if (strcasecmp(str, "deny") == 0) { 251 grant = false; 252 } else { 253 UNREACHABLE(); 254 } 255 256 str = cfg_obj_asstring(matchtype); 257 CHECK(dns_ssu_mtypefromstring(str, &mtype)); 258 if (mtype == dns_ssumatchtype_subdomain && 259 strcasecmp(str, "zonesub") == 0) 260 { 261 usezone = true; 262 } 263 264 dns_fixedname_init(&fident); 265 str = cfg_obj_asstring(identity); 266 isc_buffer_constinit(&b, str, strlen(str)); 267 isc_buffer_add(&b, strlen(str)); 268 result = dns_name_fromtext(dns_fixedname_name(&fident), &b, 269 dns_rootname, 0, NULL); 270 if (result != ISC_R_SUCCESS) { 271 cfg_obj_log(identity, named_g_lctx, ISC_LOG_ERROR, 272 "'%s' is not a valid name", str); 273 goto cleanup; 274 } 275 276 dns_fixedname_init(&fname); 277 if (usezone) { 278 dns_name_copynf(dns_zone_getorigin(zone), 279 dns_fixedname_name(&fname)); 280 } else { 281 str = cfg_obj_asstring(dname); 282 isc_buffer_constinit(&b, str, strlen(str)); 283 isc_buffer_add(&b, strlen(str)); 284 result = dns_name_fromtext(dns_fixedname_name(&fname), 285 &b, dns_rootname, 0, NULL); 286 if (result != ISC_R_SUCCESS) { 287 cfg_obj_log(identity, named_g_lctx, 288 ISC_LOG_ERROR, 289 "'%s' is not a valid name", str); 290 goto cleanup; 291 } 292 } 293 294 n = named_config_listcount(typelist); 295 if (n == 0) { 296 types = NULL; 297 } else { 298 types = isc_mem_get(mctx, n * sizeof(dns_rdatatype_t)); 299 } 300 301 i = 0; 302 for (element2 = cfg_list_first(typelist); element2 != NULL; 303 element2 = cfg_list_next(element2)) 304 { 305 const cfg_obj_t *typeobj; 306 isc_textregion_t r; 307 308 INSIST(i < n); 309 310 typeobj = cfg_listelt_value(element2); 311 str = cfg_obj_asstring(typeobj); 312 DE_CONST(str, r.base); 313 r.length = strlen(str); 314 315 result = dns_rdatatype_fromtext(&types[i++], &r); 316 if (result != ISC_R_SUCCESS) { 317 cfg_obj_log(identity, named_g_lctx, 318 ISC_LOG_ERROR, 319 "'%s' is not a valid type", str); 320 isc_mem_put(mctx, types, 321 n * sizeof(dns_rdatatype_t)); 322 goto cleanup; 323 } 324 } 325 INSIST(i == n); 326 327 result = dns_ssutable_addrule( 328 table, grant, dns_fixedname_name(&fident), mtype, 329 dns_fixedname_name(&fname), n, types); 330 if (types != NULL) { 331 isc_mem_put(mctx, types, n * sizeof(dns_rdatatype_t)); 332 } 333 if (result != ISC_R_SUCCESS) { 334 goto cleanup; 335 } 336 } 337 338 /* 339 * If "update-policy local;" and a session key exists, 340 * then use the default policy, which is equivalent to: 341 * update-policy { grant <session-keyname> zonesub any; }; 342 */ 343 if (autoddns) { 344 dns_rdatatype_t any = dns_rdatatype_any; 345 346 if (named_g_server->session_keyname == NULL) { 347 isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL, 348 NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR, 349 "failed to enable auto DDNS policy " 350 "for zone %s: session key not found", 351 zname); 352 result = ISC_R_NOTFOUND; 353 goto cleanup; 354 } 355 356 result = dns_ssutable_addrule( 357 table, true, named_g_server->session_keyname, 358 dns_ssumatchtype_local, dns_zone_getorigin(zone), 1, 359 &any); 360 361 if (result != ISC_R_SUCCESS) { 362 goto cleanup; 363 } 364 } 365 366 result = ISC_R_SUCCESS; 367 dns_zone_setssutable(zone, table); 368 369 cleanup: 370 dns_ssutable_detach(&table); 371 return (result); 372 } 373 374 /* 375 * This is the TTL used for internally generated RRsets for static-stub zones. 376 * The value doesn't matter because the mapping is static, but needs to be 377 * defined for the sake of implementation. 378 */ 379 #define STATICSTUB_SERVER_TTL 86400 380 381 /*% 382 * Configure an apex NS with glues for a static-stub zone. 383 * For example, for the zone named "example.com", the following RRs will be 384 * added to the zone DB: 385 * example.com. NS example.com. 386 * example.com. A 192.0.2.1 387 * example.com. AAAA 2001:db8::1 388 */ 389 static isc_result_t 390 configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone, 391 dns_rdatalist_t *rdatalist_ns, 392 dns_rdatalist_t *rdatalist_a, 393 dns_rdatalist_t *rdatalist_aaaa) { 394 const cfg_listelt_t *element; 395 isc_mem_t *mctx = dns_zone_getmctx(zone); 396 isc_region_t region, sregion; 397 dns_rdata_t *rdata; 398 isc_result_t result = ISC_R_SUCCESS; 399 400 for (element = cfg_list_first(zconfig); element != NULL; 401 element = cfg_list_next(element)) 402 { 403 const isc_sockaddr_t *sa; 404 isc_netaddr_t na; 405 const cfg_obj_t *address = cfg_listelt_value(element); 406 dns_rdatalist_t *rdatalist; 407 408 sa = cfg_obj_assockaddr(address); 409 if (isc_sockaddr_getport(sa) != 0) { 410 cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR, 411 "port is not configurable for " 412 "static stub server-addresses"); 413 return (ISC_R_FAILURE); 414 } 415 isc_netaddr_fromsockaddr(&na, sa); 416 if (isc_netaddr_getzone(&na) != 0) { 417 cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR, 418 "scoped address is not allowed " 419 "for static stub " 420 "server-addresses"); 421 return (ISC_R_FAILURE); 422 } 423 424 switch (na.family) { 425 case AF_INET: 426 region.length = sizeof(na.type.in); 427 rdatalist = rdatalist_a; 428 break; 429 default: 430 INSIST(na.family == AF_INET6); 431 region.length = sizeof(na.type.in6); 432 rdatalist = rdatalist_aaaa; 433 break; 434 } 435 436 rdata = isc_mem_get(mctx, sizeof(*rdata) + region.length); 437 region.base = (unsigned char *)(rdata + 1); 438 memmove(region.base, &na.type, region.length); 439 dns_rdata_init(rdata); 440 dns_rdata_fromregion(rdata, dns_zone_getclass(zone), 441 rdatalist->type, ®ion); 442 ISC_LIST_APPEND(rdatalist->rdata, rdata, link); 443 } 444 445 /* 446 * If no address is specified (unlikely in this context, but possible), 447 * there's nothing to do anymore. 448 */ 449 if (ISC_LIST_EMPTY(rdatalist_a->rdata) && 450 ISC_LIST_EMPTY(rdatalist_aaaa->rdata)) 451 { 452 return (ISC_R_SUCCESS); 453 } 454 455 /* Add to the list an apex NS with the ns name being the origin name */ 456 dns_name_toregion(dns_zone_getorigin(zone), &sregion); 457 rdata = isc_mem_get(mctx, sizeof(*rdata) + sregion.length); 458 region.length = sregion.length; 459 region.base = (unsigned char *)(rdata + 1); 460 memmove(region.base, sregion.base, region.length); 461 dns_rdata_init(rdata); 462 dns_rdata_fromregion(rdata, dns_zone_getclass(zone), dns_rdatatype_ns, 463 ®ion); 464 ISC_LIST_APPEND(rdatalist_ns->rdata, rdata, link); 465 466 return (result); 467 } 468 469 /*% 470 * Configure an apex NS with an out-of-zone NS names for a static-stub zone. 471 * For example, for the zone named "example.com", something like the following 472 * RRs will be added to the zone DB: 473 * example.com. NS ns.example.net. 474 */ 475 static isc_result_t 476 configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone, 477 dns_rdatalist_t *rdatalist, 478 const char *zname) { 479 const cfg_listelt_t *element; 480 isc_mem_t *mctx = dns_zone_getmctx(zone); 481 dns_rdata_t *rdata; 482 isc_region_t sregion, region; 483 isc_result_t result = ISC_R_SUCCESS; 484 485 for (element = cfg_list_first(zconfig); element != NULL; 486 element = cfg_list_next(element)) 487 { 488 const cfg_obj_t *obj; 489 const char *str; 490 dns_fixedname_t fixed_name; 491 dns_name_t *nsname; 492 isc_buffer_t b; 493 494 obj = cfg_listelt_value(element); 495 str = cfg_obj_asstring(obj); 496 497 nsname = dns_fixedname_initname(&fixed_name); 498 499 isc_buffer_constinit(&b, str, strlen(str)); 500 isc_buffer_add(&b, strlen(str)); 501 result = dns_name_fromtext(nsname, &b, dns_rootname, 0, NULL); 502 if (result != ISC_R_SUCCESS) { 503 cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR, 504 "server-name '%s' is not a valid " 505 "name", 506 str); 507 return (result); 508 } 509 if (dns_name_issubdomain(nsname, dns_zone_getorigin(zone))) { 510 cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR, 511 "server-name '%s' must not be a " 512 "subdomain of zone name '%s'", 513 str, zname); 514 return (ISC_R_FAILURE); 515 } 516 517 dns_name_toregion(nsname, &sregion); 518 rdata = isc_mem_get(mctx, sizeof(*rdata) + sregion.length); 519 region.length = sregion.length; 520 region.base = (unsigned char *)(rdata + 1); 521 memmove(region.base, sregion.base, region.length); 522 dns_rdata_init(rdata); 523 dns_rdata_fromregion(rdata, dns_zone_getclass(zone), 524 dns_rdatatype_ns, ®ion); 525 ISC_LIST_APPEND(rdatalist->rdata, rdata, link); 526 } 527 528 return (result); 529 } 530 531 /*% 532 * Configure static-stub zone. 533 */ 534 static isc_result_t 535 configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone, 536 const char *zname, const char *dbtype) { 537 int i = 0; 538 const cfg_obj_t *obj; 539 isc_mem_t *mctx = dns_zone_getmctx(zone); 540 dns_db_t *db = NULL; 541 dns_dbversion_t *dbversion = NULL; 542 dns_dbnode_t *apexnode = NULL; 543 dns_name_t apexname; 544 isc_result_t result; 545 dns_rdataset_t rdataset; 546 dns_rdatalist_t rdatalist_ns, rdatalist_a, rdatalist_aaaa; 547 dns_rdatalist_t *rdatalists[] = { &rdatalist_ns, &rdatalist_a, 548 &rdatalist_aaaa, NULL }; 549 dns_rdata_t *rdata; 550 isc_region_t region; 551 552 /* Create the DB beforehand */ 553 RETERR(dns_db_create(mctx, dbtype, dns_zone_getorigin(zone), 554 dns_dbtype_stub, dns_zone_getclass(zone), 0, NULL, 555 &db)); 556 557 dns_rdataset_init(&rdataset); 558 559 dns_rdatalist_init(&rdatalist_ns); 560 rdatalist_ns.rdclass = dns_zone_getclass(zone); 561 rdatalist_ns.type = dns_rdatatype_ns; 562 rdatalist_ns.ttl = STATICSTUB_SERVER_TTL; 563 564 dns_rdatalist_init(&rdatalist_a); 565 rdatalist_a.rdclass = dns_zone_getclass(zone); 566 rdatalist_a.type = dns_rdatatype_a; 567 rdatalist_a.ttl = STATICSTUB_SERVER_TTL; 568 569 dns_rdatalist_init(&rdatalist_aaaa); 570 rdatalist_aaaa.rdclass = dns_zone_getclass(zone); 571 rdatalist_aaaa.type = dns_rdatatype_aaaa; 572 rdatalist_aaaa.ttl = STATICSTUB_SERVER_TTL; 573 574 /* Prepare zone RRs from the configuration */ 575 obj = NULL; 576 result = cfg_map_get(zconfig, "server-addresses", &obj); 577 if (result == ISC_R_SUCCESS) { 578 INSIST(obj != NULL); 579 CHECK(configure_staticstub_serveraddrs(obj, zone, &rdatalist_ns, 580 &rdatalist_a, 581 &rdatalist_aaaa)); 582 } 583 584 obj = NULL; 585 result = cfg_map_get(zconfig, "server-names", &obj); 586 if (result == ISC_R_SUCCESS) { 587 INSIST(obj != NULL); 588 CHECK(configure_staticstub_servernames(obj, zone, &rdatalist_ns, 589 zname)); 590 } 591 592 /* 593 * Sanity check: there should be at least one NS RR at the zone apex 594 * to trigger delegation. 595 */ 596 if (ISC_LIST_EMPTY(rdatalist_ns.rdata)) { 597 isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL, 598 NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR, 599 "No NS record is configured for a " 600 "static-stub zone '%s'", 601 zname); 602 result = ISC_R_FAILURE; 603 goto cleanup; 604 } 605 606 /* 607 * Now add NS and glue A/AAAA RRsets to the zone DB. 608 * First open a new version for the add operation and get a pointer 609 * to the apex node (all RRs are of the apex name). 610 */ 611 CHECK(dns_db_newversion(db, &dbversion)); 612 613 dns_name_init(&apexname, NULL); 614 dns_name_clone(dns_zone_getorigin(zone), &apexname); 615 CHECK(dns_db_findnode(db, &apexname, false, &apexnode)); 616 617 /* Add NS RRset */ 618 RUNTIME_CHECK(dns_rdatalist_tordataset(&rdatalist_ns, &rdataset) == 619 ISC_R_SUCCESS); 620 CHECK(dns_db_addrdataset(db, apexnode, dbversion, 0, &rdataset, 0, 621 NULL)); 622 dns_rdataset_disassociate(&rdataset); 623 624 /* Add glue A RRset, if any */ 625 if (!ISC_LIST_EMPTY(rdatalist_a.rdata)) { 626 RUNTIME_CHECK( 627 dns_rdatalist_tordataset(&rdatalist_a, &rdataset) == 628 ISC_R_SUCCESS); 629 CHECK(dns_db_addrdataset(db, apexnode, dbversion, 0, &rdataset, 630 0, NULL)); 631 dns_rdataset_disassociate(&rdataset); 632 } 633 634 /* Add glue AAAA RRset, if any */ 635 if (!ISC_LIST_EMPTY(rdatalist_aaaa.rdata)) { 636 RUNTIME_CHECK( 637 dns_rdatalist_tordataset(&rdatalist_aaaa, &rdataset) == 638 ISC_R_SUCCESS); 639 CHECK(dns_db_addrdataset(db, apexnode, dbversion, 0, &rdataset, 640 0, NULL)); 641 dns_rdataset_disassociate(&rdataset); 642 } 643 644 dns_db_closeversion(db, &dbversion, true); 645 dns_zone_setdb(zone, db); 646 647 result = ISC_R_SUCCESS; 648 649 cleanup: 650 if (dns_rdataset_isassociated(&rdataset)) { 651 dns_rdataset_disassociate(&rdataset); 652 } 653 if (apexnode != NULL) { 654 dns_db_detachnode(db, &apexnode); 655 } 656 if (dbversion != NULL) { 657 dns_db_closeversion(db, &dbversion, false); 658 } 659 if (db != NULL) { 660 dns_db_detach(&db); 661 } 662 for (i = 0; rdatalists[i] != NULL; i++) { 663 while ((rdata = ISC_LIST_HEAD(rdatalists[i]->rdata)) != NULL) { 664 ISC_LIST_UNLINK(rdatalists[i]->rdata, rdata, link); 665 dns_rdata_toregion(rdata, ®ion); 666 isc_mem_put(mctx, rdata, 667 sizeof(*rdata) + region.length); 668 } 669 } 670 671 INSIST(dbversion == NULL); 672 673 return (result); 674 } 675 676 /*% 677 * Convert a config file zone type into a server zone type. 678 */ 679 static dns_zonetype_t 680 zonetype_fromconfig(const cfg_obj_t *map) { 681 const cfg_obj_t *obj = NULL; 682 isc_result_t result; 683 684 result = cfg_map_get(map, "type", &obj); 685 INSIST(result == ISC_R_SUCCESS && obj != NULL); 686 return (named_config_getzonetype(obj)); 687 } 688 689 /*% 690 * Helper function for strtoargv(). Pardon the gratuitous recursion. 691 */ 692 static isc_result_t 693 strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp, 694 unsigned int n) { 695 isc_result_t result; 696 697 /* Discard leading whitespace. */ 698 while (*s == ' ' || *s == '\t') { 699 s++; 700 } 701 702 if (*s == '\0') { 703 /* We have reached the end of the string. */ 704 *argcp = n; 705 *argvp = isc_mem_get(mctx, n * sizeof(char *)); 706 } else { 707 char *p = s; 708 while (*p != ' ' && *p != '\t' && *p != '\0') { 709 p++; 710 } 711 if (*p != '\0') { 712 *p++ = '\0'; 713 } 714 715 result = strtoargvsub(mctx, p, argcp, argvp, n + 1); 716 if (result != ISC_R_SUCCESS) { 717 return (result); 718 } 719 (*argvp)[n] = s; 720 } 721 return (ISC_R_SUCCESS); 722 } 723 724 /*% 725 * Tokenize the string "s" into whitespace-separated words, 726 * return the number of words in '*argcp' and an array 727 * of pointers to the words in '*argvp'. The caller 728 * must free the array using isc_mem_put(). The string 729 * is modified in-place. 730 */ 731 static isc_result_t 732 strtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp) { 733 return (strtoargvsub(mctx, s, argcp, argvp, 0)); 734 } 735 736 static const char *const primary_synonyms[] = { "primary", "master", NULL }; 737 738 static const char *const secondary_synonyms[] = { "secondary", "slave", NULL }; 739 740 static void 741 checknames(dns_zonetype_t ztype, const cfg_obj_t **maps, 742 const cfg_obj_t **objp) { 743 isc_result_t result; 744 745 switch (ztype) { 746 case dns_zone_secondary: 747 case dns_zone_mirror: 748 result = named_checknames_get(maps, secondary_synonyms, objp); 749 break; 750 case dns_zone_primary: 751 result = named_checknames_get(maps, primary_synonyms, objp); 752 break; 753 default: 754 UNREACHABLE(); 755 } 756 757 INSIST(result == ISC_R_SUCCESS && objp != NULL && *objp != NULL); 758 } 759 760 /* 761 * Callback to see if a non-recursive query coming from 'srcaddr' to 762 * 'destaddr', with optional key 'mykey' for class 'rdclass' would be 763 * delivered to 'myview'. 764 * 765 * We run this unlocked as both the view list and the interface list 766 * are updated when the appropriate task has exclusivity. 767 */ 768 static bool 769 isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr, 770 const isc_sockaddr_t *dstaddr, dns_rdataclass_t rdclass, void *arg) { 771 ns_interfacemgr_t *interfacemgr = (ns_interfacemgr_t *)arg; 772 dns_aclenv_t *env = ns_interfacemgr_getaclenv(interfacemgr); 773 dns_view_t *view; 774 dns_tsigkey_t *key = NULL; 775 isc_netaddr_t netsrc; 776 isc_netaddr_t netdst; 777 778 if (interfacemgr == NULL) { 779 return (true); 780 } 781 782 if (!ns_interfacemgr_listeningon(interfacemgr, dstaddr)) { 783 return (false); 784 } 785 786 isc_netaddr_fromsockaddr(&netsrc, srcaddr); 787 isc_netaddr_fromsockaddr(&netdst, dstaddr); 788 789 for (view = ISC_LIST_HEAD(named_g_server->viewlist); view != NULL; 790 view = ISC_LIST_NEXT(view, link)) 791 { 792 const dns_name_t *tsig = NULL; 793 794 if (view->matchrecursiveonly) { 795 continue; 796 } 797 798 if (rdclass != view->rdclass) { 799 continue; 800 } 801 802 if (mykey != NULL) { 803 bool match; 804 isc_result_t result; 805 806 result = dns_view_gettsig(view, &mykey->name, &key); 807 if (result != ISC_R_SUCCESS) { 808 continue; 809 } 810 match = dst_key_compare(mykey->key, key->key); 811 dns_tsigkey_detach(&key); 812 if (!match) { 813 continue; 814 } 815 tsig = dns_tsigkey_identity(mykey); 816 } 817 818 if (dns_acl_allowed(&netsrc, tsig, view->matchclients, env) && 819 dns_acl_allowed(&netdst, tsig, view->matchdestinations, 820 env)) 821 { 822 break; 823 } 824 } 825 return (view == myview); 826 } 827 828 /*% 829 * For mirror zones, change "notify yes;" to "notify explicit;", informing the 830 * user only if "notify" was explicitly configured rather than inherited from 831 * default configuration. 832 */ 833 static dns_notifytype_t 834 process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype, 835 const char *zname, const cfg_obj_t **maps) { 836 const cfg_obj_t *obj = NULL; 837 838 /* 839 * Return the original setting if this is not a mirror zone or if the 840 * zone is configured with something else than "notify yes;". 841 */ 842 if (ztype != dns_zone_mirror || ntype != dns_notifytype_yes) { 843 return (ntype); 844 } 845 846 /* 847 * Only log a message if "notify" was set in the configuration 848 * hierarchy supplied in 'maps'. 849 */ 850 if (named_config_get(maps, "notify", &obj) == ISC_R_SUCCESS) { 851 cfg_obj_log(obj, named_g_lctx, ISC_LOG_INFO, 852 "'notify explicit;' will be used for mirror zone " 853 "'%s'", 854 zname); 855 } 856 857 return (dns_notifytype_explicit); 858 } 859 860 isc_result_t 861 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, 862 const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac, 863 dns_kasplist_t *kasplist, dns_zone_t *zone, 864 dns_zone_t *raw) { 865 isc_result_t result; 866 const char *zname; 867 dns_rdataclass_t zclass; 868 dns_rdataclass_t vclass; 869 const cfg_obj_t *maps[5]; 870 const cfg_obj_t *nodefault[4]; 871 const cfg_obj_t *zoptions = NULL; 872 const cfg_obj_t *options = NULL; 873 const cfg_obj_t *obj; 874 const char *filename = NULL; 875 const char *kaspname = NULL; 876 const char *dupcheck; 877 dns_notifytype_t notifytype = dns_notifytype_yes; 878 uint32_t count; 879 unsigned int dbargc; 880 char **dbargv; 881 static char default_dbtype[] = "rbt"; 882 static char dlz_dbtype[] = "dlz"; 883 char *cpval = default_dbtype; 884 isc_mem_t *mctx = dns_zone_getmctx(zone); 885 dns_dialuptype_t dialup = dns_dialuptype_no; 886 dns_zonetype_t ztype; 887 int i; 888 int32_t journal_size; 889 bool multi; 890 bool alt; 891 dns_view_t *view = NULL; 892 dns_kasp_t *kasp = NULL; 893 bool check = false, fail = false; 894 bool warn = false, ignore = false; 895 bool ixfrdiff; 896 bool use_kasp = false; 897 dns_masterformat_t masterformat; 898 const dns_master_style_t *masterstyle = &dns_master_style_default; 899 isc_stats_t *zoneqrystats; 900 dns_stats_t *rcvquerystats; 901 dns_stats_t *dnssecsignstats; 902 dns_zonestat_level_t statlevel = dns_zonestat_none; 903 int seconds; 904 dns_ttl_t maxttl = 0; /* unlimited */ 905 dns_zone_t *mayberaw = (raw != NULL) ? raw : zone; 906 isc_dscp_t dscp; 907 908 i = 0; 909 if (zconfig != NULL) { 910 zoptions = cfg_tuple_get(zconfig, "options"); 911 nodefault[i] = maps[i] = zoptions; 912 i++; 913 } 914 if (vconfig != NULL) { 915 nodefault[i] = maps[i] = cfg_tuple_get(vconfig, "options"); 916 i++; 917 } 918 if (config != NULL) { 919 (void)cfg_map_get(config, "options", &options); 920 if (options != NULL) { 921 nodefault[i] = maps[i] = options; 922 i++; 923 } 924 } 925 nodefault[i] = NULL; 926 maps[i++] = named_g_defaults; 927 maps[i] = NULL; 928 929 if (vconfig != NULL) { 930 RETERR(named_config_getclass(cfg_tuple_get(vconfig, "class"), 931 dns_rdataclass_in, &vclass)); 932 } else { 933 vclass = dns_rdataclass_in; 934 } 935 936 /* 937 * Configure values common to all zone types. 938 */ 939 940 zname = cfg_obj_asstring(cfg_tuple_get(zconfig, "name")); 941 942 RETERR(named_config_getclass(cfg_tuple_get(zconfig, "class"), vclass, 943 &zclass)); 944 dns_zone_setclass(zone, zclass); 945 if (raw != NULL) { 946 dns_zone_setclass(raw, zclass); 947 } 948 949 ztype = zonetype_fromconfig(zoptions); 950 if (raw != NULL) { 951 dns_zone_settype(raw, ztype); 952 dns_zone_settype(zone, dns_zone_primary); 953 } else { 954 dns_zone_settype(zone, ztype); 955 } 956 957 obj = NULL; 958 result = cfg_map_get(zoptions, "database", &obj); 959 if (result == ISC_R_SUCCESS) { 960 cpval = isc_mem_strdup(mctx, cfg_obj_asstring(obj)); 961 } 962 if (cpval == NULL) { 963 return (ISC_R_NOMEMORY); 964 } 965 966 obj = NULL; 967 result = cfg_map_get(zoptions, "dlz", &obj); 968 if (result == ISC_R_SUCCESS) { 969 const char *dlzname = cfg_obj_asstring(obj); 970 size_t len; 971 972 if (cpval != default_dbtype) { 973 isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL, 974 NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR, 975 "zone '%s': both 'database' and 'dlz' " 976 "specified", 977 zname); 978 return (ISC_R_FAILURE); 979 } 980 981 len = strlen(dlzname) + 5; 982 cpval = isc_mem_allocate(mctx, len); 983 snprintf(cpval, len, "dlz %s", dlzname); 984 } 985 986 result = strtoargv(mctx, cpval, &dbargc, &dbargv); 987 if (result != ISC_R_SUCCESS && cpval != default_dbtype) { 988 isc_mem_free(mctx, cpval); 989 return (result); 990 } 991 992 /* 993 * ANSI C is strange here. There is no logical reason why (char **) 994 * cannot be promoted automatically to (const char * const *) by the 995 * compiler w/o generating a warning. 996 */ 997 dns_zone_setdbtype(zone, dbargc, (const char *const *)dbargv); 998 isc_mem_put(mctx, dbargv, dbargc * sizeof(*dbargv)); 999 if (cpval != default_dbtype && cpval != dlz_dbtype) { 1000 isc_mem_free(mctx, cpval); 1001 } 1002 1003 obj = NULL; 1004 result = cfg_map_get(zoptions, "file", &obj); 1005 if (result == ISC_R_SUCCESS) { 1006 filename = cfg_obj_asstring(obj); 1007 } 1008 1009 /* 1010 * Unless we're using some alternative database, a master zone 1011 * will be needing a master file. 1012 */ 1013 if (ztype == dns_zone_primary && cpval == default_dbtype && 1014 filename == NULL) 1015 { 1016 isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL, 1017 NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR, 1018 "zone '%s': 'file' not specified", zname); 1019 return (ISC_R_FAILURE); 1020 } 1021 1022 if (ztype == dns_zone_secondary || ztype == dns_zone_mirror) { 1023 masterformat = dns_masterformat_raw; 1024 } else { 1025 masterformat = dns_masterformat_text; 1026 } 1027 obj = NULL; 1028 result = named_config_get(maps, "masterfile-format", &obj); 1029 if (result == ISC_R_SUCCESS) { 1030 const char *masterformatstr = cfg_obj_asstring(obj); 1031 1032 if (strcasecmp(masterformatstr, "text") == 0) { 1033 masterformat = dns_masterformat_text; 1034 } else if (strcasecmp(masterformatstr, "raw") == 0) { 1035 masterformat = dns_masterformat_raw; 1036 } else if (strcasecmp(masterformatstr, "map") == 0) { 1037 masterformat = dns_masterformat_map; 1038 cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING, 1039 "masterfile-format: format 'map' is " 1040 "deprecated"); 1041 } else { 1042 UNREACHABLE(); 1043 } 1044 } 1045 1046 obj = NULL; 1047 result = named_config_get(maps, "masterfile-style", &obj); 1048 if (result == ISC_R_SUCCESS) { 1049 const char *masterstylestr = cfg_obj_asstring(obj); 1050 1051 if (masterformat != dns_masterformat_text) { 1052 cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR, 1053 "zone '%s': 'masterfile-style' " 1054 "can only be used with " 1055 "'masterfile-format text'", 1056 zname); 1057 return (ISC_R_FAILURE); 1058 } 1059 1060 if (strcasecmp(masterstylestr, "full") == 0) { 1061 masterstyle = &dns_master_style_full; 1062 } else if (strcasecmp(masterstylestr, "relative") == 0) { 1063 masterstyle = &dns_master_style_default; 1064 } else { 1065 UNREACHABLE(); 1066 } 1067 } 1068 1069 obj = NULL; 1070 result = named_config_get(maps, "max-records", &obj); 1071 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1072 dns_zone_setmaxrecords(mayberaw, cfg_obj_asuint32(obj)); 1073 if (zone != mayberaw) { 1074 dns_zone_setmaxrecords(zone, 0); 1075 } 1076 1077 if (raw != NULL && filename != NULL) { 1078 #define SIGNED ".signed" 1079 size_t signedlen = strlen(filename) + sizeof(SIGNED); 1080 char *signedname; 1081 1082 RETERR(dns_zone_setfile(raw, filename, masterformat, 1083 masterstyle)); 1084 signedname = isc_mem_get(mctx, signedlen); 1085 1086 (void)snprintf(signedname, signedlen, "%s" SIGNED, filename); 1087 result = dns_zone_setfile(zone, signedname, 1088 dns_masterformat_raw, NULL); 1089 isc_mem_put(mctx, signedname, signedlen); 1090 if (result != ISC_R_SUCCESS) { 1091 return (result); 1092 } 1093 } else { 1094 RETERR(dns_zone_setfile(zone, filename, masterformat, 1095 masterstyle)); 1096 } 1097 1098 obj = NULL; 1099 result = cfg_map_get(zoptions, "journal", &obj); 1100 if (result == ISC_R_SUCCESS) { 1101 RETERR(dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj))); 1102 } 1103 1104 /* 1105 * Notify messages are processed by the raw zone if it exists. 1106 */ 1107 if (ztype == dns_zone_secondary || ztype == dns_zone_mirror) { 1108 RETERR(configure_zone_acl( 1109 zconfig, vconfig, config, allow_notify, ac, mayberaw, 1110 dns_zone_setnotifyacl, dns_zone_clearnotifyacl)); 1111 } 1112 1113 /* 1114 * XXXAG This probably does not make sense for stubs. 1115 */ 1116 RETERR(configure_zone_acl(zconfig, vconfig, config, allow_query, ac, 1117 zone, dns_zone_setqueryacl, 1118 dns_zone_clearqueryacl)); 1119 1120 RETERR(configure_zone_acl(zconfig, vconfig, config, allow_query_on, ac, 1121 zone, dns_zone_setqueryonacl, 1122 dns_zone_clearqueryonacl)); 1123 1124 obj = NULL; 1125 result = named_config_get(maps, "dialup", &obj); 1126 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1127 if (cfg_obj_isboolean(obj)) { 1128 if (cfg_obj_asboolean(obj)) { 1129 dialup = dns_dialuptype_yes; 1130 } else { 1131 dialup = dns_dialuptype_no; 1132 } 1133 } else { 1134 const char *dialupstr = cfg_obj_asstring(obj); 1135 if (strcasecmp(dialupstr, "notify") == 0) { 1136 dialup = dns_dialuptype_notify; 1137 } else if (strcasecmp(dialupstr, "notify-passive") == 0) { 1138 dialup = dns_dialuptype_notifypassive; 1139 } else if (strcasecmp(dialupstr, "refresh") == 0) { 1140 dialup = dns_dialuptype_refresh; 1141 } else if (strcasecmp(dialupstr, "passive") == 0) { 1142 dialup = dns_dialuptype_passive; 1143 } else { 1144 UNREACHABLE(); 1145 } 1146 } 1147 if (raw != NULL) { 1148 dns_zone_setdialup(raw, dialup); 1149 } 1150 dns_zone_setdialup(zone, dialup); 1151 1152 obj = NULL; 1153 result = named_config_get(maps, "zone-statistics", &obj); 1154 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1155 if (cfg_obj_isboolean(obj)) { 1156 if (cfg_obj_asboolean(obj)) { 1157 statlevel = dns_zonestat_full; 1158 } else { 1159 statlevel = dns_zonestat_none; 1160 } 1161 } else { 1162 const char *levelstr = cfg_obj_asstring(obj); 1163 if (strcasecmp(levelstr, "full") == 0) { 1164 statlevel = dns_zonestat_full; 1165 } else if (strcasecmp(levelstr, "terse") == 0) { 1166 statlevel = dns_zonestat_terse; 1167 } else if (strcasecmp(levelstr, "none") == 0) { 1168 statlevel = dns_zonestat_none; 1169 } else { 1170 UNREACHABLE(); 1171 } 1172 } 1173 dns_zone_setstatlevel(zone, statlevel); 1174 1175 zoneqrystats = NULL; 1176 rcvquerystats = NULL; 1177 dnssecsignstats = NULL; 1178 if (statlevel == dns_zonestat_full) { 1179 RETERR(isc_stats_create(mctx, &zoneqrystats, 1180 ns_statscounter_max)); 1181 RETERR(dns_rdatatypestats_create(mctx, &rcvquerystats)); 1182 RETERR(dns_dnssecsignstats_create(mctx, &dnssecsignstats)); 1183 } 1184 dns_zone_setrequeststats(zone, zoneqrystats); 1185 dns_zone_setrcvquerystats(zone, rcvquerystats); 1186 dns_zone_setdnssecsignstats(zone, dnssecsignstats); 1187 1188 if (zoneqrystats != NULL) { 1189 isc_stats_detach(&zoneqrystats); 1190 } 1191 1192 if (rcvquerystats != NULL) { 1193 dns_stats_detach(&rcvquerystats); 1194 } 1195 1196 if (dnssecsignstats != NULL) { 1197 dns_stats_detach(&dnssecsignstats); 1198 } 1199 1200 /* 1201 * Configure master functionality. This applies 1202 * to primary servers (type "primary") and secondaries 1203 * acting as primaries (type "secondary"), but not to stubs. 1204 */ 1205 if (ztype != dns_zone_stub && ztype != dns_zone_staticstub && 1206 ztype != dns_zone_redirect) 1207 { 1208 obj = NULL; 1209 result = named_config_get(maps, "dnssec-policy", &obj); 1210 if (result == ISC_R_SUCCESS) { 1211 kaspname = cfg_obj_asstring(obj); 1212 if (strcmp(kaspname, "none") != 0) { 1213 result = dns_kasplist_find(kasplist, kaspname, 1214 &kasp); 1215 if (result != ISC_R_SUCCESS) { 1216 cfg_obj_log( 1217 obj, named_g_lctx, 1218 ISC_LOG_ERROR, 1219 "dnssec-policy '%s' not found ", 1220 kaspname); 1221 RETERR(result); 1222 } 1223 dns_zone_setkasp(zone, kasp); 1224 use_kasp = true; 1225 } 1226 } 1227 if (!use_kasp) { 1228 dns_zone_setkasp(zone, NULL); 1229 } 1230 1231 obj = NULL; 1232 result = named_config_get(maps, "notify", &obj); 1233 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1234 if (cfg_obj_isboolean(obj)) { 1235 if (cfg_obj_asboolean(obj)) { 1236 notifytype = dns_notifytype_yes; 1237 } else { 1238 notifytype = dns_notifytype_no; 1239 } 1240 } else { 1241 const char *str = cfg_obj_asstring(obj); 1242 if (strcasecmp(str, "explicit") == 0) { 1243 notifytype = dns_notifytype_explicit; 1244 } else if (strcasecmp(str, "master-only") == 0 || 1245 strcasecmp(str, "primary-only") == 0) 1246 { 1247 notifytype = dns_notifytype_masteronly; 1248 } else { 1249 UNREACHABLE(); 1250 } 1251 } 1252 notifytype = process_notifytype(notifytype, ztype, zname, 1253 nodefault); 1254 if (raw != NULL) { 1255 dns_zone_setnotifytype(raw, dns_notifytype_no); 1256 } 1257 dns_zone_setnotifytype(zone, notifytype); 1258 1259 obj = NULL; 1260 result = named_config_get(maps, "also-notify", &obj); 1261 if (result == ISC_R_SUCCESS && 1262 (notifytype == dns_notifytype_yes || 1263 notifytype == dns_notifytype_explicit || 1264 (notifytype == dns_notifytype_masteronly && 1265 ztype == dns_zone_primary))) 1266 { 1267 dns_ipkeylist_t ipkl; 1268 dns_ipkeylist_init(&ipkl); 1269 1270 RETERR(named_config_getipandkeylist(config, "primaries", 1271 obj, mctx, &ipkl)); 1272 result = dns_zone_setalsonotifydscpkeys( 1273 zone, ipkl.addrs, ipkl.dscps, ipkl.keys, 1274 ipkl.count); 1275 dns_ipkeylist_clear(mctx, &ipkl); 1276 RETERR(result); 1277 } else { 1278 RETERR(dns_zone_setalsonotify(zone, NULL, 0)); 1279 } 1280 1281 obj = NULL; 1282 result = named_config_get(maps, "parental-source", &obj); 1283 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1284 RETERR(dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj))); 1285 dscp = cfg_obj_getdscp(obj); 1286 if (dscp == -1) { 1287 dscp = named_g_dscp; 1288 } 1289 RETERR(dns_zone_setparentalsrc4dscp(zone, dscp)); 1290 named_add_reserved_dispatch(named_g_server, 1291 cfg_obj_assockaddr(obj)); 1292 1293 obj = NULL; 1294 result = named_config_get(maps, "parental-source-v6", &obj); 1295 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1296 RETERR(dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj))); 1297 dscp = cfg_obj_getdscp(obj); 1298 if (dscp == -1) { 1299 dscp = named_g_dscp; 1300 } 1301 RETERR(dns_zone_setparentalsrc6dscp(zone, dscp)); 1302 named_add_reserved_dispatch(named_g_server, 1303 cfg_obj_assockaddr(obj)); 1304 1305 obj = NULL; 1306 result = named_config_get(maps, "notify-source", &obj); 1307 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1308 RETERR(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj))); 1309 dscp = cfg_obj_getdscp(obj); 1310 if (dscp == -1) { 1311 dscp = named_g_dscp; 1312 } 1313 RETERR(dns_zone_setnotifysrc4dscp(zone, dscp)); 1314 named_add_reserved_dispatch(named_g_server, 1315 cfg_obj_assockaddr(obj)); 1316 1317 obj = NULL; 1318 result = named_config_get(maps, "notify-source-v6", &obj); 1319 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1320 RETERR(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj))); 1321 dscp = cfg_obj_getdscp(obj); 1322 if (dscp == -1) { 1323 dscp = named_g_dscp; 1324 } 1325 RETERR(dns_zone_setnotifysrc6dscp(zone, dscp)); 1326 named_add_reserved_dispatch(named_g_server, 1327 cfg_obj_assockaddr(obj)); 1328 1329 obj = NULL; 1330 result = named_config_get(maps, "notify-to-soa", &obj); 1331 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1332 dns_zone_setoption(zone, DNS_ZONEOPT_NOTIFYTOSOA, 1333 cfg_obj_asboolean(obj)); 1334 1335 dns_zone_setisself(zone, isself, named_g_server->interfacemgr); 1336 1337 RETERR(configure_zone_acl( 1338 zconfig, vconfig, config, allow_transfer, ac, zone, 1339 dns_zone_setxfracl, dns_zone_clearxfracl)); 1340 1341 obj = NULL; 1342 result = named_config_get(maps, "max-transfer-time-out", &obj); 1343 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1344 dns_zone_setmaxxfrout(zone, cfg_obj_asuint32(obj) * 60); 1345 1346 obj = NULL; 1347 result = named_config_get(maps, "max-transfer-idle-out", &obj); 1348 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1349 dns_zone_setidleout(zone, cfg_obj_asuint32(obj) * 60); 1350 1351 obj = NULL; 1352 result = named_config_get(maps, "max-journal-size", &obj); 1353 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1354 if (raw != NULL) { 1355 dns_zone_setjournalsize(raw, -1); 1356 } 1357 dns_zone_setjournalsize(zone, -1); 1358 if (cfg_obj_isstring(obj)) { 1359 const char *str = cfg_obj_asstring(obj); 1360 if (strcasecmp(str, "unlimited") == 0) { 1361 journal_size = DNS_JOURNAL_SIZE_MAX; 1362 } else { 1363 INSIST(strcasecmp(str, "default") == 0); 1364 journal_size = -1; 1365 } 1366 } else { 1367 isc_resourcevalue_t value; 1368 value = cfg_obj_asuint64(obj); 1369 if (value > DNS_JOURNAL_SIZE_MAX) { 1370 cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR, 1371 "'max-journal-size " 1372 "%" PRId64 "' " 1373 "is too large", 1374 value); 1375 RETERR(ISC_R_RANGE); 1376 } 1377 journal_size = (uint32_t)value; 1378 } 1379 if (raw != NULL) { 1380 dns_zone_setjournalsize(raw, journal_size); 1381 } 1382 dns_zone_setjournalsize(zone, journal_size); 1383 1384 obj = NULL; 1385 result = named_config_get(maps, "ixfr-from-differences", &obj); 1386 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1387 if (cfg_obj_isboolean(obj)) { 1388 ixfrdiff = cfg_obj_asboolean(obj); 1389 } else if ((strcasecmp(cfg_obj_asstring(obj), "primary") == 0 || 1390 strcasecmp(cfg_obj_asstring(obj), "master") == 0) && 1391 ztype == dns_zone_primary) 1392 { 1393 ixfrdiff = true; 1394 } else if ((strcasecmp(cfg_obj_asstring(obj), "secondary") == 1395 0 || 1396 strcasecmp(cfg_obj_asstring(obj), "slave") == 0) && 1397 ztype == dns_zone_secondary) 1398 { 1399 ixfrdiff = true; 1400 } else { 1401 ixfrdiff = false; 1402 } 1403 if (raw != NULL) { 1404 dns_zone_setoption(raw, DNS_ZONEOPT_IXFRFROMDIFFS, 1405 true); 1406 dns_zone_setoption(zone, DNS_ZONEOPT_IXFRFROMDIFFS, 1407 false); 1408 } else { 1409 dns_zone_setoption(zone, DNS_ZONEOPT_IXFRFROMDIFFS, 1410 ixfrdiff); 1411 } 1412 1413 obj = NULL; 1414 result = named_config_get(maps, "max-ixfr-ratio", &obj); 1415 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1416 if (cfg_obj_isstring(obj)) { 1417 dns_zone_setixfrratio(zone, 0); 1418 } else { 1419 dns_zone_setixfrratio(zone, cfg_obj_aspercentage(obj)); 1420 } 1421 1422 obj = NULL; 1423 result = named_config_get(maps, "request-expire", &obj); 1424 INSIST(result == ISC_R_SUCCESS); 1425 dns_zone_setrequestexpire(zone, cfg_obj_asboolean(obj)); 1426 1427 obj = NULL; 1428 result = named_config_get(maps, "request-ixfr", &obj); 1429 INSIST(result == ISC_R_SUCCESS); 1430 dns_zone_setrequestixfr(zone, cfg_obj_asboolean(obj)); 1431 1432 obj = NULL; 1433 checknames(ztype, maps, &obj); 1434 INSIST(obj != NULL); 1435 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) { 1436 fail = false; 1437 check = true; 1438 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) { 1439 fail = check = true; 1440 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) { 1441 fail = check = false; 1442 } else { 1443 UNREACHABLE(); 1444 } 1445 if (raw != NULL) { 1446 dns_zone_setoption(raw, DNS_ZONEOPT_CHECKNAMES, check); 1447 dns_zone_setoption(raw, DNS_ZONEOPT_CHECKNAMESFAIL, 1448 fail); 1449 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMES, false); 1450 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMESFAIL, 1451 false); 1452 } else { 1453 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMES, check); 1454 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMESFAIL, 1455 fail); 1456 } 1457 1458 obj = NULL; 1459 result = named_config_get(maps, "notify-delay", &obj); 1460 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1461 dns_zone_setnotifydelay(zone, cfg_obj_asuint32(obj)); 1462 1463 obj = NULL; 1464 result = named_config_get(maps, "check-sibling", &obj); 1465 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1466 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSIBLING, 1467 cfg_obj_asboolean(obj)); 1468 1469 obj = NULL; 1470 result = named_config_get(maps, "check-spf", &obj); 1471 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1472 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) { 1473 check = true; 1474 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) { 1475 check = false; 1476 } else { 1477 UNREACHABLE(); 1478 } 1479 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSPF, check); 1480 1481 obj = NULL; 1482 result = named_config_get(maps, "zero-no-soa-ttl", &obj); 1483 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1484 dns_zone_setzeronosoattl(zone, cfg_obj_asboolean(obj)); 1485 1486 obj = NULL; 1487 result = named_config_get(maps, "nsec3-test-zone", &obj); 1488 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1489 dns_zone_setoption(zone, DNS_ZONEOPT_NSEC3TESTZONE, 1490 cfg_obj_asboolean(obj)); 1491 } else if (ztype == dns_zone_redirect) { 1492 dns_zone_setnotifytype(zone, dns_notifytype_no); 1493 1494 obj = NULL; 1495 result = named_config_get(maps, "max-journal-size", &obj); 1496 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1497 dns_zone_setjournalsize(zone, -1); 1498 if (cfg_obj_isstring(obj)) { 1499 const char *str = cfg_obj_asstring(obj); 1500 if (strcasecmp(str, "unlimited") == 0) { 1501 journal_size = DNS_JOURNAL_SIZE_MAX; 1502 } else { 1503 INSIST(strcasecmp(str, "default") == 0); 1504 journal_size = -1; 1505 } 1506 } else { 1507 isc_resourcevalue_t value; 1508 value = cfg_obj_asuint64(obj); 1509 if (value > DNS_JOURNAL_SIZE_MAX) { 1510 cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR, 1511 "'max-journal-size " 1512 "%" PRId64 "' " 1513 "is too large", 1514 value); 1515 RETERR(ISC_R_RANGE); 1516 } 1517 journal_size = (uint32_t)value; 1518 } 1519 dns_zone_setjournalsize(zone, journal_size); 1520 } 1521 1522 if (use_kasp) { 1523 maxttl = dns_kasp_zonemaxttl(dns_zone_getkasp(zone)); 1524 } else { 1525 obj = NULL; 1526 result = named_config_get(maps, "max-zone-ttl", &obj); 1527 if (result == ISC_R_SUCCESS) { 1528 if (cfg_obj_isduration(obj)) { 1529 maxttl = cfg_obj_asduration(obj); 1530 } 1531 } 1532 } 1533 dns_zone_setmaxttl(zone, maxttl); 1534 if (raw != NULL) { 1535 dns_zone_setmaxttl(raw, maxttl); 1536 } 1537 1538 /* 1539 * Configure update-related options. These apply to 1540 * primary servers only. 1541 */ 1542 if (ztype == dns_zone_primary) { 1543 dns_acl_t *updateacl; 1544 1545 RETERR(configure_zone_acl( 1546 zconfig, vconfig, config, allow_update, ac, mayberaw, 1547 dns_zone_setupdateacl, dns_zone_clearupdateacl)); 1548 1549 updateacl = dns_zone_getupdateacl(mayberaw); 1550 if (updateacl != NULL && dns_acl_isinsecure(updateacl)) { 1551 isc_log_write(named_g_lctx, DNS_LOGCATEGORY_SECURITY, 1552 NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING, 1553 "zone '%s' allows unsigned updates " 1554 "from remote hosts, which is insecure", 1555 zname); 1556 } 1557 1558 RETERR(configure_zone_ssutable(zoptions, mayberaw, zname)); 1559 } 1560 1561 /* 1562 * Configure DNSSEC signing. These apply to primary zones or zones that 1563 * use inline-signing (raw != NULL). 1564 */ 1565 if (ztype == dns_zone_primary || raw != NULL) { 1566 const cfg_obj_t *validity, *resign; 1567 bool allow = false, maint = false; 1568 bool sigvalinsecs; 1569 1570 if (use_kasp) { 1571 if (dns_kasp_nsec3(kasp)) { 1572 result = dns_zone_setnsec3param( 1573 zone, 1, dns_kasp_nsec3flags(kasp), 1574 dns_kasp_nsec3iter(kasp), 1575 dns_kasp_nsec3saltlen(kasp), NULL, true, 1576 false); 1577 } else { 1578 result = dns_zone_setnsec3param( 1579 zone, 0, 0, 0, 0, NULL, true, false); 1580 } 1581 INSIST(result == ISC_R_SUCCESS); 1582 } 1583 1584 if (use_kasp) { 1585 seconds = (uint32_t)dns_kasp_sigvalidity_dnskey(kasp); 1586 } else { 1587 obj = NULL; 1588 result = named_config_get(maps, "dnskey-sig-validity", 1589 &obj); 1590 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1591 seconds = cfg_obj_asuint32(obj) * 86400; 1592 } 1593 dns_zone_setkeyvalidityinterval(zone, seconds); 1594 1595 if (use_kasp) { 1596 seconds = (uint32_t)dns_kasp_sigvalidity(kasp); 1597 dns_zone_setsigvalidityinterval(zone, seconds); 1598 seconds = (uint32_t)dns_kasp_sigrefresh(kasp); 1599 dns_zone_setsigresigninginterval(zone, seconds); 1600 } else { 1601 obj = NULL; 1602 result = named_config_get(maps, "sig-validity-interval", 1603 &obj); 1604 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1605 1606 sigvalinsecs = ns_server_getoption( 1607 named_g_server->sctx, NS_SERVER_SIGVALINSECS); 1608 validity = cfg_tuple_get(obj, "validity"); 1609 seconds = cfg_obj_asuint32(validity); 1610 if (!sigvalinsecs) { 1611 seconds *= 86400; 1612 } 1613 dns_zone_setsigvalidityinterval(zone, seconds); 1614 1615 resign = cfg_tuple_get(obj, "re-sign"); 1616 if (cfg_obj_isvoid(resign)) { 1617 seconds /= 4; 1618 } else if (!sigvalinsecs) { 1619 uint32_t r = cfg_obj_asuint32(resign); 1620 if (seconds > 7 * 86400) { 1621 seconds = r * 86400; 1622 } else { 1623 seconds = r * 3600; 1624 } 1625 } else { 1626 seconds = cfg_obj_asuint32(resign); 1627 } 1628 dns_zone_setsigresigninginterval(zone, seconds); 1629 } 1630 1631 obj = NULL; 1632 result = named_config_get(maps, "key-directory", &obj); 1633 if (result == ISC_R_SUCCESS) { 1634 filename = cfg_obj_asstring(obj); 1635 RETERR(dns_zone_setkeydirectory(zone, filename)); 1636 } 1637 1638 obj = NULL; 1639 result = named_config_get(maps, "sig-signing-signatures", &obj); 1640 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1641 dns_zone_setsignatures(zone, cfg_obj_asuint32(obj)); 1642 1643 obj = NULL; 1644 result = named_config_get(maps, "sig-signing-nodes", &obj); 1645 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1646 dns_zone_setnodes(zone, cfg_obj_asuint32(obj)); 1647 1648 obj = NULL; 1649 result = named_config_get(maps, "sig-signing-type", &obj); 1650 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1651 dns_zone_setprivatetype(zone, cfg_obj_asuint32(obj)); 1652 1653 obj = NULL; 1654 result = named_config_get(maps, "update-check-ksk", &obj); 1655 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1656 dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK, 1657 cfg_obj_asboolean(obj)); 1658 /* 1659 * This setting will be ignored if dnssec-policy is used. 1660 * named-checkconf will error if both are configured. 1661 */ 1662 1663 obj = NULL; 1664 result = named_config_get(maps, "dnssec-dnskey-kskonly", &obj); 1665 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1666 dns_zone_setoption(zone, DNS_ZONEOPT_DNSKEYKSKONLY, 1667 cfg_obj_asboolean(obj)); 1668 /* 1669 * This setting will be ignored if dnssec-policy is used. 1670 * named-checkconf will error if both are configured. 1671 */ 1672 1673 obj = NULL; 1674 result = named_config_get(maps, "dnssec-loadkeys-interval", 1675 &obj); 1676 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1677 RETERR(dns_zone_setrefreshkeyinterval(zone, 1678 cfg_obj_asuint32(obj))); 1679 1680 obj = NULL; 1681 result = cfg_map_get(zoptions, "auto-dnssec", &obj); 1682 if (kasp != NULL) { 1683 bool s2i = (strcmp(dns_kasp_getname(kasp), 1684 "insecure") != 0); 1685 dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, true); 1686 dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, !s2i); 1687 dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, true); 1688 } else if (result == ISC_R_SUCCESS) { 1689 const char *arg = cfg_obj_asstring(obj); 1690 if (strcasecmp(arg, "allow") == 0) { 1691 allow = true; 1692 } else if (strcasecmp(arg, "maintain") == 0) { 1693 allow = maint = true; 1694 } else if (strcasecmp(arg, "off") == 0) { 1695 /* Default */ 1696 } else { 1697 UNREACHABLE(); 1698 } 1699 dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow); 1700 dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, false); 1701 dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint); 1702 } 1703 } 1704 1705 if (ztype == dns_zone_secondary || ztype == dns_zone_mirror) { 1706 RETERR(configure_zone_acl(zconfig, vconfig, config, 1707 allow_update_forwarding, ac, mayberaw, 1708 dns_zone_setforwardacl, 1709 dns_zone_clearforwardacl)); 1710 } 1711 1712 /*% 1713 * Configure parental agents, applies to primary and secondary zones. 1714 */ 1715 if (ztype == dns_zone_primary || ztype == dns_zone_secondary) { 1716 obj = NULL; 1717 (void)cfg_map_get(zoptions, "parental-agents", &obj); 1718 if (obj != NULL) { 1719 dns_ipkeylist_t ipkl; 1720 dns_ipkeylist_init(&ipkl); 1721 RETERR(named_config_getipandkeylist( 1722 config, "parental-agents", obj, mctx, &ipkl)); 1723 result = dns_zone_setparentals(zone, ipkl.addrs, 1724 ipkl.keys, ipkl.count); 1725 dns_ipkeylist_clear(mctx, &ipkl); 1726 RETERR(result); 1727 } else { 1728 RETERR(dns_zone_setparentals(zone, NULL, NULL, 0)); 1729 } 1730 } 1731 1732 /*% 1733 * Primary master functionality. 1734 */ 1735 if (ztype == dns_zone_primary) { 1736 obj = NULL; 1737 result = named_config_get(maps, "check-wildcard", &obj); 1738 if (result == ISC_R_SUCCESS) { 1739 check = cfg_obj_asboolean(obj); 1740 } else { 1741 check = false; 1742 } 1743 dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKWILDCARD, check); 1744 1745 /* 1746 * With map files, the default is ignore duplicate 1747 * records. With other master formats, the default is 1748 * taken from the global configuration. 1749 */ 1750 obj = NULL; 1751 if (masterformat != dns_masterformat_map) { 1752 result = named_config_get(maps, "check-dup-records", 1753 &obj); 1754 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1755 dupcheck = cfg_obj_asstring(obj); 1756 } else { 1757 result = named_config_get(nodefault, 1758 "check-dup-records", &obj); 1759 if (result == ISC_R_SUCCESS) { 1760 dupcheck = cfg_obj_asstring(obj); 1761 } else { 1762 dupcheck = "ignore"; 1763 } 1764 } 1765 if (strcasecmp(dupcheck, "warn") == 0) { 1766 fail = false; 1767 check = true; 1768 } else if (strcasecmp(dupcheck, "fail") == 0) { 1769 fail = check = true; 1770 } else if (strcasecmp(dupcheck, "ignore") == 0) { 1771 fail = check = false; 1772 } else { 1773 UNREACHABLE(); 1774 } 1775 dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRR, check); 1776 dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRRFAIL, fail); 1777 1778 obj = NULL; 1779 result = named_config_get(maps, "check-mx", &obj); 1780 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1781 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) { 1782 fail = false; 1783 check = true; 1784 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) { 1785 fail = check = true; 1786 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) { 1787 fail = check = false; 1788 } else { 1789 UNREACHABLE(); 1790 } 1791 dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMX, check); 1792 dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMXFAIL, fail); 1793 1794 /* 1795 * With map files, the default is *not* to check 1796 * integrity. With other master formats, the default is 1797 * taken from the global configuration. 1798 */ 1799 obj = NULL; 1800 if (masterformat != dns_masterformat_map) { 1801 result = named_config_get(maps, "check-integrity", 1802 &obj); 1803 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1804 dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKINTEGRITY, 1805 cfg_obj_asboolean(obj)); 1806 } else { 1807 check = false; 1808 result = named_config_get(nodefault, "check-integrity", 1809 &obj); 1810 if (result == ISC_R_SUCCESS) { 1811 check = cfg_obj_asboolean(obj); 1812 } 1813 dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKINTEGRITY, 1814 check); 1815 } 1816 1817 obj = NULL; 1818 result = named_config_get(maps, "check-mx-cname", &obj); 1819 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1820 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) { 1821 warn = true; 1822 ignore = false; 1823 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) { 1824 warn = ignore = false; 1825 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) { 1826 warn = ignore = true; 1827 } else { 1828 UNREACHABLE(); 1829 } 1830 dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNMXCNAME, warn); 1831 dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNOREMXCNAME, ignore); 1832 1833 obj = NULL; 1834 result = named_config_get(maps, "check-srv-cname", &obj); 1835 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1836 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) { 1837 warn = true; 1838 ignore = false; 1839 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) { 1840 warn = ignore = false; 1841 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) { 1842 warn = ignore = true; 1843 } else { 1844 UNREACHABLE(); 1845 } 1846 dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNSRVCNAME, warn); 1847 dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNORESRVCNAME, 1848 ignore); 1849 1850 obj = NULL; 1851 result = named_config_get(maps, "dnssec-secure-to-insecure", 1852 &obj); 1853 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1854 dns_zone_setoption(mayberaw, DNS_ZONEOPT_SECURETOINSECURE, 1855 cfg_obj_asboolean(obj)); 1856 1857 obj = NULL; 1858 result = cfg_map_get(zoptions, "dnssec-update-mode", &obj); 1859 if (result == ISC_R_SUCCESS) { 1860 const char *arg = cfg_obj_asstring(obj); 1861 if (strcasecmp(arg, "no-resign") == 0) { 1862 dns_zone_setkeyopt(zone, DNS_ZONEKEY_NORESIGN, 1863 true); 1864 } else if (strcasecmp(arg, "maintain") == 0) { 1865 /* Default */ 1866 } else { 1867 UNREACHABLE(); 1868 } 1869 } 1870 1871 obj = NULL; 1872 result = named_config_get(maps, "serial-update-method", &obj); 1873 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1874 if (strcasecmp(cfg_obj_asstring(obj), "unixtime") == 0) { 1875 dns_zone_setserialupdatemethod( 1876 zone, dns_updatemethod_unixtime); 1877 } else if (strcasecmp(cfg_obj_asstring(obj), "date") == 0) { 1878 dns_zone_setserialupdatemethod(zone, 1879 dns_updatemethod_date); 1880 } else { 1881 dns_zone_setserialupdatemethod( 1882 zone, dns_updatemethod_increment); 1883 } 1884 } 1885 1886 /* 1887 * Configure slave functionality. 1888 */ 1889 switch (ztype) { 1890 case dns_zone_mirror: 1891 /* 1892 * Disable outgoing zone transfers for mirror zones unless they 1893 * are explicitly enabled by zone configuration. 1894 */ 1895 obj = NULL; 1896 (void)cfg_map_get(zoptions, "allow-transfer", &obj); 1897 if (obj == NULL) { 1898 dns_acl_t *none; 1899 RETERR(dns_acl_none(mctx, &none)); 1900 dns_zone_setxfracl(zone, none); 1901 dns_acl_detach(&none); 1902 } 1903 FALLTHROUGH; 1904 case dns_zone_secondary: 1905 case dns_zone_stub: 1906 case dns_zone_redirect: 1907 count = 0; 1908 obj = NULL; 1909 (void)cfg_map_get(zoptions, "primaries", &obj); 1910 if (obj == NULL) { 1911 (void)cfg_map_get(zoptions, "masters", &obj); 1912 } 1913 1914 /* 1915 * Use the built-in primary server list if one was not 1916 * explicitly specified and this is a root zone mirror. 1917 */ 1918 if (obj == NULL && ztype == dns_zone_mirror && 1919 dns_name_equal(dns_zone_getorigin(zone), dns_rootname)) 1920 { 1921 result = named_config_getremotesdef( 1922 named_g_config, "primaries", 1923 DEFAULT_IANA_ROOT_ZONE_PRIMARIES, &obj); 1924 RETERR(result); 1925 } 1926 if (obj != NULL) { 1927 dns_ipkeylist_t ipkl; 1928 dns_ipkeylist_init(&ipkl); 1929 1930 RETERR(named_config_getipandkeylist(config, "primaries", 1931 obj, mctx, &ipkl)); 1932 result = dns_zone_setprimarieswithkeys( 1933 mayberaw, ipkl.addrs, ipkl.keys, ipkl.count); 1934 count = ipkl.count; 1935 dns_ipkeylist_clear(mctx, &ipkl); 1936 RETERR(result); 1937 } else { 1938 result = dns_zone_setprimaries(mayberaw, NULL, 0); 1939 } 1940 RETERR(result); 1941 1942 multi = false; 1943 if (count > 1) { 1944 obj = NULL; 1945 result = named_config_get(maps, "multi-master", &obj); 1946 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1947 multi = cfg_obj_asboolean(obj); 1948 } 1949 dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi); 1950 1951 obj = NULL; 1952 result = named_config_get(maps, "max-transfer-time-in", &obj); 1953 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1954 dns_zone_setmaxxfrin(mayberaw, cfg_obj_asuint32(obj) * 60); 1955 1956 obj = NULL; 1957 result = named_config_get(maps, "max-transfer-idle-in", &obj); 1958 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1959 dns_zone_setidlein(mayberaw, cfg_obj_asuint32(obj) * 60); 1960 1961 obj = NULL; 1962 result = named_config_get(maps, "max-refresh-time", &obj); 1963 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1964 dns_zone_setmaxrefreshtime(mayberaw, cfg_obj_asuint32(obj)); 1965 1966 obj = NULL; 1967 result = named_config_get(maps, "min-refresh-time", &obj); 1968 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1969 dns_zone_setminrefreshtime(mayberaw, cfg_obj_asuint32(obj)); 1970 1971 obj = NULL; 1972 result = named_config_get(maps, "max-retry-time", &obj); 1973 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1974 dns_zone_setmaxretrytime(mayberaw, cfg_obj_asuint32(obj)); 1975 1976 obj = NULL; 1977 result = named_config_get(maps, "min-retry-time", &obj); 1978 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1979 dns_zone_setminretrytime(mayberaw, cfg_obj_asuint32(obj)); 1980 1981 obj = NULL; 1982 result = named_config_get(maps, "transfer-source", &obj); 1983 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1984 RETERR(dns_zone_setxfrsource4(mayberaw, 1985 cfg_obj_assockaddr(obj))); 1986 dscp = cfg_obj_getdscp(obj); 1987 if (dscp == -1) { 1988 dscp = named_g_dscp; 1989 } 1990 RETERR(dns_zone_setxfrsource4dscp(mayberaw, dscp)); 1991 named_add_reserved_dispatch(named_g_server, 1992 cfg_obj_assockaddr(obj)); 1993 1994 obj = NULL; 1995 result = named_config_get(maps, "transfer-source-v6", &obj); 1996 INSIST(result == ISC_R_SUCCESS && obj != NULL); 1997 RETERR(dns_zone_setxfrsource6(mayberaw, 1998 cfg_obj_assockaddr(obj))); 1999 dscp = cfg_obj_getdscp(obj); 2000 if (dscp == -1) { 2001 dscp = named_g_dscp; 2002 } 2003 RETERR(dns_zone_setxfrsource6dscp(mayberaw, dscp)); 2004 named_add_reserved_dispatch(named_g_server, 2005 cfg_obj_assockaddr(obj)); 2006 2007 obj = NULL; 2008 result = named_config_get(maps, "alt-transfer-source", &obj); 2009 INSIST(result == ISC_R_SUCCESS && obj != NULL); 2010 RETERR(dns_zone_setaltxfrsource4(mayberaw, 2011 cfg_obj_assockaddr(obj))); 2012 dscp = cfg_obj_getdscp(obj); 2013 if (dscp == -1) { 2014 dscp = named_g_dscp; 2015 } 2016 RETERR(dns_zone_setaltxfrsource4dscp(mayberaw, dscp)); 2017 2018 obj = NULL; 2019 result = named_config_get(maps, "alt-transfer-source-v6", &obj); 2020 INSIST(result == ISC_R_SUCCESS && obj != NULL); 2021 RETERR(dns_zone_setaltxfrsource6(mayberaw, 2022 cfg_obj_assockaddr(obj))); 2023 dscp = cfg_obj_getdscp(obj); 2024 if (dscp == -1) { 2025 dscp = named_g_dscp; 2026 } 2027 RETERR(dns_zone_setaltxfrsource6dscp(mayberaw, dscp)); 2028 2029 obj = NULL; 2030 (void)named_config_get(maps, "use-alt-transfer-source", &obj); 2031 if (obj == NULL) { 2032 /* 2033 * Default off when views are in use otherwise 2034 * on for BIND 8 compatibility. 2035 */ 2036 view = dns_zone_getview(zone); 2037 if (view != NULL && strcmp(view->name, "_default") == 0) 2038 { 2039 alt = true; 2040 } else { 2041 alt = false; 2042 } 2043 } else { 2044 alt = cfg_obj_asboolean(obj); 2045 } 2046 dns_zone_setoption(mayberaw, DNS_ZONEOPT_USEALTXFRSRC, alt); 2047 2048 obj = NULL; 2049 (void)named_config_get(maps, "try-tcp-refresh", &obj); 2050 dns_zone_setoption(mayberaw, DNS_ZONEOPT_TRYTCPREFRESH, 2051 cfg_obj_asboolean(obj)); 2052 break; 2053 2054 case dns_zone_staticstub: 2055 RETERR(configure_staticstub(zoptions, zone, zname, 2056 default_dbtype)); 2057 break; 2058 2059 default: 2060 break; 2061 } 2062 2063 return (ISC_R_SUCCESS); 2064 } 2065 2066 /* 2067 * Set up a DLZ zone as writeable 2068 */ 2069 isc_result_t 2070 named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone, 2071 dns_rdataclass_t rdclass, dns_name_t *name) { 2072 dns_db_t *db = NULL; 2073 isc_time_t now; 2074 isc_result_t result; 2075 2076 TIME_NOW(&now); 2077 2078 dns_zone_settype(zone, dns_zone_dlz); 2079 result = dns_sdlz_setdb(dlzdatabase, rdclass, name, &db); 2080 if (result != ISC_R_SUCCESS) { 2081 return (result); 2082 } 2083 result = dns_zone_dlzpostload(zone, db); 2084 dns_db_detach(&db); 2085 return (result); 2086 } 2087 2088 bool 2089 named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) { 2090 const cfg_obj_t *zoptions = NULL; 2091 const cfg_obj_t *obj = NULL; 2092 const char *cfilename; 2093 const char *zfilename; 2094 dns_zone_t *raw = NULL; 2095 bool has_raw, inline_signing; 2096 dns_zonetype_t ztype; 2097 2098 zoptions = cfg_tuple_get(zconfig, "options"); 2099 2100 /* 2101 * We always reconfigure a static-stub zone for simplicity, assuming 2102 * the amount of data to be loaded is small. 2103 */ 2104 if (zonetype_fromconfig(zoptions) == dns_zone_staticstub) { 2105 dns_zone_log(zone, ISC_LOG_DEBUG(1), 2106 "not reusable: staticstub"); 2107 return (false); 2108 } 2109 2110 /* If there's a raw zone, use that for filename and type comparison */ 2111 dns_zone_getraw(zone, &raw); 2112 if (raw != NULL) { 2113 zfilename = dns_zone_getfile(raw); 2114 ztype = dns_zone_gettype(raw); 2115 dns_zone_detach(&raw); 2116 has_raw = true; 2117 } else { 2118 zfilename = dns_zone_getfile(zone); 2119 ztype = dns_zone_gettype(zone); 2120 has_raw = false; 2121 } 2122 2123 inline_signing = named_zone_inlinesigning(zconfig); 2124 if (!inline_signing && has_raw) { 2125 dns_zone_log(zone, ISC_LOG_DEBUG(1), 2126 "not reusable: old zone was inline-signing"); 2127 return (false); 2128 } else if (inline_signing && !has_raw) { 2129 dns_zone_log(zone, ISC_LOG_DEBUG(1), 2130 "not reusable: old zone was not inline-signing"); 2131 return (false); 2132 } 2133 2134 if (zonetype_fromconfig(zoptions) != ztype) { 2135 dns_zone_log(zone, ISC_LOG_DEBUG(1), 2136 "not reusable: type mismatch"); 2137 return (false); 2138 } 2139 2140 obj = NULL; 2141 (void)cfg_map_get(zoptions, "file", &obj); 2142 if (obj != NULL) { 2143 cfilename = cfg_obj_asstring(obj); 2144 } else { 2145 cfilename = NULL; 2146 } 2147 if (!((cfilename == NULL && zfilename == NULL) || 2148 (cfilename != NULL && zfilename != NULL && 2149 strcmp(cfilename, zfilename) == 0))) 2150 { 2151 dns_zone_log(zone, ISC_LOG_DEBUG(1), 2152 "not reusable: filename mismatch"); 2153 return (false); 2154 } 2155 2156 return (true); 2157 } 2158 2159 bool 2160 named_zone_inlinesigning(const cfg_obj_t *zconfig) { 2161 const cfg_obj_t *zoptions = NULL; 2162 const cfg_obj_t *signing = NULL; 2163 bool inline_signing = false; 2164 2165 zoptions = cfg_tuple_get(zconfig, "options"); 2166 inline_signing = (cfg_map_get(zoptions, "inline-signing", &signing) == 2167 ISC_R_SUCCESS && 2168 cfg_obj_asboolean(signing)); 2169 2170 return (inline_signing); 2171 } 2172
Indexes created Wed Apr 08 00:23:23 UTC 2026