2 * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
3 * Copyright (C) 1999-2003 Internet Software Consortium.
5 * Permission to use, copy, modify, and/or distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
9 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
10 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
11 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
12 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
13 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
14 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
15 * PERFORMANCE OF THIS SOFTWARE.
18 /* $Id: zoneconf.c,v 1.139.56.7 2009/01/29 23:47:13 tbox Exp $ */
24 #include <isc/buffer.h>
27 #include <isc/print.h>
28 #include <isc/stats.h>
29 #include <isc/string.h> /* Required for HP/UX (and others?) */
33 #include <dns/fixedname.h>
36 #include <dns/rdatatype.h>
38 #include <dns/stats.h>
42 #include <named/client.h>
43 #include <named/config.h>
44 #include <named/globals.h>
45 #include <named/log.h>
46 #include <named/server.h>
47 #include <named/zoneconf.h>
49 /* ACLs associated with zone */
55 allow_update_forwarding
59 * These are BIND9 server defaults, not necessarily identical to the
60 * library defaults defined in zone.c.
62 #define RETERR(x) do { \
63 isc_result_t _r = (x); \
64 if (_r != ISC_R_SUCCESS) \
69 * Convenience function for configuring a single zone ACL.
72 configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
73 const cfg_obj_t *config, acl_type_t acltype,
74 cfg_aclconfctx_t *actx, dns_zone_t *zone,
75 void (*setzacl)(dns_zone_t *, dns_acl_t *),
76 void (*clearzacl)(dns_zone_t *))
79 const cfg_obj_t *maps[5] = {NULL, NULL, NULL, NULL, NULL};
80 const cfg_obj_t *aclobj = NULL;
82 dns_acl_t **aclp = NULL, *acl = NULL;
86 view = dns_zone_getview(zone);
91 aclp = &view->notifyacl;
92 aclname = "allow-notify";
96 aclp = &view->queryacl;
97 aclname = "allow-query";
101 aclp = &view->transferacl;
102 aclname = "allow-transfer";
106 aclp = &view->updateacl;
107 aclname = "allow-update";
109 case allow_update_forwarding:
111 aclp = &view->upfwdacl;
112 aclname = "allow-update-forwarding";
116 return (ISC_R_FAILURE);
119 /* First check to see if ACL is defined within the zone */
120 if (zconfig != NULL) {
121 maps[0] = cfg_tuple_get(zconfig, "options");
122 ns_config_get(maps, aclname, &aclobj);
123 if (aclobj != NULL) {
129 /* Failing that, see if there's a default ACL already in the view */
130 if (aclp != NULL && *aclp != NULL) {
131 (*setzacl)(zone, *aclp);
132 return (ISC_R_SUCCESS);
135 /* Check for default ACLs that haven't been parsed yet */
137 maps[i++] = cfg_tuple_get(vconfig, "options");
138 if (config != NULL) {
139 const cfg_obj_t *options = NULL;
140 (void)cfg_map_get(config, "options", &options);
144 maps[i++] = ns_g_defaults;
147 result = ns_config_get(maps, aclname, &aclobj);
148 if (aclobj == NULL) {
150 return (ISC_R_SUCCESS);
154 result = cfg_acl_fromconfig(aclobj, config, ns_g_lctx, actx,
155 dns_zone_getmctx(zone), 0, &acl);
156 if (result != ISC_R_SUCCESS)
158 (*setzacl)(zone, acl);
160 /* Set the view default now */
162 dns_acl_attach(acl, aclp);
164 dns_acl_detach(&acl);
165 return (ISC_R_SUCCESS);
169 * Parse the zone update-policy statement.
172 configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone) {
173 const cfg_obj_t *updatepolicy = NULL;
174 const cfg_listelt_t *element, *element2;
175 dns_ssutable_t *table = NULL;
176 isc_mem_t *mctx = dns_zone_getmctx(zone);
179 (void)cfg_map_get(zconfig, "update-policy", &updatepolicy);
180 if (updatepolicy == NULL) {
181 dns_zone_setssutable(zone, NULL);
182 return (ISC_R_SUCCESS);
185 result = dns_ssutable_create(mctx, &table);
186 if (result != ISC_R_SUCCESS)
189 for (element = cfg_list_first(updatepolicy);
191 element = cfg_list_next(element))
193 const cfg_obj_t *stmt = cfg_listelt_value(element);
194 const cfg_obj_t *mode = cfg_tuple_get(stmt, "mode");
195 const cfg_obj_t *identity = cfg_tuple_get(stmt, "identity");
196 const cfg_obj_t *matchtype = cfg_tuple_get(stmt, "matchtype");
197 const cfg_obj_t *dname = cfg_tuple_get(stmt, "name");
198 const cfg_obj_t *typelist = cfg_tuple_get(stmt, "types");
200 isc_boolean_t grant = ISC_FALSE;
201 unsigned int mtype = DNS_SSUMATCHTYPE_NAME;
202 dns_fixedname_t fname, fident;
204 dns_rdatatype_t *types;
207 str = cfg_obj_asstring(mode);
208 if (strcasecmp(str, "grant") == 0)
210 else if (strcasecmp(str, "deny") == 0)
215 str = cfg_obj_asstring(matchtype);
216 if (strcasecmp(str, "name") == 0)
217 mtype = DNS_SSUMATCHTYPE_NAME;
218 else if (strcasecmp(str, "subdomain") == 0)
219 mtype = DNS_SSUMATCHTYPE_SUBDOMAIN;
220 else if (strcasecmp(str, "wildcard") == 0)
221 mtype = DNS_SSUMATCHTYPE_WILDCARD;
222 else if (strcasecmp(str, "self") == 0)
223 mtype = DNS_SSUMATCHTYPE_SELF;
224 else if (strcasecmp(str, "selfsub") == 0)
225 mtype = DNS_SSUMATCHTYPE_SELFSUB;
226 else if (strcasecmp(str, "selfwild") == 0)
227 mtype = DNS_SSUMATCHTYPE_SELFWILD;
228 else if (strcasecmp(str, "ms-self") == 0)
229 mtype = DNS_SSUMATCHTYPE_SELFMS;
230 else if (strcasecmp(str, "krb5-self") == 0)
231 mtype = DNS_SSUMATCHTYPE_SELFKRB5;
232 else if (strcasecmp(str, "ms-subdomain") == 0)
233 mtype = DNS_SSUMATCHTYPE_SUBDOMAINMS;
234 else if (strcasecmp(str, "krb5-subdomain") == 0)
235 mtype = DNS_SSUMATCHTYPE_SUBDOMAINKRB5;
239 dns_fixedname_init(&fident);
240 str = cfg_obj_asstring(identity);
241 isc_buffer_init(&b, str, strlen(str));
242 isc_buffer_add(&b, strlen(str));
243 result = dns_name_fromtext(dns_fixedname_name(&fident), &b,
244 dns_rootname, ISC_FALSE, NULL);
245 if (result != ISC_R_SUCCESS) {
246 cfg_obj_log(identity, ns_g_lctx, ISC_LOG_ERROR,
247 "'%s' is not a valid name", str);
251 dns_fixedname_init(&fname);
252 str = cfg_obj_asstring(dname);
253 isc_buffer_init(&b, str, strlen(str));
254 isc_buffer_add(&b, strlen(str));
255 result = dns_name_fromtext(dns_fixedname_name(&fname), &b,
256 dns_rootname, ISC_FALSE, NULL);
257 if (result != ISC_R_SUCCESS) {
258 cfg_obj_log(identity, ns_g_lctx, ISC_LOG_ERROR,
259 "'%s' is not a valid name", str);
263 n = ns_config_listcount(typelist);
267 types = isc_mem_get(mctx, n * sizeof(dns_rdatatype_t));
269 result = ISC_R_NOMEMORY;
275 for (element2 = cfg_list_first(typelist);
277 element2 = cfg_list_next(element2))
279 const cfg_obj_t *typeobj;
284 typeobj = cfg_listelt_value(element2);
285 str = cfg_obj_asstring(typeobj);
286 DE_CONST(str, r.base);
287 r.length = strlen(str);
289 result = dns_rdatatype_fromtext(&types[i++], &r);
290 if (result != ISC_R_SUCCESS) {
291 cfg_obj_log(identity, ns_g_lctx, ISC_LOG_ERROR,
292 "'%s' is not a valid type", str);
293 isc_mem_put(mctx, types,
294 n * sizeof(dns_rdatatype_t));
300 result = dns_ssutable_addrule(table, grant,
301 dns_fixedname_name(&fident),
303 dns_fixedname_name(&fname),
306 isc_mem_put(mctx, types, n * sizeof(dns_rdatatype_t));
307 if (result != ISC_R_SUCCESS) {
313 result = ISC_R_SUCCESS;
314 dns_zone_setssutable(zone, table);
317 dns_ssutable_detach(&table);
322 * Convert a config file zone type into a server zone type.
324 static inline dns_zonetype_t
325 zonetype_fromconfig(const cfg_obj_t *map) {
326 const cfg_obj_t *obj = NULL;
329 result = cfg_map_get(map, "type", &obj);
330 INSIST(result == ISC_R_SUCCESS);
331 return (ns_config_getzonetype(obj));
335 * Helper function for strtoargv(). Pardon the gratuitous recursion.
338 strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp,
339 char ***argvp, unsigned int n)
343 /* Discard leading whitespace. */
344 while (*s == ' ' || *s == '\t')
348 /* We have reached the end of the string. */
350 *argvp = isc_mem_get(mctx, n * sizeof(char *));
352 return (ISC_R_NOMEMORY);
355 while (*p != ' ' && *p != '\t' && *p != '\0')
360 result = strtoargvsub(mctx, p, argcp, argvp, n + 1);
361 if (result != ISC_R_SUCCESS)
365 return (ISC_R_SUCCESS);
369 * Tokenize the string "s" into whitespace-separated words,
370 * return the number of words in '*argcp' and an array
371 * of pointers to the words in '*argvp'. The caller
372 * must free the array using isc_mem_put(). The string
373 * is modified in-place.
376 strtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp) {
377 return (strtoargvsub(mctx, s, argcp, argvp, 0));
381 checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
382 const cfg_obj_t **objp)
384 const char *zone = NULL;
388 case dns_zone_slave: zone = "slave"; break;
389 case dns_zone_master: zone = "master"; break;
393 result = ns_checknames_get(maps, zone, objp);
394 INSIST(result == ISC_R_SUCCESS);
398 ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
399 const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
404 dns_rdataclass_t zclass;
405 dns_rdataclass_t vclass;
406 const cfg_obj_t *maps[5];
407 const cfg_obj_t *zoptions = NULL;
408 const cfg_obj_t *options = NULL;
409 const cfg_obj_t *obj;
410 const char *filename = NULL;
411 dns_notifytype_t notifytype = dns_notifytype_yes;
412 isc_sockaddr_t *addrs;
413 dns_name_t **keynames;
418 static char default_dbtype[] = "rbt";
419 isc_mem_t *mctx = dns_zone_getmctx(zone);
420 dns_dialuptype_t dialup = dns_dialuptype_no;
421 dns_zonetype_t ztype;
423 isc_int32_t journal_size;
427 isc_boolean_t check = ISC_FALSE, fail = ISC_FALSE;
428 isc_boolean_t warn = ISC_FALSE, ignore = ISC_FALSE;
429 isc_boolean_t ixfrdiff;
430 dns_masterformat_t masterformat;
431 isc_stats_t *zoneqrystats;
432 isc_boolean_t zonestats_on;
435 if (zconfig != NULL) {
436 zoptions = cfg_tuple_get(zconfig, "options");
437 maps[i++] = zoptions;
440 maps[i++] = cfg_tuple_get(vconfig, "options");
441 if (config != NULL) {
442 (void)cfg_map_get(config, "options", &options);
446 maps[i++] = ns_g_defaults;
450 RETERR(ns_config_getclass(cfg_tuple_get(vconfig, "class"),
451 dns_rdataclass_in, &vclass));
453 vclass = dns_rdataclass_in;
456 * Configure values common to all zone types.
459 zname = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
461 RETERR(ns_config_getclass(cfg_tuple_get(zconfig, "class"),
463 dns_zone_setclass(zone, zclass);
465 ztype = zonetype_fromconfig(zoptions);
466 dns_zone_settype(zone, ztype);
469 result = cfg_map_get(zoptions, "database", &obj);
470 if (result == ISC_R_SUCCESS)
471 cpval = isc_mem_strdup(mctx, cfg_obj_asstring(obj));
473 cpval = default_dbtype;
476 return(ISC_R_NOMEMORY);
478 result = strtoargv(mctx, cpval, &dbargc, &dbargv);
479 if (result != ISC_R_SUCCESS && cpval != default_dbtype) {
480 isc_mem_free(mctx, cpval);
485 * ANSI C is strange here. There is no logical reason why (char **)
486 * cannot be promoted automatically to (const char * const *) by the
487 * compiler w/o generating a warning.
489 result = dns_zone_setdbtype(zone, dbargc, (const char * const *)dbargv);
490 isc_mem_put(mctx, dbargv, dbargc * sizeof(*dbargv));
491 if (cpval != default_dbtype)
492 isc_mem_free(mctx, cpval);
493 if (result != ISC_R_SUCCESS)
497 result = cfg_map_get(zoptions, "file", &obj);
498 if (result == ISC_R_SUCCESS)
499 filename = cfg_obj_asstring(obj);
501 masterformat = dns_masterformat_text;
503 result= ns_config_get(maps, "masterfile-format", &obj);
504 if (result == ISC_R_SUCCESS) {
505 const char *masterformatstr = cfg_obj_asstring(obj);
507 if (strcasecmp(masterformatstr, "text") == 0)
508 masterformat = dns_masterformat_text;
509 else if (strcasecmp(masterformatstr, "raw") == 0)
510 masterformat = dns_masterformat_raw;
514 RETERR(dns_zone_setfile2(zone, filename, masterformat));
517 result = cfg_map_get(zoptions, "journal", &obj);
518 if (result == ISC_R_SUCCESS)
519 RETERR(dns_zone_setjournal(zone, cfg_obj_asstring(obj)));
521 if (ztype == dns_zone_slave)
522 RETERR(configure_zone_acl(zconfig, vconfig, config,
523 allow_notify, ac, zone,
524 dns_zone_setnotifyacl,
525 dns_zone_clearnotifyacl));
527 * XXXAG This probably does not make sense for stubs.
529 RETERR(configure_zone_acl(zconfig, vconfig, config,
530 allow_query, ac, zone,
531 dns_zone_setqueryacl,
532 dns_zone_clearqueryacl));
535 result = ns_config_get(maps, "dialup", &obj);
536 INSIST(result == ISC_R_SUCCESS);
537 if (cfg_obj_isboolean(obj)) {
538 if (cfg_obj_asboolean(obj))
539 dialup = dns_dialuptype_yes;
541 dialup = dns_dialuptype_no;
543 const char *dialupstr = cfg_obj_asstring(obj);
544 if (strcasecmp(dialupstr, "notify") == 0)
545 dialup = dns_dialuptype_notify;
546 else if (strcasecmp(dialupstr, "notify-passive") == 0)
547 dialup = dns_dialuptype_notifypassive;
548 else if (strcasecmp(dialupstr, "refresh") == 0)
549 dialup = dns_dialuptype_refresh;
550 else if (strcasecmp(dialupstr, "passive") == 0)
551 dialup = dns_dialuptype_passive;
555 dns_zone_setdialup(zone, dialup);
558 result = ns_config_get(maps, "zone-statistics", &obj);
559 INSIST(result == ISC_R_SUCCESS);
560 zonestats_on = cfg_obj_asboolean(obj);
563 RETERR(isc_stats_create(mctx, &zoneqrystats,
564 dns_nsstatscounter_max));
566 dns_zone_setrequeststats(zone, zoneqrystats);
567 if (zoneqrystats != NULL)
568 isc_stats_detach(&zoneqrystats);
571 * Configure master functionality. This applies
572 * to primary masters (type "master") and slaves
573 * acting as masters (type "slave"), but not to stubs.
575 if (ztype != dns_zone_stub) {
577 result = ns_config_get(maps, "notify", &obj);
578 INSIST(result == ISC_R_SUCCESS);
579 if (cfg_obj_isboolean(obj)) {
580 if (cfg_obj_asboolean(obj))
581 notifytype = dns_notifytype_yes;
583 notifytype = dns_notifytype_no;
585 const char *notifystr = cfg_obj_asstring(obj);
586 if (strcasecmp(notifystr, "explicit") == 0)
587 notifytype = dns_notifytype_explicit;
588 else if (strcasecmp(notifystr, "master-only") == 0)
589 notifytype = dns_notifytype_masteronly;
593 dns_zone_setnotifytype(zone, notifytype);
596 result = ns_config_get(maps, "also-notify", &obj);
597 if (result == ISC_R_SUCCESS) {
598 isc_sockaddr_t *addrs = NULL;
599 isc_uint32_t addrcount;
600 result = ns_config_getiplist(config, obj, 0, mctx,
602 if (result != ISC_R_SUCCESS)
604 result = dns_zone_setalsonotify(zone, addrs,
606 ns_config_putiplist(mctx, &addrs, addrcount);
607 if (result != ISC_R_SUCCESS)
610 RETERR(dns_zone_setalsonotify(zone, NULL, 0));
613 result = ns_config_get(maps, "notify-source", &obj);
614 INSIST(result == ISC_R_SUCCESS);
615 RETERR(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
616 ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
619 result = ns_config_get(maps, "notify-source-v6", &obj);
620 INSIST(result == ISC_R_SUCCESS);
621 RETERR(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
622 ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
625 result = ns_config_get(maps, "notify-to-soa", &obj);
626 INSIST(result == ISC_R_SUCCESS);
627 dns_zone_setoption(zone, DNS_ZONEOPT_NOTIFYTOSOA,
628 cfg_obj_asboolean(obj));
630 dns_zone_setisself(zone, ns_client_isself, NULL);
632 RETERR(configure_zone_acl(zconfig, vconfig, config,
633 allow_transfer, ac, zone,
635 dns_zone_clearxfracl));
638 result = ns_config_get(maps, "max-transfer-time-out", &obj);
639 INSIST(result == ISC_R_SUCCESS);
640 dns_zone_setmaxxfrout(zone, cfg_obj_asuint32(obj) * 60);
643 result = ns_config_get(maps, "max-transfer-idle-out", &obj);
644 INSIST(result == ISC_R_SUCCESS);
645 dns_zone_setidleout(zone, cfg_obj_asuint32(obj) * 60);
648 result = ns_config_get(maps, "max-journal-size", &obj);
649 INSIST(result == ISC_R_SUCCESS);
650 dns_zone_setjournalsize(zone, -1);
651 if (cfg_obj_isstring(obj)) {
652 const char *str = cfg_obj_asstring(obj);
653 INSIST(strcasecmp(str, "unlimited") == 0);
654 journal_size = ISC_UINT32_MAX / 2;
656 isc_resourcevalue_t value;
657 value = cfg_obj_asuint64(obj);
658 if (value > ISC_UINT32_MAX / 2) {
659 cfg_obj_log(obj, ns_g_lctx,
662 "%" ISC_PRINT_QUADFORMAT "d' "
667 journal_size = (isc_uint32_t)value;
669 dns_zone_setjournalsize(zone, journal_size);
672 result = ns_config_get(maps, "ixfr-from-differences", &obj);
673 INSIST(result == ISC_R_SUCCESS);
674 if (cfg_obj_isboolean(obj))
675 ixfrdiff = cfg_obj_asboolean(obj);
676 else if (strcasecmp(cfg_obj_asstring(obj), "master") &&
677 ztype == dns_zone_master)
679 else if (strcasecmp(cfg_obj_asstring(obj), "slave") &&
680 ztype == dns_zone_slave)
683 ixfrdiff = ISC_FALSE;
684 dns_zone_setoption(zone, DNS_ZONEOPT_IXFRFROMDIFFS, ixfrdiff);
686 checknames(ztype, maps, &obj);
688 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
691 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
692 fail = check = ISC_TRUE;
693 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
694 fail = check = ISC_FALSE;
697 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMES, check);
698 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMESFAIL, fail);
701 result = ns_config_get(maps, "notify-delay", &obj);
702 INSIST(result == ISC_R_SUCCESS);
703 dns_zone_setnotifydelay(zone, cfg_obj_asuint32(obj));
706 result = ns_config_get(maps, "check-sibling", &obj);
707 INSIST(result == ISC_R_SUCCESS);
708 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSIBLING,
709 cfg_obj_asboolean(obj));
712 result = ns_config_get(maps, "zero-no-soa-ttl", &obj);
713 INSIST(result == ISC_R_SUCCESS);
714 dns_zone_setzeronosoattl(zone, cfg_obj_asboolean(obj));
718 * Configure update-related options. These apply to
719 * primary masters only.
721 if (ztype == dns_zone_master) {
722 dns_acl_t *updateacl;
723 RETERR(configure_zone_acl(zconfig, vconfig, config,
724 allow_update, ac, zone,
725 dns_zone_setupdateacl,
726 dns_zone_clearupdateacl));
728 updateacl = dns_zone_getupdateacl(zone);
729 if (updateacl != NULL && dns_acl_isinsecure(updateacl))
730 isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
731 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
732 "zone '%s' allows updates by IP "
733 "address, which is insecure",
736 RETERR(configure_zone_ssutable(zoptions, zone));
739 result = ns_config_get(maps, "sig-validity-interval", &obj);
740 INSIST(result == ISC_R_SUCCESS);
741 dns_zone_setsigvalidityinterval(zone,
742 cfg_obj_asuint32(obj) * 86400);
745 result = ns_config_get(maps, "key-directory", &obj);
746 if (result == ISC_R_SUCCESS) {
747 filename = cfg_obj_asstring(obj);
748 if (!isc_file_isabsolute(filename)) {
749 cfg_obj_log(obj, ns_g_lctx, ISC_LOG_ERROR,
750 "key-directory '%s' "
751 "is not absolute", filename);
752 return (ISC_R_FAILURE);
754 RETERR(dns_zone_setkeydirectory(zone, filename));
758 result = ns_config_get(maps, "check-wildcard", &obj);
759 if (result == ISC_R_SUCCESS)
760 check = cfg_obj_asboolean(obj);
763 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKWILDCARD, check);
766 result = ns_config_get(maps, "check-mx", &obj);
768 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
771 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
772 fail = check = ISC_TRUE;
773 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
774 fail = check = ISC_FALSE;
777 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKMX, check);
778 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKMXFAIL, fail);
781 result = ns_config_get(maps, "check-integrity", &obj);
783 dns_zone_setoption(zone, DNS_ZONEOPT_CHECKINTEGRITY,
784 cfg_obj_asboolean(obj));
787 result = ns_config_get(maps, "check-mx-cname", &obj);
789 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
792 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
793 warn = ignore = ISC_FALSE;
794 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
795 warn = ignore = ISC_TRUE;
798 dns_zone_setoption(zone, DNS_ZONEOPT_WARNMXCNAME, warn);
799 dns_zone_setoption(zone, DNS_ZONEOPT_IGNOREMXCNAME, ignore);
802 result = ns_config_get(maps, "check-srv-cname", &obj);
804 if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
807 } else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
808 warn = ignore = ISC_FALSE;
809 } else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
810 warn = ignore = ISC_TRUE;
813 dns_zone_setoption(zone, DNS_ZONEOPT_WARNSRVCNAME, warn);
814 dns_zone_setoption(zone, DNS_ZONEOPT_IGNORESRVCNAME, ignore);
817 result = ns_config_get(maps, "update-check-ksk", &obj);
818 INSIST(result == ISC_R_SUCCESS);
819 dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
820 cfg_obj_asboolean(obj));
821 } else if (ztype == dns_zone_slave) {
822 RETERR(configure_zone_acl(zconfig, vconfig, config,
823 allow_update_forwarding, ac, zone,
824 dns_zone_setforwardacl,
825 dns_zone_clearforwardacl));
829 * Configure slave functionality.
836 result = cfg_map_get(zoptions, "masters", &obj);
840 RETERR(ns_config_getipandkeylist(config, obj, mctx,
843 result = dns_zone_setmasterswithkeys(zone, addrs,
845 ns_config_putipandkeylist(mctx, &addrs, &keynames,
848 result = dns_zone_setmasters(zone, NULL, 0);
854 result = ns_config_get(maps, "multi-master", &obj);
855 INSIST(result == ISC_R_SUCCESS);
856 multi = cfg_obj_asboolean(obj);
858 dns_zone_setoption(zone, DNS_ZONEOPT_MULTIMASTER, multi);
861 result = ns_config_get(maps, "max-transfer-time-in", &obj);
862 INSIST(result == ISC_R_SUCCESS);
863 dns_zone_setmaxxfrin(zone, cfg_obj_asuint32(obj) * 60);
866 result = ns_config_get(maps, "max-transfer-idle-in", &obj);
867 INSIST(result == ISC_R_SUCCESS);
868 dns_zone_setidlein(zone, cfg_obj_asuint32(obj) * 60);
871 result = ns_config_get(maps, "max-refresh-time", &obj);
872 INSIST(result == ISC_R_SUCCESS);
873 dns_zone_setmaxrefreshtime(zone, cfg_obj_asuint32(obj));
876 result = ns_config_get(maps, "min-refresh-time", &obj);
877 INSIST(result == ISC_R_SUCCESS);
878 dns_zone_setminrefreshtime(zone, cfg_obj_asuint32(obj));
881 result = ns_config_get(maps, "max-retry-time", &obj);
882 INSIST(result == ISC_R_SUCCESS);
883 dns_zone_setmaxretrytime(zone, cfg_obj_asuint32(obj));
886 result = ns_config_get(maps, "min-retry-time", &obj);
887 INSIST(result == ISC_R_SUCCESS);
888 dns_zone_setminretrytime(zone, cfg_obj_asuint32(obj));
891 result = ns_config_get(maps, "transfer-source", &obj);
892 INSIST(result == ISC_R_SUCCESS);
893 RETERR(dns_zone_setxfrsource4(zone, cfg_obj_assockaddr(obj)));
894 ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
897 result = ns_config_get(maps, "transfer-source-v6", &obj);
898 INSIST(result == ISC_R_SUCCESS);
899 RETERR(dns_zone_setxfrsource6(zone, cfg_obj_assockaddr(obj)));
900 ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
903 result = ns_config_get(maps, "alt-transfer-source", &obj);
904 INSIST(result == ISC_R_SUCCESS);
905 RETERR(dns_zone_setaltxfrsource4(zone, cfg_obj_assockaddr(obj)));
908 result = ns_config_get(maps, "alt-transfer-source-v6", &obj);
909 INSIST(result == ISC_R_SUCCESS);
910 RETERR(dns_zone_setaltxfrsource6(zone, cfg_obj_assockaddr(obj)));
913 (void)ns_config_get(maps, "use-alt-transfer-source", &obj);
916 * Default off when views are in use otherwise
917 * on for BIND 8 compatibility.
919 view = dns_zone_getview(zone);
920 if (view != NULL && strcmp(view->name, "_default") == 0)
925 alt = cfg_obj_asboolean(obj);
926 dns_zone_setoption(zone, DNS_ZONEOPT_USEALTXFRSRC, alt);
929 (void)ns_config_get(maps, "try-tcp-refresh", &obj);
930 dns_zone_setoption(zone, DNS_ZONEOPT_TRYTCPREFRESH,
931 cfg_obj_asboolean(obj));
938 return (ISC_R_SUCCESS);
942 ns_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
943 const cfg_obj_t *zoptions = NULL;
944 const cfg_obj_t *obj = NULL;
945 const char *cfilename;
946 const char *zfilename;
948 zoptions = cfg_tuple_get(zconfig, "options");
950 if (zonetype_fromconfig(zoptions) != dns_zone_gettype(zone))
954 (void)cfg_map_get(zoptions, "file", &obj);
956 cfilename = cfg_obj_asstring(obj);
959 zfilename = dns_zone_getfile(zone);
960 if (!((cfilename == NULL && zfilename == NULL) ||
961 (cfilename != NULL && zfilename != NULL &&
962 strcmp(cfilename, zfilename) == 0)))