contrib/bind/bin/named/zoneconf.c

   1 /*
   2  * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
   3  * Copyright (C) 1999-2003  Internet Software Consortium.
   4  *
   5  * Permission to use, copy, modify, and/or distribute this software for any
   6  * purpose with or without fee is hereby granted, provided that the above
   7  * copyright notice and this permission notice appear in all copies.
   8  *
   9  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  10  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  11  * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  12  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  13  * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  14  * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  15  * PERFORMANCE OF THIS SOFTWARE.
  16  */
  17
  18 /* $Id: zoneconf.c,v 1.139.56.7 2009/01/29 23:47:13 tbox Exp $ */
  19
  20 /*% */
  21
  22 #include <config.h>
  23
  24 #include <isc/buffer.h>
  25 #include <isc/file.h>
  26 #include <isc/mem.h>
  27 #include <isc/print.h>
  28 #include <isc/stats.h>
  29 #include <isc/string.h>         /* Required for HP/UX (and others?) */
  30 #include <isc/util.h>
  31
  32 #include <dns/acl.h>
  33 #include <dns/fixedname.h>
  34 #include <dns/log.h>
  35 #include <dns/name.h>
  36 #include <dns/rdatatype.h>
  37 #include <dns/ssu.h>
  38 #include <dns/stats.h>
  39 #include <dns/view.h>
  40 #include <dns/zone.h>
  41
  42 #include <named/client.h>
  43 #include <named/config.h>
  44 #include <named/globals.h>
  45 #include <named/log.h>
  46 #include <named/server.h>
  47 #include <named/zoneconf.h>
  48
  49 /* ACLs associated with zone */
  50 typedef enum {
  51         allow_notify,
  52         allow_query,
  53         allow_transfer,
  54         allow_update,
  55         allow_update_forwarding
  56 } acl_type_t;
  57
  58 /*%
  59  * These are BIND9 server defaults, not necessarily identical to the
  60  * library defaults defined in zone.c.
  61  */
  62 #define RETERR(x) do { \
  63         isc_result_t _r = (x); \
  64         if (_r != ISC_R_SUCCESS) \
  65                 return (_r); \
  66         } while (0)
  67
  68 /*%
  69  * Convenience function for configuring a single zone ACL.
  70  */
  71 static isc_result_t
  72 configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
  73                    const cfg_obj_t *config, acl_type_t acltype,
  74                    cfg_aclconfctx_t *actx, dns_zone_t *zone,
  75                    void (*setzacl)(dns_zone_t *, dns_acl_t *),
  76                    void (*clearzacl)(dns_zone_t *))
  77 {
  78         isc_result_t result;
  79         const cfg_obj_t *maps[5] = {NULL, NULL, NULL, NULL, NULL};
  80         const cfg_obj_t *aclobj = NULL;
  81         int i = 0;
  82         dns_acl_t **aclp = NULL, *acl = NULL;
  83         const char *aclname;
  84         dns_view_t *view;
  85
  86         view = dns_zone_getview(zone);
  87
  88         switch (acltype) {
  89             case allow_notify:
  90                 if (view != NULL)
  91                         aclp = &view->notifyacl;
  92                 aclname = "allow-notify";
  93                 break;
  94             case allow_query:
  95                 if (view != NULL)
  96                         aclp = &view->queryacl;
  97                 aclname = "allow-query";
  98                 break;
  99             case allow_transfer:
 100                 if (view != NULL)
 101                         aclp = &view->transferacl;
 102                 aclname = "allow-transfer";
 103                 break;
 104             case allow_update:
 105                 if (view != NULL)
 106                         aclp = &view->updateacl;
 107                 aclname = "allow-update";
 108                 break;
 109             case allow_update_forwarding:
 110                 if (view != NULL)
 111                         aclp = &view->upfwdacl;
 112                 aclname = "allow-update-forwarding";
 113                 break;
 114             default:
 115                 INSIST(0);
 116                 return (ISC_R_FAILURE);
 117         }
 118
 119         /* First check to see if ACL is defined within the zone */
 120         if (zconfig != NULL) {
 121                 maps[0] = cfg_tuple_get(zconfig, "options");
 122                 ns_config_get(maps, aclname, &aclobj);
 123                 if (aclobj != NULL) {
 124                         aclp = NULL;
 125                         goto parse_acl;
 126                 }
 127         }
 128
 129         /* Failing that, see if there's a default ACL already in the view */
 130         if (aclp != NULL && *aclp != NULL) {
 131                 (*setzacl)(zone, *aclp);
 132                 return (ISC_R_SUCCESS);
 133         }
 134
 135         /* Check for default ACLs that haven't been parsed yet */
 136         if (vconfig != NULL)
 137                 maps[i++] = cfg_tuple_get(vconfig, "options");
 138         if (config != NULL) {
 139                 const cfg_obj_t *options = NULL;
 140                 (void)cfg_map_get(config, "options", &options);
 141                 if (options != NULL)
 142                         maps[i++] = options;
 143         }
 144         maps[i++] = ns_g_defaults;
 145         maps[i] = NULL;
 146
 147         result = ns_config_get(maps, aclname, &aclobj);
 148         if (aclobj == NULL) {
 149                 (*clearzacl)(zone);
 150                 return (ISC_R_SUCCESS);
 151         }
 152
 153 parse_acl:
 154         result = cfg_acl_fromconfig(aclobj, config, ns_g_lctx, actx,
 155                                     dns_zone_getmctx(zone), 0, &acl);
 156         if (result != ISC_R_SUCCESS)
 157                 return (result);
 158         (*setzacl)(zone, acl);
 159
 160         /* Set the view default now */
 161         if (aclp != NULL)
 162                 dns_acl_attach(acl, aclp);
 163
 164         dns_acl_detach(&acl);
 165         return (ISC_R_SUCCESS);
 166 }
 167
 168 /*%
 169  * Parse the zone update-policy statement.
 170  */
 171 static isc_result_t
 172 configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone) {
 173         const cfg_obj_t *updatepolicy = NULL;
 174         const cfg_listelt_t *element, *element2;
 175         dns_ssutable_t *table = NULL;
 176         isc_mem_t *mctx = dns_zone_getmctx(zone);
 177         isc_result_t result;
 178
 179         (void)cfg_map_get(zconfig, "update-policy", &updatepolicy);
 180         if (updatepolicy == NULL) {
 181                 dns_zone_setssutable(zone, NULL);
 182                 return (ISC_R_SUCCESS);
 183         }
 184
 185         result = dns_ssutable_create(mctx, &table);
 186         if (result != ISC_R_SUCCESS)
 187                 return (result);
 188
 189         for (element = cfg_list_first(updatepolicy);
 190              element != NULL;
 191              element = cfg_list_next(element))
 192         {
 193                 const cfg_obj_t *stmt = cfg_listelt_value(element);
 194                 const cfg_obj_t *mode = cfg_tuple_get(stmt, "mode");
 195                 const cfg_obj_t *identity = cfg_tuple_get(stmt, "identity");
 196                 const cfg_obj_t *matchtype = cfg_tuple_get(stmt, "matchtype");
 197                 const cfg_obj_t *dname = cfg_tuple_get(stmt, "name");
 198                 const cfg_obj_t *typelist = cfg_tuple_get(stmt, "types");
 199                 const char *str;
 200                 isc_boolean_t grant = ISC_FALSE;
 201                 unsigned int mtype = DNS_SSUMATCHTYPE_NAME;
 202                 dns_fixedname_t fname, fident;
 203                 isc_buffer_t b;
 204                 dns_rdatatype_t *types;
 205                 unsigned int i, n;
 206
 207                 str = cfg_obj_asstring(mode);
 208                 if (strcasecmp(str, "grant") == 0)
 209                         grant = ISC_TRUE;
 210                 else if (strcasecmp(str, "deny") == 0)
 211                         grant = ISC_FALSE;
 212                 else
 213                         INSIST(0);
 214
 215                 str = cfg_obj_asstring(matchtype);
 216                 if (strcasecmp(str, "name") == 0)
 217                         mtype = DNS_SSUMATCHTYPE_NAME;
 218                 else if (strcasecmp(str, "subdomain") == 0)
 219                         mtype = DNS_SSUMATCHTYPE_SUBDOMAIN;
 220                 else if (strcasecmp(str, "wildcard") == 0)
 221                         mtype = DNS_SSUMATCHTYPE_WILDCARD;
 222                 else if (strcasecmp(str, "self") == 0)
 223                         mtype = DNS_SSUMATCHTYPE_SELF;
 224                 else if (strcasecmp(str, "selfsub") == 0)
 225                         mtype = DNS_SSUMATCHTYPE_SELFSUB;
 226                 else if (strcasecmp(str, "selfwild") == 0)
 227                         mtype = DNS_SSUMATCHTYPE_SELFWILD;
 228                 else if (strcasecmp(str, "ms-self") == 0)
 229                         mtype = DNS_SSUMATCHTYPE_SELFMS;
 230                 else if (strcasecmp(str, "krb5-self") == 0)
 231                         mtype = DNS_SSUMATCHTYPE_SELFKRB5;
 232                 else if (strcasecmp(str, "ms-subdomain") == 0)
 233                         mtype = DNS_SSUMATCHTYPE_SUBDOMAINMS;
 234                 else if (strcasecmp(str, "krb5-subdomain") == 0)
 235                         mtype = DNS_SSUMATCHTYPE_SUBDOMAINKRB5;
 236                 else
 237                         INSIST(0);
 238
 239                 dns_fixedname_init(&fident);
 240                 str = cfg_obj_asstring(identity);
 241                 isc_buffer_init(&b, str, strlen(str));
 242                 isc_buffer_add(&b, strlen(str));
 243                 result = dns_name_fromtext(dns_fixedname_name(&fident), &b,
 244                                            dns_rootname, ISC_FALSE, NULL);
 245                 if (result != ISC_R_SUCCESS) {
 246                         cfg_obj_log(identity, ns_g_lctx, ISC_LOG_ERROR,
 247                                     "'%s' is not a valid name", str);
 248                         goto cleanup;
 249                 }
 250
 251                 dns_fixedname_init(&fname);
 252                 str = cfg_obj_asstring(dname);
 253                 isc_buffer_init(&b, str, strlen(str));
 254                 isc_buffer_add(&b, strlen(str));
 255                 result = dns_name_fromtext(dns_fixedname_name(&fname), &b,
 256                                            dns_rootname, ISC_FALSE, NULL);
 257                 if (result != ISC_R_SUCCESS) {
 258                         cfg_obj_log(identity, ns_g_lctx, ISC_LOG_ERROR,
 259                                     "'%s' is not a valid name", str);
 260                         goto cleanup;
 261                 }
 262
 263                 n = ns_config_listcount(typelist);
 264                 if (n == 0)
 265                         types = NULL;
 266                 else {
 267                         types = isc_mem_get(mctx, n * sizeof(dns_rdatatype_t));
 268                         if (types == NULL) {
 269                                 result = ISC_R_NOMEMORY;
 270                                 goto cleanup;
 271                         }
 272                 }
 273
 274                 i = 0;
 275                 for (element2 = cfg_list_first(typelist);
 276                      element2 != NULL;
 277                      element2 = cfg_list_next(element2))
 278                 {
 279                         const cfg_obj_t *typeobj;
 280                         isc_textregion_t r;
 281
 282                         INSIST(i < n);
 283
 284                         typeobj = cfg_listelt_value(element2);
 285                         str = cfg_obj_asstring(typeobj);
 286                         DE_CONST(str, r.base);
 287                         r.length = strlen(str);
 288
 289                         result = dns_rdatatype_fromtext(&types[i++], &r);
 290                         if (result != ISC_R_SUCCESS) {
 291                                 cfg_obj_log(identity, ns_g_lctx, ISC_LOG_ERROR,
 292                                             "'%s' is not a valid type", str);
 293                                 isc_mem_put(mctx, types,
 294                                             n * sizeof(dns_rdatatype_t));
 295                                 goto cleanup;
 296                         }
 297                 }
 298                 INSIST(i == n);
 299
 300                 result = dns_ssutable_addrule(table, grant,
 301                                               dns_fixedname_name(&fident),
 302                                               mtype,
 303                                               dns_fixedname_name(&fname),
 304                                               n, types);
 305                 if (types != NULL)
 306                         isc_mem_put(mctx, types, n * sizeof(dns_rdatatype_t));
 307                 if (result != ISC_R_SUCCESS) {
 308                         goto cleanup;
 309                 }
 310
 311         }
 312
 313         result = ISC_R_SUCCESS;
 314         dns_zone_setssutable(zone, table);
 315
 316  cleanup:
 317         dns_ssutable_detach(&table);
 318         return (result);
 319 }
 320
 321 /*%
 322  * Convert a config file zone type into a server zone type.
 323  */
 324 static inline dns_zonetype_t
 325 zonetype_fromconfig(const cfg_obj_t *map) {
 326         const cfg_obj_t *obj = NULL;
 327         isc_result_t result;
 328
 329         result = cfg_map_get(map, "type", &obj);
 330         INSIST(result == ISC_R_SUCCESS);
 331         return (ns_config_getzonetype(obj));
 332 }
 333
 334 /*%
 335  * Helper function for strtoargv().  Pardon the gratuitous recursion.
 336  */
 337 static isc_result_t
 338 strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp,
 339              char ***argvp, unsigned int n)
 340 {
 341         isc_result_t result;
 342
 343         /* Discard leading whitespace. */
 344         while (*s == ' ' || *s == '\t')
 345                 s++;
 346
 347         if (*s == '\0') {
 348                 /* We have reached the end of the string. */
 349                 *argcp = n;
 350                 *argvp = isc_mem_get(mctx, n * sizeof(char *));
 351                 if (*argvp == NULL)
 352                         return (ISC_R_NOMEMORY);
 353         } else {
 354                 char *p = s;
 355                 while (*p != ' ' && *p != '\t' && *p != '\0')
 356                         p++;
 357                 if (*p != '\0')
 358                         *p++ = '\0';
 359
 360                 result = strtoargvsub(mctx, p, argcp, argvp, n + 1);
 361                 if (result != ISC_R_SUCCESS)
 362                         return (result);
 363                 (*argvp)[n] = s;
 364         }
 365         return (ISC_R_SUCCESS);
 366 }
 367
 368 /*%
 369  * Tokenize the string "s" into whitespace-separated words,
 370  * return the number of words in '*argcp' and an array
 371  * of pointers to the words in '*argvp'.  The caller
 372  * must free the array using isc_mem_put().  The string
 373  * is modified in-place.
 374  */
 375 static isc_result_t
 376 strtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp) {
 377         return (strtoargvsub(mctx, s, argcp, argvp, 0));
 378 }
 379
 380 static void
 381 checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
 382            const cfg_obj_t **objp)
 383 {
 384         const char *zone = NULL;
 385         isc_result_t result;
 386
 387         switch (ztype) {
 388         case dns_zone_slave: zone = "slave"; break;
 389         case dns_zone_master: zone = "master"; break;
 390         default:
 391                 INSIST(0);
 392         }
 393         result = ns_checknames_get(maps, zone, objp);
 394         INSIST(result == ISC_R_SUCCESS);
 395 }
 396
 397 isc_result_t
 398 ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 399                   const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
 400                   dns_zone_t *zone)
 401 {
 402         isc_result_t result;
 403         const char *zname;
 404         dns_rdataclass_t zclass;
 405         dns_rdataclass_t vclass;
 406         const cfg_obj_t *maps[5];
 407         const cfg_obj_t *zoptions = NULL;
 408         const cfg_obj_t *options = NULL;
 409         const cfg_obj_t *obj;
 410         const char *filename = NULL;
 411         dns_notifytype_t notifytype = dns_notifytype_yes;
 412         isc_sockaddr_t *addrs;
 413         dns_name_t **keynames;
 414         isc_uint32_t count;
 415         char *cpval;
 416         unsigned int dbargc;
 417         char **dbargv;
 418         static char default_dbtype[] = "rbt";
 419         isc_mem_t *mctx = dns_zone_getmctx(zone);
 420         dns_dialuptype_t dialup = dns_dialuptype_no;
 421         dns_zonetype_t ztype;
 422         int i;
 423         isc_int32_t journal_size;
 424         isc_boolean_t multi;
 425         isc_boolean_t alt;
 426         dns_view_t *view;
 427         isc_boolean_t check = ISC_FALSE, fail = ISC_FALSE;
 428         isc_boolean_t warn = ISC_FALSE, ignore = ISC_FALSE;
 429         isc_boolean_t ixfrdiff;
 430         dns_masterformat_t masterformat;
 431         isc_stats_t *zoneqrystats;
 432         isc_boolean_t zonestats_on;
 433
 434         i = 0;
 435         if (zconfig != NULL) {
 436                 zoptions = cfg_tuple_get(zconfig, "options");
 437                 maps[i++] = zoptions;
 438         }
 439         if (vconfig != NULL)
 440                 maps[i++] = cfg_tuple_get(vconfig, "options");
 441         if (config != NULL) {
 442                 (void)cfg_map_get(config, "options", &options);
 443                 if (options != NULL)
 444                         maps[i++] = options;
 445         }
 446         maps[i++] = ns_g_defaults;
 447         maps[i++] = NULL;
 448
 449         if (vconfig != NULL)
 450                 RETERR(ns_config_getclass(cfg_tuple_get(vconfig, "class"),
 451                                           dns_rdataclass_in, &vclass));
 452         else
 453                 vclass = dns_rdataclass_in;
 454
 455         /*
 456          * Configure values common to all zone types.
 457          */
 458
 459         zname = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
 460
 461         RETERR(ns_config_getclass(cfg_tuple_get(zconfig, "class"),
 462                                   vclass, &zclass));
 463         dns_zone_setclass(zone, zclass);
 464
 465         ztype = zonetype_fromconfig(zoptions);
 466         dns_zone_settype(zone, ztype);
 467
 468         obj = NULL;
 469         result = cfg_map_get(zoptions, "database", &obj);
 470         if (result == ISC_R_SUCCESS)
 471                 cpval = isc_mem_strdup(mctx, cfg_obj_asstring(obj));
 472         else
 473                 cpval = default_dbtype;
 474
 475         if (cpval == NULL)
 476                 return(ISC_R_NOMEMORY);
 477
 478         result = strtoargv(mctx, cpval, &dbargc, &dbargv);
 479         if (result != ISC_R_SUCCESS && cpval != default_dbtype) {
 480                 isc_mem_free(mctx, cpval);
 481                 return (result);
 482         }
 483
 484         /*
 485          * ANSI C is strange here.  There is no logical reason why (char **)
 486          * cannot be promoted automatically to (const char * const *) by the
 487          * compiler w/o generating a warning.
 488          */
 489         result = dns_zone_setdbtype(zone, dbargc, (const char * const *)dbargv);
 490         isc_mem_put(mctx, dbargv, dbargc * sizeof(*dbargv));
 491         if (cpval != default_dbtype)
 492                 isc_mem_free(mctx, cpval);
 493         if (result != ISC_R_SUCCESS)
 494                 return (result);
 495
 496         obj = NULL;
 497         result = cfg_map_get(zoptions, "file", &obj);
 498         if (result == ISC_R_SUCCESS)
 499                 filename = cfg_obj_asstring(obj);
 500
 501         masterformat = dns_masterformat_text;
 502         obj = NULL;
 503         result= ns_config_get(maps, "masterfile-format", &obj);
 504         if (result == ISC_R_SUCCESS) {
 505                 const char *masterformatstr = cfg_obj_asstring(obj);
 506
 507                 if (strcasecmp(masterformatstr, "text") == 0)
 508                         masterformat = dns_masterformat_text;
 509                 else if (strcasecmp(masterformatstr, "raw") == 0)
 510                         masterformat = dns_masterformat_raw;
 511                 else
 512                         INSIST(0);
 513         }
 514         RETERR(dns_zone_setfile2(zone, filename, masterformat));
 515
 516         obj = NULL;
 517         result = cfg_map_get(zoptions, "journal", &obj);
 518         if (result == ISC_R_SUCCESS)
 519                 RETERR(dns_zone_setjournal(zone, cfg_obj_asstring(obj)));
 520
 521         if (ztype == dns_zone_slave)
 522                 RETERR(configure_zone_acl(zconfig, vconfig, config,
 523                                           allow_notify, ac, zone,
 524                                           dns_zone_setnotifyacl,
 525                                           dns_zone_clearnotifyacl));
 526         /*
 527          * XXXAG This probably does not make sense for stubs.
 528          */
 529         RETERR(configure_zone_acl(zconfig, vconfig, config,
 530                                   allow_query, ac, zone,
 531                                   dns_zone_setqueryacl,
 532                                   dns_zone_clearqueryacl));
 533
 534         obj = NULL;
 535         result = ns_config_get(maps, "dialup", &obj);
 536         INSIST(result == ISC_R_SUCCESS);
 537         if (cfg_obj_isboolean(obj)) {
 538                 if (cfg_obj_asboolean(obj))
 539                         dialup = dns_dialuptype_yes;
 540                 else
 541                         dialup = dns_dialuptype_no;
 542         } else {
 543                 const char *dialupstr = cfg_obj_asstring(obj);
 544                 if (strcasecmp(dialupstr, "notify") == 0)
 545                         dialup = dns_dialuptype_notify;
 546                 else if (strcasecmp(dialupstr, "notify-passive") == 0)
 547                         dialup = dns_dialuptype_notifypassive;
 548                 else if (strcasecmp(dialupstr, "refresh") == 0)
 549                         dialup = dns_dialuptype_refresh;
 550                 else if (strcasecmp(dialupstr, "passive") == 0)
 551                         dialup = dns_dialuptype_passive;
 552                 else
 553                         INSIST(0);
 554         }
 555         dns_zone_setdialup(zone, dialup);
 556
 557         obj = NULL;
 558         result = ns_config_get(maps, "zone-statistics", &obj);
 559         INSIST(result == ISC_R_SUCCESS);
 560         zonestats_on = cfg_obj_asboolean(obj);
 561         zoneqrystats = NULL;
 562         if (zonestats_on) {
 563                 RETERR(isc_stats_create(mctx, &zoneqrystats,
 564                                         dns_nsstatscounter_max));
 565         }
 566         dns_zone_setrequeststats(zone, zoneqrystats);
 567         if (zoneqrystats != NULL)
 568                 isc_stats_detach(&zoneqrystats);
 569
 570         /*
 571          * Configure master functionality.  This applies
 572          * to primary masters (type "master") and slaves
 573          * acting as masters (type "slave"), but not to stubs.
 574          */
 575         if (ztype != dns_zone_stub) {
 576                 obj = NULL;
 577                 result = ns_config_get(maps, "notify", &obj);
 578                 INSIST(result == ISC_R_SUCCESS);
 579                 if (cfg_obj_isboolean(obj)) {
 580                         if (cfg_obj_asboolean(obj))
 581                                 notifytype = dns_notifytype_yes;
 582                         else
 583                                 notifytype = dns_notifytype_no;
 584                 } else {
 585                         const char *notifystr = cfg_obj_asstring(obj);
 586                         if (strcasecmp(notifystr, "explicit") == 0)
 587                                 notifytype = dns_notifytype_explicit;
 588                         else if (strcasecmp(notifystr, "master-only") == 0)
 589                                 notifytype = dns_notifytype_masteronly;
 590                         else
 591                                 INSIST(0);
 592                 }
 593                 dns_zone_setnotifytype(zone, notifytype);
 594
 595                 obj = NULL;
 596                 result = ns_config_get(maps, "also-notify", &obj);
 597                 if (result == ISC_R_SUCCESS) {
 598                         isc_sockaddr_t *addrs = NULL;
 599                         isc_uint32_t addrcount;
 600                         result = ns_config_getiplist(config, obj, 0, mctx,
 601                                                      &addrs, &addrcount);
 602                         if (result != ISC_R_SUCCESS)
 603                                 return (result);
 604                         result = dns_zone_setalsonotify(zone, addrs,
 605                                                         addrcount);
 606                         ns_config_putiplist(mctx, &addrs, addrcount);
 607                         if (result != ISC_R_SUCCESS)
 608                                 return (result);
 609                 } else
 610                         RETERR(dns_zone_setalsonotify(zone, NULL, 0));
 611
 612                 obj = NULL;
 613                 result = ns_config_get(maps, "notify-source", &obj);
 614                 INSIST(result == ISC_R_SUCCESS);
 615                 RETERR(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
 616                 ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
 617
 618                 obj = NULL;
 619                 result = ns_config_get(maps, "notify-source-v6", &obj);
 620                 INSIST(result == ISC_R_SUCCESS);
 621                 RETERR(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
 622                 ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
 623
 624                 obj = NULL;
 625                 result = ns_config_get(maps, "notify-to-soa", &obj);
 626                 INSIST(result == ISC_R_SUCCESS);
 627                 dns_zone_setoption(zone, DNS_ZONEOPT_NOTIFYTOSOA,
 628                                    cfg_obj_asboolean(obj));
 629
 630                 dns_zone_setisself(zone, ns_client_isself, NULL);
 631
 632                 RETERR(configure_zone_acl(zconfig, vconfig, config,
 633                                           allow_transfer, ac, zone,
 634                                           dns_zone_setxfracl,
 635                                           dns_zone_clearxfracl));
 636
 637                 obj = NULL;
 638                 result = ns_config_get(maps, "max-transfer-time-out", &obj);
 639                 INSIST(result == ISC_R_SUCCESS);
 640                 dns_zone_setmaxxfrout(zone, cfg_obj_asuint32(obj) * 60);
 641
 642                 obj = NULL;
 643                 result = ns_config_get(maps, "max-transfer-idle-out", &obj);
 644                 INSIST(result == ISC_R_SUCCESS);
 645                 dns_zone_setidleout(zone, cfg_obj_asuint32(obj) * 60);
 646
 647                 obj = NULL;
 648                 result =  ns_config_get(maps, "max-journal-size", &obj);
 649                 INSIST(result == ISC_R_SUCCESS);
 650                 dns_zone_setjournalsize(zone, -1);
 651                 if (cfg_obj_isstring(obj)) {
 652                         const char *str = cfg_obj_asstring(obj);
 653                         INSIST(strcasecmp(str, "unlimited") == 0);
 654                         journal_size = ISC_UINT32_MAX / 2;
 655                 } else {
 656                         isc_resourcevalue_t value;
 657                         value = cfg_obj_asuint64(obj);
 658                         if (value > ISC_UINT32_MAX / 2) {
 659                                 cfg_obj_log(obj, ns_g_lctx,
 660                                             ISC_LOG_ERROR,
 661                                             "'max-journal-size "
 662                                             "%" ISC_PRINT_QUADFORMAT "d' "
 663                                             "is too large",
 664                                             value);
 665                                 RETERR(ISC_R_RANGE);
 666                         }
 667                         journal_size = (isc_uint32_t)value;
 668                 }
 669                 dns_zone_setjournalsize(zone, journal_size);
 670
 671                 obj = NULL;
 672                 result = ns_config_get(maps, "ixfr-from-differences", &obj);
 673                 INSIST(result == ISC_R_SUCCESS);
 674                 if (cfg_obj_isboolean(obj))
 675                         ixfrdiff = cfg_obj_asboolean(obj);
 676                 else if (strcasecmp(cfg_obj_asstring(obj), "master") &&
 677                          ztype == dns_zone_master)
 678                         ixfrdiff = ISC_TRUE;
 679                 else if (strcasecmp(cfg_obj_asstring(obj), "slave") &&
 680                         ztype == dns_zone_slave)
 681                         ixfrdiff = ISC_TRUE;
 682                 else
 683                         ixfrdiff = ISC_FALSE;
 684                 dns_zone_setoption(zone, DNS_ZONEOPT_IXFRFROMDIFFS, ixfrdiff);
 685
 686                 checknames(ztype, maps, &obj);
 687                 INSIST(obj != NULL);
 688                 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
 689                         fail = ISC_FALSE;
 690                         check = ISC_TRUE;
 691                 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
 692                         fail = check = ISC_TRUE;
 693                 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 694                         fail = check = ISC_FALSE;
 695                 } else
 696                         INSIST(0);
 697                 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMES, check);
 698                 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMESFAIL, fail);
 699
 700                 obj = NULL;
 701                 result = ns_config_get(maps, "notify-delay", &obj);
 702                 INSIST(result == ISC_R_SUCCESS);
 703                 dns_zone_setnotifydelay(zone, cfg_obj_asuint32(obj));
 704
 705                 obj = NULL;
 706                 result = ns_config_get(maps, "check-sibling", &obj);
 707                 INSIST(result == ISC_R_SUCCESS);
 708                 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSIBLING,
 709                                    cfg_obj_asboolean(obj));
 710
 711                 obj = NULL;
 712                 result = ns_config_get(maps, "zero-no-soa-ttl", &obj);
 713                 INSIST(result == ISC_R_SUCCESS);
 714                 dns_zone_setzeronosoattl(zone, cfg_obj_asboolean(obj));
 715         }
 716
 717         /*
 718          * Configure update-related options.  These apply to
 719          * primary masters only.
 720          */
 721         if (ztype == dns_zone_master) {
 722                 dns_acl_t *updateacl;
 723                 RETERR(configure_zone_acl(zconfig, vconfig, config,
 724                                           allow_update, ac, zone,
 725                                           dns_zone_setupdateacl,
 726                                           dns_zone_clearupdateacl));
 727
 728                 updateacl = dns_zone_getupdateacl(zone);
 729                 if (updateacl != NULL  && dns_acl_isinsecure(updateacl))
 730                         isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
 731                                       NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
 732                                       "zone '%s' allows updates by IP "
 733                                       "address, which is insecure",
 734                                       zname);
 735
 736                 RETERR(configure_zone_ssutable(zoptions, zone));
 737
 738                 obj = NULL;
 739                 result = ns_config_get(maps, "sig-validity-interval", &obj);
 740                 INSIST(result == ISC_R_SUCCESS);
 741                 dns_zone_setsigvalidityinterval(zone,
 742                                                 cfg_obj_asuint32(obj) * 86400);
 743
 744                 obj = NULL;
 745                 result = ns_config_get(maps, "key-directory", &obj);
 746                 if (result == ISC_R_SUCCESS) {
 747                         filename = cfg_obj_asstring(obj);
 748                         if (!isc_file_isabsolute(filename)) {
 749                                 cfg_obj_log(obj, ns_g_lctx, ISC_LOG_ERROR,
 750                                             "key-directory '%s' "
 751                                             "is not absolute", filename);
 752                                 return (ISC_R_FAILURE);
 753                         }
 754                         RETERR(dns_zone_setkeydirectory(zone, filename));
 755                 }
 756
 757                 obj = NULL;
 758                 result = ns_config_get(maps, "check-wildcard", &obj);
 759                 if (result == ISC_R_SUCCESS)
 760                         check = cfg_obj_asboolean(obj);
 761                 else
 762                         check = ISC_FALSE;
 763                 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKWILDCARD, check);
 764
 765                 obj = NULL;
 766                 result = ns_config_get(maps, "check-mx", &obj);
 767                 INSIST(obj != NULL);
 768                 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
 769                         fail = ISC_FALSE;
 770                         check = ISC_TRUE;
 771                 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
 772                         fail = check = ISC_TRUE;
 773                 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 774                         fail = check = ISC_FALSE;
 775                 } else
 776                         INSIST(0);
 777                 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKMX, check);
 778                 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKMXFAIL, fail);
 779
 780                 obj = NULL;
 781                 result = ns_config_get(maps, "check-integrity", &obj);
 782                 INSIST(obj != NULL);
 783                 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKINTEGRITY,
 784                                    cfg_obj_asboolean(obj));
 785
 786                 obj = NULL;
 787                 result = ns_config_get(maps, "check-mx-cname", &obj);
 788                 INSIST(obj != NULL);
 789                 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
 790                         warn = ISC_TRUE;
 791                         ignore = ISC_FALSE;
 792                 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
 793                         warn = ignore = ISC_FALSE;
 794                 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 795                         warn = ignore = ISC_TRUE;
 796                 } else
 797                         INSIST(0);
 798                 dns_zone_setoption(zone, DNS_ZONEOPT_WARNMXCNAME, warn);
 799                 dns_zone_setoption(zone, DNS_ZONEOPT_IGNOREMXCNAME, ignore);
 800
 801                 obj = NULL;
 802                 result = ns_config_get(maps, "check-srv-cname", &obj);
 803                 INSIST(obj != NULL);
 804                 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
 805                         warn = ISC_TRUE;
 806                         ignore = ISC_FALSE;
 807                 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
 808                         warn = ignore = ISC_FALSE;
 809                 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 810                         warn = ignore = ISC_TRUE;
 811                 } else
 812                         INSIST(0);
 813                 dns_zone_setoption(zone, DNS_ZONEOPT_WARNSRVCNAME, warn);
 814                 dns_zone_setoption(zone, DNS_ZONEOPT_IGNORESRVCNAME, ignore);
 815
 816                 obj = NULL;
 817                 result = ns_config_get(maps, "update-check-ksk", &obj);
 818                 INSIST(result == ISC_R_SUCCESS);
 819                 dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
 820                                    cfg_obj_asboolean(obj));
 821         } else if (ztype == dns_zone_slave) {
 822                 RETERR(configure_zone_acl(zconfig, vconfig, config,
 823                                           allow_update_forwarding, ac, zone,
 824                                           dns_zone_setforwardacl,
 825                                           dns_zone_clearforwardacl));
 826         }
 827
 828         /*
 829          * Configure slave functionality.
 830          */
 831         switch (ztype) {
 832         case dns_zone_slave:
 833         case dns_zone_stub:
 834                 count = 0;
 835                 obj = NULL;
 836                 result = cfg_map_get(zoptions, "masters", &obj);
 837                 if (obj != NULL) {
 838                         addrs = NULL;
 839                         keynames = NULL;
 840                         RETERR(ns_config_getipandkeylist(config, obj, mctx,
 841                                                          &addrs, &keynames,
 842                                                          &count));
 843                         result = dns_zone_setmasterswithkeys(zone, addrs,
 844                                                              keynames, count);
 845                         ns_config_putipandkeylist(mctx, &addrs, &keynames,
 846                                                   count);
 847                 } else
 848                         result = dns_zone_setmasters(zone, NULL, 0);
 849                 RETERR(result);
 850
 851                 multi = ISC_FALSE;
 852                 if (count > 1) {
 853                         obj = NULL;
 854                         result = ns_config_get(maps, "multi-master", &obj);
 855                         INSIST(result == ISC_R_SUCCESS);
 856                         multi = cfg_obj_asboolean(obj);
 857                 }
 858                 dns_zone_setoption(zone, DNS_ZONEOPT_MULTIMASTER, multi);
 859
 860                 obj = NULL;
 861                 result = ns_config_get(maps, "max-transfer-time-in", &obj);
 862                 INSIST(result == ISC_R_SUCCESS);
 863                 dns_zone_setmaxxfrin(zone, cfg_obj_asuint32(obj) * 60);
 864
 865                 obj = NULL;
 866                 result = ns_config_get(maps, "max-transfer-idle-in", &obj);
 867                 INSIST(result == ISC_R_SUCCESS);
 868                 dns_zone_setidlein(zone, cfg_obj_asuint32(obj) * 60);
 869
 870                 obj = NULL;
 871                 result = ns_config_get(maps, "max-refresh-time", &obj);
 872                 INSIST(result == ISC_R_SUCCESS);
 873                 dns_zone_setmaxrefreshtime(zone, cfg_obj_asuint32(obj));
 874
 875                 obj = NULL;
 876                 result = ns_config_get(maps, "min-refresh-time", &obj);
 877                 INSIST(result == ISC_R_SUCCESS);
 878                 dns_zone_setminrefreshtime(zone, cfg_obj_asuint32(obj));
 879
 880                 obj = NULL;
 881                 result = ns_config_get(maps, "max-retry-time", &obj);
 882                 INSIST(result == ISC_R_SUCCESS);
 883                 dns_zone_setmaxretrytime(zone, cfg_obj_asuint32(obj));
 884
 885                 obj = NULL;
 886                 result = ns_config_get(maps, "min-retry-time", &obj);
 887                 INSIST(result == ISC_R_SUCCESS);
 888                 dns_zone_setminretrytime(zone, cfg_obj_asuint32(obj));
 889
 890                 obj = NULL;
 891                 result = ns_config_get(maps, "transfer-source", &obj);
 892                 INSIST(result == ISC_R_SUCCESS);
 893                 RETERR(dns_zone_setxfrsource4(zone, cfg_obj_assockaddr(obj)));
 894                 ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
 895
 896                 obj = NULL;
 897                 result = ns_config_get(maps, "transfer-source-v6", &obj);
 898                 INSIST(result == ISC_R_SUCCESS);
 899                 RETERR(dns_zone_setxfrsource6(zone, cfg_obj_assockaddr(obj)));
 900                 ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
 901
 902                 obj = NULL;
 903                 result = ns_config_get(maps, "alt-transfer-source", &obj);
 904                 INSIST(result == ISC_R_SUCCESS);
 905                 RETERR(dns_zone_setaltxfrsource4(zone, cfg_obj_assockaddr(obj)));
 906
 907                 obj = NULL;
 908                 result = ns_config_get(maps, "alt-transfer-source-v6", &obj);
 909                 INSIST(result == ISC_R_SUCCESS);
 910                 RETERR(dns_zone_setaltxfrsource6(zone, cfg_obj_assockaddr(obj)));
 911
 912                 obj = NULL;
 913                 (void)ns_config_get(maps, "use-alt-transfer-source", &obj);
 914                 if (obj == NULL) {
 915                         /*
 916                          * Default off when views are in use otherwise
 917                          * on for BIND 8 compatibility.
 918                          */
 919                         view = dns_zone_getview(zone);
 920                         if (view != NULL && strcmp(view->name, "_default") == 0)
 921                                 alt = ISC_TRUE;
 922                         else
 923                                 alt = ISC_FALSE;
 924                 } else
 925                         alt = cfg_obj_asboolean(obj);
 926                 dns_zone_setoption(zone, DNS_ZONEOPT_USEALTXFRSRC, alt);
 927
 928                 obj = NULL;
 929                 (void)ns_config_get(maps, "try-tcp-refresh", &obj);
 930                 dns_zone_setoption(zone, DNS_ZONEOPT_TRYTCPREFRESH,
 931                                    cfg_obj_asboolean(obj));
 932                 break;
 933
 934         default:
 935                 break;
 936         }
 937
 938         return (ISC_R_SUCCESS);
 939 }
 940
 941 isc_boolean_t
 942 ns_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
 943         const cfg_obj_t *zoptions = NULL;
 944         const cfg_obj_t *obj = NULL;
 945         const char *cfilename;
 946         const char *zfilename;
 947
 948         zoptions = cfg_tuple_get(zconfig, "options");
 949
 950         if (zonetype_fromconfig(zoptions) != dns_zone_gettype(zone))
 951                 return (ISC_FALSE);
 952
 953         obj = NULL;
 954         (void)cfg_map_get(zoptions, "file", &obj);
 955         if (obj != NULL)
 956                 cfilename = cfg_obj_asstring(obj);
 957         else
 958                 cfilename = NULL;
 959         zfilename = dns_zone_getfile(zone);
 960         if (!((cfilename == NULL && zfilename == NULL) ||
 961               (cfilename != NULL && zfilename != NULL &&
 962                strcmp(cfilename, zfilename) == 0)))
 963             return (ISC_FALSE);
 964
 965         return (ISC_TRUE);
 966 }