Import bind 9.5.2 vendor sources.
[dragonfly.git] / contrib / bind-9.5.2 / bin / named / zoneconf.c
1 /*
2  * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
3  * Copyright (C) 1999-2003  Internet Software Consortium.
4  *
5  * Permission to use, copy, modify, and/or distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
10  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
11  * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
12  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
13  * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
14  * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
15  * PERFORMANCE OF THIS SOFTWARE.
16  */
17
18 /* $Id: zoneconf.c,v 1.139.56.7 2009/01/29 23:47:13 tbox Exp $ */
19
20 /*% */
21
22 #include <config.h>
23
24 #include <isc/buffer.h>
25 #include <isc/file.h>
26 #include <isc/mem.h>
27 #include <isc/print.h>
28 #include <isc/stats.h>
29 #include <isc/string.h>         /* Required for HP/UX (and others?) */
30 #include <isc/util.h>
31
32 #include <dns/acl.h>
33 #include <dns/fixedname.h>
34 #include <dns/log.h>
35 #include <dns/name.h>
36 #include <dns/rdatatype.h>
37 #include <dns/ssu.h>
38 #include <dns/stats.h>
39 #include <dns/view.h>
40 #include <dns/zone.h>
41
42 #include <named/client.h>
43 #include <named/config.h>
44 #include <named/globals.h>
45 #include <named/log.h>
46 #include <named/server.h>
47 #include <named/zoneconf.h>
48
49 /* ACLs associated with zone */
50 typedef enum {
51         allow_notify,
52         allow_query,
53         allow_transfer,
54         allow_update,
55         allow_update_forwarding
56 } acl_type_t;
57
58 /*%
59  * These are BIND9 server defaults, not necessarily identical to the
60  * library defaults defined in zone.c.
61  */
62 #define RETERR(x) do { \
63         isc_result_t _r = (x); \
64         if (_r != ISC_R_SUCCESS) \
65                 return (_r); \
66         } while (0)
67
68 /*%
69  * Convenience function for configuring a single zone ACL.
70  */
71 static isc_result_t
72 configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
73                    const cfg_obj_t *config, acl_type_t acltype,
74                    cfg_aclconfctx_t *actx, dns_zone_t *zone,
75                    void (*setzacl)(dns_zone_t *, dns_acl_t *),
76                    void (*clearzacl)(dns_zone_t *))
77 {
78         isc_result_t result;
79         const cfg_obj_t *maps[5] = {NULL, NULL, NULL, NULL, NULL};
80         const cfg_obj_t *aclobj = NULL;
81         int i = 0;
82         dns_acl_t **aclp = NULL, *acl = NULL;
83         const char *aclname;
84         dns_view_t *view;
85
86         view = dns_zone_getview(zone);
87
88         switch (acltype) {
89             case allow_notify:
90                 if (view != NULL)
91                         aclp = &view->notifyacl;
92                 aclname = "allow-notify";
93                 break;
94             case allow_query:
95                 if (view != NULL)
96                         aclp = &view->queryacl;
97                 aclname = "allow-query";
98                 break;
99             case allow_transfer:
100                 if (view != NULL)
101                         aclp = &view->transferacl;
102                 aclname = "allow-transfer";
103                 break;
104             case allow_update:
105                 if (view != NULL)
106                         aclp = &view->updateacl;
107                 aclname = "allow-update";
108                 break;
109             case allow_update_forwarding:
110                 if (view != NULL)
111                         aclp = &view->upfwdacl;
112                 aclname = "allow-update-forwarding";
113                 break;
114             default:
115                 INSIST(0);
116                 return (ISC_R_FAILURE);
117         }
118
119         /* First check to see if ACL is defined within the zone */
120         if (zconfig != NULL) {
121                 maps[0] = cfg_tuple_get(zconfig, "options");
122                 ns_config_get(maps, aclname, &aclobj);
123                 if (aclobj != NULL) {
124                         aclp = NULL;
125                         goto parse_acl;
126                 }
127         }
128
129         /* Failing that, see if there's a default ACL already in the view */
130         if (aclp != NULL && *aclp != NULL) {
131                 (*setzacl)(zone, *aclp);
132                 return (ISC_R_SUCCESS);
133         }
134
135         /* Check for default ACLs that haven't been parsed yet */
136         if (vconfig != NULL)
137                 maps[i++] = cfg_tuple_get(vconfig, "options");
138         if (config != NULL) {
139                 const cfg_obj_t *options = NULL;
140                 (void)cfg_map_get(config, "options", &options);
141                 if (options != NULL)
142                         maps[i++] = options;
143         }
144         maps[i++] = ns_g_defaults;
145         maps[i] = NULL;
146
147         result = ns_config_get(maps, aclname, &aclobj);
148         if (aclobj == NULL) {
149                 (*clearzacl)(zone);
150                 return (ISC_R_SUCCESS);
151         }
152
153 parse_acl:
154         result = cfg_acl_fromconfig(aclobj, config, ns_g_lctx, actx,
155                                     dns_zone_getmctx(zone), 0, &acl);
156         if (result != ISC_R_SUCCESS)
157                 return (result);
158         (*setzacl)(zone, acl);
159
160         /* Set the view default now */
161         if (aclp != NULL)
162                 dns_acl_attach(acl, aclp);
163
164         dns_acl_detach(&acl);
165         return (ISC_R_SUCCESS);
166 }
167
168 /*%
169  * Parse the zone update-policy statement.
170  */
171 static isc_result_t
172 configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone) {
173         const cfg_obj_t *updatepolicy = NULL;
174         const cfg_listelt_t *element, *element2;
175         dns_ssutable_t *table = NULL;
176         isc_mem_t *mctx = dns_zone_getmctx(zone);
177         isc_result_t result;
178
179         (void)cfg_map_get(zconfig, "update-policy", &updatepolicy);
180         if (updatepolicy == NULL) {
181                 dns_zone_setssutable(zone, NULL);
182                 return (ISC_R_SUCCESS);
183         }
184
185         result = dns_ssutable_create(mctx, &table);
186         if (result != ISC_R_SUCCESS)
187                 return (result);
188
189         for (element = cfg_list_first(updatepolicy);
190              element != NULL;
191              element = cfg_list_next(element))
192         {
193                 const cfg_obj_t *stmt = cfg_listelt_value(element);
194                 const cfg_obj_t *mode = cfg_tuple_get(stmt, "mode");
195                 const cfg_obj_t *identity = cfg_tuple_get(stmt, "identity");
196                 const cfg_obj_t *matchtype = cfg_tuple_get(stmt, "matchtype");
197                 const cfg_obj_t *dname = cfg_tuple_get(stmt, "name");
198                 const cfg_obj_t *typelist = cfg_tuple_get(stmt, "types");
199                 const char *str;
200                 isc_boolean_t grant = ISC_FALSE;
201                 unsigned int mtype = DNS_SSUMATCHTYPE_NAME;
202                 dns_fixedname_t fname, fident;
203                 isc_buffer_t b;
204                 dns_rdatatype_t *types;
205                 unsigned int i, n;
206
207                 str = cfg_obj_asstring(mode);
208                 if (strcasecmp(str, "grant") == 0)
209                         grant = ISC_TRUE;
210                 else if (strcasecmp(str, "deny") == 0)
211                         grant = ISC_FALSE;
212                 else
213                         INSIST(0);
214
215                 str = cfg_obj_asstring(matchtype);
216                 if (strcasecmp(str, "name") == 0)
217                         mtype = DNS_SSUMATCHTYPE_NAME;
218                 else if (strcasecmp(str, "subdomain") == 0)
219                         mtype = DNS_SSUMATCHTYPE_SUBDOMAIN;
220                 else if (strcasecmp(str, "wildcard") == 0)
221                         mtype = DNS_SSUMATCHTYPE_WILDCARD;
222                 else if (strcasecmp(str, "self") == 0)
223                         mtype = DNS_SSUMATCHTYPE_SELF;
224                 else if (strcasecmp(str, "selfsub") == 0)
225                         mtype = DNS_SSUMATCHTYPE_SELFSUB;
226                 else if (strcasecmp(str, "selfwild") == 0)
227                         mtype = DNS_SSUMATCHTYPE_SELFWILD;
228                 else if (strcasecmp(str, "ms-self") == 0)
229                         mtype = DNS_SSUMATCHTYPE_SELFMS;
230                 else if (strcasecmp(str, "krb5-self") == 0)
231                         mtype = DNS_SSUMATCHTYPE_SELFKRB5;
232                 else if (strcasecmp(str, "ms-subdomain") == 0)
233                         mtype = DNS_SSUMATCHTYPE_SUBDOMAINMS;
234                 else if (strcasecmp(str, "krb5-subdomain") == 0)
235                         mtype = DNS_SSUMATCHTYPE_SUBDOMAINKRB5;
236                 else
237                         INSIST(0);
238
239                 dns_fixedname_init(&fident);
240                 str = cfg_obj_asstring(identity);
241                 isc_buffer_init(&b, str, strlen(str));
242                 isc_buffer_add(&b, strlen(str));
243                 result = dns_name_fromtext(dns_fixedname_name(&fident), &b,
244                                            dns_rootname, ISC_FALSE, NULL);
245                 if (result != ISC_R_SUCCESS) {
246                         cfg_obj_log(identity, ns_g_lctx, ISC_LOG_ERROR,
247                                     "'%s' is not a valid name", str);
248                         goto cleanup;
249                 }
250
251                 dns_fixedname_init(&fname);
252                 str = cfg_obj_asstring(dname);
253                 isc_buffer_init(&b, str, strlen(str));
254                 isc_buffer_add(&b, strlen(str));
255                 result = dns_name_fromtext(dns_fixedname_name(&fname), &b,
256                                            dns_rootname, ISC_FALSE, NULL);
257                 if (result != ISC_R_SUCCESS) {
258                         cfg_obj_log(identity, ns_g_lctx, ISC_LOG_ERROR,
259                                     "'%s' is not a valid name", str);
260                         goto cleanup;
261                 }
262
263                 n = ns_config_listcount(typelist);
264                 if (n == 0)
265                         types = NULL;
266                 else {
267                         types = isc_mem_get(mctx, n * sizeof(dns_rdatatype_t));
268                         if (types == NULL) {
269                                 result = ISC_R_NOMEMORY;
270                                 goto cleanup;
271                         }
272                 }
273
274                 i = 0;
275                 for (element2 = cfg_list_first(typelist);
276                      element2 != NULL;
277                      element2 = cfg_list_next(element2))
278                 {
279                         const cfg_obj_t *typeobj;
280                         isc_textregion_t r;
281
282                         INSIST(i < n);
283
284                         typeobj = cfg_listelt_value(element2);
285                         str = cfg_obj_asstring(typeobj);
286                         DE_CONST(str, r.base);
287                         r.length = strlen(str);
288
289                         result = dns_rdatatype_fromtext(&types[i++], &r);
290                         if (result != ISC_R_SUCCESS) {
291                                 cfg_obj_log(identity, ns_g_lctx, ISC_LOG_ERROR,
292                                             "'%s' is not a valid type", str);
293                                 isc_mem_put(mctx, types,
294                                             n * sizeof(dns_rdatatype_t));
295                                 goto cleanup;
296                         }
297                 }
298                 INSIST(i == n);
299
300                 result = dns_ssutable_addrule(table, grant,
301                                               dns_fixedname_name(&fident),
302                                               mtype,
303                                               dns_fixedname_name(&fname),
304                                               n, types);
305                 if (types != NULL)
306                         isc_mem_put(mctx, types, n * sizeof(dns_rdatatype_t));
307                 if (result != ISC_R_SUCCESS) {
308                         goto cleanup;
309                 }
310
311         }
312
313         result = ISC_R_SUCCESS;
314         dns_zone_setssutable(zone, table);
315
316  cleanup:
317         dns_ssutable_detach(&table);
318         return (result);
319 }
320
321 /*%
322  * Convert a config file zone type into a server zone type.
323  */
324 static inline dns_zonetype_t
325 zonetype_fromconfig(const cfg_obj_t *map) {
326         const cfg_obj_t *obj = NULL;
327         isc_result_t result;
328
329         result = cfg_map_get(map, "type", &obj);
330         INSIST(result == ISC_R_SUCCESS);
331         return (ns_config_getzonetype(obj));
332 }
333
334 /*%
335  * Helper function for strtoargv().  Pardon the gratuitous recursion.
336  */
337 static isc_result_t
338 strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp,
339              char ***argvp, unsigned int n)
340 {
341         isc_result_t result;
342
343         /* Discard leading whitespace. */
344         while (*s == ' ' || *s == '\t')
345                 s++;
346
347         if (*s == '\0') {
348                 /* We have reached the end of the string. */
349                 *argcp = n;
350                 *argvp = isc_mem_get(mctx, n * sizeof(char *));
351                 if (*argvp == NULL)
352                         return (ISC_R_NOMEMORY);
353         } else {
354                 char *p = s;
355                 while (*p != ' ' && *p != '\t' && *p != '\0')
356                         p++;
357                 if (*p != '\0')
358                         *p++ = '\0';
359
360                 result = strtoargvsub(mctx, p, argcp, argvp, n + 1);
361                 if (result != ISC_R_SUCCESS)
362                         return (result);
363                 (*argvp)[n] = s;
364         }
365         return (ISC_R_SUCCESS);
366 }
367
368 /*%
369  * Tokenize the string "s" into whitespace-separated words,
370  * return the number of words in '*argcp' and an array
371  * of pointers to the words in '*argvp'.  The caller
372  * must free the array using isc_mem_put().  The string
373  * is modified in-place.
374  */
375 static isc_result_t
376 strtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp) {
377         return (strtoargvsub(mctx, s, argcp, argvp, 0));
378 }
379
380 static void
381 checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
382            const cfg_obj_t **objp)
383 {
384         const char *zone = NULL;
385         isc_result_t result;
386
387         switch (ztype) {
388         case dns_zone_slave: zone = "slave"; break;
389         case dns_zone_master: zone = "master"; break;
390         default:
391                 INSIST(0);
392         }
393         result = ns_checknames_get(maps, zone, objp);
394         INSIST(result == ISC_R_SUCCESS);
395 }
396
397 isc_result_t
398 ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
399                   const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
400                   dns_zone_t *zone)
401 {
402         isc_result_t result;
403         const char *zname;
404         dns_rdataclass_t zclass;
405         dns_rdataclass_t vclass;
406         const cfg_obj_t *maps[5];
407         const cfg_obj_t *zoptions = NULL;
408         const cfg_obj_t *options = NULL;
409         const cfg_obj_t *obj;
410         const char *filename = NULL;
411         dns_notifytype_t notifytype = dns_notifytype_yes;
412         isc_sockaddr_t *addrs;
413         dns_name_t **keynames;
414         isc_uint32_t count;
415         char *cpval;
416         unsigned int dbargc;
417         char **dbargv;
418         static char default_dbtype[] = "rbt";
419         isc_mem_t *mctx = dns_zone_getmctx(zone);
420         dns_dialuptype_t dialup = dns_dialuptype_no;
421         dns_zonetype_t ztype;
422         int i;
423         isc_int32_t journal_size;
424         isc_boolean_t multi;
425         isc_boolean_t alt;
426         dns_view_t *view;
427         isc_boolean_t check = ISC_FALSE, fail = ISC_FALSE;
428         isc_boolean_t warn = ISC_FALSE, ignore = ISC_FALSE;
429         isc_boolean_t ixfrdiff;
430         dns_masterformat_t masterformat;
431         isc_stats_t *zoneqrystats;
432         isc_boolean_t zonestats_on;
433
434         i = 0;
435         if (zconfig != NULL) {
436                 zoptions = cfg_tuple_get(zconfig, "options");
437                 maps[i++] = zoptions;
438         }
439         if (vconfig != NULL)
440                 maps[i++] = cfg_tuple_get(vconfig, "options");
441         if (config != NULL) {
442                 (void)cfg_map_get(config, "options", &options);
443                 if (options != NULL)
444                         maps[i++] = options;
445         }
446         maps[i++] = ns_g_defaults;
447         maps[i++] = NULL;
448
449         if (vconfig != NULL)
450                 RETERR(ns_config_getclass(cfg_tuple_get(vconfig, "class"),
451                                           dns_rdataclass_in, &vclass));
452         else
453                 vclass = dns_rdataclass_in;
454
455         /*
456          * Configure values common to all zone types.
457          */
458
459         zname = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
460
461         RETERR(ns_config_getclass(cfg_tuple_get(zconfig, "class"),
462                                   vclass, &zclass));
463         dns_zone_setclass(zone, zclass);
464
465         ztype = zonetype_fromconfig(zoptions);
466         dns_zone_settype(zone, ztype);
467
468         obj = NULL;
469         result = cfg_map_get(zoptions, "database", &obj);
470         if (result == ISC_R_SUCCESS)
471                 cpval = isc_mem_strdup(mctx, cfg_obj_asstring(obj));
472         else
473                 cpval = default_dbtype;
474
475         if (cpval == NULL)
476                 return(ISC_R_NOMEMORY);
477
478         result = strtoargv(mctx, cpval, &dbargc, &dbargv);
479         if (result != ISC_R_SUCCESS && cpval != default_dbtype) {
480                 isc_mem_free(mctx, cpval);
481                 return (result);
482         }
483
484         /*
485          * ANSI C is strange here.  There is no logical reason why (char **)
486          * cannot be promoted automatically to (const char * const *) by the
487          * compiler w/o generating a warning.
488          */
489         result = dns_zone_setdbtype(zone, dbargc, (const char * const *)dbargv);
490         isc_mem_put(mctx, dbargv, dbargc * sizeof(*dbargv));
491         if (cpval != default_dbtype)
492                 isc_mem_free(mctx, cpval);
493         if (result != ISC_R_SUCCESS)
494                 return (result);
495
496         obj = NULL;
497         result = cfg_map_get(zoptions, "file", &obj);
498         if (result == ISC_R_SUCCESS)
499                 filename = cfg_obj_asstring(obj);
500
501         masterformat = dns_masterformat_text;
502         obj = NULL;
503         result= ns_config_get(maps, "masterfile-format", &obj);
504         if (result == ISC_R_SUCCESS) {
505                 const char *masterformatstr = cfg_obj_asstring(obj);
506
507                 if (strcasecmp(masterformatstr, "text") == 0)
508                         masterformat = dns_masterformat_text;
509                 else if (strcasecmp(masterformatstr, "raw") == 0)
510                         masterformat = dns_masterformat_raw;
511                 else
512                         INSIST(0);
513         }
514         RETERR(dns_zone_setfile2(zone, filename, masterformat));
515
516         obj = NULL;
517         result = cfg_map_get(zoptions, "journal", &obj);
518         if (result == ISC_R_SUCCESS)
519                 RETERR(dns_zone_setjournal(zone, cfg_obj_asstring(obj)));
520
521         if (ztype == dns_zone_slave)
522                 RETERR(configure_zone_acl(zconfig, vconfig, config,
523                                           allow_notify, ac, zone,
524                                           dns_zone_setnotifyacl,
525                                           dns_zone_clearnotifyacl));
526         /*
527          * XXXAG This probably does not make sense for stubs.
528          */
529         RETERR(configure_zone_acl(zconfig, vconfig, config,
530                                   allow_query, ac, zone,
531                                   dns_zone_setqueryacl,
532                                   dns_zone_clearqueryacl));
533
534         obj = NULL;
535         result = ns_config_get(maps, "dialup", &obj);
536         INSIST(result == ISC_R_SUCCESS);
537         if (cfg_obj_isboolean(obj)) {
538                 if (cfg_obj_asboolean(obj))
539                         dialup = dns_dialuptype_yes;
540                 else
541                         dialup = dns_dialuptype_no;
542         } else {
543                 const char *dialupstr = cfg_obj_asstring(obj);
544                 if (strcasecmp(dialupstr, "notify") == 0)
545                         dialup = dns_dialuptype_notify;
546                 else if (strcasecmp(dialupstr, "notify-passive") == 0)
547                         dialup = dns_dialuptype_notifypassive;
548                 else if (strcasecmp(dialupstr, "refresh") == 0)
549                         dialup = dns_dialuptype_refresh;
550                 else if (strcasecmp(dialupstr, "passive") == 0)
551                         dialup = dns_dialuptype_passive;
552                 else
553                         INSIST(0);
554         }
555         dns_zone_setdialup(zone, dialup);
556
557         obj = NULL;
558         result = ns_config_get(maps, "zone-statistics", &obj);
559         INSIST(result == ISC_R_SUCCESS);
560         zonestats_on = cfg_obj_asboolean(obj);
561         zoneqrystats = NULL;
562         if (zonestats_on) {
563                 RETERR(isc_stats_create(mctx, &zoneqrystats,
564                                         dns_nsstatscounter_max));
565         }
566         dns_zone_setrequeststats(zone, zoneqrystats);
567         if (zoneqrystats != NULL)
568                 isc_stats_detach(&zoneqrystats);
569
570         /*
571          * Configure master functionality.  This applies
572          * to primary masters (type "master") and slaves
573          * acting as masters (type "slave"), but not to stubs.
574          */
575         if (ztype != dns_zone_stub) {
576                 obj = NULL;
577                 result = ns_config_get(maps, "notify", &obj);
578                 INSIST(result == ISC_R_SUCCESS);
579                 if (cfg_obj_isboolean(obj)) {
580                         if (cfg_obj_asboolean(obj))
581                                 notifytype = dns_notifytype_yes;
582                         else
583                                 notifytype = dns_notifytype_no;
584                 } else {
585                         const char *notifystr = cfg_obj_asstring(obj);
586                         if (strcasecmp(notifystr, "explicit") == 0)
587                                 notifytype = dns_notifytype_explicit;
588                         else if (strcasecmp(notifystr, "master-only") == 0)
589                                 notifytype = dns_notifytype_masteronly;
590                         else
591                                 INSIST(0);
592                 }
593                 dns_zone_setnotifytype(zone, notifytype);
594
595                 obj = NULL;
596                 result = ns_config_get(maps, "also-notify", &obj);
597                 if (result == ISC_R_SUCCESS) {
598                         isc_sockaddr_t *addrs = NULL;
599                         isc_uint32_t addrcount;
600                         result = ns_config_getiplist(config, obj, 0, mctx,
601                                                      &addrs, &addrcount);
602                         if (result != ISC_R_SUCCESS)
603                                 return (result);
604                         result = dns_zone_setalsonotify(zone, addrs,
605                                                         addrcount);
606                         ns_config_putiplist(mctx, &addrs, addrcount);
607                         if (result != ISC_R_SUCCESS)
608                                 return (result);
609                 } else
610                         RETERR(dns_zone_setalsonotify(zone, NULL, 0));
611
612                 obj = NULL;
613                 result = ns_config_get(maps, "notify-source", &obj);
614                 INSIST(result == ISC_R_SUCCESS);
615                 RETERR(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
616                 ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
617
618                 obj = NULL;
619                 result = ns_config_get(maps, "notify-source-v6", &obj);
620                 INSIST(result == ISC_R_SUCCESS);
621                 RETERR(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
622                 ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
623
624                 obj = NULL;
625                 result = ns_config_get(maps, "notify-to-soa", &obj);
626                 INSIST(result == ISC_R_SUCCESS);
627                 dns_zone_setoption(zone, DNS_ZONEOPT_NOTIFYTOSOA,
628                                    cfg_obj_asboolean(obj));
629
630                 dns_zone_setisself(zone, ns_client_isself, NULL);
631
632                 RETERR(configure_zone_acl(zconfig, vconfig, config,
633                                           allow_transfer, ac, zone,
634                                           dns_zone_setxfracl,
635                                           dns_zone_clearxfracl));
636
637                 obj = NULL;
638                 result = ns_config_get(maps, "max-transfer-time-out", &obj);
639                 INSIST(result == ISC_R_SUCCESS);
640                 dns_zone_setmaxxfrout(zone, cfg_obj_asuint32(obj) * 60);
641
642                 obj = NULL;
643                 result = ns_config_get(maps, "max-transfer-idle-out", &obj);
644                 INSIST(result == ISC_R_SUCCESS);
645                 dns_zone_setidleout(zone, cfg_obj_asuint32(obj) * 60);
646
647                 obj = NULL;
648                 result =  ns_config_get(maps, "max-journal-size", &obj);
649                 INSIST(result == ISC_R_SUCCESS);
650                 dns_zone_setjournalsize(zone, -1);
651                 if (cfg_obj_isstring(obj)) {
652                         const char *str = cfg_obj_asstring(obj);
653                         INSIST(strcasecmp(str, "unlimited") == 0);
654                         journal_size = ISC_UINT32_MAX / 2;
655                 } else {
656                         isc_resourcevalue_t value;
657                         value = cfg_obj_asuint64(obj);
658                         if (value > ISC_UINT32_MAX / 2) {
659                                 cfg_obj_log(obj, ns_g_lctx,
660                                             ISC_LOG_ERROR,
661                                             "'max-journal-size "
662                                             "%" ISC_PRINT_QUADFORMAT "d' "
663                                             "is too large",
664                                             value);
665                                 RETERR(ISC_R_RANGE);
666                         }
667                         journal_size = (isc_uint32_t)value;
668                 }
669                 dns_zone_setjournalsize(zone, journal_size);
670
671                 obj = NULL;
672                 result = ns_config_get(maps, "ixfr-from-differences", &obj);
673                 INSIST(result == ISC_R_SUCCESS);
674                 if (cfg_obj_isboolean(obj))
675                         ixfrdiff = cfg_obj_asboolean(obj);
676                 else if (strcasecmp(cfg_obj_asstring(obj), "master") &&
677                          ztype == dns_zone_master)
678                         ixfrdiff = ISC_TRUE;
679                 else if (strcasecmp(cfg_obj_asstring(obj), "slave") &&
680                         ztype == dns_zone_slave)
681                         ixfrdiff = ISC_TRUE;
682                 else
683                         ixfrdiff = ISC_FALSE;
684                 dns_zone_setoption(zone, DNS_ZONEOPT_IXFRFROMDIFFS, ixfrdiff);
685
686                 checknames(ztype, maps, &obj);
687                 INSIST(obj != NULL);
688                 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
689                         fail = ISC_FALSE;
690                         check = ISC_TRUE;
691                 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
692                         fail = check = ISC_TRUE;
693                 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
694                         fail = check = ISC_FALSE;
695                 } else
696                         INSIST(0);
697                 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMES, check);
698                 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMESFAIL, fail);
699
700                 obj = NULL;
701                 result = ns_config_get(maps, "notify-delay", &obj);
702                 INSIST(result == ISC_R_SUCCESS);
703                 dns_zone_setnotifydelay(zone, cfg_obj_asuint32(obj));
704
705                 obj = NULL;
706                 result = ns_config_get(maps, "check-sibling", &obj);
707                 INSIST(result == ISC_R_SUCCESS);
708                 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSIBLING,
709                                    cfg_obj_asboolean(obj));
710
711                 obj = NULL;
712                 result = ns_config_get(maps, "zero-no-soa-ttl", &obj);
713                 INSIST(result == ISC_R_SUCCESS);
714                 dns_zone_setzeronosoattl(zone, cfg_obj_asboolean(obj));
715         }
716
717         /*
718          * Configure update-related options.  These apply to
719          * primary masters only.
720          */
721         if (ztype == dns_zone_master) {
722                 dns_acl_t *updateacl;
723                 RETERR(configure_zone_acl(zconfig, vconfig, config,
724                                           allow_update, ac, zone,
725                                           dns_zone_setupdateacl,
726                                           dns_zone_clearupdateacl));
727
728                 updateacl = dns_zone_getupdateacl(zone);
729                 if (updateacl != NULL  && dns_acl_isinsecure(updateacl))
730                         isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
731                                       NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
732                                       "zone '%s' allows updates by IP "
733                                       "address, which is insecure",
734                                       zname);
735
736                 RETERR(configure_zone_ssutable(zoptions, zone));
737
738                 obj = NULL;
739                 result = ns_config_get(maps, "sig-validity-interval", &obj);
740                 INSIST(result == ISC_R_SUCCESS);
741                 dns_zone_setsigvalidityinterval(zone,
742                                                 cfg_obj_asuint32(obj) * 86400);
743
744                 obj = NULL;
745                 result = ns_config_get(maps, "key-directory", &obj);
746                 if (result == ISC_R_SUCCESS) {
747                         filename = cfg_obj_asstring(obj);
748                         if (!isc_file_isabsolute(filename)) {
749                                 cfg_obj_log(obj, ns_g_lctx, ISC_LOG_ERROR,
750                                             "key-directory '%s' "
751                                             "is not absolute", filename);
752                                 return (ISC_R_FAILURE);
753                         }
754                         RETERR(dns_zone_setkeydirectory(zone, filename));
755                 }
756
757                 obj = NULL;
758                 result = ns_config_get(maps, "check-wildcard", &obj);
759                 if (result == ISC_R_SUCCESS)
760                         check = cfg_obj_asboolean(obj);
761                 else
762                         check = ISC_FALSE;
763                 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKWILDCARD, check);
764
765                 obj = NULL;
766                 result = ns_config_get(maps, "check-mx", &obj);
767                 INSIST(obj != NULL);
768                 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
769                         fail = ISC_FALSE;
770                         check = ISC_TRUE;
771                 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
772                         fail = check = ISC_TRUE;
773                 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
774                         fail = check = ISC_FALSE;
775                 } else
776                         INSIST(0);
777                 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKMX, check);
778                 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKMXFAIL, fail);
779
780                 obj = NULL;
781                 result = ns_config_get(maps, "check-integrity", &obj);
782                 INSIST(obj != NULL);
783                 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKINTEGRITY,
784                                    cfg_obj_asboolean(obj));
785
786                 obj = NULL;
787                 result = ns_config_get(maps, "check-mx-cname", &obj);
788                 INSIST(obj != NULL);
789                 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
790                         warn = ISC_TRUE;
791                         ignore = ISC_FALSE;
792                 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
793                         warn = ignore = ISC_FALSE;
794                 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
795                         warn = ignore = ISC_TRUE;
796                 } else
797                         INSIST(0);
798                 dns_zone_setoption(zone, DNS_ZONEOPT_WARNMXCNAME, warn);
799                 dns_zone_setoption(zone, DNS_ZONEOPT_IGNOREMXCNAME, ignore);
800
801                 obj = NULL;
802                 result = ns_config_get(maps, "check-srv-cname", &obj);
803                 INSIST(obj != NULL);
804                 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
805                         warn = ISC_TRUE;
806                         ignore = ISC_FALSE;
807                 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
808                         warn = ignore = ISC_FALSE;
809                 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
810                         warn = ignore = ISC_TRUE;
811                 } else
812                         INSIST(0);
813                 dns_zone_setoption(zone, DNS_ZONEOPT_WARNSRVCNAME, warn);
814                 dns_zone_setoption(zone, DNS_ZONEOPT_IGNORESRVCNAME, ignore);
815
816                 obj = NULL;
817                 result = ns_config_get(maps, "update-check-ksk", &obj);
818                 INSIST(result == ISC_R_SUCCESS);
819                 dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
820                                    cfg_obj_asboolean(obj));
821         } else if (ztype == dns_zone_slave) {
822                 RETERR(configure_zone_acl(zconfig, vconfig, config,
823                                           allow_update_forwarding, ac, zone,
824                                           dns_zone_setforwardacl,
825                                           dns_zone_clearforwardacl));
826         }
827
828         /*
829          * Configure slave functionality.
830          */
831         switch (ztype) {
832         case dns_zone_slave:
833         case dns_zone_stub:
834                 count = 0;
835                 obj = NULL;
836                 result = cfg_map_get(zoptions, "masters", &obj);
837                 if (obj != NULL) {
838                         addrs = NULL;
839                         keynames = NULL;
840                         RETERR(ns_config_getipandkeylist(config, obj, mctx,
841                                                          &addrs, &keynames,
842                                                          &count));
843                         result = dns_zone_setmasterswithkeys(zone, addrs,
844                                                              keynames, count);
845                         ns_config_putipandkeylist(mctx, &addrs, &keynames,
846                                                   count);
847                 } else
848                         result = dns_zone_setmasters(zone, NULL, 0);
849                 RETERR(result);
850
851                 multi = ISC_FALSE;
852                 if (count > 1) {
853                         obj = NULL;
854                         result = ns_config_get(maps, "multi-master", &obj);
855                         INSIST(result == ISC_R_SUCCESS);
856                         multi = cfg_obj_asboolean(obj);
857                 }
858                 dns_zone_setoption(zone, DNS_ZONEOPT_MULTIMASTER, multi);
859
860                 obj = NULL;
861                 result = ns_config_get(maps, "max-transfer-time-in", &obj);
862                 INSIST(result == ISC_R_SUCCESS);
863                 dns_zone_setmaxxfrin(zone, cfg_obj_asuint32(obj) * 60);
864
865                 obj = NULL;
866                 result = ns_config_get(maps, "max-transfer-idle-in", &obj);
867                 INSIST(result == ISC_R_SUCCESS);
868                 dns_zone_setidlein(zone, cfg_obj_asuint32(obj) * 60);
869
870                 obj = NULL;
871                 result = ns_config_get(maps, "max-refresh-time", &obj);
872                 INSIST(result == ISC_R_SUCCESS);
873                 dns_zone_setmaxrefreshtime(zone, cfg_obj_asuint32(obj));
874
875                 obj = NULL;
876                 result = ns_config_get(maps, "min-refresh-time", &obj);
877                 INSIST(result == ISC_R_SUCCESS);
878                 dns_zone_setminrefreshtime(zone, cfg_obj_asuint32(obj));
879
880                 obj = NULL;
881                 result = ns_config_get(maps, "max-retry-time", &obj);
882                 INSIST(result == ISC_R_SUCCESS);
883                 dns_zone_setmaxretrytime(zone, cfg_obj_asuint32(obj));
884
885                 obj = NULL;
886                 result = ns_config_get(maps, "min-retry-time", &obj);
887                 INSIST(result == ISC_R_SUCCESS);
888                 dns_zone_setminretrytime(zone, cfg_obj_asuint32(obj));
889
890                 obj = NULL;
891                 result = ns_config_get(maps, "transfer-source", &obj);
892                 INSIST(result == ISC_R_SUCCESS);
893                 RETERR(dns_zone_setxfrsource4(zone, cfg_obj_assockaddr(obj)));
894                 ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
895
896                 obj = NULL;
897                 result = ns_config_get(maps, "transfer-source-v6", &obj);
898                 INSIST(result == ISC_R_SUCCESS);
899                 RETERR(dns_zone_setxfrsource6(zone, cfg_obj_assockaddr(obj)));
900                 ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
901
902                 obj = NULL;
903                 result = ns_config_get(maps, "alt-transfer-source", &obj);
904                 INSIST(result == ISC_R_SUCCESS);
905                 RETERR(dns_zone_setaltxfrsource4(zone, cfg_obj_assockaddr(obj)));
906
907                 obj = NULL;
908                 result = ns_config_get(maps, "alt-transfer-source-v6", &obj);
909                 INSIST(result == ISC_R_SUCCESS);
910                 RETERR(dns_zone_setaltxfrsource6(zone, cfg_obj_assockaddr(obj)));
911
912                 obj = NULL;
913                 (void)ns_config_get(maps, "use-alt-transfer-source", &obj);
914                 if (obj == NULL) {
915                         /*
916                          * Default off when views are in use otherwise
917                          * on for BIND 8 compatibility.
918                          */
919                         view = dns_zone_getview(zone);
920                         if (view != NULL && strcmp(view->name, "_default") == 0)
921                                 alt = ISC_TRUE;
922                         else
923                                 alt = ISC_FALSE;
924                 } else
925                         alt = cfg_obj_asboolean(obj);
926                 dns_zone_setoption(zone, DNS_ZONEOPT_USEALTXFRSRC, alt);
927
928                 obj = NULL;
929                 (void)ns_config_get(maps, "try-tcp-refresh", &obj);
930                 dns_zone_setoption(zone, DNS_ZONEOPT_TRYTCPREFRESH,
931                                    cfg_obj_asboolean(obj));
932                 break;
933
934         default:
935                 break;
936         }
937
938         return (ISC_R_SUCCESS);
939 }
940
941 isc_boolean_t
942 ns_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
943         const cfg_obj_t *zoptions = NULL;
944         const cfg_obj_t *obj = NULL;
945         const char *cfilename;
946         const char *zfilename;
947
948         zoptions = cfg_tuple_get(zconfig, "options");
949
950         if (zonetype_fromconfig(zoptions) != dns_zone_gettype(zone))
951                 return (ISC_FALSE);
952
953         obj = NULL;
954         (void)cfg_map_get(zoptions, "file", &obj);
955         if (obj != NULL)
956                 cfilename = cfg_obj_asstring(obj);
957         else
958                 cfilename = NULL;
959         zfilename = dns_zone_getfile(zone);
960         if (!((cfilename == NULL && zfilename == NULL) ||
961               (cfilename != NULL && zfilename != NULL &&
962                strcmp(cfilename, zfilename) == 0)))
963             return (ISC_FALSE);
964
965         return (ISC_TRUE);
966 }