1 /*
2 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
3 *
4 * This Source Code Form is subject to the terms of the Mozilla Public
5 * License, v. 2.0. If a copy of the MPL was not distributed with this
6 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
7 *
8 * See the COPYRIGHT file distributed with this work for additional
9 * information regarding copyright ownership.
10 */
11
12 /*! \file */
13
14 #include <config.h>
15
16 #include <inttypes.h>
17 #include <stdbool.h>
18 #include <stdlib.h>
19 #include <unistd.h>
20 #include <limits.h>
21 #include <ctype.h>
22 #include <sys/types.h>
23 #include <sys/stat.h>
24
25 #include <isc/aes.h>
26 #include <isc/app.h>
27 #include <isc/base64.h>
28 #include <isc/commandline.h>
29 #include <isc/dir.h>
30 #include <isc/entropy.h>
31 #include <isc/file.h>
32 #include <isc/hash.h>
33 #include <isc/hex.h>
34 #include <isc/hmacsha.h>
35 #include <isc/httpd.h>
36 #include <isc/lex.h>
37 #include <isc/meminfo.h>
38 #include <isc/parseint.h>
39 #include <isc/portset.h>
40 #include <isc/print.h>
41 #include <isc/random.h>
42 #include <isc/refcount.h>
43 #include <isc/resource.h>
44 #include <isc/sha2.h>
45 #include <isc/siphash.h>
46 #include <isc/socket.h>
47 #include <isc/stat.h>
48 #include <isc/stats.h>
49 #include <isc/stdio.h>
50 #include <isc/string.h>
51 #include <isc/task.h>
52 #include <isc/timer.h>
53 #include <isc/util.h>
54 #include <isc/xml.h>
55
56 #include <isccfg/grammar.h>
57 #include <isccfg/namedconf.h>
58
59 #include <bind9/check.h>
60
61 #include <dns/acache.h>
62 #include <dns/adb.h>
63 #include <dns/badcache.h>
64 #include <dns/cache.h>
65 #include <dns/catz.h>
66 #include <dns/db.h>
67 #include <dns/dispatch.h>
68 #include <dns/dlz.h>
69 #include <dns/dns64.h>
70 #include <dns/dyndb.h>
71 #include <dns/events.h>
72 #include <dns/forward.h>
73 #include <dns/fixedname.h>
74 #include <dns/geoip.h>
75 #include <dns/journal.h>
76 #include <dns/keytable.h>
77 #include <dns/keyvalues.h>
78 #include <dns/lib.h>
79 #include <dns/master.h>
80 #include <dns/masterdump.h>
81 #include <dns/nsec3.h>
82 #include <dns/nta.h>
83 #include <dns/order.h>
84 #include <dns/peer.h>
85 #include <dns/portlist.h>
86 #include <dns/private.h>
87 #include <dns/rbt.h>
88 #include <dns/rdataclass.h>
89 #include <dns/rdatalist.h>
90 #include <dns/rdataset.h>
91 #include <dns/rdatastruct.h>
92 #include <dns/resolver.h>
93 #include <dns/rootns.h>
94 #include <dns/rriterator.h>
95 #include <dns/secalg.h>
96 #include <dns/soa.h>
97 #include <dns/stats.h>
98 #include <dns/tkey.h>
99 #include <dns/tsig.h>
100 #include <dns/ttl.h>
101 #include <dns/view.h>
102 #include <dns/zone.h>
103 #include <dns/zt.h>
104
105 #include <dst/dst.h>
106 #include <dst/result.h>
107
108 #include <named/client.h>
109 #include <named/config.h>
110 #include <named/control.h>
111 #if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
112 #include <named/geoip.h>
113 #endif /* HAVE_GEOIP || HAVE_GEOIP2 */
114 #include <named/interfacemgr.h>
115 #include <named/log.h>
116 #include <named/logconf.h>
117 #include <named/lwresd.h>
118 #include <named/main.h>
119 #include <named/os.h>
120 #include <named/server.h>
121 #include <named/statschannel.h>
122 #include <named/tkeyconf.h>
123 #include <named/tsigconf.h>
124 #include <named/zoneconf.h>
125 #ifdef HAVE_LIBSCF
126 #include <named/ns_smf_globals.h>
127 #include <stdlib.h>
128 #endif
129
130 #ifdef HAVE_LMDB
131 #include <lmdb.h>
132 #define count_newzones count_newzones_db
133 #define configure_newzones configure_newzones_db
134 #define dumpzone dumpzone_db
135 #else /* HAVE_LMDB */
136 #define count_newzones count_newzones_file
137 #define configure_newzones configure_newzones_file
138 #define dumpzone dumpzone_file
139 #endif /* HAVE_LMDB */
140
141 #ifndef SIZE_MAX
142 #define SIZE_MAX ((size_t)-1)
143 #endif
144
145 #ifndef SIZE_AS_PERCENT
146 #define SIZE_AS_PERCENT ((size_t)-2)
147 #endif
148
149 #ifdef TUNE_LARGE
150 #define RESOLVER_NTASKS 523
151 #define UDPBUFFERS 32768
152 #define EXCLBUFFERS 32768
153 #else
154 #define RESOLVER_NTASKS 31
155 #define UDPBUFFERS 1000
156 #define EXCLBUFFERS 4096
157 #endif /* TUNE_LARGE */
158
159 /*%
160 * Check an operation for failure. Assumes that the function
161 * using it has a 'result' variable and a 'cleanup' label.
162 */
163 #define CHECK(op) \
164 do { result = (op); \
165 if (result != ISC_R_SUCCESS) goto cleanup; \
166 } while (0)
167
168 #define TCHECK(op) \
169 do { tresult = (op); \
170 if (tresult != ISC_R_SUCCESS) { \
171 isc_buffer_clear(*text); \
172 goto cleanup; \
173 } \
174 } while (0)
175
176 #define CHECKM(op, msg) \
177 do { result = (op); \
178 if (result != ISC_R_SUCCESS) { \
179 isc_log_write(ns_g_lctx, \
180 NS_LOGCATEGORY_GENERAL, \
181 NS_LOGMODULE_SERVER, \
182 ISC_LOG_ERROR, \
183 "%s: %s", msg, \
184 isc_result_totext(result)); \
185 goto cleanup; \
186 } \
187 } while (0) \
188
189 #define CHECKMF(op, msg, file) \
190 do { result = (op); \
191 if (result != ISC_R_SUCCESS) { \
192 isc_log_write(ns_g_lctx, \
193 NS_LOGCATEGORY_GENERAL, \
194 NS_LOGMODULE_SERVER, \
195 ISC_LOG_ERROR, \
196 "%s '%s': %s", msg, file, \
197 isc_result_totext(result)); \
198 goto cleanup; \
199 } \
200 } while (0) \
201
202 #define CHECKFATAL(op, msg) \
203 do { result = (op); \
204 if (result != ISC_R_SUCCESS) \
205 fatal(server, msg, result); \
206 } while (0) \
207
208 /*%
209 * Maximum ADB size for views that share a cache. Use this limit to suppress
210 * the total of memory footprint, which should be the main reason for sharing
211 * a cache. Only effective when a finite max-cache-size is specified.
212 * This is currently defined to be 8MB.
213 */
214 #define MAX_ADB_SIZE_FOR_CACHESHARE 8388608U
215
216 struct ns_dispatch {
217 isc_sockaddr_t addr;
218 unsigned int dispatchgen;
219 dns_dispatch_t *dispatch;
220 ISC_LINK(struct ns_dispatch) link;
221 };
222
223 struct ns_cache {
224 dns_cache_t *cache;
225 dns_view_t *primaryview;
226 bool needflush;
227 bool adbsizeadjusted;
228 dns_rdataclass_t rdclass;
229 ISC_LINK(ns_cache_t) link;
230 };
231
232 struct dumpcontext {
233 isc_mem_t *mctx;
234 bool dumpcache;
235 bool dumpzones;
236 bool dumpadb;
237 bool dumpbad;
238 bool dumpfail;
239 FILE *fp;
240 ISC_LIST(struct viewlistentry) viewlist;
241 struct viewlistentry *view;
242 struct zonelistentry *zone;
243 dns_dumpctx_t *mdctx;
244 dns_db_t *db;
245 dns_db_t *cache;
246 isc_task_t *task;
247 dns_dbversion_t *version;
248 };
249
250 struct viewlistentry {
251 dns_view_t *view;
252 ISC_LINK(struct viewlistentry) link;
253 ISC_LIST(struct zonelistentry) zonelist;
254 };
255
256 struct zonelistentry {
257 dns_zone_t *zone;
258 ISC_LINK(struct zonelistentry) link;
259 };
260
261 /*%
262 * Configuration context to retain for each view that allows
263 * new zones to be added at runtime.
264 */
265 typedef struct ns_cfgctx {
266 isc_mem_t * mctx;
267 cfg_parser_t * conf_parser;
268 cfg_parser_t * add_parser;
269 cfg_obj_t * config;
270 cfg_obj_t * vconfig;
271 cfg_obj_t * nzf_config;
272 cfg_aclconfctx_t * actx;
273 } ns_cfgctx_t;
274
275 /*%
276 * A function to write out added-zone configuration to the new_zone_file
277 * specified in 'view'. Maybe called by delete_zoneconf().
278 */
279 typedef isc_result_t (*nzfwriter_t)(const cfg_obj_t *config, dns_view_t *view);
280
281 /*%
282 * Holds state information for the initial zone loading process.
283 * Uses the isc_refcount structure to count the number of views
284 * with pending zone loads, dereferencing as each view finishes.
285 */
286 typedef struct {
287 ns_server_t *server;
288 bool reconfig;
289 isc_refcount_t refs;
290 } ns_zoneload_t;
291
292 typedef struct {
293 ns_server_t *server;
294 } catz_cb_data_t;
295
296 typedef struct catz_chgzone_event {
297 ISC_EVENT_COMMON(struct catz_chgzone_event);
298 dns_catz_entry_t *entry;
299 dns_catz_zone_t *origin;
300 dns_view_t *view;
301 catz_cb_data_t *cbd;
302 bool mod;
303 } catz_chgzone_event_t;
304
305 typedef struct {
306 unsigned int magic;
307 #define DZARG_MAGIC ISC_MAGIC('D', 'z', 'a', 'r')
308 isc_buffer_t **text;
309 isc_result_t result;
310 } ns_dzarg_t;
311
312 /*
313 * These zones should not leak onto the Internet.
314 */
315 const char *empty_zones[] = {
316 /* RFC 1918 */
317 "10.IN-ADDR.ARPA",
318 "16.172.IN-ADDR.ARPA",
319 "17.172.IN-ADDR.ARPA",
320 "18.172.IN-ADDR.ARPA",
321 "19.172.IN-ADDR.ARPA",
322 "20.172.IN-ADDR.ARPA",
323 "21.172.IN-ADDR.ARPA",
324 "22.172.IN-ADDR.ARPA",
325 "23.172.IN-ADDR.ARPA",
326 "24.172.IN-ADDR.ARPA",
327 "25.172.IN-ADDR.ARPA",
328 "26.172.IN-ADDR.ARPA",
329 "27.172.IN-ADDR.ARPA",
330 "28.172.IN-ADDR.ARPA",
331 "29.172.IN-ADDR.ARPA",
332 "30.172.IN-ADDR.ARPA",
333 "31.172.IN-ADDR.ARPA",
334 "168.192.IN-ADDR.ARPA",
335
336 /* RFC 6598 */
337 "64.100.IN-ADDR.ARPA",
338 "65.100.IN-ADDR.ARPA",
339 "66.100.IN-ADDR.ARPA",
340 "67.100.IN-ADDR.ARPA",
341 "68.100.IN-ADDR.ARPA",
342 "69.100.IN-ADDR.ARPA",
343 "70.100.IN-ADDR.ARPA",
344 "71.100.IN-ADDR.ARPA",
345 "72.100.IN-ADDR.ARPA",
346 "73.100.IN-ADDR.ARPA",
347 "74.100.IN-ADDR.ARPA",
348 "75.100.IN-ADDR.ARPA",
349 "76.100.IN-ADDR.ARPA",
350 "77.100.IN-ADDR.ARPA",
351 "78.100.IN-ADDR.ARPA",
352 "79.100.IN-ADDR.ARPA",
353 "80.100.IN-ADDR.ARPA",
354 "81.100.IN-ADDR.ARPA",
355 "82.100.IN-ADDR.ARPA",
356 "83.100.IN-ADDR.ARPA",
357 "84.100.IN-ADDR.ARPA",
358 "85.100.IN-ADDR.ARPA",
359 "86.100.IN-ADDR.ARPA",
360 "87.100.IN-ADDR.ARPA",
361 "88.100.IN-ADDR.ARPA",
362 "89.100.IN-ADDR.ARPA",
363 "90.100.IN-ADDR.ARPA",
364 "91.100.IN-ADDR.ARPA",
365 "92.100.IN-ADDR.ARPA",
366 "93.100.IN-ADDR.ARPA",
367 "94.100.IN-ADDR.ARPA",
368 "95.100.IN-ADDR.ARPA",
369 "96.100.IN-ADDR.ARPA",
370 "97.100.IN-ADDR.ARPA",
371 "98.100.IN-ADDR.ARPA",
372 "99.100.IN-ADDR.ARPA",
373 "100.100.IN-ADDR.ARPA",
374 "101.100.IN-ADDR.ARPA",
375 "102.100.IN-ADDR.ARPA",
376 "103.100.IN-ADDR.ARPA",
377 "104.100.IN-ADDR.ARPA",
378 "105.100.IN-ADDR.ARPA",
379 "106.100.IN-ADDR.ARPA",
380 "107.100.IN-ADDR.ARPA",
381 "108.100.IN-ADDR.ARPA",
382 "109.100.IN-ADDR.ARPA",
383 "110.100.IN-ADDR.ARPA",
384 "111.100.IN-ADDR.ARPA",
385 "112.100.IN-ADDR.ARPA",
386 "113.100.IN-ADDR.ARPA",
387 "114.100.IN-ADDR.ARPA",
388 "115.100.IN-ADDR.ARPA",
389 "116.100.IN-ADDR.ARPA",
390 "117.100.IN-ADDR.ARPA",
391 "118.100.IN-ADDR.ARPA",
392 "119.100.IN-ADDR.ARPA",
393 "120.100.IN-ADDR.ARPA",
394 "121.100.IN-ADDR.ARPA",
395 "122.100.IN-ADDR.ARPA",
396 "123.100.IN-ADDR.ARPA",
397 "124.100.IN-ADDR.ARPA",
398 "125.100.IN-ADDR.ARPA",
399 "126.100.IN-ADDR.ARPA",
400 "127.100.IN-ADDR.ARPA",
401
402 /* RFC 5735 and RFC 5737 */
403 "0.IN-ADDR.ARPA", /* THIS NETWORK */
404 "127.IN-ADDR.ARPA", /* LOOPBACK */
405 "254.169.IN-ADDR.ARPA", /* LINK LOCAL */
406 "2.0.192.IN-ADDR.ARPA", /* TEST NET */
407 "100.51.198.IN-ADDR.ARPA", /* TEST NET 2 */
408 "113.0.203.IN-ADDR.ARPA", /* TEST NET 3 */
409 "255.255.255.255.IN-ADDR.ARPA", /* BROADCAST */
410
411 /* Local IPv6 Unicast Addresses */
412 "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA",
413 "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA",
414 /* LOCALLY ASSIGNED LOCAL ADDRESS SCOPE */
415 "D.F.IP6.ARPA",
416 "8.E.F.IP6.ARPA", /* LINK LOCAL */
417 "9.E.F.IP6.ARPA", /* LINK LOCAL */
418 "A.E.F.IP6.ARPA", /* LINK LOCAL */
419 "B.E.F.IP6.ARPA", /* LINK LOCAL */
420
421 /* Example Prefix, RFC 3849. */
422 "8.B.D.0.1.0.0.2.IP6.ARPA",
423
424 /* RFC 7534 */
425 "EMPTY.AS112.ARPA",
426
427 /* RFC 8375 */
428 "HOME.ARPA",
429
430 NULL
431 };
432
433 ISC_PLATFORM_NORETURN_PRE static void
434 fatal(ns_server_t *server,const char *msg, isc_result_t result)
435 ISC_PLATFORM_NORETURN_POST;
436
437 static void
438 ns_server_reload(isc_task_t *task, isc_event_t *event);
439
440 static isc_result_t
441 ns_listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
442 cfg_aclconfctx_t *actx, isc_mem_t *mctx,
443 uint16_t family, ns_listenelt_t **target);
444 static isc_result_t
445 ns_listenlist_fromconfig(const cfg_obj_t *listenlist, const cfg_obj_t *config,
446 cfg_aclconfctx_t *actx, isc_mem_t *mctx,
447 uint16_t family, ns_listenlist_t **target);
448
449 static isc_result_t
450 configure_forward(const cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
451 const cfg_obj_t *forwarders, const cfg_obj_t *forwardtype);
452
453 static isc_result_t
454 configure_alternates(const cfg_obj_t *config, dns_view_t *view,
455 const cfg_obj_t *alternates);
456
457 static isc_result_t
458 configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
459 const cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
460 dns_viewlist_t *viewlist, cfg_aclconfctx_t *aclconf,
461 bool added, bool old_rpz_ok,
462 bool modify);
463
464 static isc_result_t
465 configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
466 isc_mem_t *mctx, cfg_aclconfctx_t *actx);
467
468 static isc_result_t
469 add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx);
470
471 static void
472 end_reserved_dispatches(ns_server_t *server, bool all);
473
474 static void
475 newzone_cfgctx_destroy(void **cfgp);
476
477 static inline isc_result_t
478 putstr(isc_buffer_t **b, const char *str);
479
480 static isc_result_t
481 putmem(isc_buffer_t **b, const char *str, size_t len);
482
483 static isc_result_t
484 putuint8(isc_buffer_t **b, uint8_t val);
485
486 static inline isc_result_t
487 putnull(isc_buffer_t **b);
488
489 static int
490 count_zones(const cfg_obj_t *conf);
491
492 #ifdef HAVE_LMDB
493 static isc_result_t
494 migrate_nzf(dns_view_t *view);
495
496 static isc_result_t
497 nzd_writable(dns_view_t *view);
498
499 static isc_result_t
500 nzd_open(dns_view_t *view, unsigned int flags, MDB_txn **txnp, MDB_dbi *dbi);
501
502 static isc_result_t
503 nzd_env_reopen(dns_view_t *view);
504
505 static void
506 nzd_env_close(dns_view_t *view);
507
508 static isc_result_t
509 nzd_close(MDB_txn **txnp, bool commit);
510
511 static isc_result_t
512 nzd_count(dns_view_t *view, int *countp);
513 #else
514 static isc_result_t
515 nzf_append(dns_view_t *view, const cfg_obj_t *zconfig);
516 #endif
517
518 /*%
519 * Configure a single view ACL at '*aclp'. Get its configuration from
520 * 'vconfig' (for per-view configuration) and maybe from 'config'
521 */
522 static isc_result_t
configure_view_acl(const cfg_obj_t * vconfig,const cfg_obj_t * config,const cfg_obj_t * gconfig,const char * aclname,const char * acltuplename,cfg_aclconfctx_t * actx,isc_mem_t * mctx,dns_acl_t ** aclp)523 configure_view_acl(const cfg_obj_t *vconfig, const cfg_obj_t *config,
524 const cfg_obj_t *gconfig, const char *aclname,
525 const char *acltuplename, cfg_aclconfctx_t *actx,
526 isc_mem_t *mctx, dns_acl_t **aclp)
527 {
528 isc_result_t result;
529 const cfg_obj_t *maps[4];
530 const cfg_obj_t *aclobj = NULL;
531 int i = 0;
532
533 if (*aclp != NULL) {
534 dns_acl_detach(aclp);
535 }
536 if (vconfig != NULL) {
537 maps[i++] = cfg_tuple_get(vconfig, "options");
538 }
539 if (config != NULL) {
540 const cfg_obj_t *options = NULL;
541 (void)cfg_map_get(config, "options", &options);
542 if (options != NULL) {
543 maps[i++] = options;
544 }
545 }
546 if (gconfig != NULL) {
547 const cfg_obj_t *options = NULL;
548 (void)cfg_map_get(gconfig, "options", &options);
549 if (options != NULL) {
550 maps[i++] = options;
551 }
552 }
553 maps[i] = NULL;
554
555 (void)ns_config_get(maps, aclname, &aclobj);
556 if (aclobj == NULL) {
557 /*
558 * No value available. *aclp == NULL.
559 */
560 return (ISC_R_SUCCESS);
561 }
562
563 if (acltuplename != NULL) {
564 /*
565 * If the ACL is given in an optional tuple, retrieve it.
566 * The parser should have ensured that a valid object be
567 * returned.
568 */
569 aclobj = cfg_tuple_get(aclobj, acltuplename);
570 }
571
572 result = cfg_acl_fromconfig(aclobj, config, ns_g_lctx,
573 actx, mctx, 0, aclp);
574
575 return (result);
576 }
577
578 /*%
579 * Configure a sortlist at '*aclp'. Essentially the same as
580 * configure_view_acl() except it calls cfg_acl_fromconfig with a
581 * nest_level value of 2.
582 */
583 static isc_result_t
configure_view_sortlist(const cfg_obj_t * vconfig,const cfg_obj_t * config,cfg_aclconfctx_t * actx,isc_mem_t * mctx,dns_acl_t ** aclp)584 configure_view_sortlist(const cfg_obj_t *vconfig, const cfg_obj_t *config,
585 cfg_aclconfctx_t *actx, isc_mem_t *mctx,
586 dns_acl_t **aclp)
587 {
588 isc_result_t result;
589 const cfg_obj_t *maps[3];
590 const cfg_obj_t *aclobj = NULL;
591 int i = 0;
592
593 if (*aclp != NULL)
594 dns_acl_detach(aclp);
595 if (vconfig != NULL)
596 maps[i++] = cfg_tuple_get(vconfig, "options");
597 if (config != NULL) {
598 const cfg_obj_t *options = NULL;
599 (void)cfg_map_get(config, "options", &options);
600 if (options != NULL)
601 maps[i++] = options;
602 }
603 maps[i] = NULL;
604
605 (void)ns_config_get(maps, "sortlist", &aclobj);
606 if (aclobj == NULL)
607 return (ISC_R_SUCCESS);
608
609 /*
610 * Use a nest level of 3 for the "top level" of the sortlist;
611 * this means each entry in the top three levels will be stored
612 * as lists of separate, nested ACLs, rather than merged together
613 * into IP tables as is usually done with ACLs.
614 */
615 result = cfg_acl_fromconfig(aclobj, config, ns_g_lctx,
616 actx, mctx, 3, aclp);
617
618 return (result);
619 }
620
621 static isc_result_t
configure_view_nametable(const cfg_obj_t * vconfig,const cfg_obj_t * config,const char * confname,const char * conftuplename,isc_mem_t * mctx,dns_rbt_t ** rbtp)622 configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
623 const char *confname, const char *conftuplename,
624 isc_mem_t *mctx, dns_rbt_t **rbtp)
625 {
626 isc_result_t result;
627 const cfg_obj_t *maps[3];
628 const cfg_obj_t *obj = NULL;
629 const cfg_listelt_t *element;
630 int i = 0;
631 dns_fixedname_t fixed;
632 dns_name_t *name;
633 isc_buffer_t b;
634 const char *str;
635 const cfg_obj_t *nameobj;
636
637 if (*rbtp != NULL)
638 dns_rbt_destroy(rbtp);
639 if (vconfig != NULL)
640 maps[i++] = cfg_tuple_get(vconfig, "options");
641 if (config != NULL) {
642 const cfg_obj_t *options = NULL;
643 (void)cfg_map_get(config, "options", &options);
644 if (options != NULL)
645 maps[i++] = options;
646 }
647 maps[i] = NULL;
648
649 (void)ns_config_get(maps, confname, &obj);
650 if (obj == NULL)
651 /*
652 * No value available. *rbtp == NULL.
653 */
654 return (ISC_R_SUCCESS);
655
656 if (conftuplename != NULL) {
657 obj = cfg_tuple_get(obj, conftuplename);
658 if (cfg_obj_isvoid(obj))
659 return (ISC_R_SUCCESS);
660 }
661
662 result = dns_rbt_create(mctx, NULL, NULL, rbtp);
663 if (result != ISC_R_SUCCESS)
664 return (result);
665
666 name = dns_fixedname_initname(&fixed);
667 for (element = cfg_list_first(obj);
668 element != NULL;
669 element = cfg_list_next(element)) {
670 nameobj = cfg_listelt_value(element);
671 str = cfg_obj_asstring(nameobj);
672 isc_buffer_constinit(&b, str, strlen(str));
673 isc_buffer_add(&b, strlen(str));
674 CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
675 /*
676 * We don't need the node data, but need to set dummy data to
677 * avoid a partial match with an empty node. For example, if
678 * we have foo.example.com and bar.example.com, we'd get a match
679 * for baz.example.com, which is not the expected result.
680 * We simply use (void *)1 as the dummy data.
681 */
682 result = dns_rbt_addname(*rbtp, name, (void *)1);
683 if (result != ISC_R_SUCCESS) {
684 cfg_obj_log(nameobj, ns_g_lctx, ISC_LOG_ERROR,
685 "failed to add %s for %s: %s",
686 str, confname, isc_result_totext(result));
687 goto cleanup;
688 }
689
690 }
691
692 return (result);
693
694 cleanup:
695 dns_rbt_destroy(rbtp);
696 return (result);
697
698 }
699
700 static isc_result_t
dstkey_fromconfig(const cfg_obj_t * vconfig,const cfg_obj_t * key,bool managed,dst_key_t ** target,isc_mem_t * mctx)701 dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,
702 bool managed, dst_key_t **target, isc_mem_t *mctx)
703 {
704 dns_rdataclass_t viewclass;
705 dns_rdata_dnskey_t keystruct;
706 uint32_t flags, proto, alg;
707 const char *keystr, *keynamestr;
708 unsigned char keydata[4096];
709 isc_buffer_t keydatabuf;
710 unsigned char rrdata[4096];
711 isc_buffer_t rrdatabuf;
712 isc_region_t r;
713 dns_fixedname_t fkeyname;
714 dns_name_t *keyname;
715 isc_buffer_t namebuf;
716 isc_result_t result;
717 dst_key_t *dstkey = NULL;
718
719 INSIST(target != NULL && *target == NULL);
720
721 flags = cfg_obj_asuint32(cfg_tuple_get(key, "flags"));
722 proto = cfg_obj_asuint32(cfg_tuple_get(key, "protocol"));
723 alg = cfg_obj_asuint32(cfg_tuple_get(key, "algorithm"));
724 keyname = dns_fixedname_name(&fkeyname);
725 keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
726
727 if (managed) {
728 const char *initmethod;
729 initmethod = cfg_obj_asstring(cfg_tuple_get(key, "init"));
730
731 if (strcasecmp(initmethod, "initial-key") != 0) {
732 cfg_obj_log(key, ns_g_lctx, ISC_LOG_ERROR,
733 "managed key '%s': "
734 "invalid initialization method '%s'",
735 keynamestr, initmethod);
736 result = ISC_R_FAILURE;
737 goto cleanup;
738 }
739 }
740
741 if (vconfig == NULL)
742 viewclass = dns_rdataclass_in;
743 else {
744 const cfg_obj_t *classobj = cfg_tuple_get(vconfig, "class");
745 CHECK(ns_config_getclass(classobj, dns_rdataclass_in,
746 &viewclass));
747 }
748 keystruct.common.rdclass = viewclass;
749 keystruct.common.rdtype = dns_rdatatype_dnskey;
750 /*
751 * The key data in keystruct is not dynamically allocated.
752 */
753 keystruct.mctx = NULL;
754
755 ISC_LINK_INIT(&keystruct.common, link);
756
757 if (flags > 0xffff)
758 CHECKM(ISC_R_RANGE, "key flags");
759 if (proto > 0xff)
760 CHECKM(ISC_R_RANGE, "key protocol");
761 if (alg > 0xff)
762 CHECKM(ISC_R_RANGE, "key algorithm");
763 keystruct.flags = (uint16_t)flags;
764 keystruct.protocol = (uint8_t)proto;
765 keystruct.algorithm = (uint8_t)alg;
766
767 isc_buffer_init(&keydatabuf, keydata, sizeof(keydata));
768 isc_buffer_init(&rrdatabuf, rrdata, sizeof(rrdata));
769
770 keystr = cfg_obj_asstring(cfg_tuple_get(key, "key"));
771 CHECK(isc_base64_decodestring(keystr, &keydatabuf));
772 isc_buffer_usedregion(&keydatabuf, &r);
773 keystruct.datalen = r.length;
774 keystruct.data = r.base;
775
776 if ((keystruct.algorithm == DST_ALG_RSASHA1 ||
777 keystruct.algorithm == DST_ALG_RSAMD5) &&
778 r.length > 1 && r.base[0] == 1 && r.base[1] == 3)
779 cfg_obj_log(key, ns_g_lctx, ISC_LOG_WARNING,
780 "%s key '%s' has a weak exponent",
781 managed ? "managed" : "trusted",
782 keynamestr);
783
784 CHECK(dns_rdata_fromstruct(NULL,
785 keystruct.common.rdclass,
786 keystruct.common.rdtype,
787 &keystruct, &rrdatabuf));
788 dns_fixedname_init(&fkeyname);
789 isc_buffer_constinit(&namebuf, keynamestr, strlen(keynamestr));
790 isc_buffer_add(&namebuf, strlen(keynamestr));
791 CHECK(dns_name_fromtext(keyname, &namebuf, dns_rootname, 0, NULL));
792 CHECK(dst_key_fromdns(keyname, viewclass, &rrdatabuf,
793 mctx, &dstkey));
794
795 *target = dstkey;
796 return (ISC_R_SUCCESS);
797
798 cleanup:
799 if (result == DST_R_NOCRYPTO) {
800 cfg_obj_log(key, ns_g_lctx, ISC_LOG_ERROR,
801 "ignoring %s key for '%s': no crypto support",
802 managed ? "managed" : "trusted",
803 keynamestr);
804 } else if (result == DST_R_UNSUPPORTEDALG) {
805 cfg_obj_log(key, ns_g_lctx, ISC_LOG_WARNING,
806 "skipping %s key for '%s': %s",
807 managed ? "managed" : "trusted",
808 keynamestr, isc_result_totext(result));
809 } else {
810 cfg_obj_log(key, ns_g_lctx, ISC_LOG_ERROR,
811 "configuring %s key for '%s': %s",
812 managed ? "managed" : "trusted",
813 keynamestr, isc_result_totext(result));
814 result = ISC_R_FAILURE;
815 }
816
817 if (dstkey != NULL)
818 dst_key_free(&dstkey);
819
820 return (result);
821 }
822
823 static isc_result_t
load_view_keys(const cfg_obj_t * keys,const cfg_obj_t * vconfig,dns_view_t * view,bool managed,dns_name_t * keyname,isc_mem_t * mctx)824 load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
825 dns_view_t *view, bool managed,
826 dns_name_t *keyname, isc_mem_t *mctx)
827 {
828 const cfg_listelt_t *elt, *elt2;
829 const cfg_obj_t *key, *keylist;
830 dst_key_t *dstkey = NULL;
831 isc_result_t result;
832 dns_keytable_t *secroots = NULL;
833
834 CHECK(dns_view_getsecroots(view, &secroots));
835
836 for (elt = cfg_list_first(keys);
837 elt != NULL;
838 elt = cfg_list_next(elt)) {
839 keylist = cfg_listelt_value(elt);
840
841 for (elt2 = cfg_list_first(keylist);
842 elt2 != NULL;
843 elt2 = cfg_list_next(elt2)) {
844 key = cfg_listelt_value(elt2);
845 result = dstkey_fromconfig(vconfig, key, managed,
846 &dstkey, mctx);
847 if (result == DST_R_UNSUPPORTEDALG) {
848 result = ISC_R_SUCCESS;
849 continue;
850 }
851 if (result != ISC_R_SUCCESS)
852 goto cleanup;
853
854 /*
855 * If keyname was specified, we only add that key.
856 */
857 if (keyname != NULL &&
858 !dns_name_equal(keyname, dst_key_name(dstkey)))
859 {
860 dst_key_free(&dstkey);
861 continue;
862 }
863
864 CHECK(dns_keytable_add(secroots, managed, &dstkey));
865 }
866 }
867
868 cleanup:
869 if (dstkey != NULL)
870 dst_key_free(&dstkey);
871 if (secroots != NULL)
872 dns_keytable_detach(&secroots);
873 if (result == DST_R_NOCRYPTO)
874 result = ISC_R_SUCCESS;
875 return (result);
876 }
877
878 /*%
879 * Check whether a key has been successfully loaded.
880 */
881 static bool
keyloaded(dns_view_t * view,dns_name_t * name)882 keyloaded(dns_view_t *view, dns_name_t *name) {
883 isc_result_t result;
884 dns_keytable_t *secroots = NULL;
885 dns_keynode_t *keynode = NULL;
886
887 result = dns_view_getsecroots(view, &secroots);
888 if (result != ISC_R_SUCCESS)
889 return (false);
890
891 result = dns_keytable_find(secroots, name, &keynode);
892
893 if (keynode != NULL)
894 dns_keytable_detachkeynode(secroots, &keynode);
895 if (secroots != NULL)
896 dns_keytable_detach(&secroots);
897
898 return (result == ISC_R_SUCCESS);
899 }
900
901 /*%
902 * Configure DNSSEC keys for a view.
903 *
904 * The per-view configuration values and the server-global defaults are read
905 * from 'vconfig' and 'config'.
906 */
907 static isc_result_t
configure_view_dnsseckeys(dns_view_t * view,const cfg_obj_t * vconfig,const cfg_obj_t * config,const cfg_obj_t * bindkeys,bool auto_root,isc_mem_t * mctx)908 configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
909 const cfg_obj_t *config, const cfg_obj_t *bindkeys,
910 bool auto_root, isc_mem_t *mctx)
911 {
912 isc_result_t result = ISC_R_SUCCESS;
913 const cfg_obj_t *view_keys = NULL;
914 const cfg_obj_t *global_keys = NULL;
915 const cfg_obj_t *view_managed_keys = NULL;
916 const cfg_obj_t *global_managed_keys = NULL;
917 const cfg_obj_t *maps[4];
918 const cfg_obj_t *voptions = NULL;
919 const cfg_obj_t *options = NULL;
920 const cfg_obj_t *obj = NULL;
921 const char *directory;
922 bool need_mkey_dir = false;
923 int i = 0;
924
925 /* We don't need trust anchors for the _bind view */
926 if (strcmp(view->name, "_bind") == 0 &&
927 view->rdclass == dns_rdataclass_chaos)
928 {
929 return (ISC_R_SUCCESS);
930 }
931
932 if (vconfig != NULL) {
933 voptions = cfg_tuple_get(vconfig, "options");
934 if (voptions != NULL) {
935 (void) cfg_map_get(voptions, "trusted-keys",
936 &view_keys);
937 (void) cfg_map_get(voptions, "managed-keys",
938 &view_managed_keys);
939 maps[i++] = voptions;
940 }
941 }
942
943 if (config != NULL) {
944 (void)cfg_map_get(config, "trusted-keys", &global_keys);
945 (void)cfg_map_get(config, "managed-keys", &global_managed_keys);
946 (void)cfg_map_get(config, "options", &options);
947 if (options != NULL) {
948 maps[i++] = options;
949 }
950 }
951
952 maps[i++] = ns_g_defaults;
953 maps[i] = NULL;
954
955 result = dns_view_initsecroots(view, mctx);
956 if (result != ISC_R_SUCCESS) {
957 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
958 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
959 "couldn't create keytable");
960 return (ISC_R_UNEXPECTED);
961 }
962
963 result = dns_view_initntatable(view, ns_g_taskmgr, ns_g_timermgr);
964 if (result != ISC_R_SUCCESS) {
965 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
966 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
967 "couldn't create NTA table");
968 return (ISC_R_UNEXPECTED);
969 }
970
971 if (auto_root && view->rdclass == dns_rdataclass_in) {
972 const cfg_obj_t *builtin_keys = NULL;
973 const cfg_obj_t *builtin_managed_keys = NULL;
974
975 /*
976 * If bind.keys exists and is populated, it overrides
977 * the managed-keys clause hard-coded in ns_g_config.
978 */
979 if (bindkeys != NULL) {
980 isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
981 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
982 "obtaining root key for view %s "
983 "from '%s'",
984 view->name, ns_g_server->bindkeysfile);
985
986 (void)cfg_map_get(bindkeys, "trusted-keys",
987 &builtin_keys);
988 (void)cfg_map_get(bindkeys, "managed-keys",
989 &builtin_managed_keys);
990
991 if ((builtin_keys == NULL) &&
992 (builtin_managed_keys == NULL))
993 isc_log_write(ns_g_lctx,
994 DNS_LOGCATEGORY_SECURITY,
995 NS_LOGMODULE_SERVER,
996 ISC_LOG_WARNING,
997 "dnssec-validation auto: "
998 "WARNING: root zone key "
999 "not found");
1000 }
1001
1002 if ((builtin_keys == NULL) &&
1003 (builtin_managed_keys == NULL))
1004 {
1005 isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
1006 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
1007 "using built-in root key for view %s",
1008 view->name);
1009
1010 (void)cfg_map_get(ns_g_config, "trusted-keys",
1011 &builtin_keys);
1012 (void)cfg_map_get(ns_g_config, "managed-keys",
1013 &builtin_managed_keys);
1014 }
1015
1016 if (builtin_keys != NULL)
1017 CHECK(load_view_keys(builtin_keys, vconfig, view,
1018 false, dns_rootname, mctx));
1019 if (builtin_managed_keys != NULL)
1020 CHECK(load_view_keys(builtin_managed_keys, vconfig,
1021 view, true, dns_rootname,
1022 mctx));
1023
1024 if (!keyloaded(view, dns_rootname)) {
1025 isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
1026 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
1027 "root key not loaded");
1028 result = ISC_R_FAILURE;
1029 goto cleanup;
1030 }
1031 }
1032
1033 CHECK(load_view_keys(view_keys, vconfig, view, false,
1034 NULL, mctx));
1035 CHECK(load_view_keys(view_managed_keys, vconfig, view, true,
1036 NULL, mctx));
1037
1038 if (view->rdclass == dns_rdataclass_in) {
1039 CHECK(load_view_keys(global_keys, vconfig, view, false,
1040 NULL, mctx));
1041 CHECK(load_view_keys(global_managed_keys, vconfig, view,
1042 true, NULL, mctx));
1043 }
1044
1045 /*
1046 * Add key zone for managed-keys.
1047 */
1048 need_mkey_dir = (auto_root || view_managed_keys != NULL);
1049
1050 obj = NULL;
1051 (void)ns_config_get(maps, "managed-keys-directory", &obj);
1052 directory = (obj != NULL ? cfg_obj_asstring(obj) : NULL);
1053 if (directory != NULL) {
1054 result = isc_file_isdirectory(directory);
1055 }
1056 if (result != ISC_R_SUCCESS) {
1057 isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
1058 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
1059 "invalid managed-keys-directory %s: %s",
1060 directory, isc_result_totext(result));
1061 goto cleanup;
1062
1063 } else if (need_mkey_dir && directory != NULL) {
1064 if (!isc_file_isdirwritable(directory)) {
1065 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
1066 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
1067 "managed-keys-directory '%s' "
1068 "is not writable", directory);
1069 result = ISC_R_NOPERM;
1070 goto cleanup;
1071 }
1072 } else if (need_mkey_dir) {
1073 char cwd[PATH_MAX];
1074
1075 if (getcwd(cwd, sizeof(cwd)) == NULL) {
1076 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
1077 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
1078 "unable to retrieve "
1079 "current working directory");
1080 result = ISC_R_FAILURE;
1081 goto cleanup;
1082 }
1083
1084 if (!isc_file_isdirwritable(cwd)) {
1085 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
1086 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
1087 "working directory '%s' "
1088 "is not writable", cwd);
1089 result = ISC_R_NOPERM;
1090 goto cleanup;
1091 }
1092 }
1093
1094 CHECK(add_keydata_zone(view, directory, ns_g_mctx));
1095
1096 cleanup:
1097 return (result);
1098 }
1099
1100 static isc_result_t
mustbesecure(const cfg_obj_t * mbs,dns_resolver_t * resolver)1101 mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver) {
1102 const cfg_listelt_t *element;
1103 const cfg_obj_t *obj;
1104 const char *str;
1105 dns_fixedname_t fixed;
1106 dns_name_t *name;
1107 bool value;
1108 isc_result_t result;
1109 isc_buffer_t b;
1110
1111 name = dns_fixedname_initname(&fixed);
1112 for (element = cfg_list_first(mbs);
1113 element != NULL;
1114 element = cfg_list_next(element))
1115 {
1116 obj = cfg_listelt_value(element);
1117 str = cfg_obj_asstring(cfg_tuple_get(obj, "name"));
1118 isc_buffer_constinit(&b, str, strlen(str));
1119 isc_buffer_add(&b, strlen(str));
1120 CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
1121 value = cfg_obj_asboolean(cfg_tuple_get(obj, "value"));
1122 CHECK(dns_resolver_setmustbesecure(resolver, name, value));
1123 }
1124
1125 result = ISC_R_SUCCESS;
1126
1127 cleanup:
1128 return (result);
1129 }
1130
1131 /*%
1132 * Get a dispatch appropriate for the resolver of a given view.
1133 */
1134 static isc_result_t
get_view_querysource_dispatch(const cfg_obj_t ** maps,int af,dns_dispatch_t ** dispatchp,isc_dscp_t * dscpp,bool is_firstview)1135 get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
1136 dns_dispatch_t **dispatchp, isc_dscp_t *dscpp,
1137 bool is_firstview)
1138 {
1139 isc_result_t result = ISC_R_FAILURE;
1140 dns_dispatch_t *disp;
1141 isc_sockaddr_t sa;
1142 unsigned int attrs, attrmask;
1143 const cfg_obj_t *obj = NULL;
1144 unsigned int maxdispatchbuffers = UDPBUFFERS;
1145 isc_dscp_t dscp = -1;
1146
1147 switch (af) {
1148 case AF_INET:
1149 result = ns_config_get(maps, "query-source", &obj);
1150 INSIST(result == ISC_R_SUCCESS);
1151 break;
1152 case AF_INET6:
1153 result = ns_config_get(maps, "query-source-v6", &obj);
1154 INSIST(result == ISC_R_SUCCESS);
1155 break;
1156 default:
1157 INSIST(0);
1158 ISC_UNREACHABLE();
1159 }
1160
1161 sa = *(cfg_obj_assockaddr(obj));
1162 INSIST(isc_sockaddr_pf(&sa) == af);
1163
1164 dscp = cfg_obj_getdscp(obj);
1165 if (dscp != -1 && dscpp != NULL)
1166 *dscpp = dscp;
1167
1168 /*
1169 * If we don't support this address family, we're done!
1170 */
1171 switch (af) {
1172 case AF_INET:
1173 result = isc_net_probeipv4();
1174 break;
1175 case AF_INET6:
1176 result = isc_net_probeipv6();
1177 break;
1178 default:
1179 INSIST(0);
1180 ISC_UNREACHABLE();
1181 }
1182 if (result != ISC_R_SUCCESS)
1183 return (ISC_R_SUCCESS);
1184
1185 /*
1186 * Try to find a dispatcher that we can share.
1187 */
1188 attrs = 0;
1189 attrs |= DNS_DISPATCHATTR_UDP;
1190 switch (af) {
1191 case AF_INET:
1192 attrs |= DNS_DISPATCHATTR_IPV4;
1193 break;
1194 case AF_INET6:
1195 attrs |= DNS_DISPATCHATTR_IPV6;
1196 break;
1197 }
1198 if (isc_sockaddr_getport(&sa) == 0) {
1199 attrs |= DNS_DISPATCHATTR_EXCLUSIVE;
1200 maxdispatchbuffers = EXCLBUFFERS;
1201 } else {
1202 INSIST(obj != NULL);
1203 if (is_firstview) {
1204 cfg_obj_log(obj, ns_g_lctx, ISC_LOG_INFO,
1205 "using specific query-source port "
1206 "suppresses port randomization and can be "
1207 "insecure.");
1208 }
1209 }
1210
1211 attrmask = 0;
1212 attrmask |= DNS_DISPATCHATTR_UDP;
1213 attrmask |= DNS_DISPATCHATTR_TCP;
1214 attrmask |= DNS_DISPATCHATTR_IPV4;
1215 attrmask |= DNS_DISPATCHATTR_IPV6;
1216
1217 disp = NULL;
1218 result = dns_dispatch_getudp(ns_g_dispatchmgr, ns_g_socketmgr,
1219 ns_g_taskmgr, &sa, 4096,
1220 maxdispatchbuffers, 32768, 16411, 16433,
1221 attrs, attrmask, &disp);
1222 if (result != ISC_R_SUCCESS) {
1223 isc_sockaddr_t any;
1224 char buf[ISC_SOCKADDR_FORMATSIZE];
1225
1226 switch (af) {
1227 case AF_INET:
1228 isc_sockaddr_any(&any);
1229 break;
1230 case AF_INET6:
1231 isc_sockaddr_any6(&any);
1232 break;
1233 }
1234 if (isc_sockaddr_equal(&sa, &any))
1235 return (ISC_R_SUCCESS);
1236 isc_sockaddr_format(&sa, buf, sizeof(buf));
1237 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
1238 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
1239 "could not get query source dispatcher (%s)",
1240 buf);
1241 return (result);
1242 }
1243
1244 *dispatchp = disp;
1245
1246 return (ISC_R_SUCCESS);
1247 }
1248
1249 static isc_result_t
configure_order(dns_order_t * order,const cfg_obj_t * ent)1250 configure_order(dns_order_t *order, const cfg_obj_t *ent) {
1251 dns_rdataclass_t rdclass;
1252 dns_rdatatype_t rdtype;
1253 const cfg_obj_t *obj;
1254 dns_fixedname_t fixed;
1255 unsigned int mode = 0;
1256 const char *str;
1257 isc_buffer_t b;
1258 isc_result_t result;
1259 bool addroot;
1260
1261 result = ns_config_getclass(cfg_tuple_get(ent, "class"),
1262 dns_rdataclass_any, &rdclass);
1263 if (result != ISC_R_SUCCESS)
1264 return (result);
1265
1266 result = ns_config_gettype(cfg_tuple_get(ent, "type"),
1267 dns_rdatatype_any, &rdtype);
1268 if (result != ISC_R_SUCCESS)
1269 return (result);
1270
1271 obj = cfg_tuple_get(ent, "name");
1272 if (cfg_obj_isstring(obj))
1273 str = cfg_obj_asstring(obj);
1274 else
1275 str = "*";
1276 addroot = (strcmp(str, "*") == 0);
1277 isc_buffer_constinit(&b, str, strlen(str));
1278 isc_buffer_add(&b, strlen(str));
1279 dns_fixedname_init(&fixed);
1280 result = dns_name_fromtext(dns_fixedname_name(&fixed), &b,
1281 dns_rootname, 0, NULL);
1282 if (result != ISC_R_SUCCESS)
1283 return (result);
1284
1285 obj = cfg_tuple_get(ent, "ordering");
1286 INSIST(cfg_obj_isstring(obj));
1287 str = cfg_obj_asstring(obj);
1288 if (!strcasecmp(str, "fixed")) {
1289 #if DNS_RDATASET_FIXED
1290 mode = DNS_RDATASETATTR_FIXEDORDER;
1291 #else
1292 mode = 0;
1293 #endif /* DNS_RDATASET_FIXED */
1294 } else if (!strcasecmp(str, "random")) {
1295 mode = DNS_RDATASETATTR_RANDOMIZE;
1296 } else if (!strcasecmp(str, "cyclic")) {
1297 mode = 0;
1298 } else {
1299 INSIST(0);
1300 ISC_UNREACHABLE();
1301 }
1302
1303 /*
1304 * "*" should match everything including the root (BIND 8 compat).
1305 * As dns_name_matcheswildcard(".", "*.") returns FALSE add a
1306 * explicit entry for "." when the name is "*".
1307 */
1308 if (addroot) {
1309 result = dns_order_add(order, dns_rootname,
1310 rdtype, rdclass, mode);
1311 if (result != ISC_R_SUCCESS)
1312 return (result);
1313 }
1314
1315 return (dns_order_add(order, dns_fixedname_name(&fixed),
1316 rdtype, rdclass, mode));
1317 }
1318
1319 static isc_result_t
configure_peer(const cfg_obj_t * cpeer,isc_mem_t * mctx,dns_peer_t ** peerp)1320 configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
1321 isc_netaddr_t na;
1322 dns_peer_t *peer;
1323 const cfg_obj_t *obj;
1324 const char *str;
1325 isc_result_t result;
1326 unsigned int prefixlen;
1327
1328 cfg_obj_asnetprefix(cfg_map_getname(cpeer), &na, &prefixlen);
1329
1330 peer = NULL;
1331 result = dns_peer_newprefix(mctx, &na, prefixlen, &peer);
1332 if (result != ISC_R_SUCCESS)
1333 return (result);
1334
1335 obj = NULL;
1336 (void)cfg_map_get(cpeer, "bogus", &obj);
1337 if (obj != NULL)
1338 CHECK(dns_peer_setbogus(peer, cfg_obj_asboolean(obj)));
1339
1340 obj = NULL;
1341 (void)cfg_map_get(cpeer, "provide-ixfr", &obj);
1342 if (obj != NULL)
1343 CHECK(dns_peer_setprovideixfr(peer, cfg_obj_asboolean(obj)));
1344
1345 obj = NULL;
1346 (void)cfg_map_get(cpeer, "request-expire", &obj);
1347 if (obj != NULL)
1348 CHECK(dns_peer_setrequestexpire(peer, cfg_obj_asboolean(obj)));
1349
1350 obj = NULL;
1351 (void)cfg_map_get(cpeer, "request-ixfr", &obj);
1352 if (obj != NULL)
1353 CHECK(dns_peer_setrequestixfr(peer, cfg_obj_asboolean(obj)));
1354
1355 obj = NULL;
1356 (void)cfg_map_get(cpeer, "request-nsid", &obj);
1357 if (obj != NULL)
1358 CHECK(dns_peer_setrequestnsid(peer, cfg_obj_asboolean(obj)));
1359
1360 obj = NULL;
1361 (void)cfg_map_get(cpeer, "send-cookie", &obj);
1362 if (obj != NULL)
1363 CHECK(dns_peer_setsendcookie(peer, cfg_obj_asboolean(obj)));
1364
1365 obj = NULL;
1366 (void)cfg_map_get(cpeer, "edns", &obj);
1367 if (obj != NULL)
1368 CHECK(dns_peer_setsupportedns(peer, cfg_obj_asboolean(obj)));
1369
1370 obj = NULL;
1371 (void)cfg_map_get(cpeer, "edns-udp-size", &obj);
1372 if (obj != NULL) {
1373 uint32_t udpsize = cfg_obj_asuint32(obj);
1374 if (udpsize < 512)
1375 udpsize = 512;
1376 if (udpsize > 4096)
1377 udpsize = 4096;
1378 CHECK(dns_peer_setudpsize(peer, (uint16_t)udpsize));
1379 }
1380
1381 obj = NULL;
1382 (void)cfg_map_get(cpeer, "edns-version", &obj);
1383 if (obj != NULL) {
1384 uint32_t ednsversion = cfg_obj_asuint32(obj);
1385 if (ednsversion > 255)
1386 ednsversion = 255;
1387 CHECK(dns_peer_setednsversion(peer, (uint8_t)ednsversion));
1388 }
1389
1390 obj = NULL;
1391 (void)cfg_map_get(cpeer, "max-udp-size", &obj);
1392 if (obj != NULL) {
1393 uint32_t udpsize = cfg_obj_asuint32(obj);
1394 if (udpsize < 512)
1395 udpsize = 512;
1396 if (udpsize > 4096)
1397 udpsize = 4096;
1398 CHECK(dns_peer_setmaxudp(peer, (uint16_t)udpsize));
1399 }
1400
1401 obj = NULL;
1402 (void)cfg_map_get(cpeer, "tcp-only", &obj);
1403 if (obj != NULL)
1404 CHECK(dns_peer_setforcetcp(peer, cfg_obj_asboolean(obj)));
1405
1406 obj = NULL;
1407 (void)cfg_map_get(cpeer, "transfers", &obj);
1408 if (obj != NULL)
1409 CHECK(dns_peer_settransfers(peer, cfg_obj_asuint32(obj)));
1410
1411 obj = NULL;
1412 (void)cfg_map_get(cpeer, "transfer-format", &obj);
1413 if (obj != NULL) {
1414 str = cfg_obj_asstring(obj);
1415 if (strcasecmp(str, "many-answers") == 0) {
1416 CHECK(dns_peer_settransferformat(peer,
1417 dns_many_answers));
1418 } else if (strcasecmp(str, "one-answer") == 0) {
1419 CHECK(dns_peer_settransferformat(peer,
1420 dns_one_answer));
1421 } else {
1422 INSIST(0);
1423 ISC_UNREACHABLE();
1424 }
1425 }
1426
1427 obj = NULL;
1428 (void)cfg_map_get(cpeer, "keys", &obj);
1429 if (obj != NULL) {
1430 result = dns_peer_setkeybycharp(peer, cfg_obj_asstring(obj));
1431 if (result != ISC_R_SUCCESS)
1432 goto cleanup;
1433 }
1434
1435 obj = NULL;
1436 if (na.family == AF_INET)
1437 (void)cfg_map_get(cpeer, "transfer-source", &obj);
1438 else
1439 (void)cfg_map_get(cpeer, "transfer-source-v6", &obj);
1440 if (obj != NULL) {
1441 result = dns_peer_settransfersource(peer,
1442 cfg_obj_assockaddr(obj));
1443 if (result != ISC_R_SUCCESS)
1444 goto cleanup;
1445 result = dns_peer_settransferdscp(peer, cfg_obj_getdscp(obj));
1446 if (result != ISC_R_SUCCESS)
1447 goto cleanup;
1448 ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
1449 }
1450
1451 obj = NULL;
1452 if (na.family == AF_INET)
1453 (void)cfg_map_get(cpeer, "notify-source", &obj);
1454 else
1455 (void)cfg_map_get(cpeer, "notify-source-v6", &obj);
1456 if (obj != NULL) {
1457 result = dns_peer_setnotifysource(peer,
1458 cfg_obj_assockaddr(obj));
1459 if (result != ISC_R_SUCCESS)
1460 goto cleanup;
1461 result = dns_peer_setnotifydscp(peer, cfg_obj_getdscp(obj));
1462 if (result != ISC_R_SUCCESS)
1463 goto cleanup;
1464 ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
1465 }
1466
1467 obj = NULL;
1468 if (na.family == AF_INET)
1469 (void)cfg_map_get(cpeer, "query-source", &obj);
1470 else
1471 (void)cfg_map_get(cpeer, "query-source-v6", &obj);
1472 if (obj != NULL) {
1473 result = dns_peer_setquerysource(peer,
1474 cfg_obj_assockaddr(obj));
1475 if (result != ISC_R_SUCCESS)
1476 goto cleanup;
1477 result = dns_peer_setquerydscp(peer, cfg_obj_getdscp(obj));
1478 if (result != ISC_R_SUCCESS)
1479 goto cleanup;
1480 ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
1481 }
1482
1483 *peerp = peer;
1484 return (ISC_R_SUCCESS);
1485
1486 cleanup:
1487 dns_peer_detach(&peer);
1488 return (result);
1489 }
1490
1491 #ifdef HAVE_DLOPEN
1492 static isc_result_t
configure_dyndb(const cfg_obj_t * dyndb,isc_mem_t * mctx,const dns_dyndbctx_t * dctx)1493 configure_dyndb(const cfg_obj_t *dyndb, isc_mem_t *mctx,
1494 const dns_dyndbctx_t *dctx)
1495 {
1496 isc_result_t result = ISC_R_SUCCESS;
1497 const cfg_obj_t *obj;
1498 const char *name, *library;
1499
1500 /* Get the name of the dyndb instance and the library path . */
1501 name = cfg_obj_asstring(cfg_tuple_get(dyndb, "name"));
1502 library = cfg_obj_asstring(cfg_tuple_get(dyndb, "library"));
1503
1504 obj = cfg_tuple_get(dyndb, "parameters");
1505 if (obj != NULL)
1506 result = dns_dyndb_load(library, name, cfg_obj_asstring(obj),
1507 cfg_obj_file(obj), cfg_obj_line(obj),
1508 mctx, dctx);
1509
1510 if (result != ISC_R_SUCCESS)
1511 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
1512 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
1513 "dynamic database '%s' configuration failed: %s",
1514 name, isc_result_totext(result));
1515 return (result);
1516 }
1517 #endif
1518
1519
1520 static isc_result_t
disable_algorithms(const cfg_obj_t * disabled,dns_resolver_t * resolver)1521 disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
1522 isc_result_t result;
1523 const cfg_obj_t *algorithms;
1524 const cfg_listelt_t *element;
1525 const char *str;
1526 dns_fixedname_t fixed;
1527 dns_name_t *name;
1528 isc_buffer_t b;
1529
1530 name = dns_fixedname_initname(&fixed);
1531 str = cfg_obj_asstring(cfg_tuple_get(disabled, "name"));
1532 isc_buffer_constinit(&b, str, strlen(str));
1533 isc_buffer_add(&b, strlen(str));
1534 CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
1535
1536 algorithms = cfg_tuple_get(disabled, "algorithms");
1537 for (element = cfg_list_first(algorithms);
1538 element != NULL;
1539 element = cfg_list_next(element))
1540 {
1541 isc_textregion_t r;
1542 dns_secalg_t alg;
1543
1544 DE_CONST(cfg_obj_asstring(cfg_listelt_value(element)), r.base);
1545 r.length = strlen(r.base);
1546
1547 result = dns_secalg_fromtext(&alg, &r);
1548 if (result != ISC_R_SUCCESS) {
1549 uint8_t ui;
1550 result = isc_parse_uint8(&ui, r.base, 10);
1551 alg = ui;
1552 }
1553 if (result != ISC_R_SUCCESS) {
1554 cfg_obj_log(cfg_listelt_value(element),
1555 ns_g_lctx, ISC_LOG_ERROR,
1556 "invalid algorithm");
1557 CHECK(result);
1558 }
1559 CHECK(dns_resolver_disable_algorithm(resolver, name, alg));
1560 }
1561 cleanup:
1562 return (result);
1563 }
1564
1565 static isc_result_t
disable_ds_digests(const cfg_obj_t * disabled,dns_resolver_t * resolver)1566 disable_ds_digests(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
1567 isc_result_t result;
1568 const cfg_obj_t *digests;
1569 const cfg_listelt_t *element;
1570 const char *str;
1571 dns_fixedname_t fixed;
1572 dns_name_t *name;
1573 isc_buffer_t b;
1574
1575 name = dns_fixedname_initname(&fixed);
1576 str = cfg_obj_asstring(cfg_tuple_get(disabled, "name"));
1577 isc_buffer_constinit(&b, str, strlen(str));
1578 isc_buffer_add(&b, strlen(str));
1579 CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
1580
1581 digests = cfg_tuple_get(disabled, "digests");
1582 for (element = cfg_list_first(digests);
1583 element != NULL;
1584 element = cfg_list_next(element))
1585 {
1586 isc_textregion_t r;
1587 dns_dsdigest_t digest;
1588
1589 DE_CONST(cfg_obj_asstring(cfg_listelt_value(element)), r.base);
1590 r.length = strlen(r.base);
1591
1592 /* disable_ds_digests handles numeric values. */
1593 result = dns_dsdigest_fromtext(&digest, &r);
1594 if (result != ISC_R_SUCCESS) {
1595 cfg_obj_log(cfg_listelt_value(element),
1596 ns_g_lctx, ISC_LOG_ERROR,
1597 "invalid algorithm");
1598 CHECK(result);
1599 }
1600 CHECK(dns_resolver_disable_ds_digest(resolver, name, digest));
1601 }
1602 cleanup:
1603 return (result);
1604 }
1605
1606 static bool
on_disable_list(const cfg_obj_t * disablelist,dns_name_t * zonename)1607 on_disable_list(const cfg_obj_t *disablelist, dns_name_t *zonename) {
1608 const cfg_listelt_t *element;
1609 dns_fixedname_t fixed;
1610 dns_name_t *name;
1611 isc_result_t result;
1612 const cfg_obj_t *value;
1613 const char *str;
1614 isc_buffer_t b;
1615
1616 name = dns_fixedname_initname(&fixed);
1617
1618 for (element = cfg_list_first(disablelist);
1619 element != NULL;
1620 element = cfg_list_next(element))
1621 {
1622 value = cfg_listelt_value(element);
1623 str = cfg_obj_asstring(value);
1624 isc_buffer_constinit(&b, str, strlen(str));
1625 isc_buffer_add(&b, strlen(str));
1626 result = dns_name_fromtext(name, &b, dns_rootname,
1627 0, NULL);
1628 RUNTIME_CHECK(result == ISC_R_SUCCESS);
1629 if (dns_name_equal(name, zonename))
1630 return (true);
1631 }
1632 return (false);
1633 }
1634
1635 static isc_result_t
check_dbtype(dns_zone_t * zone,unsigned int dbtypec,const char ** dbargv,isc_mem_t * mctx)1636 check_dbtype(dns_zone_t *zone, unsigned int dbtypec, const char **dbargv,
1637 isc_mem_t *mctx)
1638 {
1639 char **argv = NULL;
1640 unsigned int i;
1641 isc_result_t result = ISC_R_SUCCESS;
1642
1643 CHECK(dns_zone_getdbtype(zone, &argv, mctx));
1644
1645 /*
1646 * Check that all the arguments match.
1647 */
1648 for (i = 0; i < dbtypec; i++)
1649 if (argv[i] == NULL || strcmp(argv[i], dbargv[i]) != 0)
1650 CHECK(ISC_R_FAILURE);
1651
1652 /*
1653 * Check that there are not extra arguments.
1654 */
1655 if (i == dbtypec && argv[i] != NULL)
1656 result = ISC_R_FAILURE;
1657
1658 cleanup:
1659 isc_mem_free(mctx, argv);
1660 return (result);
1661 }
1662
1663 static isc_result_t
setquerystats(dns_zone_t * zone,isc_mem_t * mctx,dns_zonestat_level_t level)1664 setquerystats(dns_zone_t *zone, isc_mem_t *mctx, dns_zonestat_level_t level) {
1665 isc_result_t result;
1666 isc_stats_t *zoneqrystats;
1667
1668 dns_zone_setstatlevel(zone, level);
1669
1670 zoneqrystats = NULL;
1671 if (level == dns_zonestat_full) {
1672 result = isc_stats_create(mctx, &zoneqrystats,
1673 dns_nsstatscounter_max);
1674 if (result != ISC_R_SUCCESS)
1675 return (result);
1676 }
1677 dns_zone_setrequeststats(zone, zoneqrystats);
1678 if (zoneqrystats != NULL)
1679 isc_stats_detach(&zoneqrystats);
1680
1681 return (ISC_R_SUCCESS);
1682 }
1683
1684 static ns_cache_t *
cachelist_find(ns_cachelist_t * cachelist,const char * cachename,dns_rdataclass_t rdclass)1685 cachelist_find(ns_cachelist_t *cachelist, const char *cachename,
1686 dns_rdataclass_t rdclass)
1687 {
1688 ns_cache_t *nsc;
1689
1690 for (nsc = ISC_LIST_HEAD(*cachelist);
1691 nsc != NULL;
1692 nsc = ISC_LIST_NEXT(nsc, link)) {
1693 if (nsc->rdclass == rdclass &&
1694 strcmp(dns_cache_getname(nsc->cache), cachename) == 0)
1695 return (nsc);
1696 }
1697
1698 return (NULL);
1699 }
1700
1701 static bool
cache_reusable(dns_view_t * originview,dns_view_t * view,bool new_zero_no_soattl)1702 cache_reusable(dns_view_t *originview, dns_view_t *view,
1703 bool new_zero_no_soattl)
1704 {
1705 if (originview->rdclass != view->rdclass ||
1706 originview->checknames != view->checknames ||
1707 dns_resolver_getzeronosoattl(originview->resolver) !=
1708 new_zero_no_soattl ||
1709 originview->acceptexpired != view->acceptexpired ||
1710 originview->enablevalidation != view->enablevalidation ||
1711 originview->maxcachettl != view->maxcachettl ||
1712 originview->maxncachettl != view->maxncachettl) {
1713 return (false);
1714 }
1715
1716 return (true);
1717 }
1718
1719 static bool
cache_sharable(dns_view_t * originview,dns_view_t * view,bool new_zero_no_soattl,unsigned int new_cleaning_interval,uint64_t new_max_cache_size)1720 cache_sharable(dns_view_t *originview, dns_view_t *view,
1721 bool new_zero_no_soattl,
1722 unsigned int new_cleaning_interval,
1723 uint64_t new_max_cache_size)
1724 {
1725 /*
1726 * If the cache cannot even reused for the same view, it cannot be
1727 * shared with other views.
1728 */
1729 if (!cache_reusable(originview, view, new_zero_no_soattl))
1730 return (false);
1731
1732 /*
1733 * Check other cache related parameters that must be consistent among
1734 * the sharing views.
1735 */
1736 if (dns_cache_getcleaninginterval(originview->cache) !=
1737 new_cleaning_interval ||
1738 dns_cache_getcachesize(originview->cache) != new_max_cache_size) {
1739 return (false);
1740 }
1741
1742 return (true);
1743 }
1744
1745 /*
1746 * Callback from DLZ configure when the driver sets up a writeable zone
1747 */
1748 static isc_result_t
dlzconfigure_callback(dns_view_t * view,dns_dlzdb_t * dlzdb,dns_zone_t * zone)1749 dlzconfigure_callback(dns_view_t *view, dns_dlzdb_t *dlzdb, dns_zone_t *zone) {
1750 dns_name_t *origin = dns_zone_getorigin(zone);
1751 dns_rdataclass_t zclass = view->rdclass;
1752 isc_result_t result;
1753
1754 result = dns_zonemgr_managezone(ns_g_server->zonemgr, zone);
1755 if (result != ISC_R_SUCCESS)
1756 return (result);
1757 dns_zone_setstats(zone, ns_g_server->zonestats);
1758
1759 return (ns_zone_configure_writeable_dlz(dlzdb, zone, zclass, origin));
1760 }
1761
1762 static isc_result_t
dns64_reverse(dns_view_t * view,isc_mem_t * mctx,isc_netaddr_t * na,unsigned int prefixlen,const char * server,const char * contact)1763 dns64_reverse(dns_view_t *view, isc_mem_t *mctx, isc_netaddr_t *na,
1764 unsigned int prefixlen, const char *server,
1765 const char *contact)
1766 {
1767 char reverse[48+sizeof("ip6.arpa.")] = { 0 };
1768 char buf[sizeof("x.x.")];
1769 const char *dns64_dbtype[4] = { "_dns64", "dns64", ".", "." };
1770 const char *sep = ": view ";
1771 const char *viewname = view->name;
1772 const unsigned char *s6;
1773 dns_fixedname_t fixed;
1774 dns_name_t *name;
1775 dns_zone_t *zone = NULL;
1776 int dns64_dbtypec = 4;
1777 isc_buffer_t b;
1778 isc_result_t result;
1779
1780 REQUIRE(prefixlen == 32 || prefixlen == 40 || prefixlen == 48 ||
1781 prefixlen == 56 || prefixlen == 64 || prefixlen == 96);
1782
1783 if (!strcmp(viewname, "_default")) {
1784 sep = "";
1785 viewname = "";
1786 }
1787
1788 /*
1789 * Construct the reverse name of the zone.
1790 */
1791 s6 = na->type.in6.s6_addr;
1792 while (prefixlen > 0) {
1793 prefixlen -= 8;
1794 snprintf(buf, sizeof(buf), "%x.%x.", s6[prefixlen/8] & 0xf,
1795 (s6[prefixlen/8] >> 4) & 0xf);
1796 strlcat(reverse, buf, sizeof(reverse));
1797 }
1798 strlcat(reverse, "ip6.arpa.", sizeof(reverse));
1799
1800 /*
1801 * Create the actual zone.
1802 */
1803 if (server != NULL)
1804 dns64_dbtype[2] = server;
1805 if (contact != NULL)
1806 dns64_dbtype[3] = contact;
1807 name = dns_fixedname_initname(&fixed);
1808 isc_buffer_constinit(&b, reverse, strlen(reverse));
1809 isc_buffer_add(&b, strlen(reverse));
1810 CHECK(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
1811 CHECK(dns_zone_create(&zone, mctx));
1812 CHECK(dns_zone_setorigin(zone, name));
1813 dns_zone_setview(zone, view);
1814 CHECK(dns_zonemgr_managezone(ns_g_server->zonemgr, zone));
1815 dns_zone_setclass(zone, view->rdclass);
1816 dns_zone_settype(zone, dns_zone_master);
1817 dns_zone_setstats(zone, ns_g_server->zonestats);
1818 CHECK(dns_zone_setdbtype(zone, dns64_dbtypec, dns64_dbtype));
1819 if (view->queryacl != NULL)
1820 dns_zone_setqueryacl(zone, view->queryacl);
1821 if (view->queryonacl != NULL)
1822 dns_zone_setqueryonacl(zone, view->queryonacl);
1823 dns_zone_setdialup(zone, dns_dialuptype_no);
1824 dns_zone_setnotifytype(zone, dns_notifytype_no);
1825 dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
1826 CHECK(setquerystats(zone, mctx, dns_zonestat_none)); /* XXXMPA */
1827 CHECK(dns_view_addzone(view, zone));
1828 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
1829 ISC_LOG_INFO, "dns64 reverse zone%s%s: %s", sep,
1830 viewname, reverse);
1831
1832 cleanup:
1833 if (zone != NULL)
1834 dns_zone_detach(&zone);
1835 return (result);
1836 }
1837
1838 static isc_result_t
configure_rpz_name(dns_view_t * view,const cfg_obj_t * obj,dns_name_t * name,const char * str,const char * msg)1839 configure_rpz_name(dns_view_t *view, const cfg_obj_t *obj, dns_name_t *name,
1840 const char *str, const char *msg)
1841 {
1842 isc_result_t result;
1843
1844 result = dns_name_fromstring(name, str, DNS_NAME_DOWNCASE, view->mctx);
1845 if (result != ISC_R_SUCCESS)
1846 cfg_obj_log(obj, ns_g_lctx, DNS_RPZ_ERROR_LEVEL,
1847 "invalid %s '%s'", msg, str);
1848 return (result);
1849 }
1850
1851 static isc_result_t
configure_rpz_name2(dns_view_t * view,const cfg_obj_t * obj,dns_name_t * name,const char * str,const dns_name_t * origin)1852 configure_rpz_name2(dns_view_t *view, const cfg_obj_t *obj, dns_name_t *name,
1853 const char *str, const dns_name_t *origin)
1854 {
1855 isc_result_t result;
1856
1857 result = dns_name_fromstring2(name, str, origin, DNS_NAME_DOWNCASE,
1858 view->mctx);
1859 if (result != ISC_R_SUCCESS)
1860 cfg_obj_log(obj, ns_g_lctx, DNS_RPZ_ERROR_LEVEL,
1861 "invalid zone '%s'", str);
1862 return (result);
1863 }
1864
1865 static isc_result_t
configure_rpz_zone(dns_view_t * view,const cfg_listelt_t * element,bool recursive_only_def,dns_ttl_t ttl_def,const dns_rpz_zone_t * old,bool * old_rpz_okp)1866 configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
1867 bool recursive_only_def, dns_ttl_t ttl_def,
1868 const dns_rpz_zone_t *old, bool *old_rpz_okp)
1869 {
1870 const cfg_obj_t *rpz_obj, *obj;
1871 const char *str;
1872 dns_rpz_zone_t *new;
1873 isc_result_t result;
1874 dns_rpz_num_t rpz_num;
1875
1876 REQUIRE(old != NULL || !*old_rpz_okp);
1877
1878 rpz_obj = cfg_listelt_value(element);
1879
1880 if (view->rpzs->p.num_zones >= DNS_RPZ_MAX_ZONES) {
1881 cfg_obj_log(rpz_obj, ns_g_lctx, DNS_RPZ_ERROR_LEVEL,
1882 "limit of %d response policy zones exceeded",
1883 DNS_RPZ_MAX_ZONES);
1884 return (ISC_R_FAILURE);
1885 }
1886
1887 new = isc_mem_get(view->rpzs->mctx, sizeof(*new));
1888 if (new == NULL) {
1889 cfg_obj_log(rpz_obj, ns_g_lctx, DNS_RPZ_ERROR_LEVEL,
1890 "no memory for response policy zones");
1891 return (ISC_R_NOMEMORY);
1892 }
1893
1894 memset(new, 0, sizeof(*new));
1895 result = isc_refcount_init(&new->refs, 1);
1896 if (result != ISC_R_SUCCESS) {
1897 isc_mem_put(view->rpzs->mctx, new, sizeof(*new));
1898 return (result);
1899 }
1900 dns_name_init(&new->origin, NULL);
1901 dns_name_init(&new->client_ip, NULL);
1902 dns_name_init(&new->ip, NULL);
1903 dns_name_init(&new->nsdname, NULL);
1904 dns_name_init(&new->nsip, NULL);
1905 dns_name_init(&new->passthru, NULL);
1906 dns_name_init(&new->drop, NULL);
1907 dns_name_init(&new->tcp_only, NULL);
1908 dns_name_init(&new->cname, NULL);
1909 new->num = view->rpzs->p.num_zones++;
1910 view->rpzs->zones[new->num] = new;
1911
1912 obj = cfg_tuple_get(rpz_obj, "recursive-only");
1913 if (cfg_obj_isvoid(obj) ? recursive_only_def : cfg_obj_asboolean(obj)) {
1914 view->rpzs->p.no_rd_ok &= ~DNS_RPZ_ZBIT(new->num);
1915 } else {
1916 view->rpzs->p.no_rd_ok |= DNS_RPZ_ZBIT(new->num);
1917 }
1918
1919 obj = cfg_tuple_get(rpz_obj, "log");
1920 if (!cfg_obj_isvoid(obj) && !cfg_obj_asboolean(obj)) {
1921 view->rpzs->p.no_log |= DNS_RPZ_ZBIT(new->num);
1922 } else {
1923 view->rpzs->p.no_log &= ~DNS_RPZ_ZBIT(new->num);
1924 }
1925
1926 obj = cfg_tuple_get(rpz_obj, "max-policy-ttl");
1927 if (cfg_obj_isuint32(obj)) {
1928 new->max_policy_ttl = cfg_obj_asuint32(obj);
1929 } else {
1930 new->max_policy_ttl = ttl_def;
1931 }
1932 if (*old_rpz_okp && new->max_policy_ttl != old->max_policy_ttl)
1933 *old_rpz_okp = false;
1934
1935 str = cfg_obj_asstring(cfg_tuple_get(rpz_obj, "zone name"));
1936 result = configure_rpz_name(view, rpz_obj, &new->origin, str, "zone");
1937 if (result != ISC_R_SUCCESS)
1938 return (result);
1939 if (dns_name_equal(&new->origin, dns_rootname)) {
1940 cfg_obj_log(rpz_obj, ns_g_lctx, DNS_RPZ_ERROR_LEVEL,
1941 "invalid zone name '%s'", str);
1942 return (DNS_R_EMPTYLABEL);
1943 }
1944 for (rpz_num = 0; rpz_num < view->rpzs->p.num_zones-1; ++rpz_num) {
1945 if (dns_name_equal(&view->rpzs->zones[rpz_num]->origin,
1946 &new->origin)) {
1947 cfg_obj_log(rpz_obj, ns_g_lctx, DNS_RPZ_ERROR_LEVEL,
1948 "duplicate '%s'", str);
1949 result = DNS_R_DUPLICATE;
1950 return (result);
1951 }
1952 }
1953 if (*old_rpz_okp && !dns_name_equal(&old->origin, &new->origin))
1954 *old_rpz_okp = false;
1955
1956 result = configure_rpz_name2(view, rpz_obj, &new->client_ip,
1957 DNS_RPZ_CLIENT_IP_ZONE, &new->origin);
1958 if (result != ISC_R_SUCCESS)
1959 return (result);
1960
1961 result = configure_rpz_name2(view, rpz_obj, &new->ip,
1962 DNS_RPZ_IP_ZONE, &new->origin);
1963 if (result != ISC_R_SUCCESS)
1964 return (result);
1965
1966 result = configure_rpz_name2(view, rpz_obj, &new->nsdname,
1967 DNS_RPZ_NSDNAME_ZONE, &new->origin);
1968 if (result != ISC_R_SUCCESS)
1969 return (result);
1970
1971 result = configure_rpz_name2(view, rpz_obj, &new->nsip,
1972 DNS_RPZ_NSIP_ZONE, &new->origin);
1973 if (result != ISC_R_SUCCESS)
1974 return (result);
1975
1976 result = configure_rpz_name(view, rpz_obj, &new->passthru,
1977 DNS_RPZ_PASSTHRU_NAME, "name");
1978 if (result != ISC_R_SUCCESS)
1979 return (result);
1980
1981 result = configure_rpz_name(view, rpz_obj, &new->drop,
1982 DNS_RPZ_DROP_NAME, "name");
1983 if (result != ISC_R_SUCCESS)
1984 return (result);
1985
1986 result = configure_rpz_name(view, rpz_obj, &new->tcp_only,
1987 DNS_RPZ_TCP_ONLY_NAME, "name");
1988 if (result != ISC_R_SUCCESS)
1989 return (result);
1990
1991 obj = cfg_tuple_get(rpz_obj, "policy");
1992 if (cfg_obj_isvoid(obj)) {
1993 new->policy = DNS_RPZ_POLICY_GIVEN;
1994 } else {
1995 str = cfg_obj_asstring(cfg_tuple_get(obj, "policy name"));
1996 new->policy = dns_rpz_str2policy(str);
1997 INSIST(new->policy != DNS_RPZ_POLICY_ERROR);
1998 if (new->policy == DNS_RPZ_POLICY_CNAME) {
1999 str = cfg_obj_asstring(cfg_tuple_get(obj, "cname"));
2000 result = configure_rpz_name(view, rpz_obj, &new->cname,
2001 str, "cname");
2002 if (result != ISC_R_SUCCESS)
2003 return (result);
2004 }
2005 }
2006 if (*old_rpz_okp && (new->policy != old->policy ||
2007 !dns_name_equal(&old->cname, &new->cname)))
2008 *old_rpz_okp = false;
2009
2010 return (ISC_R_SUCCESS);
2011 }
2012
2013 static isc_result_t
configure_rpz(dns_view_t * view,const cfg_obj_t * rpz_obj,bool * old_rpz_okp)2014 configure_rpz(dns_view_t *view, const cfg_obj_t *rpz_obj,
2015 bool *old_rpz_okp)
2016 {
2017 const cfg_listelt_t *zone_element;
2018 const cfg_obj_t *sub_obj;
2019 bool recursive_only_def;
2020 dns_ttl_t ttl_def;
2021 dns_rpz_zones_t *new;
2022 const dns_rpz_zones_t *old;
2023 dns_view_t *pview;
2024 const dns_rpz_zone_t *old_zone;
2025 isc_result_t result;
2026 int i;
2027
2028 *old_rpz_okp = false;
2029
2030 zone_element = cfg_list_first(cfg_tuple_get(rpz_obj, "zone list"));
2031 if (zone_element == NULL)
2032 return (ISC_R_SUCCESS);
2033
2034 result = dns_rpz_new_zones(&view->rpzs, view->mctx);
2035 if (result != ISC_R_SUCCESS)
2036 return (result);
2037 new = view->rpzs;
2038
2039 sub_obj = cfg_tuple_get(rpz_obj, "recursive-only");
2040 if (!cfg_obj_isvoid(sub_obj) &&
2041 !cfg_obj_asboolean(sub_obj))
2042 recursive_only_def = false;
2043 else
2044 recursive_only_def = true;
2045
2046 sub_obj = cfg_tuple_get(rpz_obj, "break-dnssec");
2047 if (!cfg_obj_isvoid(sub_obj) &&
2048 cfg_obj_asboolean(sub_obj))
2049 new->p.break_dnssec = true;
2050 else
2051 new->p.break_dnssec = false;
2052
2053 sub_obj = cfg_tuple_get(rpz_obj, "max-policy-ttl");
2054 if (cfg_obj_isuint32(sub_obj))
2055 ttl_def = cfg_obj_asuint32(sub_obj);
2056 else
2057 ttl_def = DNS_RPZ_MAX_TTL_DEFAULT;
2058
2059 sub_obj = cfg_tuple_get(rpz_obj, "min-ns-dots");
2060 if (cfg_obj_isuint32(sub_obj))
2061 new->p.min_ns_labels = cfg_obj_asuint32(sub_obj) + 1;
2062 else
2063 new->p.min_ns_labels = 2;
2064
2065 sub_obj = cfg_tuple_get(rpz_obj, "qname-wait-recurse");
2066 if (cfg_obj_isvoid(sub_obj) || cfg_obj_asboolean(sub_obj))
2067 new->p.qname_wait_recurse = true;
2068 else
2069 new->p.qname_wait_recurse = false;
2070
2071 sub_obj = cfg_tuple_get(rpz_obj, "nsip-wait-recurse");
2072 if (cfg_obj_isvoid(sub_obj) || cfg_obj_asboolean(sub_obj))
2073 new->p.nsip_wait_recurse = true;
2074 else
2075 new->p.nsip_wait_recurse = false;
2076
2077 pview = NULL;
2078 result = dns_viewlist_find(&ns_g_server->viewlist,
2079 view->name, view->rdclass, &pview);
2080 if (result == ISC_R_SUCCESS) {
2081 old = pview->rpzs;
2082 } else {
2083 old = NULL;
2084 }
2085 if (old == NULL) {
2086 *old_rpz_okp = false;
2087 } else {
2088 *old_rpz_okp = true;
2089 }
2090
2091 for (i = 0;
2092 zone_element != NULL;
2093 ++i, zone_element = cfg_list_next(zone_element))
2094 {
2095 INSIST(!*old_rpz_okp || old != NULL);
2096 if (*old_rpz_okp && i < old->p.num_zones) {
2097 old_zone = old->zones[i];
2098 } else {
2099 *old_rpz_okp = false;
2100 old_zone = NULL;
2101 }
2102 result = configure_rpz_zone(view, zone_element,
2103 recursive_only_def, ttl_def,
2104 old_zone, old_rpz_okp);
2105 if (result != ISC_R_SUCCESS) {
2106 if (pview != NULL)
2107 dns_view_detach(&pview);
2108 return (result);
2109 }
2110 }
2111
2112 /*
2113 * If this is a reloading and the parameters and list of policy
2114 * zones are unchanged, then use the same policy data.
2115 * Data for individual zones that must be reloaded will be merged.
2116 */
2117 if (old != NULL && memcmp(&old->p, &new->p, sizeof(new->p)) != 0)
2118 *old_rpz_okp = false;
2119 if (*old_rpz_okp) {
2120 dns_rpz_detach_rpzs(&view->rpzs);
2121 dns_rpz_attach_rpzs(pview->rpzs, &view->rpzs);
2122 } else if (old != NULL && pview != NULL) {
2123 pview->rpzs->rpz_ver += 1;
2124 view->rpzs->rpz_ver = pview->rpzs->rpz_ver;
2125 cfg_obj_log(rpz_obj, ns_g_lctx, DNS_RPZ_DEBUG_LEVEL1,
2126 "updated RPZ policy: version %d",
2127 view->rpzs->rpz_ver);
2128 }
2129
2130 if (pview != NULL) {
2131 dns_view_detach(&pview);
2132 }
2133
2134 return (ISC_R_SUCCESS);
2135 }
2136
2137 static void
catz_addmodzone_taskaction(isc_task_t * task,isc_event_t * event0)2138 catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
2139 catz_chgzone_event_t *ev = (catz_chgzone_event_t *) event0;
2140 isc_result_t result;
2141 isc_buffer_t namebuf;
2142 isc_buffer_t *confbuf;
2143 char nameb[DNS_NAME_FORMATSIZE];
2144 const cfg_obj_t *zlist = NULL;
2145 cfg_obj_t *zoneconf = NULL;
2146 cfg_obj_t *zoneobj = NULL;
2147 ns_cfgctx_t *cfg;
2148 dns_zone_t *zone = NULL;
2149
2150 cfg = (ns_cfgctx_t *) ev->view->new_zone_config;
2151 if (cfg == NULL) {
2152 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
2153 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
2154 "catz: allow-new-zones statement missing from "
2155 "config; cannot add zone from the catalog");
2156 goto cleanup;
2157 }
2158
2159 isc_buffer_init(&namebuf, nameb, DNS_NAME_FORMATSIZE);
2160 dns_name_totext(dns_catz_entry_getname(ev->entry), true, &namebuf);
2161 isc_buffer_putuint8(&namebuf, 0);
2162
2163 /* Zone shouldn't already exist */
2164 result = dns_zt_find(ev->view->zonetable,
2165 dns_catz_entry_getname(ev->entry), 0, NULL, &zone);
2166
2167 if (ev->mod == true) {
2168 if (result != ISC_R_SUCCESS) {
2169 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
2170 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
2171 "catz: error \"%s\" while trying to "
2172 "modify zone \"%s\"",
2173 isc_result_totext(result),
2174 nameb);
2175 goto cleanup;
2176 } else {
2177 if (!dns_zone_getadded(zone)) {
2178 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
2179 NS_LOGMODULE_SERVER,
2180 ISC_LOG_WARNING,
2181 "catz: catz_addmodzone_taskaction: "
2182 "zone '%s' is not a dynamically "
2183 "added zone",
2184 nameb);
2185 goto cleanup;
2186 }
2187 if (dns_zone_get_parentcatz(zone) != ev->origin) {
2188 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
2189 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
2190 "catz: catz_delzone_taskaction: "
2191 "zone '%s' exists in multiple "
2192 "catalog zones",
2193 nameb);
2194 goto cleanup;
2195 }
2196 dns_zone_detach(&zone);
2197 }
2198
2199 } else {
2200 if (result == ISC_R_SUCCESS) {
2201 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
2202 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
2203 "catz: zone \"%s\" is overridden "
2204 "by explicitly configured zone",
2205 nameb);
2206 goto cleanup;
2207 } else if (result != ISC_R_NOTFOUND &&
2208 result != DNS_R_PARTIALMATCH) {
2209 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
2210 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
2211 "catz: error \"%s\" while trying to "
2212 "add zone \"%s\"",
2213 isc_result_totext(result),
2214 nameb);
2215 goto cleanup;
2216 } else { /* this can happen in case of DNS_R_PARTIALMATCH */
2217 if (zone != NULL)
2218 dns_zone_detach(&zone);
2219 }
2220 }
2221 RUNTIME_CHECK(zone == NULL);
2222 /* Create a config for new zone */
2223 confbuf = NULL;
2224 result = dns_catz_generate_zonecfg(ev->origin, ev->entry, &confbuf);
2225 if (result == ISC_R_SUCCESS) {
2226 cfg_parser_reset(cfg->add_parser);
2227 result = cfg_parse_buffer3(cfg->add_parser, confbuf, "catz", 0,
2228 &cfg_type_addzoneconf, &zoneconf);
2229 isc_buffer_free(&confbuf);
2230 }
2231 /*
2232 * Fail if either dns_catz_generate_zonecfg() or cfg_parse_buffer3()
2233 * failed.
2234 */
2235 if (result != ISC_R_SUCCESS) {
2236 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
2237 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
2238 "catz: error \"%s\" while trying to generate "
2239 "config for zone \"%s\"",
2240 isc_result_totext(result), nameb);
2241 goto cleanup;
2242 }
2243 CHECK(cfg_map_get(zoneconf, "zone", &zlist));
2244 if (!cfg_obj_islist(zlist))
2245 CHECK(ISC_R_FAILURE);
2246
2247 /* For now we only support adding one zone at a time */
2248 zoneobj = cfg_listelt_value(cfg_list_first(zlist));
2249
2250 /* Mark view unfrozen so that zone can be added */
2251
2252 result = isc_task_beginexclusive(task);
2253 RUNTIME_CHECK(result == ISC_R_SUCCESS);
2254 dns_view_thaw(ev->view);
2255 result = configure_zone(cfg->config, zoneobj, cfg->vconfig,
2256 ev->cbd->server->mctx, ev->view,
2257 &ev->cbd->server->viewlist, cfg->actx,
2258 true, false, ev->mod);
2259 dns_view_freeze(ev->view);
2260 isc_task_endexclusive(task);
2261
2262 if (result != ISC_R_SUCCESS) {
2263 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
2264 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
2265 "catz: failed to configure zone \"%s\" - %d",
2266 nameb, result);
2267 goto cleanup;
2268 }
2269
2270 /* Is it there yet? */
2271 CHECK(dns_zt_find(ev->view->zonetable,
2272 dns_catz_entry_getname(ev->entry), 0, NULL, &zone));
2273
2274 /*
2275 * Load the zone from the master file. If this fails, we'll
2276 * need to undo the configuration we've done already.
2277 */
2278 result = dns_zone_loadnew(zone);
2279 if (result != ISC_R_SUCCESS) {
2280 dns_db_t *dbp = NULL;
2281 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
2282 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
2283 "catz: dns_zone_loadnew() failed "
2284 "with %s; reverting.",
2285 isc_result_totext(result));
2286
2287 /* If the zone loaded partially, unload it */
2288 if (dns_zone_getdb(zone, &dbp) == ISC_R_SUCCESS) {
2289 dns_db_detach(&dbp);
2290 dns_zone_unload(zone);
2291 }
2292
2293 /* Remove the zone from the zone table */
2294 dns_zt_unmount(ev->view->zonetable, zone);
2295 goto cleanup;
2296 }
2297
2298 /* Flag the zone as having been added at runtime */
2299 dns_zone_setadded(zone, true);
2300 dns_zone_set_parentcatz(zone, ev->origin);
2301
2302 cleanup:
2303 if (zone != NULL)
2304 dns_zone_detach(&zone);
2305 if (zoneconf != NULL)
2306 cfg_obj_destroy(cfg->add_parser, &zoneconf);
2307 dns_catz_entry_detach(ev->origin, &ev->entry);
2308 dns_catz_zone_detach(&ev->origin);
2309 dns_view_detach(&ev->view);
2310 isc_event_free(ISC_EVENT_PTR(&ev));
2311 }
2312
2313 static void
catz_delzone_taskaction(isc_task_t * task,isc_event_t * event0)2314 catz_delzone_taskaction(isc_task_t *task, isc_event_t *event0) {
2315 catz_chgzone_event_t *ev = (catz_chgzone_event_t *) event0;
2316 isc_result_t result;
2317 dns_zone_t *zone = NULL;
2318 dns_db_t *dbp = NULL;
2319 char cname[DNS_NAME_FORMATSIZE];
2320 const char * file;
2321
2322 result = isc_task_beginexclusive(task);
2323 RUNTIME_CHECK(result == ISC_R_SUCCESS);
2324
2325 dns_name_format(dns_catz_entry_getname(ev->entry), cname,
2326 DNS_NAME_FORMATSIZE);
2327 result = dns_zt_find(ev->view->zonetable,
2328 dns_catz_entry_getname(ev->entry), 0, NULL, &zone);
2329 if (result != ISC_R_SUCCESS) {
2330 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
2331 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
2332 "catz: catz_delzone_taskaction: "
2333 "zone '%s' not found", cname);
2334 goto cleanup;
2335 }
2336
2337 if (!dns_zone_getadded(zone)) {
2338 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
2339 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
2340 "catz: catz_delzone_taskaction: "
2341 "zone '%s' is not a dynamically added zone",
2342 cname);
2343 goto cleanup;
2344 }
2345
2346 if (dns_zone_get_parentcatz(zone) != ev->origin) {
2347 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
2348 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
2349 "catz: catz_delzone_taskaction: zone "
2350 "'%s' exists in multiple catalog zones",
2351 cname);
2352 goto cleanup;
2353 }
2354
2355 /* Stop answering for this zone */
2356 if (dns_zone_getdb(zone, &dbp) == ISC_R_SUCCESS) {
2357 dns_db_detach(&dbp);
2358 dns_zone_unload(zone);
2359 }
2360
2361 CHECK(dns_zt_unmount(ev->view->zonetable, zone));
2362 file = dns_zone_getfile(zone);
2363 if (file != NULL)
2364 isc_file_remove(file);
2365
2366 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
2367 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
2368 "catz: catz_delzone_taskaction: "
2369 "zone '%s' deleted", cname);
2370 cleanup:
2371 isc_task_endexclusive(task);
2372 if (zone != NULL)
2373 dns_zone_detach(&zone);
2374 dns_catz_entry_detach(ev->origin, &ev->entry);
2375 dns_catz_zone_detach(&ev->origin);
2376 dns_view_detach(&ev->view);
2377 isc_event_free(ISC_EVENT_PTR(&ev));
2378 }
2379
2380 static isc_result_t
catz_create_chg_task(dns_catz_entry_t * entry,dns_catz_zone_t * origin,dns_view_t * view,isc_taskmgr_t * taskmgr,void * udata,isc_eventtype_t type)2381 catz_create_chg_task(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
2382 dns_view_t *view, isc_taskmgr_t *taskmgr, void *udata,
2383 isc_eventtype_t type)
2384 {
2385 catz_chgzone_event_t *event;
2386 isc_task_t *task;
2387 isc_result_t result;
2388 isc_taskaction_t action = NULL;
2389
2390 switch (type) {
2391 case DNS_EVENT_CATZADDZONE:
2392 case DNS_EVENT_CATZMODZONE:
2393 action = catz_addmodzone_taskaction;
2394 break;
2395 case DNS_EVENT_CATZDELZONE:
2396 action = catz_delzone_taskaction;
2397 break;
2398 default:
2399 REQUIRE(0);
2400 }
2401
2402 event = (catz_chgzone_event_t *) isc_event_allocate(view->mctx, origin,
2403 type, action, NULL,
2404 sizeof(*event));
2405 if (event == NULL)
2406 return (ISC_R_NOMEMORY);
2407
2408 event->cbd = (catz_cb_data_t *) udata;
2409 event->entry = NULL;
2410 event->origin = NULL;
2411 event->view = NULL;
2412 event->mod = (type == DNS_EVENT_CATZMODZONE);
2413 dns_catz_entry_attach(entry, &event->entry);
2414 dns_catz_zone_attach(origin, &event->origin);
2415 dns_view_attach(view, &event->view);
2416
2417 task = NULL;
2418 result = isc_taskmgr_excltask(taskmgr, &task);
2419 REQUIRE(result == ISC_R_SUCCESS);
2420 isc_task_send(task, ISC_EVENT_PTR(&event));
2421 isc_task_detach(&task);
2422
2423 return (ISC_R_SUCCESS);
2424 }
2425
2426 static isc_result_t
catz_addzone(dns_catz_entry_t * entry,dns_catz_zone_t * origin,dns_view_t * view,isc_taskmgr_t * taskmgr,void * udata)2427 catz_addzone(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
2428 dns_view_t *view, isc_taskmgr_t *taskmgr, void *udata)
2429 {
2430 return (catz_create_chg_task(entry, origin, view, taskmgr, udata,
2431 DNS_EVENT_CATZADDZONE));
2432 }
2433
2434 static isc_result_t
catz_delzone(dns_catz_entry_t * entry,dns_catz_zone_t * origin,dns_view_t * view,isc_taskmgr_t * taskmgr,void * udata)2435 catz_delzone(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
2436 dns_view_t *view, isc_taskmgr_t *taskmgr, void *udata)
2437 {
2438 return (catz_create_chg_task(entry, origin, view, taskmgr, udata,
2439 DNS_EVENT_CATZDELZONE));
2440 }
2441
2442 static isc_result_t
catz_modzone(dns_catz_entry_t * entry,dns_catz_zone_t * origin,dns_view_t * view,isc_taskmgr_t * taskmgr,void * udata)2443 catz_modzone(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
2444 dns_view_t *view, isc_taskmgr_t *taskmgr, void *udata)
2445 {
2446 return (catz_create_chg_task(entry, origin, view, taskmgr, udata,
2447 DNS_EVENT_CATZMODZONE));
2448 }
2449
2450 static isc_result_t
configure_catz_zone(dns_view_t * view,const cfg_obj_t * config,const cfg_listelt_t * element)2451 configure_catz_zone(dns_view_t *view, const cfg_obj_t *config,
2452 const cfg_listelt_t *element)
2453 {
2454 const cfg_obj_t *catz_obj, *obj;
2455 dns_catz_zone_t *zone = NULL;
2456 const char *str;
2457 isc_result_t result;
2458 dns_name_t origin;
2459 dns_catz_options_t *opts;
2460 dns_view_t *pview = NULL;
2461
2462 dns_name_init(&origin, NULL);
2463 catz_obj = cfg_listelt_value(element);
2464
2465 str = cfg_obj_asstring(cfg_tuple_get(catz_obj, "zone name"));
2466
2467 result = dns_name_fromstring(&origin, str, DNS_NAME_DOWNCASE,
2468 view->mctx);
2469 if (result == ISC_R_SUCCESS && dns_name_equal(&origin, dns_rootname))
2470 result = DNS_R_EMPTYLABEL;
2471
2472 if (result != ISC_R_SUCCESS) {
2473 cfg_obj_log(catz_obj, ns_g_lctx, DNS_CATZ_ERROR_LEVEL,
2474 "catz: invalid zone name '%s'", str);
2475 goto cleanup;
2476 }
2477
2478 result = dns_catz_add_zone(view->catzs, &origin, &zone);
2479 if (result != ISC_R_SUCCESS && result != ISC_R_EXISTS) {
2480 cfg_obj_log(catz_obj, ns_g_lctx, DNS_CATZ_ERROR_LEVEL,
2481 "catz: unable to create catalog zone '%s', "
2482 "error %s",
2483 str, isc_result_totext(result));
2484 goto cleanup;
2485 }
2486
2487 if (result == ISC_R_EXISTS) {
2488 isc_ht_iter_t *it = NULL;
2489
2490 result = dns_viewlist_find(&ns_g_server->viewlist,
2491 view->name,
2492 view->rdclass, &pview);
2493 RUNTIME_CHECK(result == ISC_R_SUCCESS);
2494
2495 /*
2496 * xxxwpk todo: reconfigure the zone!!!!
2497 */
2498 cfg_obj_log(catz_obj, ns_g_lctx, DNS_CATZ_ERROR_LEVEL,
2499 "catz: catalog zone '%s' will not be reconfigured",
2500 str);
2501 /*
2502 * We have to walk through all the member zones and attach
2503 * them to current view
2504 */
2505 result = dns_catz_get_iterator(zone, &it);
2506 if (result != ISC_R_SUCCESS) {
2507 cfg_obj_log(catz_obj, ns_g_lctx, DNS_CATZ_ERROR_LEVEL,
2508 "catz: unable to create iterator");
2509 goto cleanup;
2510 }
2511
2512 for (result = isc_ht_iter_first(it);
2513 result == ISC_R_SUCCESS;
2514 result = isc_ht_iter_next(it))
2515 {
2516 dns_name_t *name = NULL;
2517 dns_zone_t *dnszone = NULL;
2518 dns_catz_entry_t *entry = NULL;
2519 isc_result_t tresult;
2520
2521 isc_ht_iter_current(it, (void **) &entry);
2522 name = dns_catz_entry_getname(entry);
2523
2524 tresult = dns_view_findzone(pview, name, &dnszone);
2525 RUNTIME_CHECK(tresult == ISC_R_SUCCESS);
2526
2527 dns_zone_setview(dnszone, view);
2528 if (view->acache != NULL)
2529 dns_zone_setacache(dnszone, view->acache);
2530 dns_view_addzone(view, dnszone);
2531
2532 /*
2533 * The dns_view_findzone() call above increments the
2534 * zone's reference count, which we need to decrement
2535 * back. However, as dns_zone_detach() sets the
2536 * supplied pointer to NULL, calling it is deferred
2537 * until the dnszone variable is no longer used.
2538 */
2539 dns_zone_detach(&dnszone);
2540 }
2541
2542 isc_ht_iter_destroy(&it);
2543
2544 result = ISC_R_SUCCESS;
2545 }
2546
2547 dns_catz_zone_resetdefoptions(zone);
2548 opts = dns_catz_zone_getdefoptions(zone);
2549
2550 obj = cfg_tuple_get(catz_obj, "default-masters");
2551 if (obj != NULL && cfg_obj_istuple(obj))
2552 result = ns_config_getipandkeylist(config, obj,
2553 view->mctx, &opts->masters);
2554
2555 obj = cfg_tuple_get(catz_obj, "in-memory");
2556 if (obj != NULL && cfg_obj_isboolean(obj))
2557 opts->in_memory = cfg_obj_asboolean(obj);
2558
2559 obj = cfg_tuple_get(catz_obj, "zone-directory");
2560 if (!opts->in_memory && obj != NULL && cfg_obj_isstring(obj)) {
2561 opts->zonedir = isc_mem_strdup(view->mctx,
2562 cfg_obj_asstring(obj));
2563 if (isc_file_isdirectory(opts->zonedir) != ISC_R_SUCCESS) {
2564 cfg_obj_log(obj, ns_g_lctx, DNS_CATZ_ERROR_LEVEL,
2565 "catz: zone-directory '%s' "
2566 "not found; zone files will not be "
2567 "saved", opts->zonedir);
2568 opts->in_memory = true;
2569 }
2570 }
2571
2572 obj = cfg_tuple_get(catz_obj, "min-update-interval");
2573 if (obj != NULL && cfg_obj_isuint32(obj))
2574 opts->min_update_interval = cfg_obj_asuint32(obj);
2575
2576 cleanup:
2577 if (pview != NULL)
2578 dns_view_detach(&pview);
2579 dns_name_free(&origin, view->mctx);
2580
2581 return (result);
2582 }
2583
2584 static catz_cb_data_t ns_catz_cbdata;
2585 static dns_catz_zonemodmethods_t ns_catz_zonemodmethods = {
2586 catz_addzone,
2587 catz_modzone,
2588 catz_delzone,
2589 &ns_catz_cbdata
2590 };
2591
2592 static isc_result_t
configure_catz(dns_view_t * view,const cfg_obj_t * config,const cfg_obj_t * catz_obj)2593 configure_catz(dns_view_t *view, const cfg_obj_t *config,
2594 const cfg_obj_t *catz_obj)
2595 {
2596 const cfg_listelt_t *zone_element;
2597 const dns_catz_zones_t *old = NULL;
2598 dns_view_t *pview = NULL;
2599 isc_result_t result;
2600
2601 /* xxxwpk TODO do it cleaner, once, somewhere */
2602 ns_catz_cbdata.server = ns_g_server;
2603
2604 zone_element = cfg_list_first(cfg_tuple_get(catz_obj, "zone list"));
2605 if (zone_element == NULL)
2606 return (ISC_R_SUCCESS);
2607
2608 CHECK(dns_catz_new_zones(&view->catzs, &ns_catz_zonemodmethods,
2609 view->mctx, ns_g_taskmgr, ns_g_timermgr));
2610
2611 result = dns_viewlist_find(&ns_g_server->viewlist, view->name,
2612 view->rdclass, &pview);
2613 if (result == ISC_R_SUCCESS)
2614 old = pview->catzs;
2615
2616 if (old != NULL) {
2617 dns_catz_catzs_detach(&view->catzs);
2618 dns_catz_catzs_attach(pview->catzs, &view->catzs);
2619 dns_catz_prereconfig(view->catzs);
2620 }
2621
2622 while (zone_element != NULL) {
2623 CHECK(configure_catz_zone(view, config, zone_element));
2624 zone_element = cfg_list_next(zone_element);
2625 }
2626
2627 if (old != NULL)
2628 dns_catz_postreconfig(view->catzs);
2629
2630 result = ISC_R_SUCCESS;
2631
2632 cleanup:
2633 if (pview != NULL)
2634 dns_view_detach(&pview);
2635
2636 return (result);
2637 }
2638
2639 #define CHECK_RRL(cond, pat, val1, val2) \
2640 do { \
2641 if (!(cond)) { \
2642 cfg_obj_log(obj, ns_g_lctx, ISC_LOG_ERROR, \
2643 pat, val1, val2); \
2644 result = ISC_R_RANGE; \
2645 goto cleanup; \
2646 } \
2647 } while (0)
2648
2649 #define CHECK_RRL_RATE(rate, def, max_rate, name) \
2650 do { \
2651 obj = NULL; \
2652 rrl->rate.str = name; \
2653 result = cfg_map_get(map, name, &obj); \
2654 if (result == ISC_R_SUCCESS) { \
2655 rrl->rate.r = cfg_obj_asuint32(obj); \
2656 CHECK_RRL(rrl->rate.r <= max_rate, \
2657 name" %d > %d", \
2658 rrl->rate.r, max_rate); \
2659 } else { \
2660 rrl->rate.r = def; \
2661 } \
2662 rrl->rate.scaled = rrl->rate.r; \
2663 } while (0)
2664
2665 static isc_result_t
configure_rrl(dns_view_t * view,const cfg_obj_t * config,const cfg_obj_t * map)2666 configure_rrl(dns_view_t *view, const cfg_obj_t *config, const cfg_obj_t *map) {
2667 const cfg_obj_t *obj;
2668 dns_rrl_t *rrl;
2669 isc_result_t result;
2670 int min_entries, i, j;
2671
2672 /*
2673 * Most DNS servers have few clients, but intentinally open
2674 * recursive and authoritative servers often have many.
2675 * So start with a small number of entries unless told otherwise
2676 * to reduce cold-start costs.
2677 */
2678 min_entries = 500;
2679 obj = NULL;
2680 result = cfg_map_get(map, "min-table-size", &obj);
2681 if (result == ISC_R_SUCCESS) {
2682 min_entries = cfg_obj_asuint32(obj);
2683 if (min_entries < 1)
2684 min_entries = 1;
2685 }
2686 result = dns_rrl_init(&rrl, view, min_entries);
2687 if (result != ISC_R_SUCCESS)
2688 return (result);
2689
2690 i = ISC_MAX(20000, min_entries);
2691 obj = NULL;
2692 result = cfg_map_get(map, "max-table-size", &obj);
2693 if (result == ISC_R_SUCCESS) {
2694 i = cfg_obj_asuint32(obj);
2695 CHECK_RRL(i >= min_entries,
2696 "max-table-size %d < min-table-size %d",
2697 i, min_entries);
2698 }
2699 rrl->max_entries = i;
2700
2701 CHECK_RRL_RATE(responses_per_second, 0, DNS_RRL_MAX_RATE,
2702 "responses-per-second");
2703 CHECK_RRL_RATE(referrals_per_second,
2704 rrl->responses_per_second.r, DNS_RRL_MAX_RATE,
2705 "referrals-per-second");
2706 CHECK_RRL_RATE(nodata_per_second,
2707 rrl->responses_per_second.r, DNS_RRL_MAX_RATE,
2708 "nodata-per-second");
2709 CHECK_RRL_RATE(nxdomains_per_second,
2710 rrl->responses_per_second.r, DNS_RRL_MAX_RATE,
2711 "nxdomains-per-second");
2712 CHECK_RRL_RATE(errors_per_second,
2713 rrl->responses_per_second.r, DNS_RRL_MAX_RATE,
2714 "errors-per-second");
2715
2716 CHECK_RRL_RATE(all_per_second, 0, DNS_RRL_MAX_RATE,
2717 "all-per-second");
2718
2719 CHECK_RRL_RATE(slip, 2, DNS_RRL_MAX_SLIP,
2720 "slip");
2721
2722 i = 15;
2723 obj = NULL;
2724 result = cfg_map_get(map, "window", &obj);
2725 if (result == ISC_R_SUCCESS) {
2726 i = cfg_obj_asuint32(obj);
2727 CHECK_RRL(i >= 1 && i <= DNS_RRL_MAX_WINDOW,
2728 "window %d < 1 or > %d", i, DNS_RRL_MAX_WINDOW);
2729 }
2730 rrl->window = i;
2731
2732 i = 0;
2733 obj = NULL;
2734 result = cfg_map_get(map, "qps-scale", &obj);
2735 if (result == ISC_R_SUCCESS) {
2736 i = cfg_obj_asuint32(obj);
2737 CHECK_RRL(i >= 1, "invalid 'qps-scale %d'%s", i, "");
2738 }
2739 rrl->qps_scale = i;
2740 rrl->qps = 1.0;
2741
2742 i = 24;
2743 obj = NULL;
2744 result = cfg_map_get(map, "ipv4-prefix-length", &obj);
2745 if (result == ISC_R_SUCCESS) {
2746 i = cfg_obj_asuint32(obj);
2747 CHECK_RRL(i >= 8 && i <= 32,
2748 "invalid 'ipv4-prefix-length %d'%s", i, "");
2749 }
2750 rrl->ipv4_prefixlen = i;
2751 if (i == 32)
2752 rrl->ipv4_mask = 0xffffffff;
2753 else
2754 rrl->ipv4_mask = htonl(0xffffffff << (32-i));
2755
2756 i = 56;
2757 obj = NULL;
2758 result = cfg_map_get(map, "ipv6-prefix-length", &obj);
2759 if (result == ISC_R_SUCCESS) {
2760 i = cfg_obj_asuint32(obj);
2761 CHECK_RRL(i >= 16 && i <= DNS_RRL_MAX_PREFIX,
2762 "ipv6-prefix-length %d < 16 or > %d",
2763 i, DNS_RRL_MAX_PREFIX);
2764 }
2765 rrl->ipv6_prefixlen = i;
2766 for (j = 0; j < 4; ++j) {
2767 if (i <= 0) {
2768 rrl->ipv6_mask[j] = 0;
2769 } else if (i < 32) {
2770 rrl->ipv6_mask[j] = htonl(0xffffffff << (32-i));
2771 } else {
2772 rrl->ipv6_mask[j] = 0xffffffff;
2773 }
2774 i -= 32;
2775 }
2776
2777 obj = NULL;
2778 result = cfg_map_get(map, "exempt-clients", &obj);
2779 if (result == ISC_R_SUCCESS) {
2780 result = cfg_acl_fromconfig(obj, config, ns_g_lctx,
2781 ns_g_aclconfctx, ns_g_mctx,
2782 0, &rrl->exempt);
2783 CHECK_RRL(result == ISC_R_SUCCESS,
2784 "invalid %s%s", "address match list", "");
2785 }
2786
2787 obj = NULL;
2788 result = cfg_map_get(map, "log-only", &obj);
2789 if (result == ISC_R_SUCCESS && cfg_obj_asboolean(obj))
2790 rrl->log_only = true;
2791 else
2792 rrl->log_only = false;
2793
2794 return (ISC_R_SUCCESS);
2795
2796 cleanup:
2797 dns_rrl_view_destroy(view);
2798 return (result);
2799 }
2800
2801 static isc_result_t
add_soa(dns_db_t * db,dns_dbversion_t * version,dns_name_t * name,dns_name_t * origin,dns_name_t * contact)2802 add_soa(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
2803 dns_name_t *origin, dns_name_t *contact)
2804 {
2805 dns_dbnode_t *node = NULL;
2806 dns_rdata_t rdata = DNS_RDATA_INIT;
2807 dns_rdatalist_t rdatalist;
2808 dns_rdataset_t rdataset;
2809 isc_result_t result;
2810 unsigned char buf[DNS_SOA_BUFFERSIZE];
2811
2812 CHECK(dns_soa_buildrdata(origin, contact, dns_db_class(db),
2813 0, 28800, 7200, 604800, 86400, buf, &rdata));
2814
2815 dns_rdatalist_init(&rdatalist);
2816 rdatalist.type = rdata.type;
2817 rdatalist.rdclass = rdata.rdclass;
2818 rdatalist.ttl = 86400;
2819 ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
2820
2821 dns_rdataset_init(&rdataset);
2822 CHECK(dns_rdatalist_tordataset(&rdatalist, &rdataset));
2823 CHECK(dns_db_findnode(db, name, true, &node));
2824 CHECK(dns_db_addrdataset(db, node, version, 0, &rdataset, 0, NULL));
2825
2826 cleanup:
2827 if (node != NULL)
2828 dns_db_detachnode(db, &node);
2829 return (result);
2830 }
2831
2832 static isc_result_t
add_ns(dns_db_t * db,dns_dbversion_t * version,dns_name_t * name,dns_name_t * nsname)2833 add_ns(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
2834 dns_name_t *nsname)
2835 {
2836 dns_dbnode_t *node = NULL;
2837 dns_rdata_ns_t ns;
2838 dns_rdata_t rdata = DNS_RDATA_INIT;
2839 dns_rdatalist_t rdatalist;
2840 dns_rdataset_t rdataset;
2841 isc_result_t result;
2842 isc_buffer_t b;
2843 unsigned char buf[DNS_NAME_MAXWIRE];
2844
2845 isc_buffer_init(&b, buf, sizeof(buf));
2846
2847 ns.common.rdtype = dns_rdatatype_ns;
2848 ns.common.rdclass = dns_db_class(db);
2849 ns.mctx = NULL;
2850 dns_name_init(&ns.name, NULL);
2851 dns_name_clone(nsname, &ns.name);
2852 CHECK(dns_rdata_fromstruct(&rdata, dns_db_class(db), dns_rdatatype_ns,
2853 &ns, &b));
2854
2855 dns_rdatalist_init(&rdatalist);
2856 rdatalist.type = rdata.type;
2857 rdatalist.rdclass = rdata.rdclass;
2858 rdatalist.ttl = 86400;
2859 ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
2860
2861 dns_rdataset_init(&rdataset);
2862 CHECK(dns_rdatalist_tordataset(&rdatalist, &rdataset));
2863 CHECK(dns_db_findnode(db, name, true, &node));
2864 CHECK(dns_db_addrdataset(db, node, version, 0, &rdataset, 0, NULL));
2865
2866 cleanup:
2867 if (node != NULL)
2868 dns_db_detachnode(db, &node);
2869 return (result);
2870 }
2871
2872 static isc_result_t
create_empty_zone(dns_zone_t * zone,dns_name_t * name,dns_view_t * view,const cfg_obj_t * zonelist,const char ** empty_dbtype,int empty_dbtypec,dns_zonestat_level_t statlevel)2873 create_empty_zone(dns_zone_t *zone, dns_name_t *name, dns_view_t *view,
2874 const cfg_obj_t *zonelist, const char **empty_dbtype,
2875 int empty_dbtypec, dns_zonestat_level_t statlevel)
2876 {
2877 char namebuf[DNS_NAME_FORMATSIZE];
2878 const cfg_listelt_t *element;
2879 const cfg_obj_t *obj;
2880 const cfg_obj_t *zconfig;
2881 const cfg_obj_t *zoptions;
2882 const char *rbt_dbtype[4] = { "rbt" };
2883 const char *sep = ": view ";
2884 const char *str;
2885 const char *viewname = view->name;
2886 dns_db_t *db = NULL;
2887 dns_dbversion_t *version = NULL;
2888 dns_fixedname_t cfixed;
2889 dns_fixedname_t fixed;
2890 dns_fixedname_t nsfixed;
2891 dns_name_t *contact;
2892 dns_name_t *ns;
2893 dns_name_t *zname;
2894 dns_zone_t *myzone = NULL;
2895 int rbt_dbtypec = 1;
2896 isc_result_t result;
2897 dns_namereln_t namereln;
2898 int order;
2899 unsigned int nlabels;
2900
2901 zname = dns_fixedname_initname(&fixed);
2902 ns = dns_fixedname_initname(&nsfixed);
2903 contact = dns_fixedname_initname(&cfixed);
2904
2905 /*
2906 * Look for forward "zones" beneath this empty zone and if so
2907 * create a custom db for the empty zone.
2908 */
2909 for (element = cfg_list_first(zonelist);
2910 element != NULL;
2911 element = cfg_list_next(element)) {
2912
2913 zconfig = cfg_listelt_value(element);
2914 str = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
2915 CHECK(dns_name_fromstring(zname, str, 0, NULL));
2916 namereln = dns_name_fullcompare(zname, name, &order, &nlabels);
2917 if (namereln != dns_namereln_subdomain)
2918 continue;
2919
2920 zoptions = cfg_tuple_get(zconfig, "options");
2921
2922 obj = NULL;
2923 (void)cfg_map_get(zoptions, "type", &obj);
2924 if (obj != NULL &&
2925 strcasecmp(cfg_obj_asstring(obj), "forward") == 0) {
2926 obj = NULL;
2927 (void)cfg_map_get(zoptions, "forward", &obj);
2928 if (obj == NULL)
2929 continue;
2930 if (strcasecmp(cfg_obj_asstring(obj), "only") != 0)
2931 continue;
2932 }
2933 if (db == NULL) {
2934 CHECK(dns_db_create(view->mctx, "rbt", name,
2935 dns_dbtype_zone, view->rdclass,
2936 0, NULL, &db));
2937 CHECK(dns_db_newversion(db, &version));
2938 if (strcmp(empty_dbtype[2], "@") == 0)
2939 dns_name_clone(name, ns);
2940 else
2941 CHECK(dns_name_fromstring(ns, empty_dbtype[2],
2942 0, NULL));
2943 CHECK(dns_name_fromstring(contact, empty_dbtype[3],
2944 0, NULL));
2945 CHECK(add_soa(db, version, name, ns, contact));
2946 CHECK(add_ns(db, version, name, ns));
2947 }
2948 CHECK(add_ns(db, version, zname, dns_rootname));
2949 }
2950
2951 /*
2952 * Is the existing zone the ok to use?
2953 */
2954 if (zone != NULL) {
2955 unsigned int typec;
2956 const char **dbargv;
2957
2958 if (db != NULL) {
2959 typec = rbt_dbtypec;
2960 dbargv = rbt_dbtype;
2961 } else {
2962 typec = empty_dbtypec;
2963 dbargv = empty_dbtype;
2964 }
2965
2966 result = check_dbtype(zone, typec, dbargv, view->mctx);
2967 if (result != ISC_R_SUCCESS)
2968 zone = NULL;
2969
2970 if (zone != NULL && dns_zone_gettype(zone) != dns_zone_master)
2971 zone = NULL;
2972 if (zone != NULL && dns_zone_getfile(zone) != NULL)
2973 zone = NULL;
2974 if (zone != NULL) {
2975 dns_zone_getraw(zone, &myzone);
2976 if (myzone != NULL) {
2977 dns_zone_detach(&myzone);
2978 zone = NULL;
2979 }
2980 }
2981 }
2982
2983 if (zone == NULL) {
2984 CHECK(dns_zonemgr_createzone(ns_g_server->zonemgr, &myzone));
2985 zone = myzone;
2986 CHECK(dns_zone_setorigin(zone, name));
2987 CHECK(dns_zonemgr_managezone(ns_g_server->zonemgr, zone));
2988 if (db == NULL)
2989 CHECK(dns_zone_setdbtype(zone, empty_dbtypec,
2990 empty_dbtype));
2991 dns_zone_setclass(zone, view->rdclass);
2992 dns_zone_settype(zone, dns_zone_master);
2993 dns_zone_setstats(zone, ns_g_server->zonestats);
2994 }
2995
2996 dns_zone_setoption(zone, ~DNS_ZONEOPT_NOCHECKNS, false);
2997 dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
2998 dns_zone_setnotifytype(zone, dns_notifytype_no);
2999 dns_zone_setdialup(zone, dns_dialuptype_no);
3000 dns_zone_setautomatic(zone, true);
3001 if (view->queryacl != NULL)
3002 dns_zone_setqueryacl(zone, view->queryacl);
3003 else
3004 dns_zone_clearqueryacl(zone);
3005 if (view->queryonacl != NULL)
3006 dns_zone_setqueryonacl(zone, view->queryonacl);
3007 else
3008 dns_zone_clearqueryonacl(zone);
3009 dns_zone_clearupdateacl(zone);
3010 if (view->transferacl != NULL)
3011 dns_zone_setxfracl(zone, view->transferacl);
3012 else
3013 dns_zone_clearxfracl(zone);
3014
3015 CHECK(setquerystats(zone, view->mctx, statlevel));
3016 if (db != NULL) {
3017 dns_db_closeversion(db, &version, true);
3018 CHECK(dns_zone_replacedb(zone, db, false));
3019 }
3020 dns_zone_setoption2(zone, DNS_ZONEOPT2_AUTOEMPTY, true);
3021 dns_zone_setview(zone, view);
3022 CHECK(dns_view_addzone(view, zone));
3023
3024 if (!strcmp(viewname, "_default")) {
3025 sep = "";
3026 viewname = "";
3027 }
3028 dns_name_format(name, namebuf, sizeof(namebuf));
3029 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
3030 ISC_LOG_INFO, "automatic empty zone%s%s: %s",
3031 sep, viewname, namebuf);
3032
3033 cleanup:
3034 if (myzone != NULL)
3035 dns_zone_detach(&myzone);
3036 if (version != NULL)
3037 dns_db_closeversion(db, &version, false);
3038 if (db != NULL)
3039 dns_db_detach(&db);
3040
3041 INSIST(version == NULL);
3042
3043 return (result);
3044 }
3045
3046 #ifdef HAVE_DNSTAP
3047 static isc_result_t
configure_dnstap(const cfg_obj_t ** maps,dns_view_t * view)3048 configure_dnstap(const cfg_obj_t **maps, dns_view_t *view) {
3049 isc_result_t result;
3050 const cfg_obj_t *obj, *obj2;
3051 const cfg_listelt_t *element;
3052 const char *dpath;
3053 const cfg_obj_t *dlist = NULL;
3054 dns_dtmsgtype_t dttypes = 0;
3055 dns_dtmode_t dmode;
3056 unsigned int i;
3057 struct fstrm_iothr_options *fopt = NULL;
3058
3059 result = ns_config_get(maps, "dnstap", &dlist);
3060 if (result != ISC_R_SUCCESS)
3061 return (ISC_R_SUCCESS);
3062
3063 for (element = cfg_list_first(dlist);
3064 element != NULL;
3065 element = cfg_list_next(element))
3066 {
3067 const char *str;
3068 dns_dtmsgtype_t dt = 0;
3069
3070 obj = cfg_listelt_value(element);
3071 obj2 = cfg_tuple_get(obj, "type");
3072 str = cfg_obj_asstring(obj2);
3073 if (strcasecmp(str, "client") == 0) {
3074 dt |= DNS_DTTYPE_CQ|DNS_DTTYPE_CR;
3075 } else if (strcasecmp(str, "auth") == 0) {
3076 dt |= DNS_DTTYPE_AQ|DNS_DTTYPE_AR;
3077 } else if (strcasecmp(str, "resolver") == 0) {
3078 dt |= DNS_DTTYPE_RQ|DNS_DTTYPE_RR;
3079 } else if (strcasecmp(str, "forwarder") == 0) {
3080 dt |= DNS_DTTYPE_FQ|DNS_DTTYPE_FR;
3081 } else if (strcasecmp(str, "all") == 0) {
3082 dt |= DNS_DTTYPE_CQ|DNS_DTTYPE_CR|
3083 DNS_DTTYPE_AQ|DNS_DTTYPE_AR|
3084 DNS_DTTYPE_RQ|DNS_DTTYPE_RR|
3085 DNS_DTTYPE_FQ|DNS_DTTYPE_FR;
3086 }
3087
3088 obj2 = cfg_tuple_get(obj, "mode");
3089 if (obj2 == NULL || cfg_obj_isvoid(obj2)) {
3090 dttypes |= dt;
3091 continue;
3092 }
3093
3094 str = cfg_obj_asstring(obj2);
3095 if (strcasecmp(str, "query") == 0) {
3096 dt &= ~DNS_DTTYPE_RESPONSE;
3097 } else if (strcasecmp(str, "response") == 0) {
3098 dt &= ~DNS_DTTYPE_QUERY;
3099 }
3100
3101 dttypes |= dt;
3102 }
3103
3104 if (ns_g_server->dtenv == NULL && dttypes != 0) {
3105 obj = NULL;
3106 CHECKM(ns_config_get(maps, "dnstap-output", &obj),
3107 "'dnstap-output' must be set if 'dnstap' is set");
3108
3109 obj2 = cfg_tuple_get(obj, "mode");
3110 if (obj2 == NULL)
3111 CHECKM(ISC_R_FAILURE, "dnstap-output mode not found");
3112 if (strcasecmp(cfg_obj_asstring(obj2), "file") == 0)
3113 dmode = dns_dtmode_file;
3114 else
3115 dmode = dns_dtmode_unix;
3116
3117 obj2 = cfg_tuple_get(obj, "path");
3118 if (obj2 == NULL)
3119 CHECKM(ISC_R_FAILURE, "dnstap-output path not found");
3120
3121 dpath = cfg_obj_asstring(obj2);
3122
3123 fopt = fstrm_iothr_options_init();
3124 fstrm_iothr_options_set_num_input_queues(fopt, ns_g_cpus);
3125 fstrm_iothr_options_set_queue_model(fopt,
3126 FSTRM_IOTHR_QUEUE_MODEL_MPSC);
3127
3128 obj = NULL;
3129 result = ns_config_get(maps, "fstrm-set-buffer-hint", &obj);
3130 if (result == ISC_R_SUCCESS) {
3131 i = cfg_obj_asuint32(obj);
3132 fstrm_iothr_options_set_buffer_hint(fopt, i);
3133 }
3134
3135 obj = NULL;
3136 result = ns_config_get(maps, "fstrm-set-flush-timeout", &obj);
3137 if (result == ISC_R_SUCCESS) {
3138 i = cfg_obj_asuint32(obj);
3139 fstrm_iothr_options_set_flush_timeout(fopt, i);
3140 }
3141
3142 obj = NULL;
3143 result = ns_config_get(maps, "fstrm-set-input-queue-size",
3144 &obj);
3145 if (result == ISC_R_SUCCESS) {
3146 i = cfg_obj_asuint32(obj);
3147 fstrm_iothr_options_set_input_queue_size(fopt, i);
3148 }
3149
3150 obj = NULL;
3151 result = ns_config_get(maps,
3152 "fstrm-set-output-notify-threshold",
3153 &obj);
3154 if (result == ISC_R_SUCCESS) {
3155 i = cfg_obj_asuint32(obj);
3156 fstrm_iothr_options_set_queue_notify_threshold(fopt,
3157 i);
3158 }
3159
3160 obj = NULL;
3161 result = ns_config_get(maps, "fstrm-set-output-queue-model",
3162 &obj);
3163 if (result == ISC_R_SUCCESS) {
3164 if (strcasecmp(cfg_obj_asstring(obj), "spsc") == 0)
3165 i = FSTRM_IOTHR_QUEUE_MODEL_SPSC;
3166 else
3167 i = FSTRM_IOTHR_QUEUE_MODEL_MPSC;
3168 fstrm_iothr_options_set_queue_model(fopt, i);
3169 }
3170
3171 obj = NULL;
3172 result = ns_config_get(maps, "fstrm-set-output-queue-size",
3173 &obj);
3174 if (result == ISC_R_SUCCESS) {
3175 i = cfg_obj_asuint32(obj);
3176 fstrm_iothr_options_set_output_queue_size(fopt, i);
3177 }
3178
3179 obj = NULL;
3180 result = ns_config_get(maps, "fstrm-set-reopen-interval",
3181 &obj);
3182 if (result == ISC_R_SUCCESS) {
3183 i = cfg_obj_asuint32(obj);
3184 fstrm_iothr_options_set_reopen_interval(fopt, i);
3185 }
3186
3187 CHECKM(dns_dt_create(ns_g_mctx, dmode, dpath, &fopt,
3188 &ns_g_server->dtenv),
3189 "unable to create dnstap environment");
3190 }
3191
3192 if (ns_g_server->dtenv == NULL)
3193 return (ISC_R_SUCCESS);
3194
3195 obj = NULL;
3196 result = ns_config_get(maps, "dnstap-version", &obj);
3197 if (result != ISC_R_SUCCESS) {
3198 /* not specified; use the product and version */
3199 dns_dt_setversion(ns_g_server->dtenv, PRODUCT " " VERSION);
3200 } else if (result == ISC_R_SUCCESS && !cfg_obj_isvoid(obj)) {
3201 /* Quoted string */
3202 dns_dt_setversion(ns_g_server->dtenv, cfg_obj_asstring(obj));
3203 }
3204
3205 obj = NULL;
3206 result = ns_config_get(maps, "dnstap-identity", &obj);
3207 if (result == ISC_R_SUCCESS && cfg_obj_isboolean(obj)) {
3208 /* "hostname" is interpreted as boolean true */
3209 char buf[256];
3210 result = ns_os_gethostname(buf, sizeof(buf));
3211 if (result == ISC_R_SUCCESS)
3212 dns_dt_setidentity(ns_g_server->dtenv, buf);
3213 } else if (result == ISC_R_SUCCESS && !cfg_obj_isvoid(obj)) {
3214 /* Quoted string */
3215 dns_dt_setidentity(ns_g_server->dtenv, cfg_obj_asstring(obj));
3216 }
3217
3218 dns_dt_attach(ns_g_server->dtenv, &view->dtenv);
3219 view->dttypes = dttypes;
3220
3221 result = ISC_R_SUCCESS;
3222
3223 cleanup:
3224 if (fopt != NULL)
3225 fstrm_iothr_options_destroy(&fopt);
3226
3227 return (result);
3228 }
3229 #endif /* HAVE_DNSTAP */
3230
3231 static isc_result_t
create_mapped_acl(void)3232 create_mapped_acl(void) {
3233 isc_result_t result;
3234 dns_acl_t *acl = NULL;
3235 struct in6_addr in6 = IN6ADDR_V4MAPPED_INIT;
3236 isc_netaddr_t addr;
3237
3238 isc_netaddr_fromin6(&addr, &in6);
3239
3240 result = dns_acl_create(ns_g_mctx, 1, &acl);
3241 if (result != ISC_R_SUCCESS)
3242 return (result);
3243
3244 result = dns_iptable_addprefix2(acl->iptable, &addr, 96,
3245 true, false);
3246 if (result == ISC_R_SUCCESS)
3247 dns_acl_attach(acl, &ns_g_mapped);
3248 dns_acl_detach(&acl);
3249 return (result);
3250 }
3251
3252 /*
3253 * Configure 'view' according to 'vconfig', taking defaults from 'config'
3254 * where values are missing in 'vconfig'.
3255 *
3256 * When configuring the default view, 'vconfig' will be NULL and the
3257 * global defaults in 'config' used exclusively.
3258 */
3259 static isc_result_t
configure_view(dns_view_t * view,dns_viewlist_t * viewlist,cfg_obj_t * config,cfg_obj_t * vconfig,ns_cachelist_t * cachelist,const cfg_obj_t * bindkeys,isc_mem_t * mctx,cfg_aclconfctx_t * actx,bool need_hints)3260 configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
3261 cfg_obj_t *config, cfg_obj_t *vconfig,
3262 ns_cachelist_t *cachelist, const cfg_obj_t *bindkeys,
3263 isc_mem_t *mctx, cfg_aclconfctx_t *actx,
3264 bool need_hints)
3265 {
3266 const cfg_obj_t *maps[4];
3267 const cfg_obj_t *cfgmaps[3];
3268 const cfg_obj_t *optionmaps[3];
3269 const cfg_obj_t *options = NULL;
3270 const cfg_obj_t *voptions = NULL;
3271 const cfg_obj_t *forwardtype;
3272 const cfg_obj_t *forwarders;
3273 const cfg_obj_t *alternates;
3274 const cfg_obj_t *zonelist;
3275 const cfg_obj_t *dlzlist;
3276 const cfg_obj_t *dlz;
3277 const cfg_obj_t *dlvobj = NULL;
3278 unsigned int dlzargc;
3279 char **dlzargv;
3280 const cfg_obj_t *dyndb_list;
3281 const cfg_obj_t *disabled;
3282 const cfg_obj_t *obj, *obj2;
3283 const cfg_listelt_t *element;
3284 in_port_t port;
3285 dns_cache_t *cache = NULL;
3286 isc_result_t result;
3287 unsigned int cleaning_interval;
3288 size_t max_cache_size;
3289 uint32_t max_cache_size_percent = 0;
3290 size_t max_acache_size;
3291 size_t max_adb_size;
3292 uint32_t lame_ttl, fail_ttl;
3293 dns_tsig_keyring_t *ring = NULL;
3294 dns_view_t *pview = NULL; /* Production view */
3295 isc_mem_t *cmctx = NULL, *hmctx = NULL;
3296 dns_dispatch_t *dispatch4 = NULL;
3297 dns_dispatch_t *dispatch6 = NULL;
3298 bool reused_cache = false;
3299 bool shared_cache = false;
3300 int i = 0, j = 0, k = 0;
3301 const char *str;
3302 const char *cachename = NULL;
3303 dns_order_t *order = NULL;
3304 uint32_t udpsize;
3305 uint32_t maxbits;
3306 unsigned int resopts = 0;
3307 dns_zone_t *zone = NULL;
3308 uint32_t max_clients_per_query;
3309 bool empty_zones_enable;
3310 const cfg_obj_t *disablelist = NULL;
3311 isc_stats_t *resstats = NULL;
3312 dns_stats_t *resquerystats = NULL;
3313 bool auto_root = false;
3314 ns_cache_t *nsc;
3315 bool zero_no_soattl;
3316 dns_acl_t *clients = NULL, *mapped = NULL, *excluded = NULL;
3317 unsigned int query_timeout, ndisp;
3318 bool old_rpz_ok = false;
3319 isc_dscp_t dscp4 = -1, dscp6 = -1;
3320 dns_dyndbctx_t *dctx = NULL;
3321
3322 REQUIRE(DNS_VIEW_VALID(view));
3323
3324 if (config != NULL)
3325 (void)cfg_map_get(config, "options", &options);
3326
3327 /*
3328 * maps: view options, options, defaults
3329 * cfgmaps: view options, config
3330 * optionmaps: view options, options
3331 */
3332 if (vconfig != NULL) {
3333 voptions = cfg_tuple_get(vconfig, "options");
3334 maps[i++] = voptions;
3335 optionmaps[j++] = voptions;
3336 cfgmaps[k++] = voptions;
3337 }
3338 if (options != NULL) {
3339 maps[i++] = options;
3340 optionmaps[j++] = options;
3341 }
3342
3343 maps[i++] = ns_g_defaults;
3344 maps[i] = NULL;
3345 optionmaps[j] = NULL;
3346 if (config != NULL)
3347 cfgmaps[k++] = config;
3348 cfgmaps[k] = NULL;
3349
3350 /*
3351 * Set the view's port number for outgoing queries.
3352 */
3353 CHECKM(ns_config_getport(config, &port), "port");
3354 dns_view_setdstport(view, port);
3355
3356 /*
3357 * Create additional cache for this view and zones under the view
3358 * if explicitly enabled.
3359 * XXX950 default to on.
3360 */
3361 obj = NULL;
3362 (void)ns_config_get(maps, "acache-enable", &obj);
3363 if (obj != NULL && cfg_obj_asboolean(obj)) {
3364 cmctx = NULL;
3365 CHECK(isc_mem_create(0, 0, &cmctx));
3366 CHECK(dns_acache_create(&view->acache, cmctx, ns_g_taskmgr,
3367 ns_g_timermgr));
3368 isc_mem_setname(cmctx, "acache", NULL);
3369 isc_mem_detach(&cmctx);
3370 }
3371 if (view->acache != NULL) {
3372 obj = NULL;
3373 result = ns_config_get(maps, "acache-cleaning-interval", &obj);
3374 INSIST(result == ISC_R_SUCCESS);
3375 dns_acache_setcleaninginterval(view->acache,
3376 cfg_obj_asuint32(obj) * 60);
3377
3378 obj = NULL;
3379 result = ns_config_get(maps, "max-acache-size", &obj);
3380 INSIST(result == ISC_R_SUCCESS);
3381 if (cfg_obj_isstring(obj)) {
3382 str = cfg_obj_asstring(obj);
3383 INSIST(strcasecmp(str, "unlimited") == 0);
3384 max_acache_size = 0;
3385 } else {
3386 isc_resourcevalue_t value;
3387 value = cfg_obj_asuint64(obj);
3388 if (value > SIZE_MAX) {
3389 cfg_obj_log(obj, ns_g_lctx,
3390 ISC_LOG_WARNING,
3391 "'max-acache-size "
3392 "%" PRIu64 "' "
3393 "is too large for this "
3394 "system; reducing to %lu",
3395 value, (unsigned long)SIZE_MAX);
3396 value = SIZE_MAX;
3397 }
3398 max_acache_size = (size_t) value;
3399 }
3400 dns_acache_setcachesize(view->acache, max_acache_size);
3401 }
3402
3403 /*
3404 * Make the list of response policy zone names for a view that
3405 * is used for real lookups and so cares about hints.
3406 */
3407 obj = NULL;
3408 if (view->rdclass == dns_rdataclass_in && need_hints &&
3409 ns_config_get(maps, "response-policy", &obj) == ISC_R_SUCCESS) {
3410 CHECK(configure_rpz(view, obj, &old_rpz_ok));
3411 }
3412
3413 obj = NULL;
3414 if (view->rdclass == dns_rdataclass_in && need_hints &&
3415 ns_config_get(maps, "catalog-zones", &obj) == ISC_R_SUCCESS) {
3416 CHECK(configure_catz(view, config, obj));
3417 }
3418
3419 /*
3420 * Configure the zones.
3421 */
3422 zonelist = NULL;
3423 if (voptions != NULL)
3424 (void)cfg_map_get(voptions, "zone", &zonelist);
3425 else
3426 (void)cfg_map_get(config, "zone", &zonelist);
3427
3428 /*
3429 * Load zone configuration
3430 */
3431 for (element = cfg_list_first(zonelist);
3432 element != NULL;
3433 element = cfg_list_next(element))
3434 {
3435 const cfg_obj_t *zconfig = cfg_listelt_value(element);
3436 CHECK(configure_zone(config, zconfig, vconfig, mctx, view,
3437 viewlist, actx, false, old_rpz_ok,
3438 false));
3439 }
3440
3441 /*
3442 * If we're allowing added zones, then load zone configuration
3443 * from the newzone file for zones that were added during previous
3444 * runs.
3445 */
3446 CHECK(configure_newzones(view, config, vconfig, mctx, actx));
3447
3448 /*
3449 * Create Dynamically Loadable Zone driver.
3450 */
3451 dlzlist = NULL;
3452 if (voptions != NULL)
3453 (void)cfg_map_get(voptions, "dlz", &dlzlist);
3454 else
3455 (void)cfg_map_get(config, "dlz", &dlzlist);
3456
3457 for (element = cfg_list_first(dlzlist);
3458 element != NULL;
3459 element = cfg_list_next(element))
3460 {
3461 dlz = cfg_listelt_value(element);
3462
3463 obj = NULL;
3464 (void)cfg_map_get(dlz, "database", &obj);
3465 if (obj != NULL) {
3466 dns_dlzdb_t *dlzdb = NULL;
3467 const cfg_obj_t *name, *search = NULL;
3468 char *s = isc_mem_strdup(mctx, cfg_obj_asstring(obj));
3469
3470 if (s == NULL) {
3471 result = ISC_R_NOMEMORY;
3472 goto cleanup;
3473 }
3474
3475 result = isc_commandline_strtoargv(mctx, s, &dlzargc,
3476 &dlzargv, 0);
3477 if (result != ISC_R_SUCCESS) {
3478 isc_mem_free(mctx, s);
3479 goto cleanup;
3480 }
3481
3482 name = cfg_map_getname(dlz);
3483 result = dns_dlzcreate(mctx, cfg_obj_asstring(name),
3484 dlzargv[0], dlzargc, dlzargv,
3485 &dlzdb);
3486 isc_mem_free(mctx, s);
3487 isc_mem_put(mctx, dlzargv, dlzargc * sizeof(*dlzargv));
3488 if (result != ISC_R_SUCCESS)
3489 goto cleanup;
3490
3491 /*
3492 * If the DLZ backend supports configuration,
3493 * and is searchable, then call its configure
3494 * method now. If not searchable, we'll take
3495 * care of it when we process the zone statement.
3496 */
3497 (void)cfg_map_get(dlz, "search", &search);
3498 if (search == NULL || cfg_obj_asboolean(search)) {
3499 dlzdb->search = true;
3500 result = dns_dlzconfigure(view, dlzdb,
3501 dlzconfigure_callback);
3502 if (result != ISC_R_SUCCESS)
3503 goto cleanup;
3504 ISC_LIST_APPEND(view->dlz_searched,
3505 dlzdb, link);
3506 } else {
3507 dlzdb->search = false;
3508 ISC_LIST_APPEND(view->dlz_unsearched,
3509 dlzdb, link);
3510 }
3511
3512 }
3513 }
3514
3515 /*
3516 * Obtain configuration parameters that affect the decision of whether
3517 * we can reuse/share an existing cache.
3518 */
3519 obj = NULL;
3520 result = ns_config_get(maps, "cleaning-interval", &obj);
3521 INSIST(result == ISC_R_SUCCESS);
3522 cleaning_interval = cfg_obj_asuint32(obj) * 60;
3523
3524 obj = NULL;
3525 result = ns_config_get(maps, "max-cache-size", &obj);
3526 INSIST(result == ISC_R_SUCCESS);
3527 if (cfg_obj_isstring(obj)) {
3528 str = cfg_obj_asstring(obj);
3529 INSIST(strcasecmp(str, "unlimited") == 0);
3530 max_cache_size = 0;
3531 } else if (cfg_obj_ispercentage(obj)) {
3532 max_cache_size = SIZE_AS_PERCENT;
3533 max_cache_size_percent = cfg_obj_aspercentage(obj);
3534 } else {
3535 isc_resourcevalue_t value;
3536 value = cfg_obj_asuint64(obj);
3537 if (value > SIZE_MAX) {
3538 cfg_obj_log(obj, ns_g_lctx,
3539 ISC_LOG_WARNING,
3540 "'max-cache-size "
3541 "%" PRIu64 "' "
3542 "is too large for this "
3543 "system; reducing to %lu",
3544 value, (unsigned long)SIZE_MAX);
3545 value = SIZE_MAX;
3546 }
3547 max_cache_size = (size_t) value;
3548 }
3549
3550 if (max_cache_size == SIZE_AS_PERCENT) {
3551 uint64_t totalphys = isc_meminfo_totalphys();
3552
3553 max_cache_size =
3554 (size_t) (totalphys * max_cache_size_percent/100);
3555 if (totalphys == 0) {
3556 cfg_obj_log(obj, ns_g_lctx,
3557 ISC_LOG_WARNING,
3558 "Unable to determine amount of physical "
3559 "memory, setting 'max-cache-size' to "
3560 "unlimited");
3561 } else {
3562 cfg_obj_log(obj, ns_g_lctx,
3563 ISC_LOG_INFO,
3564 "'max-cache-size %d%%' "
3565 "- setting to %" PRIu64 "MB "
3566 "(out of %" PRIu64 "MB)",
3567 max_cache_size_percent,
3568 (uint64_t)(max_cache_size / (1024*1024)),
3569 totalphys / (1024*1024));
3570 }
3571 }
3572
3573 /* Check-names. */
3574 obj = NULL;
3575 result = ns_checknames_get(maps, "response", &obj);
3576 INSIST(result == ISC_R_SUCCESS);
3577
3578 str = cfg_obj_asstring(obj);
3579 if (strcasecmp(str, "fail") == 0) {
3580 resopts |= DNS_RESOLVER_CHECKNAMES |
3581 DNS_RESOLVER_CHECKNAMESFAIL;
3582 view->checknames = true;
3583 } else if (strcasecmp(str, "warn") == 0) {
3584 resopts |= DNS_RESOLVER_CHECKNAMES;
3585 view->checknames = false;
3586 } else if (strcasecmp(str, "ignore") == 0) {
3587 view->checknames = false;
3588 } else {
3589 INSIST(0);
3590 ISC_UNREACHABLE();
3591 }
3592
3593 obj = NULL;
3594 result = ns_config_get(maps, "zero-no-soa-ttl-cache", &obj);
3595 INSIST(result == ISC_R_SUCCESS);
3596 zero_no_soattl = cfg_obj_asboolean(obj);
3597
3598 obj = NULL;
3599 result = ns_config_get(maps, "dns64", &obj);
3600 if (result == ISC_R_SUCCESS && strcmp(view->name, "_bind") &&
3601 strcmp(view->name, "_meta")) {
3602 isc_netaddr_t na, suffix, *sp;
3603 unsigned int prefixlen;
3604 const char *server, *contact;
3605 const cfg_obj_t *myobj;
3606
3607 myobj = NULL;
3608 result = ns_config_get(maps, "dns64-server", &myobj);
3609 if (result == ISC_R_SUCCESS)
3610 server = cfg_obj_asstring(myobj);
3611 else
3612 server = NULL;
3613
3614 myobj = NULL;
3615 result = ns_config_get(maps, "dns64-contact", &myobj);
3616 if (result == ISC_R_SUCCESS)
3617 contact = cfg_obj_asstring(myobj);
3618 else
3619 contact = NULL;
3620
3621 for (element = cfg_list_first(obj);
3622 element != NULL;
3623 element = cfg_list_next(element))
3624 {
3625 const cfg_obj_t *map = cfg_listelt_value(element);
3626 dns_dns64_t *dns64 = NULL;
3627 unsigned int dns64options = 0;
3628
3629 cfg_obj_asnetprefix(cfg_map_getname(map), &na,
3630 &prefixlen);
3631
3632 obj = NULL;
3633 (void)cfg_map_get(map, "suffix", &obj);
3634 if (obj != NULL) {
3635 sp = &suffix;
3636 isc_netaddr_fromsockaddr(sp,
3637 cfg_obj_assockaddr(obj));
3638 } else
3639 sp = NULL;
3640
3641 clients = mapped = excluded = NULL;
3642 obj = NULL;
3643 (void)cfg_map_get(map, "clients", &obj);
3644 if (obj != NULL) {
3645 result = cfg_acl_fromconfig(obj, config,
3646 ns_g_lctx, actx,
3647 mctx, 0, &clients);
3648 if (result != ISC_R_SUCCESS)
3649 goto cleanup;
3650 }
3651 obj = NULL;
3652 (void)cfg_map_get(map, "mapped", &obj);
3653 if (obj != NULL) {
3654 result = cfg_acl_fromconfig(obj, config,
3655 ns_g_lctx, actx,
3656 mctx, 0, &mapped);
3657 if (result != ISC_R_SUCCESS)
3658 goto cleanup;
3659 }
3660 obj = NULL;
3661 (void)cfg_map_get(map, "exclude", &obj);
3662 if (obj != NULL) {
3663 result = cfg_acl_fromconfig(obj, config,
3664 ns_g_lctx, actx,
3665 mctx, 0, &excluded);
3666 if (result != ISC_R_SUCCESS)
3667 goto cleanup;
3668 } else {
3669 if (ns_g_mapped == NULL) {
3670 result = create_mapped_acl();
3671 if (result != ISC_R_SUCCESS)
3672 goto cleanup;
3673 }
3674 dns_acl_attach(ns_g_mapped, &excluded);
3675 }
3676
3677 obj = NULL;
3678 (void)cfg_map_get(map, "recursive-only", &obj);
3679 if (obj != NULL && cfg_obj_asboolean(obj))
3680 dns64options |= DNS_DNS64_RECURSIVE_ONLY;
3681
3682 obj = NULL;
3683 (void)cfg_map_get(map, "break-dnssec", &obj);
3684 if (obj != NULL && cfg_obj_asboolean(obj))
3685 dns64options |= DNS_DNS64_BREAK_DNSSEC;
3686
3687 result = dns_dns64_create(mctx, &na, prefixlen, sp,
3688 clients, mapped, excluded,
3689 dns64options, &dns64);
3690 if (result != ISC_R_SUCCESS)
3691 goto cleanup;
3692 dns_dns64_append(&view->dns64, dns64);
3693 view->dns64cnt++;
3694 result = dns64_reverse(view, mctx, &na, prefixlen,
3695 server, contact);
3696 if (result != ISC_R_SUCCESS)
3697 goto cleanup;
3698 if (clients != NULL)
3699 dns_acl_detach(&clients);
3700 if (mapped != NULL)
3701 dns_acl_detach(&mapped);
3702 if (excluded != NULL)
3703 dns_acl_detach(&excluded);
3704 }
3705 }
3706
3707 obj = NULL;
3708 result = ns_config_get(maps, "dnssec-accept-expired", &obj);
3709 INSIST(result == ISC_R_SUCCESS);
3710 view->acceptexpired = cfg_obj_asboolean(obj);
3711
3712 obj = NULL;
3713 result = ns_config_get(maps, "dnssec-validation", &obj);
3714 INSIST(result == ISC_R_SUCCESS);
3715 if (cfg_obj_isboolean(obj)) {
3716 view->enablevalidation = cfg_obj_asboolean(obj);
3717 } else {
3718 /* If dnssec-validation is not boolean, it must be "auto" */
3719 view->enablevalidation = true;
3720 auto_root = true;
3721 }
3722
3723 obj = NULL;
3724 result = ns_config_get(maps, "max-cache-ttl", &obj);
3725 INSIST(result == ISC_R_SUCCESS);
3726 view->maxcachettl = cfg_obj_asuint32(obj);
3727
3728 obj = NULL;
3729 result = ns_config_get(maps, "max-ncache-ttl", &obj);
3730 INSIST(result == ISC_R_SUCCESS);
3731 view->maxncachettl = cfg_obj_asuint32(obj);
3732 if (view->maxncachettl > 7 * 24 * 3600)
3733 view->maxncachettl = 7 * 24 * 3600;
3734
3735 /*
3736 * Configure the view's cache.
3737 *
3738 * First, check to see if there are any attach-cache options. If yes,
3739 * attempt to lookup an existing cache at attach it to the view. If
3740 * there is not one, then try to reuse an existing cache if possible;
3741 * otherwise create a new cache.
3742 *
3743 * Note that the ADB is not preserved or shared in either case.
3744 *
3745 * When a matching view is found, the associated statistics are also
3746 * retrieved and reused.
3747 *
3748 * XXX Determining when it is safe to reuse or share a cache is tricky.
3749 * When the view's configuration changes, the cached data may become
3750 * invalid because it reflects our old view of the world. We check
3751 * some of the configuration parameters that could invalidate the cache
3752 * or otherwise make it unshareable, but there are other configuration
3753 * options that should be checked. For example, if a view uses a
3754 * forwarder, changes in the forwarder configuration may invalidate
3755 * the cache. At the moment, it's the administrator's responsibility to
3756 * ensure these configuration options don't invalidate reusing/sharing.
3757 */
3758 obj = NULL;
3759 result = ns_config_get(maps, "attach-cache", &obj);
3760 if (result == ISC_R_SUCCESS)
3761 cachename = cfg_obj_asstring(obj);
3762 else
3763 cachename = view->name;
3764 cache = NULL;
3765 nsc = cachelist_find(cachelist, cachename, view->rdclass);
3766 if (nsc != NULL) {
3767 if (!cache_sharable(nsc->primaryview, view, zero_no_soattl,
3768 cleaning_interval, max_cache_size)) {
3769 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
3770 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
3771 "views %s and %s can't share the cache "
3772 "due to configuration parameter mismatch",
3773 nsc->primaryview->name, view->name);
3774 result = ISC_R_FAILURE;
3775 goto cleanup;
3776 }
3777 dns_cache_attach(nsc->cache, &cache);
3778 shared_cache = true;
3779 } else {
3780 if (strcmp(cachename, view->name) == 0) {
3781 result = dns_viewlist_find(&ns_g_server->viewlist,
3782 cachename, view->rdclass,
3783 &pview);
3784 if (result != ISC_R_NOTFOUND && result != ISC_R_SUCCESS)
3785 goto cleanup;
3786 if (pview != NULL) {
3787 if (!cache_reusable(pview, view,
3788 zero_no_soattl)) {
3789 isc_log_write(ns_g_lctx,
3790 NS_LOGCATEGORY_GENERAL,
3791 NS_LOGMODULE_SERVER,
3792 ISC_LOG_DEBUG(1),
3793 "cache cannot be reused "
3794 "for view %s due to "
3795 "configuration parameter "
3796 "mismatch", view->name);
3797 } else {
3798 INSIST(pview->cache != NULL);
3799 isc_log_write(ns_g_lctx,
3800 NS_LOGCATEGORY_GENERAL,
3801 NS_LOGMODULE_SERVER,
3802 ISC_LOG_DEBUG(3),
3803 "reusing existing cache");
3804 reused_cache = true;
3805 dns_cache_attach(pview->cache, &cache);
3806 }
3807 dns_view_getresstats(pview, &resstats);
3808 dns_view_getresquerystats(pview,
3809 &resquerystats);
3810 dns_view_detach(&pview);
3811 }
3812 }
3813 if (cache == NULL) {
3814 /*
3815 * Create a cache with the desired name. This normally
3816 * equals the view name, but may also be a forward
3817 * reference to a view that share the cache with this
3818 * view but is not yet configured. If it is not the
3819 * view name but not a forward reference either, then it
3820 * is simply a named cache that is not shared.
3821 *
3822 * We use two separate memory contexts for the
3823 * cache, for the main cache memory and the heap
3824 * memory.
3825 */
3826 CHECK(isc_mem_create(0, 0, &cmctx));
3827 isc_mem_setname(cmctx, "cache", NULL);
3828 CHECK(isc_mem_create(0, 0, &hmctx));
3829 isc_mem_setname(hmctx, "cache_heap", NULL);
3830 CHECK(dns_cache_create3(cmctx, hmctx, ns_g_taskmgr,
3831 ns_g_timermgr, view->rdclass,
3832 cachename, "rbt", 0, NULL,
3833 &cache));
3834 isc_mem_detach(&cmctx);
3835 isc_mem_detach(&hmctx);
3836 }
3837 nsc = isc_mem_get(mctx, sizeof(*nsc));
3838 if (nsc == NULL) {
3839 result = ISC_R_NOMEMORY;
3840 goto cleanup;
3841 }
3842 nsc->cache = NULL;
3843 dns_cache_attach(cache, &nsc->cache);
3844 nsc->primaryview = view;
3845 nsc->needflush = false;
3846 nsc->adbsizeadjusted = false;
3847 nsc->rdclass = view->rdclass;
3848 ISC_LINK_INIT(nsc, link);
3849 ISC_LIST_APPEND(*cachelist, nsc, link);
3850 }
3851 dns_view_setcache2(view, cache, shared_cache);
3852
3853 /*
3854 * cache-file cannot be inherited if views are present, but this
3855 * should be caught by the configuration checking stage.
3856 */
3857 obj = NULL;
3858 result = ns_config_get(maps, "cache-file", &obj);
3859 if (result == ISC_R_SUCCESS && strcmp(view->name, "_bind") != 0) {
3860 CHECK(dns_cache_setfilename(cache, cfg_obj_asstring(obj)));
3861 if (!reused_cache && !shared_cache)
3862 CHECK(dns_cache_load(cache));
3863 }
3864
3865 dns_cache_setcleaninginterval(cache, cleaning_interval);
3866 dns_cache_setcachesize(cache, max_cache_size);
3867
3868 dns_cache_detach(&cache);
3869
3870 /*
3871 * Resolver.
3872 *
3873 * XXXRTH Hardwired number of tasks.
3874 */
3875 CHECK(get_view_querysource_dispatch(maps, AF_INET, &dispatch4, &dscp4,
3876 (ISC_LIST_PREV(view, link)
3877 == NULL)));
3878 CHECK(get_view_querysource_dispatch(maps, AF_INET6, &dispatch6, &dscp6,
3879 (ISC_LIST_PREV(view, link)
3880 == NULL)));
3881 if (dispatch4 == NULL && dispatch6 == NULL) {
3882 UNEXPECTED_ERROR(__FILE__, __LINE__,
3883 "unable to obtain neither an IPv4 nor"
3884 " an IPv6 dispatch");
3885 result = ISC_R_UNEXPECTED;
3886 goto cleanup;
3887 }
3888
3889 if (resstats == NULL) {
3890 CHECK(isc_stats_create(mctx, &resstats,
3891 dns_resstatscounter_max));
3892 }
3893 dns_view_setresstats(view, resstats);
3894 if (resquerystats == NULL)
3895 CHECK(dns_rdatatypestats_create(mctx, &resquerystats));
3896 dns_view_setresquerystats(view, resquerystats);
3897
3898 ndisp = 4 * ISC_MIN(ns_g_udpdisp, MAX_UDP_DISPATCH);
3899 CHECK(dns_view_createresolver(view, ns_g_taskmgr, RESOLVER_NTASKS,
3900 ndisp, ns_g_socketmgr, ns_g_timermgr,
3901 resopts, ns_g_dispatchmgr,
3902 dispatch4, dispatch6));
3903
3904 if (dscp4 == -1)
3905 dscp4 = ns_g_dscp;
3906 if (dscp6 == -1)
3907 dscp6 = ns_g_dscp;
3908 if (dscp4 != -1)
3909 dns_resolver_setquerydscp4(view->resolver, dscp4);
3910 if (dscp6 != -1)
3911 dns_resolver_setquerydscp6(view->resolver, dscp6);
3912
3913 /*
3914 * Set the ADB cache size to 1/8th of the max-cache-size or
3915 * MAX_ADB_SIZE_FOR_CACHESHARE when the cache is shared.
3916 */
3917 max_adb_size = 0;
3918 if (max_cache_size != 0U) {
3919 max_adb_size = max_cache_size / 8;
3920 if (max_adb_size == 0U)
3921 max_adb_size = 1; /* Force minimum. */
3922 if (view != nsc->primaryview &&
3923 max_adb_size > MAX_ADB_SIZE_FOR_CACHESHARE) {
3924 max_adb_size = MAX_ADB_SIZE_FOR_CACHESHARE;
3925 if (!nsc->adbsizeadjusted) {
3926 dns_adb_setadbsize(nsc->primaryview->adb,
3927 MAX_ADB_SIZE_FOR_CACHESHARE);
3928 nsc->adbsizeadjusted = true;
3929 }
3930 }
3931 }
3932 dns_adb_setadbsize(view->adb, max_adb_size);
3933
3934 /*
3935 * Set up ADB quotas
3936 */
3937 {
3938 uint32_t fps, freq;
3939 double low, high, discount;
3940
3941 obj = NULL;
3942 result = ns_config_get(maps, "fetches-per-server", &obj);
3943 INSIST(result == ISC_R_SUCCESS);
3944 obj2 = cfg_tuple_get(obj, "fetches");
3945 fps = cfg_obj_asuint32(obj2);
3946 obj2 = cfg_tuple_get(obj, "response");
3947 if (!cfg_obj_isvoid(obj2)) {
3948 const char *resp = cfg_obj_asstring(obj2);
3949 isc_result_t r = DNS_R_SERVFAIL;
3950
3951 if (strcasecmp(resp, "drop") == 0) {
3952 r = DNS_R_DROP;
3953 } else if (strcasecmp(resp, "fail") == 0) {
3954 r = DNS_R_SERVFAIL;
3955 } else {
3956 INSIST(0);
3957 ISC_UNREACHABLE();
3958 }
3959
3960 dns_resolver_setquotaresponse(view->resolver,
3961 dns_quotatype_server, r);
3962 }
3963
3964 obj = NULL;
3965 result = ns_config_get(maps, "fetch-quota-params", &obj);
3966 INSIST(result == ISC_R_SUCCESS);
3967
3968 obj2 = cfg_tuple_get(obj, "frequency");
3969 freq = cfg_obj_asuint32(obj2);
3970
3971 obj2 = cfg_tuple_get(obj, "low");
3972 low = (double) cfg_obj_asfixedpoint(obj2) / 100.0;
3973
3974 obj2 = cfg_tuple_get(obj, "high");
3975 high = (double) cfg_obj_asfixedpoint(obj2) / 100.0;
3976
3977 obj2 = cfg_tuple_get(obj, "discount");
3978 discount = (double) cfg_obj_asfixedpoint(obj2) / 100.0;
3979
3980 dns_adb_setquota(view->adb, fps, freq, low, high, discount);
3981 }
3982
3983 /*
3984 * Set resolver's lame-ttl.
3985 */
3986 obj = NULL;
3987 result = ns_config_get(maps, "lame-ttl", &obj);
3988 INSIST(result == ISC_R_SUCCESS);
3989 lame_ttl = cfg_obj_asuint32(obj);
3990 if (lame_ttl > 0) {
3991 cfg_obj_log(obj, ns_g_lctx, ISC_LOG_WARNING,
3992 "disabling lame cache despite lame-ttl > 0 as it "
3993 "may cause performance issues");
3994 lame_ttl = 0;
3995 }
3996 dns_resolver_setlamettl(view->resolver, lame_ttl);
3997
3998 /*
3999 * Set the resolver's query timeout.
4000 */
4001 obj = NULL;
4002 result = ns_config_get(maps, "resolver-query-timeout", &obj);
4003 INSIST(result == ISC_R_SUCCESS);
4004 query_timeout = cfg_obj_asuint32(obj);
4005 dns_resolver_settimeout(view->resolver, query_timeout);
4006
4007 /* Specify whether to use 0-TTL for negative response for SOA query */
4008 dns_resolver_setzeronosoattl(view->resolver, zero_no_soattl);
4009
4010 /*
4011 * Set the resolver's EDNS UDP size.
4012 */
4013 obj = NULL;
4014 result = ns_config_get(maps, "edns-udp-size", &obj);
4015 INSIST(result == ISC_R_SUCCESS);
4016 udpsize = cfg_obj_asuint32(obj);
4017 if (udpsize < 512)
4018 udpsize = 512;
4019 if (udpsize > 4096)
4020 udpsize = 4096;
4021 dns_resolver_setudpsize(view->resolver, (uint16_t)udpsize);
4022
4023 /*
4024 * Set the maximum UDP response size.
4025 */
4026 obj = NULL;
4027 result = ns_config_get(maps, "max-udp-size", &obj);
4028 INSIST(result == ISC_R_SUCCESS);
4029 udpsize = cfg_obj_asuint32(obj);
4030 if (udpsize < 512)
4031 udpsize = 512;
4032 if (udpsize > 4096)
4033 udpsize = 4096;
4034 view->maxudp = udpsize;
4035
4036 /*
4037 * Set the maximum UDP when a COOKIE is not provided.
4038 */
4039 obj = NULL;
4040 result = ns_config_get(maps, "nocookie-udp-size", &obj);
4041 INSIST(result == ISC_R_SUCCESS);
4042 udpsize = cfg_obj_asuint32(obj);
4043 if (udpsize < 128)
4044 udpsize = 128;
4045 if (udpsize > view->maxudp)
4046 udpsize = view->maxudp;
4047 view->nocookieudp = udpsize;
4048
4049 /*
4050 * Set the maximum rsa exponent bits.
4051 */
4052 obj = NULL;
4053 result = ns_config_get(maps, "max-rsa-exponent-size", &obj);
4054 INSIST(result == ISC_R_SUCCESS);
4055 maxbits = cfg_obj_asuint32(obj);
4056 if (maxbits != 0 && maxbits < 35)
4057 maxbits = 35;
4058 if (maxbits > 4096)
4059 maxbits = 4096;
4060 view->maxbits = maxbits;
4061
4062 /*
4063 * Set supported DNSSEC algorithms.
4064 */
4065 dns_resolver_reset_algorithms(view->resolver);
4066 disabled = NULL;
4067 (void)ns_config_get(maps, "disable-algorithms", &disabled);
4068 if (disabled != NULL) {
4069 for (element = cfg_list_first(disabled);
4070 element != NULL;
4071 element = cfg_list_next(element))
4072 CHECK(disable_algorithms(cfg_listelt_value(element),
4073 view->resolver));
4074 }
4075
4076 /*
4077 * Set supported DS/DLV digest types.
4078 */
4079 dns_resolver_reset_ds_digests(view->resolver);
4080 disabled = NULL;
4081 (void)ns_config_get(maps, "disable-ds-digests", &disabled);
4082 if (disabled != NULL) {
4083 for (element = cfg_list_first(disabled);
4084 element != NULL;
4085 element = cfg_list_next(element))
4086 CHECK(disable_ds_digests(cfg_listelt_value(element),
4087 view->resolver));
4088 }
4089
4090 /*
4091 * A global or view "forwarders" option, if present,
4092 * creates an entry for "." in the forwarding table.
4093 */
4094 forwardtype = NULL;
4095 forwarders = NULL;
4096 (void)ns_config_get(maps, "forward", &forwardtype);
4097 (void)ns_config_get(maps, "forwarders", &forwarders);
4098 if (forwarders != NULL)
4099 CHECK(configure_forward(config, view, dns_rootname,
4100 forwarders, forwardtype));
4101
4102 /*
4103 * Dual Stack Servers.
4104 */
4105 alternates = NULL;
4106 (void)ns_config_get(maps, "dual-stack-servers", &alternates);
4107 if (alternates != NULL)
4108 CHECK(configure_alternates(config, view, alternates));
4109
4110 /*
4111 * We have default hints for class IN if we need them.
4112 */
4113 if (view->rdclass == dns_rdataclass_in && view->hints == NULL)
4114 dns_view_sethints(view, ns_g_server->in_roothints);
4115
4116 /*
4117 * If we still have no hints, this is a non-IN view with no
4118 * "hints zone" configured. Issue a warning, except if this
4119 * is a root server. Root servers never need to consult
4120 * their hints, so it's no point requiring users to configure
4121 * them.
4122 */
4123 if (view->hints == NULL) {
4124 dns_zone_t *rootzone = NULL;
4125 (void)dns_view_findzone(view, dns_rootname, &rootzone);
4126 if (rootzone != NULL) {
4127 dns_zone_detach(&rootzone);
4128 need_hints = false;
4129 }
4130 if (need_hints)
4131 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
4132 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
4133 "no root hints for view '%s'",
4134 view->name);
4135 }
4136
4137 /*
4138 * Configure the view's TSIG keys.
4139 */
4140 CHECK(ns_tsigkeyring_fromconfig(config, vconfig, view->mctx, &ring));
4141 if (ns_g_server->sessionkey != NULL) {
4142 CHECK(dns_tsigkeyring_add(ring, ns_g_server->session_keyname,
4143 ns_g_server->sessionkey));
4144 }
4145 dns_view_setkeyring(view, ring);
4146 dns_tsigkeyring_detach(&ring);
4147
4148 /*
4149 * See if we can re-use a dynamic key ring.
4150 */
4151 result = dns_viewlist_find(&ns_g_server->viewlist, view->name,
4152 view->rdclass, &pview);
4153 if (result != ISC_R_NOTFOUND && result != ISC_R_SUCCESS)
4154 goto cleanup;
4155 if (pview != NULL) {
4156 dns_view_getdynamickeyring(pview, &ring);
4157 if (ring != NULL)
4158 dns_view_setdynamickeyring(view, ring);
4159 dns_tsigkeyring_detach(&ring);
4160 dns_view_detach(&pview);
4161 } else
4162 dns_view_restorekeyring(view);
4163
4164 /*
4165 * Configure the view's peer list.
4166 */
4167 {
4168 const cfg_obj_t *peers = NULL;
4169 dns_peerlist_t *newpeers = NULL;
4170
4171 (void)ns_config_get(cfgmaps, "server", &peers);
4172 CHECK(dns_peerlist_new(mctx, &newpeers));
4173 for (element = cfg_list_first(peers);
4174 element != NULL;
4175 element = cfg_list_next(element))
4176 {
4177 const cfg_obj_t *cpeer = cfg_listelt_value(element);
4178 dns_peer_t *peer;
4179
4180 CHECK(configure_peer(cpeer, mctx, &peer));
4181 dns_peerlist_addpeer(newpeers, peer);
4182 dns_peer_detach(&peer);
4183 }
4184 dns_peerlist_detach(&view->peers);
4185 view->peers = newpeers; /* Transfer ownership. */
4186 }
4187
4188 /*
4189 * Configure the views rrset-order.
4190 */
4191 {
4192 const cfg_obj_t *rrsetorder = NULL;
4193
4194 (void)ns_config_get(maps, "rrset-order", &rrsetorder);
4195 CHECK(dns_order_create(mctx, &order));
4196 for (element = cfg_list_first(rrsetorder);
4197 element != NULL;
4198 element = cfg_list_next(element))
4199 {
4200 const cfg_obj_t *ent = cfg_listelt_value(element);
4201
4202 CHECK(configure_order(order, ent));
4203 }
4204 if (view->order != NULL)
4205 dns_order_detach(&view->order);
4206 dns_order_attach(order, &view->order);
4207 dns_order_detach(&order);
4208 }
4209 /*
4210 * Copy the aclenv object.
4211 */
4212 dns_aclenv_copy(&view->aclenv, &ns_g_server->aclenv);
4213
4214 /*
4215 * Configure the "match-clients" and "match-destinations" ACL.
4216 * (These are only meaningful at the view level, but 'config'
4217 * must be passed so that named ACLs defined at the global level
4218 * can be retrieved.)
4219 */
4220 CHECK(configure_view_acl(vconfig, config, NULL, "match-clients",
4221 NULL, actx, ns_g_mctx,
4222 &view->matchclients));
4223 CHECK(configure_view_acl(vconfig, config, NULL, "match-destinations",
4224 NULL, actx, ns_g_mctx,
4225 &view->matchdestinations));
4226
4227 /*
4228 * Configure the "match-recursive-only" option.
4229 */
4230 obj = NULL;
4231 (void)ns_config_get(maps, "match-recursive-only", &obj);
4232 if (obj != NULL && cfg_obj_asboolean(obj))
4233 view->matchrecursiveonly = true;
4234 else
4235 view->matchrecursiveonly = false;
4236
4237 /*
4238 * Configure other configurable data.
4239 */
4240 obj = NULL;
4241 result = ns_config_get(maps, "recursion", &obj);
4242 INSIST(result == ISC_R_SUCCESS);
4243 view->recursion = cfg_obj_asboolean(obj);
4244
4245 obj = NULL;
4246 result = ns_config_get(maps, "auth-nxdomain", &obj);
4247 INSIST(result == ISC_R_SUCCESS);
4248 view->auth_nxdomain = cfg_obj_asboolean(obj);
4249
4250 obj = NULL;
4251 result = ns_config_get(maps, "minimal-any", &obj);
4252 INSIST(result == ISC_R_SUCCESS);
4253 view->minimal_any = cfg_obj_asboolean(obj);
4254
4255 obj = NULL;
4256 result = ns_config_get(maps, "minimal-responses", &obj);
4257 INSIST(result == ISC_R_SUCCESS);
4258 if (cfg_obj_isboolean(obj)) {
4259 if (cfg_obj_asboolean(obj))
4260 view->minimalresponses = dns_minimal_yes;
4261 else
4262 view->minimalresponses = dns_minimal_no;
4263 } else {
4264 str = cfg_obj_asstring(obj);
4265 if (strcasecmp(str, "no-auth") == 0) {
4266 view->minimalresponses = dns_minimal_noauth;
4267 } else if (strcasecmp(str, "no-auth-recursive") == 0) {
4268 view->minimalresponses = dns_minimal_noauthrec;
4269 } else {
4270 INSIST(0);
4271 ISC_UNREACHABLE();
4272 }
4273 }
4274
4275 obj = NULL;
4276 result = ns_config_get(maps, "transfer-format", &obj);
4277 INSIST(result == ISC_R_SUCCESS);
4278 str = cfg_obj_asstring(obj);
4279 if (strcasecmp(str, "many-answers") == 0) {
4280 view->transfer_format = dns_many_answers;
4281 } else if (strcasecmp(str, "one-answer") == 0) {
4282 view->transfer_format = dns_one_answer;
4283 } else {
4284 INSIST(0);
4285 ISC_UNREACHABLE();
4286 }
4287
4288 obj = NULL;
4289 result = ns_config_get(maps, "trust-anchor-telemetry", &obj);
4290 INSIST(result == ISC_R_SUCCESS);
4291 view->trust_anchor_telemetry = cfg_obj_asboolean(obj);
4292
4293 obj = NULL;
4294 result = ns_config_get(maps, "root-key-sentinel", &obj);
4295 INSIST(result == ISC_R_SUCCESS);
4296 view->root_key_sentinel = cfg_obj_asboolean(obj);
4297
4298 /*
4299 * Set sources where additional data and CNAME/DNAME
4300 * targets for authoritative answers may be found.
4301 */
4302 obj = NULL;
4303 result = ns_config_get(maps, "additional-from-auth", &obj);
4304 INSIST(result == ISC_R_SUCCESS);
4305 view->additionalfromauth = cfg_obj_asboolean(obj);
4306 if (view->recursion && ! view->additionalfromauth) {
4307 cfg_obj_log(obj, ns_g_lctx, ISC_LOG_WARNING,
4308 "'additional-from-auth no' is only supported "
4309 "with 'recursion no'");
4310 view->additionalfromauth = true;
4311 }
4312
4313 obj = NULL;
4314 result = ns_config_get(maps, "additional-from-cache", &obj);
4315 INSIST(result == ISC_R_SUCCESS);
4316 view->additionalfromcache = cfg_obj_asboolean(obj);
4317 if (view->recursion && ! view->additionalfromcache) {
4318 cfg_obj_log(obj, ns_g_lctx, ISC_LOG_WARNING,
4319 "'additional-from-cache no' is only supported "
4320 "with 'recursion no'");
4321 view->additionalfromcache = true;
4322 }
4323
4324 CHECK(configure_view_acl(vconfig, config, ns_g_config,
4325 "allow-query-cache-on", NULL, actx,
4326 ns_g_mctx, &view->cacheonacl));
4327
4328 /*
4329 * Set the "allow-query", "allow-query-cache", "allow-recursion",
4330 * and "allow-recursion-on" ACLs if configured in named.conf, but
4331 * NOT from the global defaults. This is done by leaving the third
4332 * argument to configure_view_acl() NULL.
4333 *
4334 * We ignore the global defaults here because these ACLs
4335 * can inherit from each other. If any are still unset after
4336 * applying the inheritance rules, we'll look up the defaults at
4337 * that time.
4338 */
4339
4340 /* named.conf only */
4341 CHECK(configure_view_acl(vconfig, config, NULL,
4342 "allow-query", NULL, actx,
4343 ns_g_mctx, &view->queryacl));
4344
4345 /* named.conf only */
4346 CHECK(configure_view_acl(vconfig, config, NULL,
4347 "allow-query-cache", NULL, actx,
4348 ns_g_mctx, &view->cacheacl));
4349
4350 if (strcmp(view->name, "_bind") != 0 &&
4351 view->rdclass != dns_rdataclass_chaos)
4352 {
4353 /* named.conf only */
4354 CHECK(configure_view_acl(vconfig, config, NULL,
4355 "allow-recursion", NULL, actx,
4356 ns_g_mctx, &view->recursionacl));
4357 /* named.conf only */
4358 CHECK(configure_view_acl(vconfig, config, NULL,
4359 "allow-recursion-on", NULL, actx,
4360 ns_g_mctx, &view->recursiononacl));
4361 }
4362
4363 if (view->recursion) {
4364 /*
4365 * "allow-query-cache" inherits from "allow-recursion" if set,
4366 * otherwise from "allow-query" if set.
4367 * "allow-recursion" inherits from "allow-query-cache" if set,
4368 * otherwise from "allow-query" if set.
4369 */
4370 if (view->cacheacl == NULL) {
4371 if (view->recursionacl != NULL) {
4372 dns_acl_attach(view->recursionacl,
4373 &view->cacheacl);
4374 } else if (view->queryacl != NULL) {
4375 dns_acl_attach(view->queryacl,
4376 &view->cacheacl);
4377 }
4378 }
4379 if (view->recursionacl == NULL) {
4380 if (view->cacheacl != NULL) {
4381 dns_acl_attach(view->cacheacl,
4382 &view->recursionacl);
4383 } else if (view->queryacl != NULL) {
4384 dns_acl_attach(view->queryacl,
4385 &view->recursionacl);
4386 }
4387 }
4388
4389 /*
4390 * If any are still unset, we now get default "allow-recursion",
4391 * "allow-recursion-on" and "allow-query-cache" ACLs from
4392 * the global config.
4393 */
4394 /* cppcheck-suppress duplicateCondition */
4395 if (view->recursionacl == NULL) {
4396 /* global default only */
4397 CHECK(configure_view_acl(NULL, NULL, ns_g_config,
4398 "allow-recursion", NULL,
4399 actx, ns_g_mctx,
4400 &view->recursionacl));
4401 }
4402 /* cppcheck-suppress duplicateCondition */
4403 if (view->recursiononacl == NULL) {
4404 /* global default only */
4405 CHECK(configure_view_acl(NULL, NULL, ns_g_config,
4406 "allow-recursion-on", NULL,
4407 actx, ns_g_mctx,
4408 &view->recursiononacl));
4409 }
4410 if (view->cacheacl == NULL) {
4411 /* global default only */
4412 CHECK(configure_view_acl(NULL, NULL, ns_g_config,
4413 "allow-query-cache", NULL,
4414 actx, ns_g_mctx,
4415 &view->cacheacl));
4416 }
4417 } else if (view->cacheacl == NULL) {
4418 /*
4419 * We're not recursive; if "allow-query-cache" hasn't been
4420 * set at the options/view level, set it to none.
4421 */
4422 CHECK(dns_acl_none(mctx, &view->cacheacl));
4423 }
4424
4425 if (view->queryacl == NULL) {
4426 /* global default only */
4427 CHECK(configure_view_acl(NULL, NULL, ns_g_config,
4428 "allow-query", NULL,
4429 actx, ns_g_mctx,
4430 &view->queryacl));
4431 }
4432
4433 /*
4434 * Ignore case when compressing responses to the specified
4435 * clients. This causes case not always to be preserved,
4436 * and is needed by some broken clients.
4437 */
4438 CHECK(configure_view_acl(vconfig, config, ns_g_config,
4439 "no-case-compress", NULL, actx,
4440 ns_g_mctx, &view->nocasecompress));
4441
4442 /*
4443 * Disable name compression completely, this is a tradeoff
4444 * between CPU and network usage.
4445 */
4446 obj = NULL;
4447 result = ns_config_get(maps, "message-compression", &obj);
4448 INSIST(result == ISC_R_SUCCESS);
4449 view->msgcompression = cfg_obj_asboolean(obj);
4450
4451 /*
4452 * Filter setting on addresses in the answer section.
4453 */
4454 CHECK(configure_view_acl(vconfig, config, ns_g_config,
4455 "deny-answer-addresses", "acl",
4456 actx, ns_g_mctx,
4457 &view->denyansweracl));
4458 CHECK(configure_view_nametable(vconfig, config, "deny-answer-addresses",
4459 "except-from", ns_g_mctx,
4460 &view->answeracl_exclude));
4461
4462 /*
4463 * Filter setting on names (CNAME/DNAME targets) in the answer section.
4464 */
4465 CHECK(configure_view_nametable(vconfig, config, "deny-answer-aliases",
4466 "name", ns_g_mctx,
4467 &view->denyanswernames));
4468 CHECK(configure_view_nametable(vconfig, config, "deny-answer-aliases",
4469 "except-from", ns_g_mctx,
4470 &view->answernames_exclude));
4471
4472 /*
4473 * Configure sortlist, if set
4474 */
4475 CHECK(configure_view_sortlist(vconfig, config, actx, ns_g_mctx,
4476 &view->sortlist));
4477
4478 /*
4479 * Configure default allow-notify, allow-update
4480 * and allow-update-forwarding ACLs, so they can be
4481 * inherited by zones. (Note these cannot be set at
4482 * options/view level.)
4483 */
4484 if (view->notifyacl == NULL) {
4485 CHECK(configure_view_acl(vconfig, config, ns_g_config,
4486 "allow-notify", NULL, actx,
4487 ns_g_mctx, &view->notifyacl));
4488 }
4489 if (view->updateacl == NULL) {
4490 CHECK(configure_view_acl(NULL, NULL, ns_g_config,
4491 "allow-update", NULL, actx,
4492 ns_g_mctx, &view->updateacl));
4493 }
4494 if (view->upfwdacl == NULL) {
4495 CHECK(configure_view_acl(NULL, NULL, ns_g_config,
4496 "allow-update-forwarding", NULL, actx,
4497 ns_g_mctx, &view->upfwdacl));
4498 }
4499
4500 /*
4501 * Configure default allow-transer ACL so it can be inherited
4502 * by zones. (Note this *can* be set at options or view level.)
4503 */
4504 if (view->transferacl == NULL) {
4505 CHECK(configure_view_acl(vconfig, config, ns_g_config,
4506 "allow-transfer", NULL, actx,
4507 ns_g_mctx, &view->transferacl));
4508 }
4509
4510 obj = NULL;
4511 result = ns_config_get(maps, "provide-ixfr", &obj);
4512 INSIST(result == ISC_R_SUCCESS);
4513 view->provideixfr = cfg_obj_asboolean(obj);
4514
4515 obj = NULL;
4516 result = ns_config_get(maps, "request-nsid", &obj);
4517 INSIST(result == ISC_R_SUCCESS);
4518 view->requestnsid = cfg_obj_asboolean(obj);
4519
4520 obj = NULL;
4521 result = ns_config_get(maps, "send-cookie", &obj);
4522 INSIST(result == ISC_R_SUCCESS);
4523 view->sendcookie = cfg_obj_asboolean(obj);
4524
4525 obj = NULL;
4526 result = ns_config_get(maps, "require-server-cookie", &obj);
4527 INSIST(result == ISC_R_SUCCESS);
4528 view->requireservercookie = cfg_obj_asboolean(obj);
4529
4530 obj = NULL;
4531 result = ns_config_get(maps, "v6-bias", &obj);
4532 INSIST(result == ISC_R_SUCCESS);
4533 view->v6bias = cfg_obj_asuint32(obj) * 1000;
4534
4535 obj = NULL;
4536 result = ns_config_get(maps, "max-clients-per-query", &obj);
4537 INSIST(result == ISC_R_SUCCESS);
4538 max_clients_per_query = cfg_obj_asuint32(obj);
4539
4540 obj = NULL;
4541 result = ns_config_get(maps, "clients-per-query", &obj);
4542 INSIST(result == ISC_R_SUCCESS);
4543 dns_resolver_setclientsperquery(view->resolver,
4544 cfg_obj_asuint32(obj),
4545 max_clients_per_query);
4546
4547 obj = NULL;
4548 result = ns_config_get(maps, "max-recursion-depth", &obj);
4549 INSIST(result == ISC_R_SUCCESS);
4550 dns_resolver_setmaxdepth(view->resolver, cfg_obj_asuint32(obj));
4551
4552 obj = NULL;
4553 result = ns_config_get(maps, "max-recursion-queries", &obj);
4554 INSIST(result == ISC_R_SUCCESS);
4555 dns_resolver_setmaxqueries(view->resolver, cfg_obj_asuint32(obj));
4556
4557 obj = NULL;
4558 result = ns_config_get(maps, "fetches-per-zone", &obj);
4559 INSIST(result == ISC_R_SUCCESS);
4560 obj2 = cfg_tuple_get(obj, "fetches");
4561 dns_resolver_setfetchesperzone(view->resolver, cfg_obj_asuint32(obj2));
4562 obj2 = cfg_tuple_get(obj, "response");
4563 if (!cfg_obj_isvoid(obj2)) {
4564 const char *resp = cfg_obj_asstring(obj2);
4565 isc_result_t r = DNS_R_SERVFAIL;
4566
4567 if (strcasecmp(resp, "drop") == 0) {
4568 r = DNS_R_DROP;
4569 } else if (strcasecmp(resp, "fail") == 0) {
4570 r = DNS_R_SERVFAIL;
4571 } else {
4572 INSIST(0);
4573 ISC_UNREACHABLE();
4574 }
4575
4576 dns_resolver_setquotaresponse(view->resolver,
4577 dns_quotatype_zone, r);
4578 }
4579
4580 #ifdef ALLOW_FILTER_AAAA
4581 obj = NULL;
4582 result = ns_config_get(maps, "filter-aaaa-on-v4", &obj);
4583 INSIST(result == ISC_R_SUCCESS);
4584 if (cfg_obj_isboolean(obj)) {
4585 if (cfg_obj_asboolean(obj))
4586 view->v4_aaaa = dns_aaaa_filter;
4587 else
4588 view->v4_aaaa = dns_aaaa_ok;
4589 } else {
4590 const char *v4_aaaastr = cfg_obj_asstring(obj);
4591 if (strcasecmp(v4_aaaastr, "break-dnssec") == 0) {
4592 view->v4_aaaa = dns_aaaa_break_dnssec;
4593 } else {
4594 INSIST(0);
4595 ISC_UNREACHABLE();
4596 }
4597 }
4598
4599 obj = NULL;
4600 result = ns_config_get(maps, "filter-aaaa-on-v6", &obj);
4601 INSIST(result == ISC_R_SUCCESS);
4602 if (cfg_obj_isboolean(obj)) {
4603 if (cfg_obj_asboolean(obj))
4604 view->v6_aaaa = dns_aaaa_filter;
4605 else
4606 view->v6_aaaa = dns_aaaa_ok;
4607 } else {
4608 const char *v6_aaaastr = cfg_obj_asstring(obj);
4609 if (strcasecmp(v6_aaaastr, "break-dnssec") == 0) {
4610 view->v6_aaaa = dns_aaaa_break_dnssec;
4611 } else {
4612 INSIST(0);
4613 ISC_UNREACHABLE();
4614 }
4615 }
4616
4617 CHECK(configure_view_acl(vconfig, config, ns_g_config,
4618 "filter-aaaa", NULL, actx,
4619 ns_g_mctx, &view->aaaa_acl));
4620 #endif
4621 obj = NULL;
4622 result = ns_config_get(maps, "prefetch", &obj);
4623 if (result == ISC_R_SUCCESS) {
4624 const cfg_obj_t *trigger, *eligible;
4625
4626 trigger = cfg_tuple_get(obj, "trigger");
4627 view->prefetch_trigger = cfg_obj_asuint32(trigger);
4628 if (view->prefetch_trigger > 10)
4629 view->prefetch_trigger = 10;
4630 eligible = cfg_tuple_get(obj, "eligible");
4631 if (cfg_obj_isvoid(eligible)) {
4632 int m;
4633 for (m = 1; maps[m] != NULL; m++) {
4634 obj = NULL;
4635 result = ns_config_get(&maps[m],
4636 "prefetch", &obj);
4637 INSIST(result == ISC_R_SUCCESS);
4638 eligible = cfg_tuple_get(obj, "eligible");
4639 if (cfg_obj_isuint32(eligible))
4640 break;
4641 }
4642 INSIST(cfg_obj_isuint32(eligible));
4643 }
4644 view->prefetch_eligible = cfg_obj_asuint32(eligible);
4645 if (view->prefetch_eligible < view->prefetch_trigger + 6)
4646 view->prefetch_eligible = view->prefetch_trigger + 6;
4647 }
4648
4649 obj = NULL;
4650 result = ns_config_get(maps, "dnssec-enable", &obj);
4651 INSIST(result == ISC_R_SUCCESS);
4652 view->enablednssec = cfg_obj_asboolean(obj);
4653
4654 obj = NULL;
4655 result = ns_config_get(optionmaps, "dnssec-lookaside", &obj);
4656 if (result == ISC_R_SUCCESS) {
4657 /* "auto" is deprecated, log a warning if seen */
4658 const char *dom;
4659 dlvobj = cfg_listelt_value(cfg_list_first(obj));
4660 dom = cfg_obj_asstring(cfg_tuple_get(dlvobj, "domain"));
4661 if (cfg_obj_isvoid(cfg_tuple_get(dlvobj, "trust-anchor"))) {
4662 /* If "no", skip; if "auto", log warning */
4663 if (!strcasecmp(dom, "no")) {
4664 result = ISC_R_NOTFOUND;
4665 } else if (!strcasecmp(dom, "auto")) {
4666 /*
4667 * Warning logged by libbind9.
4668 */
4669 result = ISC_R_NOTFOUND;
4670 }
4671 }
4672 }
4673
4674 if (result == ISC_R_SUCCESS) {
4675 dns_name_t *dlv, *iscdlv;
4676 dns_fixedname_t f;
4677
4678 /* Also log a warning if manually configured to dlv.isc.org */
4679 iscdlv = dns_fixedname_initname(&f);
4680 CHECK(dns_name_fromstring(iscdlv, "dlv.isc.org", 0, NULL));
4681
4682 for (element = cfg_list_first(obj);
4683 element != NULL;
4684 element = cfg_list_next(element))
4685 {
4686 obj = cfg_listelt_value(element);
4687 obj = cfg_tuple_get(obj, "trust-anchor");
4688
4689 dlv = dns_fixedname_name(&view->dlv_fixed);
4690 CHECK(dns_name_fromstring(dlv, cfg_obj_asstring(obj),
4691 DNS_NAME_DOWNCASE, NULL));
4692 if (dns_name_equal(dlv, iscdlv)) {
4693 /*
4694 * Warning logged by libbind9.
4695 */
4696 view->dlv = NULL;
4697 } else {
4698 view->dlv = dlv;
4699 }
4700 }
4701 } else {
4702 view->dlv = NULL;
4703 }
4704
4705 /*
4706 * For now, there is only one kind of trusted keys, the
4707 * "security roots".
4708 */
4709 CHECK(configure_view_dnsseckeys(view, vconfig, config, bindkeys,
4710 auto_root, mctx));
4711 dns_resolver_resetmustbesecure(view->resolver);
4712 obj = NULL;
4713 result = ns_config_get(maps, "dnssec-must-be-secure", &obj);
4714 if (result == ISC_R_SUCCESS)
4715 CHECK(mustbesecure(obj, view->resolver));
4716
4717 obj = NULL;
4718 result = ns_config_get(maps, "nta-recheck", &obj);
4719 INSIST(result == ISC_R_SUCCESS);
4720 view->nta_recheck = cfg_obj_asuint32(obj);
4721
4722 obj = NULL;
4723 result = ns_config_get(maps, "nta-lifetime", &obj);
4724 INSIST(result == ISC_R_SUCCESS);
4725 view->nta_lifetime = cfg_obj_asuint32(obj);
4726
4727 obj = NULL;
4728 result = ns_config_get(maps, "preferred-glue", &obj);
4729 if (result == ISC_R_SUCCESS) {
4730 str = cfg_obj_asstring(obj);
4731 if (strcasecmp(str, "a") == 0)
4732 view->preferred_glue = dns_rdatatype_a;
4733 else if (strcasecmp(str, "aaaa") == 0)
4734 view->preferred_glue = dns_rdatatype_aaaa;
4735 else
4736 view->preferred_glue = 0;
4737 } else
4738 view->preferred_glue = 0;
4739
4740 obj = NULL;
4741 result = ns_config_get(maps, "root-delegation-only", &obj);
4742 if (result == ISC_R_SUCCESS)
4743 dns_view_setrootdelonly(view, true);
4744 if (result == ISC_R_SUCCESS && ! cfg_obj_isvoid(obj)) {
4745 const cfg_obj_t *exclude;
4746 dns_fixedname_t fixed;
4747 dns_name_t *name;
4748
4749 name = dns_fixedname_initname(&fixed);
4750 for (element = cfg_list_first(obj);
4751 element != NULL;
4752 element = cfg_list_next(element))
4753 {
4754 exclude = cfg_listelt_value(element);
4755 CHECK(dns_name_fromstring(name,
4756 cfg_obj_asstring(exclude),
4757 0, NULL));
4758 CHECK(dns_view_excludedelegationonly(view, name));
4759 }
4760 } else
4761 dns_view_setrootdelonly(view, false);
4762
4763 /*
4764 * Load DynDB modules.
4765 */
4766 dyndb_list = NULL;
4767 if (voptions != NULL)
4768 (void)cfg_map_get(voptions, "dyndb", &dyndb_list);
4769 else
4770 (void)cfg_map_get(config, "dyndb", &dyndb_list);
4771
4772 #ifdef HAVE_DLOPEN
4773 for (element = cfg_list_first(dyndb_list);
4774 element != NULL;
4775 element = cfg_list_next(element))
4776 {
4777 const cfg_obj_t *dyndb = cfg_listelt_value(element);
4778
4779 if (dctx == NULL) {
4780 const void *hashinit = isc_hash_get_initializer();
4781 CHECK(dns_dyndb_createctx(mctx, hashinit,
4782 ns_g_lctx, view,
4783 ns_g_server->zonemgr,
4784 ns_g_server->task,
4785 ns_g_timermgr, &dctx));
4786 }
4787
4788 CHECK(configure_dyndb(dyndb, mctx, dctx));
4789 }
4790 #endif
4791
4792 /*
4793 * Setup automatic empty zones. If recursion is off then
4794 * they are disabled by default.
4795 */
4796 obj = NULL;
4797 (void)ns_config_get(maps, "empty-zones-enable", &obj);
4798 (void)ns_config_get(maps, "disable-empty-zone", &disablelist);
4799 if (obj == NULL && disablelist == NULL &&
4800 view->rdclass == dns_rdataclass_in) {
4801 empty_zones_enable = view->recursion;
4802 } else if (view->rdclass == dns_rdataclass_in) {
4803 if (obj != NULL)
4804 empty_zones_enable = cfg_obj_asboolean(obj);
4805 else
4806 empty_zones_enable = view->recursion;
4807 } else {
4808 empty_zones_enable = false;
4809 }
4810
4811 if (empty_zones_enable && !lwresd_g_useresolvconf) {
4812 const char *empty;
4813 int empty_zone = 0;
4814 dns_fixedname_t fixed;
4815 dns_name_t *name;
4816 isc_buffer_t buffer;
4817 char server[DNS_NAME_FORMATSIZE + 1];
4818 char contact[DNS_NAME_FORMATSIZE + 1];
4819 const char *empty_dbtype[4] =
4820 { "_builtin", "empty", NULL, NULL };
4821 int empty_dbtypec = 4;
4822 dns_zonestat_level_t statlevel = dns_zonestat_none;
4823
4824 name = dns_fixedname_initname(&fixed);
4825
4826 obj = NULL;
4827 result = ns_config_get(maps, "empty-server", &obj);
4828 if (result == ISC_R_SUCCESS) {
4829 CHECK(dns_name_fromstring(name, cfg_obj_asstring(obj),
4830 0, NULL));
4831 isc_buffer_init(&buffer, server, sizeof(server) - 1);
4832 CHECK(dns_name_totext(name, false, &buffer));
4833 server[isc_buffer_usedlength(&buffer)] = 0;
4834 empty_dbtype[2] = server;
4835 } else
4836 empty_dbtype[2] = "@";
4837
4838 obj = NULL;
4839 result = ns_config_get(maps, "empty-contact", &obj);
4840 if (result == ISC_R_SUCCESS) {
4841 CHECK(dns_name_fromstring(name, cfg_obj_asstring(obj),
4842 0, NULL));
4843 isc_buffer_init(&buffer, contact, sizeof(contact) - 1);
4844 CHECK(dns_name_totext(name, false, &buffer));
4845 contact[isc_buffer_usedlength(&buffer)] = 0;
4846 empty_dbtype[3] = contact;
4847 } else
4848 empty_dbtype[3] = ".";
4849
4850 obj = NULL;
4851 result = ns_config_get(maps, "zone-statistics", &obj);
4852 INSIST(result == ISC_R_SUCCESS);
4853 if (cfg_obj_isboolean(obj)) {
4854 if (cfg_obj_asboolean(obj))
4855 statlevel = dns_zonestat_full;
4856 else
4857 statlevel = dns_zonestat_none;
4858 } else {
4859 const char *levelstr = cfg_obj_asstring(obj);
4860 if (strcasecmp(levelstr, "full") == 0) {
4861 statlevel = dns_zonestat_full;
4862 } else if (strcasecmp(levelstr, "terse") == 0) {
4863 statlevel = dns_zonestat_terse;
4864 } else if (strcasecmp(levelstr, "none") == 0) {
4865 statlevel = dns_zonestat_none;
4866 } else {
4867 INSIST(0);
4868 ISC_UNREACHABLE();
4869 }
4870 }
4871
4872 for (empty = empty_zones[empty_zone];
4873 empty != NULL;
4874 empty = empty_zones[++empty_zone])
4875 {
4876 dns_forwarders_t *dnsforwarders = NULL;
4877
4878 /*
4879 * Look for zone on drop list.
4880 */
4881 CHECK(dns_name_fromstring(name, empty, 0, NULL));
4882 if (disablelist != NULL &&
4883 on_disable_list(disablelist, name))
4884 continue;
4885
4886 /*
4887 * This zone already exists.
4888 */
4889 (void)dns_view_findzone(view, name, &zone);
4890 if (zone != NULL) {
4891 dns_zone_detach(&zone);
4892 continue;
4893 }
4894
4895 /*
4896 * If we would forward this name don't add a
4897 * empty zone for it.
4898 */
4899 result = dns_fwdtable_find(view->fwdtable, name,
4900 &dnsforwarders);
4901 if (result == ISC_R_SUCCESS &&
4902 dnsforwarders->fwdpolicy == dns_fwdpolicy_only)
4903 continue;
4904
4905 /*
4906 * See if we can re-use a existing zone.
4907 */
4908 result = dns_viewlist_find(&ns_g_server->viewlist,
4909 view->name, view->rdclass,
4910 &pview);
4911 if (result != ISC_R_NOTFOUND &&
4912 result != ISC_R_SUCCESS)
4913 goto cleanup;
4914
4915 if (pview != NULL) {
4916 (void)dns_view_findzone(pview, name, &zone);
4917 dns_view_detach(&pview);
4918 }
4919
4920 CHECK(create_empty_zone(zone, name, view, zonelist,
4921 empty_dbtype, empty_dbtypec,
4922 statlevel));
4923 if (zone != NULL)
4924 dns_zone_detach(&zone);
4925 }
4926 }
4927
4928 obj = NULL;
4929 result = ns_config_get(maps, "rate-limit", &obj);
4930 if (result == ISC_R_SUCCESS) {
4931 result = configure_rrl(view, config, obj);
4932 if (result != ISC_R_SUCCESS)
4933 goto cleanup;
4934 }
4935
4936 /*
4937 * Set the servfail-ttl.
4938 */
4939 obj = NULL;
4940 result = ns_config_get(maps, "servfail-ttl", &obj);
4941 INSIST(result == ISC_R_SUCCESS);
4942 fail_ttl = cfg_obj_asuint32(obj);
4943 if (fail_ttl > 30)
4944 fail_ttl = 30;
4945 dns_view_setfailttl(view, fail_ttl);
4946
4947 /*
4948 * Name space to look up redirect information in.
4949 */
4950 obj = NULL;
4951 result = ns_config_get(maps, "nxdomain-redirect", &obj);
4952 if (result == ISC_R_SUCCESS) {
4953 dns_name_t *name = dns_fixedname_name(&view->redirectfixed);
4954 CHECK(dns_name_fromstring(name, cfg_obj_asstring(obj), 0,
4955 NULL));
4956 view->redirectzone = name;
4957 } else
4958 view->redirectzone = NULL;
4959
4960 #ifdef HAVE_DNSTAP
4961 /*
4962 * Set up the dnstap environment and configure message
4963 * types to log.
4964 */
4965 CHECK(configure_dnstap(maps, view));
4966 #endif /* HAVE_DNSTAP */
4967
4968 result = ISC_R_SUCCESS;
4969
4970 cleanup:
4971 if (clients != NULL)
4972 dns_acl_detach(&clients);
4973 if (mapped != NULL)
4974 dns_acl_detach(&mapped);
4975 if (excluded != NULL)
4976 dns_acl_detach(&excluded);
4977 if (ring != NULL)
4978 dns_tsigkeyring_detach(&ring);
4979 if (zone != NULL)
4980 dns_zone_detach(&zone);
4981 if (dispatch4 != NULL)
4982 dns_dispatch_detach(&dispatch4);
4983 if (dispatch6 != NULL)
4984 dns_dispatch_detach(&dispatch6);
4985 if (resstats != NULL)
4986 isc_stats_detach(&resstats);
4987 if (resquerystats != NULL)
4988 dns_stats_detach(&resquerystats);
4989 if (order != NULL)
4990 dns_order_detach(&order);
4991 if (cmctx != NULL)
4992 isc_mem_detach(&cmctx);
4993 if (hmctx != NULL)
4994 isc_mem_detach(&hmctx);
4995
4996 if (cache != NULL)
4997 dns_cache_detach(&cache);
4998 if (dctx != NULL)
4999 dns_dyndb_destroyctx(&dctx);
5000
5001 return (result);
5002 }
5003
5004 static isc_result_t
configure_hints(dns_view_t * view,const char * filename)5005 configure_hints(dns_view_t *view, const char *filename) {
5006 isc_result_t result;
5007 dns_db_t *db;
5008
5009 db = NULL;
5010 result = dns_rootns_create(view->mctx, view->rdclass, filename, &db);
5011 if (result == ISC_R_SUCCESS) {
5012 dns_view_sethints(view, db);
5013 dns_db_detach(&db);
5014 }
5015
5016 return (result);
5017 }
5018
5019 static isc_result_t
configure_alternates(const cfg_obj_t * config,dns_view_t * view,const cfg_obj_t * alternates)5020 configure_alternates(const cfg_obj_t *config, dns_view_t *view,
5021 const cfg_obj_t *alternates)
5022 {
5023 const cfg_obj_t *portobj;
5024 const cfg_obj_t *addresses;
5025 const cfg_listelt_t *element;
5026 isc_result_t result = ISC_R_SUCCESS;
5027 in_port_t port;
5028
5029 /*
5030 * Determine which port to send requests to.
5031 */
5032 if (ns_g_lwresdonly && ns_g_port != 0)
5033 port = ns_g_port;
5034 else
5035 CHECKM(ns_config_getport(config, &port), "port");
5036
5037 if (alternates != NULL) {
5038 portobj = cfg_tuple_get(alternates, "port");
5039 if (cfg_obj_isuint32(portobj)) {
5040 uint32_t val = cfg_obj_asuint32(portobj);
5041 if (val > UINT16_MAX) {
5042 cfg_obj_log(portobj, ns_g_lctx, ISC_LOG_ERROR,
5043 "port '%u' out of range", val);
5044 return (ISC_R_RANGE);
5045 }
5046 port = (in_port_t) val;
5047 }
5048 }
5049
5050 addresses = NULL;
5051 if (alternates != NULL)
5052 addresses = cfg_tuple_get(alternates, "addresses");
5053
5054 for (element = cfg_list_first(addresses);
5055 element != NULL;
5056 element = cfg_list_next(element))
5057 {
5058 const cfg_obj_t *alternate = cfg_listelt_value(element);
5059 isc_sockaddr_t sa;
5060
5061 if (!cfg_obj_issockaddr(alternate)) {
5062 dns_fixedname_t fixed;
5063 dns_name_t *name;
5064 const char *str = cfg_obj_asstring(cfg_tuple_get(
5065 alternate, "name"));
5066 isc_buffer_t buffer;
5067 in_port_t myport = port;
5068
5069 isc_buffer_constinit(&buffer, str, strlen(str));
5070 isc_buffer_add(&buffer, strlen(str));
5071 name = dns_fixedname_initname(&fixed);
5072 CHECK(dns_name_fromtext(name, &buffer, dns_rootname, 0,
5073 NULL));
5074
5075 portobj = cfg_tuple_get(alternate, "port");
5076 if (cfg_obj_isuint32(portobj)) {
5077 uint32_t val = cfg_obj_asuint32(portobj);
5078 if (val > UINT16_MAX) {
5079 cfg_obj_log(portobj, ns_g_lctx,
5080 ISC_LOG_ERROR,
5081 "port '%u' out of range",
5082 val);
5083 return (ISC_R_RANGE);
5084 }
5085 myport = (in_port_t) val;
5086 }
5087 CHECK(dns_resolver_addalternate(view->resolver, NULL,
5088 name, myport));
5089 continue;
5090 }
5091
5092 sa = *cfg_obj_assockaddr(alternate);
5093 if (isc_sockaddr_getport(&sa) == 0)
5094 isc_sockaddr_setport(&sa, port);
5095 CHECK(dns_resolver_addalternate(view->resolver, &sa,
5096 NULL, 0));
5097 }
5098
5099 cleanup:
5100 return (result);
5101 }
5102
5103 static isc_result_t
configure_forward(const cfg_obj_t * config,dns_view_t * view,dns_name_t * origin,const cfg_obj_t * forwarders,const cfg_obj_t * forwardtype)5104 configure_forward(const cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
5105 const cfg_obj_t *forwarders, const cfg_obj_t *forwardtype)
5106 {
5107 const cfg_obj_t *portobj, *dscpobj;
5108 const cfg_obj_t *faddresses;
5109 const cfg_listelt_t *element;
5110 dns_fwdpolicy_t fwdpolicy = dns_fwdpolicy_none;
5111 dns_forwarderlist_t fwdlist;
5112 dns_forwarder_t *fwd;
5113 isc_result_t result;
5114 in_port_t port;
5115 isc_dscp_t dscp = -1;
5116
5117 ISC_LIST_INIT(fwdlist);
5118
5119 /*
5120 * Determine which port to send forwarded requests to.
5121 */
5122 if (ns_g_lwresdonly && ns_g_port != 0)
5123 port = ns_g_port;
5124 else
5125 CHECKM(ns_config_getport(config, &port), "port");
5126
5127 if (forwarders != NULL) {
5128 portobj = cfg_tuple_get(forwarders, "port");
5129 if (cfg_obj_isuint32(portobj)) {
5130 uint32_t val = cfg_obj_asuint32(portobj);
5131 if (val > UINT16_MAX) {
5132 cfg_obj_log(portobj, ns_g_lctx, ISC_LOG_ERROR,
5133 "port '%u' out of range", val);
5134 return (ISC_R_RANGE);
5135 }
5136 port = (in_port_t) val;
5137 }
5138 }
5139
5140 /*
5141 * DSCP value for forwarded requests.
5142 */
5143 dscp = ns_g_dscp;
5144 if (forwarders != NULL) {
5145 dscpobj = cfg_tuple_get(forwarders, "dscp");
5146 if (cfg_obj_isuint32(dscpobj)) {
5147 if (cfg_obj_asuint32(dscpobj) > 63) {
5148 cfg_obj_log(dscpobj, ns_g_lctx, ISC_LOG_ERROR,
5149 "dscp value '%u' is out of range",
5150 cfg_obj_asuint32(dscpobj));
5151 return (ISC_R_RANGE);
5152 }
5153 dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
5154 }
5155 }
5156
5157 faddresses = NULL;
5158 if (forwarders != NULL)
5159 faddresses = cfg_tuple_get(forwarders, "addresses");
5160
5161 for (element = cfg_list_first(faddresses);
5162 element != NULL;
5163 element = cfg_list_next(element))
5164 {
5165 const cfg_obj_t *forwarder = cfg_listelt_value(element);
5166 fwd = isc_mem_get(view->mctx, sizeof(dns_forwarder_t));
5167 if (fwd == NULL) {
5168 result = ISC_R_NOMEMORY;
5169 goto cleanup;
5170 }
5171 fwd->addr = *cfg_obj_assockaddr(forwarder);
5172 if (isc_sockaddr_getport(&fwd->addr) == 0)
5173 isc_sockaddr_setport(&fwd->addr, port);
5174 fwd->dscp = cfg_obj_getdscp(forwarder);
5175 if (fwd->dscp == -1)
5176 fwd->dscp = dscp;
5177 ISC_LINK_INIT(fwd, link);
5178 ISC_LIST_APPEND(fwdlist, fwd, link);
5179 }
5180
5181 if (ISC_LIST_EMPTY(fwdlist)) {
5182 if (forwardtype != NULL)
5183 cfg_obj_log(forwardtype, ns_g_lctx, ISC_LOG_WARNING,
5184 "no forwarders seen; disabling "
5185 "forwarding");
5186 fwdpolicy = dns_fwdpolicy_none;
5187 } else {
5188 if (forwardtype == NULL) {
5189 fwdpolicy = dns_fwdpolicy_first;
5190 } else {
5191 const char *forwardstr = cfg_obj_asstring(forwardtype);
5192 if (strcasecmp(forwardstr, "first") == 0) {
5193 fwdpolicy = dns_fwdpolicy_first;
5194 } else if (strcasecmp(forwardstr, "only") == 0) {
5195 fwdpolicy = dns_fwdpolicy_only;
5196 } else {
5197 INSIST(0);
5198 ISC_UNREACHABLE();
5199 }
5200 }
5201 }
5202
5203 result = dns_fwdtable_addfwd(view->fwdtable, origin, &fwdlist,
5204 fwdpolicy);
5205 if (result != ISC_R_SUCCESS) {
5206 char namebuf[DNS_NAME_FORMATSIZE];
5207 dns_name_format(origin, namebuf, sizeof(namebuf));
5208 cfg_obj_log(forwarders, ns_g_lctx, ISC_LOG_WARNING,
5209 "could not set up forwarding for domain '%s': %s",
5210 namebuf, isc_result_totext(result));
5211 goto cleanup;
5212 }
5213
5214 result = ISC_R_SUCCESS;
5215
5216 cleanup:
5217
5218 while (!ISC_LIST_EMPTY(fwdlist)) {
5219 fwd = ISC_LIST_HEAD(fwdlist);
5220 ISC_LIST_UNLINK(fwdlist, fwd, link);
5221 isc_mem_put(view->mctx, fwd, sizeof(dns_forwarder_t));
5222 }
5223
5224 return (result);
5225 }
5226
5227 static isc_result_t
get_viewinfo(const cfg_obj_t * vconfig,const char ** namep,dns_rdataclass_t * classp)5228 get_viewinfo(const cfg_obj_t *vconfig, const char **namep,
5229 dns_rdataclass_t *classp)
5230 {
5231 isc_result_t result = ISC_R_SUCCESS;
5232 const char *viewname;
5233 dns_rdataclass_t viewclass;
5234
5235 REQUIRE(namep != NULL && *namep == NULL);
5236 REQUIRE(classp != NULL);
5237
5238 if (vconfig != NULL) {
5239 const cfg_obj_t *classobj = NULL;
5240
5241 viewname = cfg_obj_asstring(cfg_tuple_get(vconfig, "name"));
5242 classobj = cfg_tuple_get(vconfig, "class");
5243 CHECK(ns_config_getclass(classobj, dns_rdataclass_in,
5244 &viewclass));
5245 if (dns_rdataclass_ismeta(viewclass)) {
5246 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
5247 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
5248 "view '%s': class must not be meta",
5249 viewname);
5250 CHECK(ISC_R_FAILURE);
5251 }
5252 } else {
5253 viewname = "_default";
5254 viewclass = dns_rdataclass_in;
5255 }
5256
5257 *namep = viewname;
5258 *classp = viewclass;
5259
5260 cleanup:
5261 return (result);
5262 }
5263
5264 /*
5265 * Find a view based on its configuration info and attach to it.
5266 *
5267 * If 'vconfig' is NULL, attach to the default view.
5268 */
5269 static isc_result_t
find_view(const cfg_obj_t * vconfig,dns_viewlist_t * viewlist,dns_view_t ** viewp)5270 find_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
5271 dns_view_t **viewp)
5272 {
5273 isc_result_t result;
5274 const char *viewname = NULL;
5275 dns_rdataclass_t viewclass;
5276 dns_view_t *view = NULL;
5277
5278 result = get_viewinfo(vconfig, &viewname, &viewclass);
5279 if (result != ISC_R_SUCCESS)
5280 return (result);
5281
5282 result = dns_viewlist_find(viewlist, viewname, viewclass, &view);
5283 if (result != ISC_R_SUCCESS)
5284 return (result);
5285
5286 *viewp = view;
5287 return (ISC_R_SUCCESS);
5288 }
5289
5290 /*
5291 * Create a new view and add it to the list.
5292 *
5293 * If 'vconfig' is NULL, create the default view.
5294 *
5295 * The view created is attached to '*viewp'.
5296 */
5297 static isc_result_t
create_view(const cfg_obj_t * vconfig,dns_viewlist_t * viewlist,dns_view_t ** viewp)5298 create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
5299 dns_view_t **viewp)
5300 {
5301 isc_result_t result;
5302 const char *viewname = NULL;
5303 dns_rdataclass_t viewclass;
5304 dns_view_t *view = NULL;
5305
5306 result = get_viewinfo(vconfig, &viewname, &viewclass);
5307 if (result != ISC_R_SUCCESS)
5308 return (result);
5309
5310 result = dns_viewlist_find(viewlist, viewname, viewclass, &view);
5311 if (result == ISC_R_SUCCESS)
5312 return (ISC_R_EXISTS);
5313 if (result != ISC_R_NOTFOUND)
5314 return (result);
5315 INSIST(view == NULL);
5316
5317 result = dns_view_create(ns_g_mctx, viewclass, viewname, &view);
5318 if (result != ISC_R_SUCCESS)
5319 return (result);
5320
5321 result = isc_entropy_getdata(ns_g_entropy, view->secret,
5322 sizeof(view->secret), NULL, 0);
5323 if (result != ISC_R_SUCCESS) {
5324 dns_view_detach(&view);
5325 return (result);
5326 }
5327
5328 #ifdef HAVE_GEOIP
5329 view->aclenv.geoip = ns_g_geoip;
5330 #endif
5331
5332 ISC_LIST_APPEND(*viewlist, view, link);
5333 dns_view_attach(view, viewp);
5334 return (ISC_R_SUCCESS);
5335 }
5336
5337 /*
5338 * Configure or reconfigure a zone.
5339 */
5340 static isc_result_t
configure_zone(const cfg_obj_t * config,const cfg_obj_t * zconfig,const cfg_obj_t * vconfig,isc_mem_t * mctx,dns_view_t * view,dns_viewlist_t * viewlist,cfg_aclconfctx_t * aclconf,bool added,bool old_rpz_ok,bool modify)5341 configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
5342 const cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
5343 dns_viewlist_t *viewlist, cfg_aclconfctx_t *aclconf,
5344 bool added, bool old_rpz_ok,
5345 bool modify)
5346 {
5347 dns_view_t *pview = NULL; /* Production view */
5348 dns_zone_t *zone = NULL; /* New or reused zone */
5349 dns_zone_t *raw = NULL; /* New or reused raw zone */
5350 dns_zone_t *dupzone = NULL;
5351 const cfg_obj_t *options = NULL;
5352 const cfg_obj_t *zoptions = NULL;
5353 const cfg_obj_t *typeobj = NULL;
5354 const cfg_obj_t *forwarders = NULL;
5355 const cfg_obj_t *forwardtype = NULL;
5356 const cfg_obj_t *ixfrfromdiffs = NULL;
5357 const cfg_obj_t *only = NULL;
5358 const cfg_obj_t *signing = NULL;
5359 const cfg_obj_t *viewobj = NULL;
5360 isc_result_t result;
5361 isc_result_t tresult;
5362 isc_buffer_t buffer;
5363 dns_fixedname_t fixorigin;
5364 dns_name_t *origin;
5365 const char *zname;
5366 dns_rdataclass_t zclass;
5367 const char *ztypestr;
5368 dns_rpz_num_t rpz_num;
5369 bool zone_is_catz = false;
5370
5371 options = NULL;
5372 (void)cfg_map_get(config, "options", &options);
5373
5374 zoptions = cfg_tuple_get(zconfig, "options");
5375
5376 /*
5377 * Get the zone origin as a dns_name_t.
5378 */
5379 zname = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
5380 isc_buffer_constinit(&buffer, zname, strlen(zname));
5381 isc_buffer_add(&buffer, strlen(zname));
5382 dns_fixedname_init(&fixorigin);
5383 CHECK(dns_name_fromtext(dns_fixedname_name(&fixorigin),
5384 &buffer, dns_rootname, 0, NULL));
5385 origin = dns_fixedname_name(&fixorigin);
5386
5387 CHECK(ns_config_getclass(cfg_tuple_get(zconfig, "class"),
5388 view->rdclass, &zclass));
5389 if (zclass != view->rdclass) {
5390 const char *vname = NULL;
5391 if (vconfig != NULL)
5392 vname = cfg_obj_asstring(cfg_tuple_get(vconfig,
5393 "name"));
5394 else
5395 vname = "<default view>";
5396
5397 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
5398 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
5399 "zone '%s': wrong class for view '%s'",
5400 zname, vname);
5401 result = ISC_R_FAILURE;
5402 goto cleanup;
5403 }
5404
5405 (void)cfg_map_get(zoptions, "in-view", &viewobj);
5406 if (viewobj != NULL) {
5407 const char *inview = cfg_obj_asstring(viewobj);
5408 dns_view_t *otherview = NULL;
5409
5410 if (viewlist == NULL) {
5411 cfg_obj_log(zconfig, ns_g_lctx, ISC_LOG_ERROR,
5412 "'in-view' option is not permitted in "
5413 "dynamically added zones");
5414 result = ISC_R_FAILURE;
5415 goto cleanup;
5416 }
5417
5418 result = dns_viewlist_find(viewlist, inview, view->rdclass,
5419 &otherview);
5420 if (result != ISC_R_SUCCESS) {
5421 cfg_obj_log(zconfig, ns_g_lctx, ISC_LOG_ERROR,
5422 "view '%s' is not yet defined.", inview);
5423 result = ISC_R_FAILURE;
5424 goto cleanup;
5425 }
5426
5427 result = dns_view_findzone(otherview, origin, &zone);
5428 dns_view_detach(&otherview);
5429 if (result != ISC_R_SUCCESS) {
5430 cfg_obj_log(zconfig, ns_g_lctx, ISC_LOG_ERROR,
5431 "zone '%s' not defined in view '%s'",
5432 zname, inview);
5433 result = ISC_R_FAILURE;
5434 goto cleanup;
5435 }
5436
5437 CHECK(dns_view_addzone(view, zone));
5438 dns_zone_detach(&zone);
5439
5440 /*
5441 * If the zone contains a 'forwarders' statement, configure
5442 * selective forwarding. Note: this is not inherited from the
5443 * other view.
5444 */
5445 forwarders = NULL;
5446 result = cfg_map_get(zoptions, "forwarders", &forwarders);
5447 if (result == ISC_R_SUCCESS) {
5448 forwardtype = NULL;
5449 (void)cfg_map_get(zoptions, "forward", &forwardtype);
5450 CHECK(configure_forward(config, view, origin,
5451 forwarders, forwardtype));
5452 }
5453 result = ISC_R_SUCCESS;
5454 goto cleanup;
5455 }
5456
5457 (void)cfg_map_get(zoptions, "type", &typeobj);
5458 if (typeobj == NULL) {
5459 cfg_obj_log(zconfig, ns_g_lctx, ISC_LOG_ERROR,
5460 "zone '%s' 'type' not specified", zname);
5461 result = ISC_R_FAILURE;
5462 goto cleanup;
5463 }
5464 ztypestr = cfg_obj_asstring(typeobj);
5465
5466 /*
5467 * "hints zones" aren't zones. If we've got one,
5468 * configure it and return.
5469 */
5470 if (strcasecmp(ztypestr, "hint") == 0) {
5471 const cfg_obj_t *fileobj = NULL;
5472 if (cfg_map_get(zoptions, "file", &fileobj) != ISC_R_SUCCESS) {
5473 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
5474 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
5475 "zone '%s': 'file' not specified",
5476 zname);
5477 result = ISC_R_FAILURE;
5478 goto cleanup;
5479 }
5480 if (dns_name_equal(origin, dns_rootname)) {
5481 const char *hintsfile = cfg_obj_asstring(fileobj);
5482
5483 CHECK(configure_hints(view, hintsfile));
5484
5485 /*
5486 * Hint zones may also refer to delegation only points.
5487 */
5488 only = NULL;
5489 tresult = cfg_map_get(zoptions, "delegation-only",
5490 &only);
5491 if (tresult == ISC_R_SUCCESS && cfg_obj_asboolean(only))
5492 CHECK(dns_view_adddelegationonly(view, origin));
5493 } else {
5494 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
5495 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
5496 "ignoring non-root hint zone '%s'",
5497 zname);
5498 result = ISC_R_SUCCESS;
5499 }
5500 /* Skip ordinary zone processing. */
5501 goto cleanup;
5502 }
5503
5504 /*
5505 * "forward zones" aren't zones either. Translate this syntax into
5506 * the appropriate selective forwarding configuration and return.
5507 */
5508 if (strcasecmp(ztypestr, "forward") == 0) {
5509 forwardtype = NULL;
5510 forwarders = NULL;
5511
5512 (void)cfg_map_get(zoptions, "forward", &forwardtype);
5513 (void)cfg_map_get(zoptions, "forwarders", &forwarders);
5514 CHECK(configure_forward(config, view, origin, forwarders,
5515 forwardtype));
5516
5517 /*
5518 * Forward zones may also set delegation only.
5519 */
5520 only = NULL;
5521 tresult = cfg_map_get(zoptions, "delegation-only", &only);
5522 if (tresult == ISC_R_SUCCESS && cfg_obj_asboolean(only))
5523 CHECK(dns_view_adddelegationonly(view, origin));
5524 goto cleanup;
5525 }
5526
5527 /*
5528 * "delegation-only zones" aren't zones either.
5529 */
5530 if (strcasecmp(ztypestr, "delegation-only") == 0) {
5531 result = dns_view_adddelegationonly(view, origin);
5532 goto cleanup;
5533 }
5534
5535 /*
5536 * Redirect zones only require minimal configuration.
5537 */
5538 if (strcasecmp(ztypestr, "redirect") == 0) {
5539 if (view->redirect != NULL) {
5540 cfg_obj_log(zconfig, ns_g_lctx, ISC_LOG_ERROR,
5541 "redirect zone already exists");
5542 result = ISC_R_EXISTS;
5543 goto cleanup;
5544 }
5545 result = dns_viewlist_find(viewlist, view->name,
5546 view->rdclass, &pview);
5547 if (result != ISC_R_NOTFOUND && result != ISC_R_SUCCESS)
5548 goto cleanup;
5549 if (pview != NULL && pview->redirect != NULL) {
5550 dns_zone_attach(pview->redirect, &zone);
5551 dns_zone_setview(zone, view);
5552 } else {
5553 CHECK(dns_zonemgr_createzone(ns_g_server->zonemgr,
5554 &zone));
5555 CHECK(dns_zone_setorigin(zone, origin));
5556 dns_zone_setview(zone, view);
5557 CHECK(dns_zonemgr_managezone(ns_g_server->zonemgr,
5558 zone));
5559 dns_zone_setstats(zone, ns_g_server->zonestats);
5560 }
5561 CHECK(ns_zone_configure(config, vconfig, zconfig, aclconf,
5562 zone, NULL));
5563 dns_zone_attach(zone, &view->redirect);
5564 goto cleanup;
5565 }
5566
5567 if (!modify) {
5568 /*
5569 * Check for duplicates in the new zone table.
5570 */
5571 result = dns_view_findzone(view, origin, &dupzone);
5572 if (result == ISC_R_SUCCESS) {
5573 /*
5574 * We already have this zone!
5575 */
5576 cfg_obj_log(zconfig, ns_g_lctx, ISC_LOG_ERROR,
5577 "zone '%s' already exists", zname);
5578 dns_zone_detach(&dupzone);
5579 result = ISC_R_EXISTS;
5580 goto cleanup;
5581 }
5582 INSIST(dupzone == NULL);
5583 }
5584
5585 /*
5586 * Note whether this is a response policy zone and which one if so.
5587 */
5588 for (rpz_num = 0; ; ++rpz_num) {
5589 if (view->rpzs == NULL || rpz_num >= view->rpzs->p.num_zones) {
5590 rpz_num = DNS_RPZ_INVALID_NUM;
5591 break;
5592 }
5593 if (dns_name_equal(&view->rpzs->zones[rpz_num]->origin, origin))
5594 break;
5595 }
5596
5597 if (view->catzs != NULL &&
5598 dns_catz_get_zone(view->catzs, origin) != NULL)
5599 zone_is_catz = true;
5600
5601 /*
5602 * See if we can reuse an existing zone. This is
5603 * only possible if all of these are true:
5604 * - The zone's view exists
5605 * - A zone with the right name exists in the view
5606 * - The zone is compatible with the config
5607 * options (e.g., an existing master zone cannot
5608 * be reused if the options specify a slave zone)
5609 * - The zone was not and is still not a response policy zone
5610 * or the zone is a policy zone with an unchanged number
5611 * and we are using the old policy zone summary data.
5612 */
5613 result = dns_viewlist_find(&ns_g_server->viewlist, view->name,
5614 view->rdclass, &pview);
5615 if (result != ISC_R_NOTFOUND && result != ISC_R_SUCCESS)
5616 goto cleanup;
5617 if (pview != NULL)
5618 result = dns_view_findzone(pview, origin, &zone);
5619 if (result != ISC_R_NOTFOUND && result != ISC_R_SUCCESS)
5620 goto cleanup;
5621
5622 if (zone != NULL && !ns_zone_reusable(zone, zconfig))
5623 dns_zone_detach(&zone);
5624
5625 if (zone != NULL && (rpz_num != dns_zone_get_rpz_num(zone) ||
5626 (rpz_num != DNS_RPZ_INVALID_NUM && !old_rpz_ok)))
5627 dns_zone_detach(&zone);
5628
5629 if (zone != NULL) {
5630 /*
5631 * We found a reusable zone. Make it use the
5632 * new view.
5633 */
5634 dns_zone_setview(zone, view);
5635 if (view->acache != NULL)
5636 dns_zone_setacache(zone, view->acache);
5637 } else {
5638 /*
5639 * We cannot reuse an existing zone, we have
5640 * to create a new one.
5641 */
5642 CHECK(dns_zonemgr_createzone(ns_g_server->zonemgr, &zone));
5643 CHECK(dns_zone_setorigin(zone, origin));
5644 dns_zone_setview(zone, view);
5645 if (view->acache != NULL)
5646 dns_zone_setacache(zone, view->acache);
5647 CHECK(dns_zonemgr_managezone(ns_g_server->zonemgr, zone));
5648 dns_zone_setstats(zone, ns_g_server->zonestats);
5649 }
5650 if (rpz_num != DNS_RPZ_INVALID_NUM) {
5651 result = dns_zone_rpz_enable(zone, view->rpzs, rpz_num);
5652 if (result != ISC_R_SUCCESS) {
5653 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
5654 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
5655 "zone '%s': incompatible"
5656 " masterfile-format or database"
5657 " for a response policy zone",
5658 zname);
5659 goto cleanup;
5660 }
5661 }
5662
5663 if (zone_is_catz)
5664 dns_zone_catz_enable(zone, view->catzs);
5665
5666 /*
5667 * If the zone contains a 'forwarders' statement, configure
5668 * selective forwarding.
5669 */
5670 forwarders = NULL;
5671 if (cfg_map_get(zoptions, "forwarders", &forwarders) == ISC_R_SUCCESS)
5672 {
5673 forwardtype = NULL;
5674 (void)cfg_map_get(zoptions, "forward", &forwardtype);
5675 CHECK(configure_forward(config, view, origin, forwarders,
5676 forwardtype));
5677 }
5678
5679 /*
5680 * Stub and forward zones may also refer to delegation only points.
5681 */
5682 only = NULL;
5683 if (cfg_map_get(zoptions, "delegation-only", &only) == ISC_R_SUCCESS)
5684 {
5685 if (cfg_obj_asboolean(only))
5686 CHECK(dns_view_adddelegationonly(view, origin));
5687 }
5688
5689 /*
5690 * Mark whether the zone was originally added at runtime or not
5691 */
5692 dns_zone_setadded(zone, added);
5693
5694 signing = NULL;
5695 if ((strcasecmp(ztypestr, "master") == 0 ||
5696 strcasecmp(ztypestr, "slave") == 0) &&
5697 cfg_map_get(zoptions, "inline-signing", &signing) == ISC_R_SUCCESS &&
5698 cfg_obj_asboolean(signing))
5699 {
5700 dns_zone_getraw(zone, &raw);
5701 if (raw == NULL) {
5702 CHECK(dns_zone_create(&raw, mctx));
5703 CHECK(dns_zone_setorigin(raw, origin));
5704 dns_zone_setview(raw, view);
5705 if (view->acache != NULL)
5706 dns_zone_setacache(raw, view->acache);
5707 dns_zone_setstats(raw, ns_g_server->zonestats);
5708 CHECK(dns_zone_link(zone, raw));
5709 }
5710 if (cfg_map_get(zoptions, "ixfr-from-differences",
5711 &ixfrfromdiffs) == ISC_R_SUCCESS)
5712 {
5713 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
5714 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
5715 "zone '%s': 'ixfr-from-differences' is "
5716 "ignored for inline-signed zones",
5717 zname);
5718 }
5719 }
5720
5721 /*
5722 * Configure the zone.
5723 */
5724 CHECK(ns_zone_configure(config, vconfig, zconfig, aclconf, zone, raw));
5725
5726 /*
5727 * Add the zone to its view in the new view list.
5728 */
5729 if (!modify)
5730 CHECK(dns_view_addzone(view, zone));
5731
5732 if (zone_is_catz) {
5733 /*
5734 * force catz reload if the zone is loaded;
5735 * if it's not it'll get reloaded on zone load
5736 */
5737 dns_db_t *db = NULL;
5738
5739 tresult = dns_zone_getdb(zone, &db);
5740 if (tresult == ISC_R_SUCCESS) {
5741 dns_catz_dbupdate_callback(db, view->catzs);
5742 dns_db_detach(&db);
5743 }
5744
5745 }
5746
5747 /*
5748 * Ensure that zone keys are reloaded on reconfig
5749 */
5750 if ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_MAINTAIN) != 0)
5751 dns_zone_rekey(zone, false);
5752
5753 cleanup:
5754 if (zone != NULL)
5755 dns_zone_detach(&zone);
5756 if (raw != NULL)
5757 dns_zone_detach(&raw);
5758 if (pview != NULL)
5759 dns_view_detach(&pview);
5760
5761 return (result);
5762 }
5763
5764 /*
5765 * Configure built-in zone for storing managed-key data.
5766 */
5767
5768 static isc_result_t
add_keydata_zone(dns_view_t * view,const char * directory,isc_mem_t * mctx)5769 add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx) {
5770 isc_result_t result;
5771 dns_view_t *pview = NULL;
5772 dns_zone_t *zone = NULL;
5773 dns_acl_t *none = NULL;
5774 char filename[PATH_MAX];
5775 bool defaultview;
5776
5777 REQUIRE(view != NULL);
5778
5779 /* See if we can re-use an existing keydata zone. */
5780 result = dns_viewlist_find(&ns_g_server->viewlist,
5781 view->name, view->rdclass,
5782 &pview);
5783 if (result != ISC_R_NOTFOUND &&
5784 result != ISC_R_SUCCESS)
5785 return (result);
5786
5787 if (pview != NULL && pview->managed_keys != NULL) {
5788 dns_zone_attach(pview->managed_keys, &view->managed_keys);
5789 dns_zone_setview(pview->managed_keys, view);
5790 dns_view_detach(&pview);
5791 dns_zone_synckeyzone(view->managed_keys);
5792 return (ISC_R_SUCCESS);
5793 }
5794
5795 /* No existing keydata zone was found; create one */
5796 CHECK(dns_zonemgr_createzone(ns_g_server->zonemgr, &zone));
5797 CHECK(dns_zone_setorigin(zone, dns_rootname));
5798
5799 defaultview = (strcmp(view->name, "_default") == 0);
5800 CHECK(isc_file_sanitize(directory,
5801 defaultview ? "managed-keys" : view->name,
5802 defaultview ? "bind" : "mkeys",
5803 filename, sizeof(filename)));
5804 CHECK(dns_zone_setfile(zone, filename));
5805
5806 dns_zone_setview(zone, view);
5807 dns_zone_settype(zone, dns_zone_key);
5808 dns_zone_setclass(zone, view->rdclass);
5809
5810 CHECK(dns_zonemgr_managezone(ns_g_server->zonemgr, zone));
5811
5812 if (view->acache != NULL)
5813 dns_zone_setacache(zone, view->acache);
5814
5815 CHECK(dns_acl_none(mctx, &none));
5816 dns_zone_setqueryacl(zone, none);
5817 dns_zone_setqueryonacl(zone, none);
5818 dns_acl_detach(&none);
5819
5820 dns_zone_setdialup(zone, dns_dialuptype_no);
5821 dns_zone_setnotifytype(zone, dns_notifytype_no);
5822 dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, true);
5823 dns_zone_setjournalsize(zone, 0);
5824
5825 dns_zone_setstats(zone, ns_g_server->zonestats);
5826 CHECK(setquerystats(zone, mctx, dns_zonestat_none));
5827
5828 if (view->managed_keys != NULL)
5829 dns_zone_detach(&view->managed_keys);
5830 dns_zone_attach(zone, &view->managed_keys);
5831
5832 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
5833 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
5834 "set up managed keys zone for view %s, file '%s'",
5835 view->name, filename);
5836
5837 cleanup:
5838 if (zone != NULL)
5839 dns_zone_detach(&zone);
5840 if (none != NULL)
5841 dns_acl_detach(&none);
5842
5843 return (result);
5844 }
5845
5846 /*
5847 * Configure a single server quota.
5848 */
5849 static void
configure_server_quota(const cfg_obj_t ** maps,const char * name,isc_quota_t * quota)5850 configure_server_quota(const cfg_obj_t **maps, const char *name,
5851 isc_quota_t *quota)
5852 {
5853 const cfg_obj_t *obj = NULL;
5854 isc_result_t result;
5855
5856 result = ns_config_get(maps, name, &obj);
5857 INSIST(result == ISC_R_SUCCESS);
5858 isc_quota_max(quota, cfg_obj_asuint32(obj));
5859 }
5860
5861 /*
5862 * This function is called as soon as the 'directory' statement has been
5863 * parsed. This can be extended to support other options if necessary.
5864 */
5865 static isc_result_t
directory_callback(const char * clausename,const cfg_obj_t * obj,void * arg)5866 directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
5867 isc_result_t result;
5868 const char *directory;
5869
5870 REQUIRE(strcasecmp("directory", clausename) == 0);
5871
5872 UNUSED(arg);
5873 UNUSED(clausename);
5874
5875 /*
5876 * Change directory.
5877 */
5878 directory = cfg_obj_asstring(obj);
5879
5880 if (! isc_file_ischdiridempotent(directory))
5881 cfg_obj_log(obj, ns_g_lctx, ISC_LOG_WARNING,
5882 "option 'directory' contains relative path '%s'",
5883 directory);
5884
5885 result = isc_dir_chdir(directory);
5886 if (result != ISC_R_SUCCESS) {
5887 cfg_obj_log(obj, ns_g_lctx, ISC_LOG_ERROR,
5888 "change directory to '%s' failed: %s",
5889 directory, isc_result_totext(result));
5890 return (result);
5891 }
5892
5893 return (ISC_R_SUCCESS);
5894 }
5895
5896 static isc_result_t
scan_interfaces(ns_server_t * server,bool verbose)5897 scan_interfaces(ns_server_t *server, bool verbose) {
5898 isc_result_t result;
5899 bool match_mapped = server->aclenv.match_mapped;
5900 #if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
5901 bool use_ecs = server->aclenv.geoip_use_ecs;
5902 #endif
5903
5904 result = ns_interfacemgr_scan(server->interfacemgr, verbose);
5905 /*
5906 * Update the "localhost" and "localnets" ACLs to match the
5907 * current set of network interfaces.
5908 */
5909 dns_aclenv_copy(&server->aclenv,
5910 ns_interfacemgr_getaclenv(server->interfacemgr));
5911
5912 server->aclenv.match_mapped = match_mapped;
5913 #if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
5914 server->aclenv.geoip_use_ecs = use_ecs;
5915 #endif
5916
5917 return (result);
5918 }
5919
5920 static isc_result_t
add_listenelt(isc_mem_t * mctx,ns_listenlist_t * list,isc_sockaddr_t * addr,isc_dscp_t dscp,bool wcardport_ok)5921 add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr,
5922 isc_dscp_t dscp, bool wcardport_ok)
5923 {
5924 ns_listenelt_t *lelt = NULL;
5925 dns_acl_t *src_acl = NULL;
5926 isc_result_t result;
5927 isc_sockaddr_t any_sa6;
5928 isc_netaddr_t netaddr;
5929
5930 REQUIRE(isc_sockaddr_pf(addr) == AF_INET6);
5931
5932 isc_sockaddr_any6(&any_sa6);
5933 if (!isc_sockaddr_equal(&any_sa6, addr) &&
5934 (wcardport_ok || isc_sockaddr_getport(addr) != 0)) {
5935 isc_netaddr_fromin6(&netaddr, &addr->type.sin6.sin6_addr);
5936
5937 result = dns_acl_create(mctx, 0, &src_acl);
5938 if (result != ISC_R_SUCCESS)
5939 return (result);
5940
5941 result = dns_iptable_addprefix(src_acl->iptable,
5942 &netaddr, 128, true);
5943 if (result != ISC_R_SUCCESS)
5944 goto clean;
5945
5946 result = ns_listenelt_create(mctx, isc_sockaddr_getport(addr),
5947 dscp, src_acl, &lelt);
5948 if (result != ISC_R_SUCCESS)
5949 goto clean;
5950 ISC_LIST_APPEND(list->elts, lelt, link);
5951 }
5952
5953 return (ISC_R_SUCCESS);
5954
5955 clean:
5956 INSIST(lelt == NULL);
5957 dns_acl_detach(&src_acl);
5958
5959 return (result);
5960 }
5961
5962 /*
5963 * Make a list of xxx-source addresses and call ns_interfacemgr_adjust()
5964 * to update the listening interfaces accordingly.
5965 * We currently only consider IPv6, because this only affects IPv6 wildcard
5966 * sockets.
5967 */
5968 static void
adjust_interfaces(ns_server_t * server,isc_mem_t * mctx)5969 adjust_interfaces(ns_server_t *server, isc_mem_t *mctx) {
5970 isc_result_t result;
5971 ns_listenlist_t *list = NULL;
5972 dns_view_t *view;
5973 dns_zone_t *zone, *next;
5974 isc_sockaddr_t addr, *addrp;
5975 isc_dscp_t dscp = -1;
5976
5977 result = ns_listenlist_create(mctx, &list);
5978 if (result != ISC_R_SUCCESS)
5979 return;
5980
5981 for (view = ISC_LIST_HEAD(server->viewlist);
5982 view != NULL;
5983 view = ISC_LIST_NEXT(view, link)) {
5984 dns_dispatch_t *dispatch6;
5985
5986 dispatch6 = dns_resolver_dispatchv6(view->resolver);
5987 if (dispatch6 == NULL)
5988 continue;
5989 result = dns_dispatch_getlocaladdress(dispatch6, &addr);
5990 if (result != ISC_R_SUCCESS)
5991 goto fail;
5992
5993 /*
5994 * We always add non-wildcard address regardless of whether
5995 * the port is 'any' (the fourth arg is TRUE): if the port is
5996 * specific, we need to add it since it may conflict with a
5997 * listening interface; if it's zero, we'll dynamically open
5998 * query ports, and some of them may override an existing
5999 * wildcard IPv6 port.
6000 */
6001 /* XXXMPA fix dscp */
6002 result = add_listenelt(mctx, list, &addr, dscp, true);
6003 if (result != ISC_R_SUCCESS)
6004 goto fail;
6005 }
6006
6007 zone = NULL;
6008 for (result = dns_zone_first(server->zonemgr, &zone);
6009 result == ISC_R_SUCCESS;
6010 next = NULL, result = dns_zone_next(zone, &next), zone = next) {
6011 dns_view_t *zoneview;
6012
6013 /*
6014 * At this point the zone list may contain a stale zone
6015 * just removed from the configuration. To see the validity,
6016 * check if the corresponding view is in our current view list.
6017 * There may also be old zones that are still in the process
6018 * of shutting down and have detached from their old view
6019 * (zoneview == NULL).
6020 */
6021 zoneview = dns_zone_getview(zone);
6022 if (zoneview == NULL)
6023 continue;
6024 for (view = ISC_LIST_HEAD(server->viewlist);
6025 view != NULL && view != zoneview;
6026 view = ISC_LIST_NEXT(view, link))
6027 ;
6028 if (view == NULL)
6029 continue;
6030
6031 addrp = dns_zone_getnotifysrc6(zone);
6032 dscp = dns_zone_getnotifysrc6dscp(zone);
6033 result = add_listenelt(mctx, list, addrp, dscp, false);
6034 if (result != ISC_R_SUCCESS)
6035 goto fail;
6036
6037 addrp = dns_zone_getxfrsource6(zone);
6038 dscp = dns_zone_getxfrsource6dscp(zone);
6039 result = add_listenelt(mctx, list, addrp, dscp, false);
6040 if (result != ISC_R_SUCCESS)
6041 goto fail;
6042 }
6043
6044 ns_interfacemgr_adjust(server->interfacemgr, list, true);
6045
6046 clean:
6047 ns_listenlist_detach(&list);
6048 return;
6049
6050 fail:
6051 /*
6052 * Even when we failed the procedure, most of other interfaces
6053 * should work correctly. We therefore just warn it.
6054 */
6055 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
6056 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
6057 "could not adjust the listen-on list; "
6058 "some interfaces may not work");
6059 goto clean;
6060 }
6061
6062 /*
6063 * This event callback is invoked to do periodic network interface
6064 * scanning. It is also called by ns_server_scan_interfaces(),
6065 * invoked by "rndc scan"
6066 */
6067
6068 static void
interface_timer_tick(isc_task_t * task,isc_event_t * event)6069 interface_timer_tick(isc_task_t *task, isc_event_t *event) {
6070 isc_result_t result;
6071 ns_server_t *server = (ns_server_t *) event->ev_arg;
6072 INSIST(task == server->task);
6073 UNUSED(task);
6074
6075 isc_event_free(&event);
6076
6077 /*
6078 * XXX should scan interfaces unlocked and get exclusive access
6079 * only to replace ACLs.
6080 */
6081 result = isc_task_beginexclusive(server->task);
6082 RUNTIME_CHECK(result == ISC_R_SUCCESS);
6083 scan_interfaces(server, false);
6084 isc_task_endexclusive(server->task);
6085 }
6086
6087 static void
heartbeat_timer_tick(isc_task_t * task,isc_event_t * event)6088 heartbeat_timer_tick(isc_task_t *task, isc_event_t *event) {
6089 ns_server_t *server = (ns_server_t *) event->ev_arg;
6090 dns_view_t *view;
6091
6092 UNUSED(task);
6093 isc_event_free(&event);
6094 view = ISC_LIST_HEAD(server->viewlist);
6095 while (view != NULL) {
6096 dns_view_dialup(view);
6097 view = ISC_LIST_NEXT(view, link);
6098 }
6099 }
6100
6101 typedef struct {
6102 isc_mem_t *mctx;
6103 isc_task_t *task;
6104 dns_fetch_t *fetch;
6105 dns_view_t *view;
6106 dns_fixedname_t tatname;
6107 dns_fixedname_t keyname;
6108 dns_rdataset_t rdataset;
6109 dns_rdataset_t sigrdataset;
6110 } ns_tat_t;
6111
6112 static int
cid(const void * a,const void * b)6113 cid(const void *a, const void *b) {
6114 const uint16_t ida = *(const uint16_t *)a;
6115 const uint16_t idb = *(const uint16_t *)b;
6116 if (ida < idb)
6117 return (-1);
6118 else if (ida > idb)
6119 return (1);
6120 else
6121 return (0);
6122 }
6123
6124 static void
tat_done(isc_task_t * task,isc_event_t * event)6125 tat_done(isc_task_t *task, isc_event_t *event) {
6126 dns_fetchevent_t *devent;
6127 ns_tat_t *tat;
6128
6129 INSIST(event != NULL && event->ev_type == DNS_EVENT_FETCHDONE);
6130 INSIST(event->ev_arg != NULL);
6131
6132 UNUSED(task);
6133
6134 tat = event->ev_arg;
6135 devent = (dns_fetchevent_t *) event;
6136
6137 /* Free resources which are not of interest */
6138 if (devent->node != NULL)
6139 dns_db_detachnode(devent->db, &devent->node);
6140 if (devent->db != NULL)
6141 dns_db_detach(&devent->db);
6142 isc_event_free(&event);
6143 dns_resolver_destroyfetch(&tat->fetch);
6144 if (dns_rdataset_isassociated(&tat->rdataset))
6145 dns_rdataset_disassociate(&tat->rdataset);
6146 if (dns_rdataset_isassociated(&tat->sigrdataset))
6147 dns_rdataset_disassociate(&tat->sigrdataset);
6148 dns_view_detach(&tat->view);
6149 isc_task_detach(&tat->task);
6150 isc_mem_putanddetach(&tat->mctx, tat, sizeof(*tat));
6151 }
6152
6153 struct dotat_arg {
6154 dns_view_t *view;
6155 isc_task_t *task;
6156 };
6157
6158 /*%
6159 * Prepare the QNAME for the TAT query to be sent by processing the trust
6160 * anchors present at 'keynode' of 'keytable'. Store the result in 'dst' and
6161 * the domain name which 'keynode' is associated with in 'keyname'.
6162 *
6163 * A maximum of 12 key IDs can be reported in a single TAT query due to the
6164 * 63-octet length limit for any single label in a domain name. If there are
6165 * more than 12 keys configured at 'keynode', only the first 12 will be
6166 * reported in the TAT query.
6167 */
6168 static isc_result_t
get_tat_qname(dns_name_t * dst,dns_name_t ** keyname,dns_keytable_t * keytable,dns_keynode_t * keynode)6169 get_tat_qname(dns_name_t *dst, dns_name_t **keyname, dns_keytable_t *keytable,
6170 dns_keynode_t *keynode)
6171 {
6172 dns_keynode_t *firstnode = keynode;
6173 dns_keynode_t *nextnode;
6174 unsigned int i, n = 0;
6175 uint16_t ids[12];
6176 isc_textregion_t r;
6177 char label[64];
6178 int m;
6179
6180 REQUIRE(keyname != NULL && *keyname == NULL);
6181
6182 do {
6183 dst_key_t *key = dns_keynode_key(keynode);
6184 if (key != NULL) {
6185 *keyname = dst_key_name(key);
6186 if (n < (sizeof(ids)/sizeof(ids[0]))) {
6187 ids[n] = dst_key_id(key);
6188 n++;
6189 }
6190 }
6191 nextnode = NULL;
6192 (void)dns_keytable_nextkeynode(keytable, keynode, &nextnode);
6193 if (keynode != firstnode)
6194 dns_keytable_detachkeynode(keytable, &keynode);
6195 keynode = nextnode;
6196 } while (keynode != NULL);
6197
6198 if (n == 0) {
6199 return (DNS_R_EMPTYNAME);
6200 }
6201
6202 if (n > 1)
6203 qsort(ids, n, sizeof(ids[0]), cid);
6204
6205 /*
6206 * Encoded as "_ta-xxxx\(-xxxx\)*" where xxxx is the hex version of
6207 * of the keyid.
6208 */
6209 label[0] = 0;
6210 r.base = label;
6211 r.length = sizeof(label);;
6212 m = snprintf(r.base, r.length, "_ta");
6213 if (m < 0 || (unsigned)m > r.length) {
6214 return (ISC_R_FAILURE);
6215 }
6216 isc_textregion_consume(&r, m);
6217 for (i = 0; i < n; i++) {
6218 m = snprintf(r.base, r.length, "-%04x", ids[i]);
6219 if (m < 0 || (unsigned)m > r.length) {
6220 return (ISC_R_FAILURE);
6221 }
6222 isc_textregion_consume(&r, m);
6223 }
6224
6225 return (dns_name_fromstring2(dst, label, *keyname, 0, NULL));
6226 }
6227
6228 static void
tat_send(isc_task_t * task,isc_event_t * event)6229 tat_send(isc_task_t *task, isc_event_t *event) {
6230 ns_tat_t *tat;
6231 char namebuf[DNS_NAME_FORMATSIZE];
6232 dns_fixedname_t fdomain;
6233 dns_name_t *domain;
6234 dns_rdataset_t nameservers;
6235 isc_result_t result;
6236 dns_name_t *keyname;
6237 dns_name_t *tatname;
6238
6239 INSIST(event != NULL && event->ev_type == NS_EVENT_TATSEND);
6240 INSIST(event->ev_arg != NULL);
6241
6242 UNUSED(task);
6243
6244 tat = event->ev_arg;
6245
6246 tatname = dns_fixedname_name(&tat->tatname);
6247 keyname = dns_fixedname_name(&tat->keyname);
6248
6249 dns_name_format(tatname, namebuf, sizeof(namebuf));
6250 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
6251 ISC_LOG_INFO,
6252 "%s: sending trust-anchor-telemetry query '%s/NULL'",
6253 tat->view->name, namebuf);
6254
6255 /*
6256 * TAT queries should be sent to the authoritative servers for a given
6257 * zone. If this function is called for a keytable node corresponding
6258 * to a locally served zone, calling dns_resolver_createfetch() with
6259 * NULL 'domain' and 'nameservers' arguments will cause 'tatname' to be
6260 * resolved locally, without sending any TAT queries upstream.
6261 *
6262 * Work around this issue by calling dns_view_findzonecut() first. If
6263 * the zone is served locally, the NS RRset for the given domain name
6264 * will be retrieved from local data; if it is not, the deepest zone
6265 * cut we have for it will be retrieved from cache. In either case,
6266 * passing the results to dns_resolver_createfetch() will prevent it
6267 * from returning NXDOMAIN for 'tatname' while still allowing it to
6268 * chase down any potential delegations returned by upstream servers in
6269 * order to eventually find the destination host to send the TAT query
6270 * to.
6271 *
6272 * 'keyname' holds the domain name at 'keynode', i.e. the domain name
6273 * for which the trust anchors to be reported by this TAT query are
6274 * defined.
6275 *
6276 * After the dns_view_findzonecut() call, 'domain' will hold the
6277 * deepest zone cut we can find for 'keyname' while 'nameservers' will
6278 * hold the NS RRset at that zone cut.
6279 */
6280 domain = dns_fixedname_initname(&fdomain);
6281 dns_rdataset_init(&nameservers);
6282 result = dns_view_findzonecut(tat->view, keyname, domain, 0, 0, true,
6283 &nameservers, NULL);
6284 if (result == ISC_R_SUCCESS) {
6285 result = dns_resolver_createfetch(tat->view->resolver, tatname,
6286 dns_rdatatype_null, domain,
6287 &nameservers, NULL, 0,
6288 tat->task, tat_done, tat,
6289 &tat->rdataset,
6290 &tat->sigrdataset,
6291 &tat->fetch);
6292 }
6293
6294 /*
6295 * 'domain' holds the dns_name_t pointer inside a dst_key_t structure.
6296 * dns_resolver_createfetch() creates its own copy of 'domain' if it
6297 * succeeds. Thus, 'domain' is not freed here.
6298 *
6299 * Even if dns_view_findzonecut() returned something else than
6300 * ISC_R_SUCCESS, it still could have associated 'nameservers'.
6301 * dns_resolver_createfetch() creates its own copy of 'nameservers' if
6302 * it succeeds. Thus, we need to check whether 'nameservers' is
6303 * associated and release it if it is.
6304 */
6305 if (dns_rdataset_isassociated(&nameservers)) {
6306 dns_rdataset_disassociate(&nameservers);
6307 }
6308
6309 if (result != ISC_R_SUCCESS) {
6310 dns_view_detach(&tat->view);
6311 isc_task_detach(&tat->task);
6312 isc_mem_putanddetach(&tat->mctx, tat, sizeof(*tat));
6313 }
6314 isc_event_free(&event);
6315 }
6316
6317 static void
dotat(dns_keytable_t * keytable,dns_keynode_t * keynode,void * arg)6318 dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
6319 struct dotat_arg *dotat_arg = arg;
6320 dns_name_t *keyname = NULL;
6321 isc_result_t result;
6322 dns_view_t *view;
6323 isc_task_t *task;
6324 ns_tat_t *tat;
6325 isc_event_t *event;
6326
6327 REQUIRE(keytable != NULL);
6328 REQUIRE(keynode != NULL);
6329 REQUIRE(dotat_arg != NULL);
6330
6331 view = dotat_arg->view;
6332 task = dotat_arg->task;
6333
6334 tat = isc_mem_get(dotat_arg->view->mctx, sizeof(*tat));
6335
6336 tat->fetch = NULL;
6337 tat->mctx = NULL;
6338 tat->task = NULL;
6339 tat->view = NULL;
6340 dns_rdataset_init(&tat->rdataset);
6341 dns_rdataset_init(&tat->sigrdataset);
6342 result = get_tat_qname(dns_fixedname_initname(&tat->tatname), &keyname,
6343 keytable, keynode);
6344 if (result != ISC_R_SUCCESS) {
6345 isc_mem_put(dotat_arg->view->mctx, tat, sizeof(*tat));
6346 return;
6347 }
6348 dns_name_copy(keyname, dns_fixedname_initname(&tat->keyname), NULL);
6349 isc_mem_attach(dotat_arg->view->mctx, &tat->mctx);
6350 isc_task_attach(task, &tat->task);
6351 dns_view_attach(view, &tat->view);
6352
6353 /*
6354 * We don't want to be holding the keytable lock when calling
6355 * dns_view_findzonecut() as it creates a lock order loop so
6356 * call dns_view_findzonecut() in a event handler.
6357 *
6358 * zone->lock (dns_zone_setviewcommit) while holding view->lock
6359 * (dns_view_setviewcommit)
6360 *
6361 * keytable->lock (dns_keytable_find) while holding zone->lock
6362 * (zone_asyncload)
6363 *
6364 * view->lock (dns_view_findzonecut) while holding keytable->lock
6365 * (dns_keytable_forall)
6366 */
6367 event = isc_event_allocate(tat->mctx, keytable, NS_EVENT_TATSEND,
6368 tat_send, tat, sizeof(isc_event_t));
6369 isc_task_send(task, &event);
6370 }
6371
6372 static void
tat_timer_tick(isc_task_t * task,isc_event_t * event)6373 tat_timer_tick(isc_task_t *task, isc_event_t *event) {
6374 isc_result_t result;
6375 ns_server_t *server = (ns_server_t *) event->ev_arg;
6376 struct dotat_arg arg;
6377 dns_view_t *view;
6378 dns_keytable_t *secroots = NULL;
6379
6380 isc_event_free(&event);
6381
6382 for (view = ISC_LIST_HEAD(server->viewlist);
6383 view != NULL;
6384 view = ISC_LIST_NEXT(view, link))
6385 {
6386 if (!view->trust_anchor_telemetry ||
6387 !view->enablevalidation)
6388 {
6389 continue;
6390 }
6391
6392 result = dns_view_getsecroots(view, &secroots);
6393 if (result != ISC_R_SUCCESS) {
6394 continue;
6395 }
6396
6397 arg.view = view;
6398 arg.task = task;
6399 (void)dns_keytable_forall(secroots, dotat, &arg);
6400 dns_keytable_detach(&secroots);
6401 }
6402 }
6403
6404 static void
pps_timer_tick(isc_task_t * task,isc_event_t * event)6405 pps_timer_tick(isc_task_t *task, isc_event_t *event) {
6406 static unsigned int oldrequests = 0;
6407 unsigned int requests = ncr_load(ns_client_requests);
6408
6409 UNUSED(task);
6410 isc_event_free(&event);
6411
6412 /*
6413 * Don't worry about wrapping as the overflow result will be right.
6414 */
6415 dns_pps = (requests - oldrequests) / 1200;
6416 oldrequests = requests;
6417 }
6418
6419 /*
6420 * Replace the current value of '*field', a dynamically allocated
6421 * string or NULL, with a dynamically allocated copy of the
6422 * null-terminated string pointed to by 'value', or NULL.
6423 */
6424 static isc_result_t
setstring(ns_server_t * server,char ** field,const char * value)6425 setstring(ns_server_t *server, char **field, const char *value) {
6426 char *copy;
6427
6428 if (value != NULL) {
6429 copy = isc_mem_strdup(server->mctx, value);
6430 if (copy == NULL)
6431 return (ISC_R_NOMEMORY);
6432 } else {
6433 copy = NULL;
6434 }
6435
6436 if (*field != NULL)
6437 isc_mem_free(server->mctx, *field);
6438
6439 *field = copy;
6440 return (ISC_R_SUCCESS);
6441 }
6442
6443 /*
6444 * Replace the current value of '*field', a dynamically allocated
6445 * string or NULL, with another dynamically allocated string
6446 * or NULL if whether 'obj' is a string or void value, respectively.
6447 */
6448 static isc_result_t
setoptstring(ns_server_t * server,char ** field,const cfg_obj_t * obj)6449 setoptstring(ns_server_t *server, char **field, const cfg_obj_t *obj) {
6450 if (cfg_obj_isvoid(obj))
6451 return (setstring(server, field, NULL));
6452 else
6453 return (setstring(server, field, cfg_obj_asstring(obj)));
6454 }
6455
6456 static void
set_limit(const cfg_obj_t ** maps,const char * configname,const char * description,isc_resource_t resourceid,isc_resourcevalue_t defaultvalue)6457 set_limit(const cfg_obj_t **maps, const char *configname,
6458 const char *description, isc_resource_t resourceid,
6459 isc_resourcevalue_t defaultvalue)
6460 {
6461 const cfg_obj_t *obj = NULL;
6462 const char *resource;
6463 isc_resourcevalue_t value;
6464 isc_result_t result;
6465
6466 if (ns_config_get(maps, configname, &obj) != ISC_R_SUCCESS)
6467 return;
6468
6469 if (cfg_obj_isstring(obj)) {
6470 resource = cfg_obj_asstring(obj);
6471 if (strcasecmp(resource, "unlimited") == 0)
6472 value = ISC_RESOURCE_UNLIMITED;
6473 else {
6474 INSIST(strcasecmp(resource, "default") == 0);
6475 value = defaultvalue;
6476 }
6477 } else
6478 value = cfg_obj_asuint64(obj);
6479
6480 result = isc_resource_setlimit(resourceid, value);
6481 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
6482 result == ISC_R_SUCCESS ?
6483 ISC_LOG_DEBUG(3) : ISC_LOG_WARNING,
6484 "set maximum %s to %" PRIu64 ": %s",
6485 description, value, isc_result_totext(result));
6486 }
6487
6488 #define SETLIMIT(cfgvar, resource, description) \
6489 set_limit(maps, cfgvar, description, isc_resource_ ## resource, \
6490 ns_g_init ## resource)
6491
6492 static void
set_limits(const cfg_obj_t ** maps)6493 set_limits(const cfg_obj_t **maps) {
6494 SETLIMIT("stacksize", stacksize, "stack size");
6495 SETLIMIT("datasize", datasize, "data size");
6496 SETLIMIT("coresize", coresize, "core size");
6497 SETLIMIT("files", openfiles, "open files");
6498 }
6499
6500 static void
portset_fromconf(isc_portset_t * portset,const cfg_obj_t * ports,bool positive)6501 portset_fromconf(isc_portset_t *portset, const cfg_obj_t *ports,
6502 bool positive)
6503 {
6504 const cfg_listelt_t *element;
6505
6506 for (element = cfg_list_first(ports);
6507 element != NULL;
6508 element = cfg_list_next(element)) {
6509 const cfg_obj_t *obj = cfg_listelt_value(element);
6510
6511 if (cfg_obj_isuint32(obj)) {
6512 in_port_t port = (in_port_t)cfg_obj_asuint32(obj);
6513
6514 if (positive)
6515 isc_portset_add(portset, port);
6516 else
6517 isc_portset_remove(portset, port);
6518 } else {
6519 const cfg_obj_t *obj_loport, *obj_hiport;
6520 in_port_t loport, hiport;
6521
6522 obj_loport = cfg_tuple_get(obj, "loport");
6523 loport = (in_port_t)cfg_obj_asuint32(obj_loport);
6524 obj_hiport = cfg_tuple_get(obj, "hiport");
6525 hiport = (in_port_t)cfg_obj_asuint32(obj_hiport);
6526
6527 if (positive)
6528 isc_portset_addrange(portset, loport, hiport);
6529 else {
6530 isc_portset_removerange(portset, loport,
6531 hiport);
6532 }
6533 }
6534 }
6535 }
6536
6537 static isc_result_t
removed(dns_zone_t * zone,void * uap)6538 removed(dns_zone_t *zone, void *uap) {
6539 const char *type;
6540
6541 if (dns_zone_getview(zone) != uap)
6542 return (ISC_R_SUCCESS);
6543
6544 switch (dns_zone_gettype(zone)) {
6545 case dns_zone_master:
6546 type = "master";
6547 break;
6548 case dns_zone_slave:
6549 type = "slave";
6550 break;
6551 case dns_zone_stub:
6552 type = "stub";
6553 break;
6554 case dns_zone_staticstub:
6555 type = "static-stub";
6556 break;
6557 case dns_zone_redirect:
6558 type = "redirect";
6559 break;
6560 default:
6561 type = "other";
6562 break;
6563 }
6564 dns_zone_log(zone, ISC_LOG_INFO, "(%s) removed", type);
6565 return (ISC_R_SUCCESS);
6566 }
6567
6568 static void
cleanup_session_key(ns_server_t * server,isc_mem_t * mctx)6569 cleanup_session_key(ns_server_t *server, isc_mem_t *mctx) {
6570 if (server->session_keyfile != NULL) {
6571 isc_file_remove(server->session_keyfile);
6572 isc_mem_free(mctx, server->session_keyfile);
6573 server->session_keyfile = NULL;
6574 }
6575
6576 if (server->session_keyname != NULL) {
6577 if (dns_name_dynamic(server->session_keyname))
6578 dns_name_free(server->session_keyname, mctx);
6579 isc_mem_put(mctx, server->session_keyname, sizeof(dns_name_t));
6580 server->session_keyname = NULL;
6581 }
6582
6583 if (server->sessionkey != NULL)
6584 dns_tsigkey_detach(&server->sessionkey);
6585
6586 server->session_keyalg = DST_ALG_UNKNOWN;
6587 server->session_keybits = 0;
6588 }
6589
6590 static isc_result_t
generate_session_key(const char * filename,const char * keynamestr,dns_name_t * keyname,const char * algstr,dns_name_t * algname,unsigned int algtype,uint16_t bits,isc_mem_t * mctx,bool first_time,dns_tsigkey_t ** tsigkeyp)6591 generate_session_key(const char *filename, const char *keynamestr,
6592 dns_name_t *keyname, const char *algstr,
6593 dns_name_t *algname, unsigned int algtype,
6594 uint16_t bits, isc_mem_t *mctx, bool first_time,
6595 dns_tsigkey_t **tsigkeyp)
6596 {
6597 isc_result_t result = ISC_R_SUCCESS;
6598 dst_key_t *key = NULL;
6599 isc_buffer_t key_txtbuffer;
6600 isc_buffer_t key_rawbuffer;
6601 char key_txtsecret[256];
6602 char key_rawsecret[64];
6603 isc_region_t key_rawregion;
6604 isc_stdtime_t now;
6605 dns_tsigkey_t *tsigkey = NULL;
6606 FILE *fp = NULL;
6607
6608 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
6609 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
6610 "generating session key for dynamic DNS");
6611
6612 /* generate key */
6613 result = dst_key_generate(keyname, algtype, bits, 1, 0,
6614 DNS_KEYPROTO_ANY, dns_rdataclass_in,
6615 mctx, &key);
6616 if (result != ISC_R_SUCCESS)
6617 return (result);
6618
6619 /*
6620 * Dump the key to the buffer for later use. Should be done before
6621 * we transfer the ownership of key to tsigkey.
6622 */
6623 isc_buffer_init(&key_rawbuffer, &key_rawsecret, sizeof(key_rawsecret));
6624 CHECK(dst_key_tobuffer(key, &key_rawbuffer));
6625
6626 isc_buffer_usedregion(&key_rawbuffer, &key_rawregion);
6627 isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));
6628 CHECK(isc_base64_totext(&key_rawregion, -1, "", &key_txtbuffer));
6629
6630 /* Store the key in tsigkey. */
6631 isc_stdtime_get(&now);
6632 CHECK(dns_tsigkey_createfromkey(dst_key_name(key), algname, key,
6633 false, NULL, now, now, mctx, NULL,
6634 &tsigkey));
6635
6636 /* Dump the key to the key file. */
6637 fp = ns_os_openfile(filename, S_IRUSR|S_IWUSR, first_time);
6638 if (fp == NULL) {
6639 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
6640 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
6641 "could not create %s", filename);
6642 result = ISC_R_NOPERM;
6643 goto cleanup;
6644 }
6645
6646 fprintf(fp, "key \"%s\" {\n"
6647 "\talgorithm %s;\n"
6648 "\tsecret \"%.*s\";\n};\n", keynamestr, algstr,
6649 (int) isc_buffer_usedlength(&key_txtbuffer),
6650 (char*) isc_buffer_base(&key_txtbuffer));
6651
6652 CHECK(isc_stdio_flush(fp));
6653 result = isc_stdio_close(fp);
6654 fp = NULL;
6655 if (result != ISC_R_SUCCESS)
6656 goto cleanup;
6657
6658 dst_key_free(&key);
6659
6660 *tsigkeyp = tsigkey;
6661
6662 return (ISC_R_SUCCESS);
6663
6664 cleanup:
6665 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
6666 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
6667 "failed to generate session key "
6668 "for dynamic DNS: %s", isc_result_totext(result));
6669 if (fp != NULL) {
6670 (void)isc_stdio_close(fp);
6671 (void)isc_file_remove(filename);
6672 }
6673 if (tsigkey != NULL)
6674 dns_tsigkey_detach(&tsigkey);
6675 if (key != NULL)
6676 dst_key_free(&key);
6677
6678 return (result);
6679 }
6680
6681 static isc_result_t
configure_session_key(const cfg_obj_t ** maps,ns_server_t * server,isc_mem_t * mctx,bool first_time)6682 configure_session_key(const cfg_obj_t **maps, ns_server_t *server,
6683 isc_mem_t *mctx, bool first_time)
6684 {
6685 const char *keyfile, *keynamestr, *algstr;
6686 unsigned int algtype;
6687 dns_fixedname_t fname;
6688 dns_name_t *keyname, *algname;
6689 isc_buffer_t buffer;
6690 uint16_t bits;
6691 const cfg_obj_t *obj;
6692 bool need_deleteold = false;
6693 bool need_createnew = false;
6694 isc_result_t result;
6695
6696 obj = NULL;
6697 result = ns_config_get(maps, "session-keyfile", &obj);
6698 if (result == ISC_R_SUCCESS) {
6699 if (cfg_obj_isvoid(obj))
6700 keyfile = NULL; /* disable it */
6701 else
6702 keyfile = cfg_obj_asstring(obj);
6703 } else
6704 keyfile = ns_g_defaultsessionkeyfile;
6705
6706 obj = NULL;
6707 result = ns_config_get(maps, "session-keyname", &obj);
6708 INSIST(result == ISC_R_SUCCESS);
6709 keynamestr = cfg_obj_asstring(obj);
6710 isc_buffer_constinit(&buffer, keynamestr, strlen(keynamestr));
6711 isc_buffer_add(&buffer, strlen(keynamestr));
6712 keyname = dns_fixedname_initname(&fname);
6713 result = dns_name_fromtext(keyname, &buffer, dns_rootname, 0, NULL);
6714 if (result != ISC_R_SUCCESS)
6715 return (result);
6716
6717 obj = NULL;
6718 result = ns_config_get(maps, "session-keyalg", &obj);
6719 INSIST(result == ISC_R_SUCCESS);
6720 algstr = cfg_obj_asstring(obj);
6721 algname = NULL;
6722 result = ns_config_getkeyalgorithm2(algstr, &algname, &algtype, &bits);
6723 if (result != ISC_R_SUCCESS) {
6724 const char *s = " (keeping current key)";
6725
6726 cfg_obj_log(obj, ns_g_lctx, ISC_LOG_ERROR, "session-keyalg: "
6727 "unsupported or unknown algorithm '%s'%s",
6728 algstr,
6729 server->session_keyfile != NULL ? s : "");
6730 return (result);
6731 }
6732
6733 /* See if we need to (re)generate a new key. */
6734 if (keyfile == NULL) {
6735 if (server->session_keyfile != NULL)
6736 need_deleteold = true;
6737 } else if (server->session_keyfile == NULL)
6738 need_createnew = true;
6739 else if (strcmp(keyfile, server->session_keyfile) != 0 ||
6740 !dns_name_equal(server->session_keyname, keyname) ||
6741 server->session_keyalg != algtype ||
6742 server->session_keybits != bits) {
6743 need_deleteold = true;
6744 need_createnew = true;
6745 }
6746
6747 if (need_deleteold) {
6748 INSIST(server->session_keyfile != NULL);
6749 INSIST(server->session_keyname != NULL);
6750 INSIST(server->sessionkey != NULL);
6751
6752 cleanup_session_key(server, mctx);
6753 }
6754
6755 if (need_createnew) {
6756 INSIST(server->sessionkey == NULL);
6757 INSIST(server->session_keyfile == NULL);
6758 INSIST(server->session_keyname == NULL);
6759 INSIST(server->session_keyalg == DST_ALG_UNKNOWN);
6760 INSIST(server->session_keybits == 0);
6761
6762 server->session_keyname = isc_mem_get(mctx, sizeof(dns_name_t));
6763 if (server->session_keyname == NULL)
6764 goto cleanup;
6765 dns_name_init(server->session_keyname, NULL);
6766 CHECK(dns_name_dup(keyname, mctx, server->session_keyname));
6767
6768 server->session_keyfile = isc_mem_strdup(mctx, keyfile);
6769 if (server->session_keyfile == NULL)
6770 goto cleanup;
6771
6772 server->session_keyalg = algtype;
6773 server->session_keybits = bits;
6774
6775 CHECK(generate_session_key(keyfile, keynamestr, keyname, algstr,
6776 algname, algtype, bits, mctx,
6777 first_time, &server->sessionkey));
6778 }
6779
6780 return (result);
6781
6782 cleanup:
6783 cleanup_session_key(server, mctx);
6784 return (result);
6785 }
6786
6787 #ifndef HAVE_LMDB
6788 static isc_result_t
count_newzones(dns_view_t * view,ns_cfgctx_t * nzcfg,int * num_zonesp)6789 count_newzones(dns_view_t *view, ns_cfgctx_t *nzcfg, int *num_zonesp) {
6790 isc_result_t result;
6791
6792 /* The new zone file may not exist. That is OK. */
6793 if (!isc_file_exists(view->new_zone_file)) {
6794 *num_zonesp = 0;
6795 return (ISC_R_SUCCESS);
6796 }
6797
6798 /*
6799 * In the case of NZF files, we also parse the configuration in
6800 * the file at this stage.
6801 *
6802 * This may be called in multiple views, so we reset
6803 * the parser each time.
6804 */
6805 cfg_parser_reset(ns_g_addparser);
6806 result = cfg_parse_file(ns_g_addparser, view->new_zone_file,
6807 &cfg_type_addzoneconf, &nzcfg->nzf_config);
6808 if (result == ISC_R_SUCCESS) {
6809 int num_zones;
6810
6811 num_zones = count_zones(nzcfg->nzf_config);
6812 isc_log_write(ns_g_lctx,
6813 NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
6814 ISC_LOG_INFO,
6815 "NZF file '%s' contains %d zones",
6816 view->new_zone_file, num_zones);
6817 if (num_zonesp != NULL)
6818 *num_zonesp = num_zones;
6819 } else {
6820 isc_log_write(ns_g_lctx,
6821 NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
6822 ISC_LOG_ERROR,
6823 "Error parsing NZF file '%s': %s",
6824 view->new_zone_file,
6825 isc_result_totext(result));
6826 }
6827
6828 return (result);
6829 }
6830
6831 #else /* HAVE_LMDB */
6832
6833 static isc_result_t
count_newzones(dns_view_t * view,ns_cfgctx_t * nzcfg,int * num_zonesp)6834 count_newzones(dns_view_t *view, ns_cfgctx_t *nzcfg, int *num_zonesp) {
6835 isc_result_t result;
6836 int n;
6837
6838 UNUSED(nzcfg);
6839
6840 REQUIRE(num_zonesp != NULL);
6841
6842 LOCK(&view->new_zone_lock);
6843
6844 CHECK(migrate_nzf(view));
6845
6846 isc_log_write(ns_g_lctx,
6847 NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
6848 ISC_LOG_INFO, "loading NZD zone count from '%s' "
6849 "for view '%s'",
6850 view->new_zone_db, view->name);
6851
6852 CHECK(nzd_count(view, &n));
6853
6854 *num_zonesp = n;
6855
6856 isc_log_write(ns_g_lctx,
6857 NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
6858 ISC_LOG_INFO,
6859 "NZD database '%s' contains %d zones",
6860 view->new_zone_db, n);
6861
6862 cleanup:
6863 if (result != ISC_R_SUCCESS)
6864 *num_zonesp = 0;
6865
6866 UNLOCK(&view->new_zone_lock);
6867
6868 return (ISC_R_SUCCESS);
6869 }
6870
6871 #endif /* HAVE_LMDB */
6872
6873 static isc_result_t
setup_newzones(dns_view_t * view,cfg_obj_t * config,cfg_obj_t * vconfig,cfg_parser_t * conf_parser,cfg_aclconfctx_t * actx,int * num_zones)6874 setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
6875 cfg_parser_t *conf_parser, cfg_aclconfctx_t *actx,
6876 int *num_zones)
6877 {
6878 isc_result_t result = ISC_R_SUCCESS;
6879 bool allow = false;
6880 ns_cfgctx_t *nzcfg = NULL;
6881 const cfg_obj_t *maps[4];
6882 const cfg_obj_t *options = NULL, *voptions = NULL;
6883 const cfg_obj_t *nz = NULL;
6884 const cfg_obj_t *obj = NULL;
6885 int i = 0;
6886 uint64_t mapsize = 0ULL;
6887
6888 REQUIRE(config != NULL);
6889
6890 if (vconfig != NULL)
6891 voptions = cfg_tuple_get(vconfig, "options");
6892 if (voptions != NULL)
6893 maps[i++] = voptions;
6894 result = cfg_map_get(config, "options", &options);
6895 if (result == ISC_R_SUCCESS)
6896 maps[i++] = options;
6897 maps[i++] = ns_g_defaults;
6898 maps[i] = NULL;
6899
6900 result = ns_config_get(maps, "allow-new-zones", &nz);
6901 if (result == ISC_R_SUCCESS)
6902 allow = cfg_obj_asboolean(nz);
6903
6904 #ifdef HAVE_LMDB
6905 result = ns_config_get(maps, "lmdb-mapsize", &obj);
6906 if (result == ISC_R_SUCCESS && obj != NULL) {
6907 mapsize = cfg_obj_asuint64(obj);
6908 if (mapsize < (1ULL << 20)) { /* 1 megabyte */
6909 cfg_obj_log(obj, ns_g_lctx,
6910 ISC_LOG_ERROR,
6911 "'lmdb-mapsize "
6912 "%" PRId64 "' "
6913 "is too small",
6914 mapsize);
6915 return (ISC_R_FAILURE);
6916 } else if (mapsize > (1ULL << 40)) { /* 1 terabyte */
6917 cfg_obj_log(obj, ns_g_lctx,
6918 ISC_LOG_ERROR,
6919 "'lmdb-mapsize "
6920 "%" PRId64 "' "
6921 "is too large",
6922 mapsize);
6923 return (ISC_R_FAILURE);
6924 }
6925 }
6926 #else
6927 UNUSED(obj);
6928 #endif /* HAVE_LMDB */
6929
6930 /*
6931 * A non-empty catalog-zones statement implies allow-new-zones
6932 */
6933 if (!allow) {
6934 const cfg_obj_t *cz = NULL;
6935 result = ns_config_get(maps, "catalog-zones", &cz);
6936 if (result == ISC_R_SUCCESS) {
6937 const cfg_listelt_t *e =
6938 cfg_list_first(cfg_tuple_get(cz, "zone list"));
6939 if (e != NULL)
6940 allow = true;
6941 }
6942 }
6943
6944 if (!allow) {
6945 dns_view_setnewzones(view, false, NULL, NULL, 0ULL);
6946 if (num_zones != NULL)
6947 *num_zones = 0;
6948 return (ISC_R_SUCCESS);
6949 }
6950
6951 nzcfg = isc_mem_get(view->mctx, sizeof(*nzcfg));
6952 if (nzcfg == NULL) {
6953 dns_view_setnewzones(view, false, NULL, NULL, 0ULL);
6954 return (ISC_R_NOMEMORY);
6955 }
6956
6957 /*
6958 * We attach the parser that was used for config as well
6959 * as the one that will be used for added zones, to avoid
6960 * a shutdown race later.
6961 */
6962 memset(nzcfg, 0, sizeof(*nzcfg));
6963 cfg_parser_attach(conf_parser, &nzcfg->conf_parser);
6964 cfg_parser_attach(ns_g_addparser, &nzcfg->add_parser);
6965 isc_mem_attach(view->mctx, &nzcfg->mctx);
6966 cfg_aclconfctx_attach(actx, &nzcfg->actx);
6967
6968 result = dns_view_setnewzones(view, allow, nzcfg,
6969 newzone_cfgctx_destroy, mapsize);
6970 if (result != ISC_R_SUCCESS) {
6971 dns_view_setnewzones(view, false, NULL, NULL, 0ULL);
6972 return (result);
6973 }
6974
6975 cfg_obj_attach(config, &nzcfg->config);
6976 if (vconfig != NULL)
6977 cfg_obj_attach(vconfig, &nzcfg->vconfig);
6978
6979 result = count_newzones(view, nzcfg, num_zones);
6980 return (result);
6981 }
6982
6983 static void
configure_zone_setviewcommit(isc_result_t result,const cfg_obj_t * zconfig,dns_view_t * view)6984 configure_zone_setviewcommit(isc_result_t result, const cfg_obj_t *zconfig,
6985 dns_view_t *view)
6986 {
6987 const char *zname;
6988 dns_fixedname_t fixorigin;
6989 dns_name_t *origin;
6990 isc_result_t result2;
6991 dns_view_t *pview = NULL;
6992 dns_zone_t *zone = NULL;
6993 dns_zone_t *raw = NULL;
6994
6995 zname = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
6996 origin = dns_fixedname_initname(&fixorigin);
6997
6998 result2 = dns_name_fromstring(origin, zname, 0, NULL);
6999 if (result2 != ISC_R_SUCCESS) {
7000 return;
7001 }
7002
7003 result2 = dns_viewlist_find(&ns_g_server->viewlist, view->name,
7004 view->rdclass, &pview);
7005 if (result2 != ISC_R_SUCCESS) {
7006 return;
7007 }
7008
7009 result2 = dns_view_findzone(pview, origin, &zone);
7010 if (result2 != ISC_R_SUCCESS) {
7011 dns_view_detach(&pview);
7012 return;
7013 }
7014
7015 dns_zone_getraw(zone, &raw);
7016
7017 if (result == ISC_R_SUCCESS) {
7018 dns_zone_setviewcommit(zone);
7019 if (raw != NULL)
7020 dns_zone_setviewcommit(raw);
7021 } else {
7022 dns_zone_setviewrevert(zone);
7023 if (raw != NULL)
7024 dns_zone_setviewrevert(raw);
7025 }
7026
7027 if (raw != NULL) {
7028 dns_zone_detach(&raw);
7029 }
7030
7031 dns_zone_detach(&zone);
7032 dns_view_detach(&pview);
7033 }
7034
7035 #ifndef HAVE_LMDB
7036
7037 static isc_result_t
configure_newzones(dns_view_t * view,cfg_obj_t * config,cfg_obj_t * vconfig,isc_mem_t * mctx,cfg_aclconfctx_t * actx)7038 configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
7039 isc_mem_t *mctx, cfg_aclconfctx_t *actx)
7040 {
7041 isc_result_t result;
7042 ns_cfgctx_t *nzctx;
7043 const cfg_obj_t *zonelist;
7044 const cfg_listelt_t *element;
7045
7046 nzctx = view->new_zone_config;
7047 if (nzctx == NULL || nzctx->nzf_config == NULL) {
7048 return (ISC_R_SUCCESS);
7049 }
7050
7051 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
7052 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
7053 "loading additional zones for view '%s'",
7054 view->name);
7055
7056 zonelist = NULL;
7057 cfg_map_get(nzctx->nzf_config, "zone", &zonelist);
7058
7059 for (element = cfg_list_first(zonelist);
7060 element != NULL;
7061 element = cfg_list_next(element))
7062 {
7063 const cfg_obj_t *zconfig = cfg_listelt_value(element);
7064 CHECK(configure_zone(config, zconfig, vconfig, mctx,
7065 view, &ns_g_server->viewlist, actx,
7066 true, false, false));
7067 }
7068
7069 result = ISC_R_SUCCESS;
7070
7071 cleanup:
7072 for (element = cfg_list_first(zonelist);
7073 element != NULL;
7074 element = cfg_list_next(element))
7075 {
7076 const cfg_obj_t *zconfig = cfg_listelt_value(element);
7077 configure_zone_setviewcommit(result, zconfig, view);
7078 }
7079
7080 return (result);
7081 }
7082
7083 #else /* HAVE_LMDB */
7084
7085 static isc_result_t
data_to_cfg(dns_view_t * view,MDB_val * key,MDB_val * data,isc_buffer_t ** text,cfg_obj_t ** zoneconfig)7086 data_to_cfg(dns_view_t *view, MDB_val *key, MDB_val *data,
7087 isc_buffer_t **text, cfg_obj_t **zoneconfig)
7088 {
7089 isc_result_t result;
7090 const char *zone_name;
7091 size_t zone_name_len;
7092 const char *zone_config;
7093 size_t zone_config_len;
7094 cfg_obj_t *zoneconf = NULL;
7095 char bufname[DNS_NAME_FORMATSIZE];
7096
7097 REQUIRE(view != NULL);
7098 REQUIRE(key != NULL);
7099 REQUIRE(data != NULL);
7100 REQUIRE(text != NULL);
7101 REQUIRE(zoneconfig != NULL && *zoneconfig == NULL);
7102
7103 if (*text == NULL) {
7104 result = isc_buffer_allocate(view->mctx, text, 256);
7105 if (result != ISC_R_SUCCESS)
7106 goto cleanup;
7107 } else {
7108 isc_buffer_clear(*text);
7109 }
7110
7111 zone_name = (const char *) key->mv_data;
7112 zone_name_len = key->mv_size;
7113 INSIST(zone_name != NULL && zone_name_len > 0);
7114
7115 zone_config = (const char *) data->mv_data;
7116 zone_config_len = data->mv_size;
7117 INSIST(zone_config != NULL && zone_config_len > 0);
7118
7119 /* zone zonename { config; }; */
7120 result = isc_buffer_reserve(text, 6 + zone_name_len + 2 +
7121 zone_config_len + 2);
7122 if (result != ISC_R_SUCCESS) {
7123 goto cleanup;
7124 }
7125
7126 CHECK(putstr(text, "zone \""));
7127 CHECK(putmem(text, (const void *) zone_name, zone_name_len));
7128 CHECK(putstr(text, "\" "));
7129 CHECK(putmem(text, (const void *) zone_config, zone_config_len));
7130 CHECK(putstr(text, ";\n"));
7131
7132 cfg_parser_reset(ns_g_addparser);
7133 result = cfg_parse_buffer3(ns_g_addparser, *text, bufname, 0,
7134 &cfg_type_addzoneconf, &zoneconf);
7135 if (result != ISC_R_SUCCESS) {
7136 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
7137 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
7138 "parsing config for zone '%.*s' in "
7139 "NZD database '%s' failed",
7140 (int) zone_name_len, zone_name,
7141 view->new_zone_db);
7142 goto cleanup;
7143 }
7144
7145 *zoneconfig = zoneconf;
7146 zoneconf = NULL;
7147 result = ISC_R_SUCCESS;
7148
7149 cleanup:
7150 if (zoneconf != NULL) {
7151 cfg_obj_destroy(ns_g_addparser, &zoneconf);
7152 }
7153
7154 return (result);
7155 }
7156
7157 /*%
7158 * Prototype for a callback which can be used with for_all_newzone_cfgs().
7159 */
7160 typedef isc_result_t (*newzone_cfg_cb_t)(const cfg_obj_t *zconfig,
7161 cfg_obj_t *config, cfg_obj_t *vconfig,
7162 isc_mem_t *mctx, dns_view_t *view,
7163 cfg_aclconfctx_t *actx);
7164
7165 /*%
7166 * For each zone found in a NZD opened by the caller, create an object
7167 * representing its configuration and invoke "callback" with the created
7168 * object, "config", "vconfig", "mctx", "view" and "actx" as arguments (all
7169 * these are non-global variables required to invoke configure_zone()).
7170 * Immediately interrupt processing if an error is encountered while
7171 * transforming NZD data into a zone configuration object or if "callback"
7172 * returns an error.
7173 *
7174 * Caller must hold 'view->new_zone_lock'.
7175 */
7176 static isc_result_t
for_all_newzone_cfgs(newzone_cfg_cb_t callback,cfg_obj_t * config,cfg_obj_t * vconfig,isc_mem_t * mctx,dns_view_t * view,cfg_aclconfctx_t * actx,MDB_txn * txn,MDB_dbi dbi)7177 for_all_newzone_cfgs(newzone_cfg_cb_t callback, cfg_obj_t *config,
7178 cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
7179 cfg_aclconfctx_t *actx, MDB_txn *txn, MDB_dbi dbi)
7180 {
7181 const cfg_obj_t *zconfig, *zlist;
7182 isc_result_t result = ISC_R_SUCCESS;
7183 cfg_obj_t *zconfigobj = NULL;
7184 isc_buffer_t *text = NULL;
7185 MDB_cursor *cursor = NULL;
7186 MDB_val data, key;
7187 int status;
7188
7189 status = mdb_cursor_open(txn, dbi, &cursor);
7190 if (status != MDB_SUCCESS) {
7191 return (ISC_R_FAILURE);
7192 }
7193
7194 for (status = mdb_cursor_get(cursor, &key, &data, MDB_FIRST);
7195 status == MDB_SUCCESS;
7196 status = mdb_cursor_get(cursor, &key, &data, MDB_NEXT))
7197 {
7198 /*
7199 * Create a configuration object from data fetched from NZD.
7200 */
7201 result = data_to_cfg(view, &key, &data, &text, &zconfigobj);
7202 if (result != ISC_R_SUCCESS) {
7203 break;
7204 }
7205
7206 /*
7207 * Extract zone configuration from configuration object.
7208 */
7209 zlist = NULL;
7210 result = cfg_map_get(zconfigobj, "zone", &zlist);
7211 if (result != ISC_R_SUCCESS) {
7212 break;
7213 } else if (!cfg_obj_islist(zlist)) {
7214 result = ISC_R_FAILURE;
7215 break;
7216 }
7217 zconfig = cfg_listelt_value(cfg_list_first(zlist));
7218
7219 /*
7220 * Invoke callback.
7221 */
7222 result = callback(zconfig, config, vconfig, mctx, view, actx);
7223 if (result != ISC_R_SUCCESS) {
7224 break;
7225 }
7226
7227 /*
7228 * Destroy the configuration object created in this iteration.
7229 */
7230 cfg_obj_destroy(ns_g_addparser, &zconfigobj);
7231 }
7232
7233 if (text != NULL) {
7234 isc_buffer_free(&text);
7235 }
7236 if (zconfigobj != NULL) {
7237 cfg_obj_destroy(ns_g_addparser, &zconfigobj);
7238 }
7239 mdb_cursor_close(cursor);
7240
7241 return (result);
7242 }
7243
7244 /*%
7245 * Attempt to configure a zone found in NZD and return the result.
7246 */
7247 static isc_result_t
configure_newzone(const cfg_obj_t * zconfig,cfg_obj_t * config,cfg_obj_t * vconfig,isc_mem_t * mctx,dns_view_t * view,cfg_aclconfctx_t * actx)7248 configure_newzone(const cfg_obj_t *zconfig, cfg_obj_t *config,
7249 cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
7250 cfg_aclconfctx_t *actx)
7251 {
7252 return (configure_zone(config, zconfig, vconfig, mctx, view,
7253 &ns_g_server->viewlist, actx, true,
7254 false, false));
7255 }
7256
7257 /*%
7258 * Revert new view assignment for a zone found in NZD.
7259 */
7260 static isc_result_t
configure_newzone_revert(const cfg_obj_t * zconfig,cfg_obj_t * config,cfg_obj_t * vconfig,isc_mem_t * mctx,dns_view_t * view,cfg_aclconfctx_t * actx)7261 configure_newzone_revert(const cfg_obj_t *zconfig, cfg_obj_t *config,
7262 cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
7263 cfg_aclconfctx_t *actx)
7264 {
7265 UNUSED(config);
7266 UNUSED(vconfig);
7267 UNUSED(mctx);
7268 UNUSED(actx);
7269
7270 configure_zone_setviewcommit(ISC_R_FAILURE, zconfig, view);
7271
7272 return (ISC_R_SUCCESS);
7273 }
7274
7275 static isc_result_t
configure_newzones(dns_view_t * view,cfg_obj_t * config,cfg_obj_t * vconfig,isc_mem_t * mctx,cfg_aclconfctx_t * actx)7276 configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
7277 isc_mem_t *mctx, cfg_aclconfctx_t *actx)
7278 {
7279 isc_result_t result;
7280 MDB_txn *txn = NULL;
7281 MDB_dbi dbi;
7282
7283 if (view->new_zone_config == NULL) {
7284 return (ISC_R_SUCCESS);
7285 }
7286
7287 LOCK(&view->new_zone_lock);
7288
7289 result = nzd_open(view, MDB_RDONLY, &txn, &dbi);
7290 if (result != ISC_R_SUCCESS) {
7291 UNLOCK(&view->new_zone_lock);
7292 return (ISC_R_SUCCESS);
7293 }
7294
7295 isc_log_write(ns_g_lctx,
7296 NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
7297 ISC_LOG_INFO, "loading NZD configs from '%s' "
7298 "for view '%s'",
7299 view->new_zone_db, view->name);
7300
7301 result = for_all_newzone_cfgs(configure_newzone, config, vconfig, mctx,
7302 view, actx, txn, dbi);
7303 if (result != ISC_R_SUCCESS) {
7304 /*
7305 * An error was encountered while attempting to configure zones
7306 * found in NZD. As this error may have been caused by a
7307 * configure_zone() failure, try restoring a sane configuration
7308 * by reattaching all zones found in NZD to the old view. If
7309 * this also fails, too bad, there is nothing more we can do in
7310 * terms of trying to make things right.
7311 */
7312 (void) for_all_newzone_cfgs(configure_newzone_revert, config,
7313 vconfig, mctx, view, actx, txn,
7314 dbi);
7315 }
7316
7317 (void) nzd_close(&txn, false);
7318
7319 UNLOCK(&view->new_zone_lock);
7320
7321 return (result);
7322 }
7323
7324 static isc_result_t
get_newzone_config(dns_view_t * view,const char * zonename,cfg_obj_t ** zoneconfig)7325 get_newzone_config(dns_view_t *view, const char *zonename,
7326 cfg_obj_t **zoneconfig)
7327 {
7328 isc_result_t result;
7329 int status;
7330 cfg_obj_t *zoneconf = NULL;
7331 isc_buffer_t *text = NULL;
7332 MDB_txn *txn = NULL;
7333 MDB_dbi dbi;
7334 MDB_val key, data;
7335 char zname[DNS_NAME_FORMATSIZE];
7336 dns_fixedname_t fname;
7337 dns_name_t *name;
7338 isc_buffer_t b;
7339
7340 INSIST(zoneconfig != NULL && *zoneconfig == NULL);
7341
7342 LOCK(&view->new_zone_lock);
7343
7344 CHECK(nzd_open(view, MDB_RDONLY, &txn, &dbi));
7345
7346 isc_log_write(ns_g_lctx,
7347 NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
7348 ISC_LOG_INFO, "loading NZD config from '%s' "
7349 "for zone '%s'",
7350 view->new_zone_db, zonename);
7351
7352 /* Normalize zone name */
7353 isc_buffer_constinit(&b, zonename, strlen(zonename));
7354 isc_buffer_add(&b, strlen(zonename));
7355 name = dns_fixedname_initname(&fname);
7356 CHECK(dns_name_fromtext(name, &b, dns_rootname,
7357 DNS_NAME_DOWNCASE, NULL));
7358 dns_name_format(name, zname, sizeof(zname));
7359
7360 key.mv_data = zname;
7361 key.mv_size = strlen(zname);
7362
7363 status = mdb_get(txn, dbi, &key, &data);
7364 if (status != MDB_SUCCESS) {
7365 CHECK(ISC_R_FAILURE);
7366 }
7367
7368 CHECK(data_to_cfg(view, &key, &data, &text, &zoneconf));
7369
7370 *zoneconfig = zoneconf;
7371 zoneconf = NULL;
7372 result = ISC_R_SUCCESS;
7373
7374 cleanup:
7375 (void) nzd_close(&txn, false);
7376
7377 UNLOCK(&view->new_zone_lock);
7378
7379 if (zoneconf != NULL) {
7380 cfg_obj_destroy(ns_g_addparser, &zoneconf);
7381 }
7382 if (text != NULL) {
7383 isc_buffer_free(&text);
7384 }
7385
7386 return (result);
7387 }
7388
7389 #endif /* HAVE_LMDB */
7390
7391 static int
count_zones(const cfg_obj_t * conf)7392 count_zones(const cfg_obj_t *conf) {
7393 const cfg_obj_t *zonelist = NULL;
7394 const cfg_listelt_t *element;
7395 int n = 0;
7396
7397 REQUIRE(conf != NULL);
7398
7399 cfg_map_get(conf, "zone", &zonelist);
7400 for (element = cfg_list_first(zonelist);
7401 element != NULL;
7402 element = cfg_list_next(element))
7403 n++;
7404
7405 return (n);
7406 }
7407
7408 static isc_result_t
check_lockfile(ns_server_t * server,const cfg_obj_t * config,bool first_time)7409 check_lockfile(ns_server_t *server, const cfg_obj_t *config,
7410 bool first_time)
7411 {
7412 isc_result_t result;
7413 const char *filename = NULL;
7414 const cfg_obj_t *maps[3];
7415 const cfg_obj_t *options;
7416 const cfg_obj_t *obj;
7417 int i;
7418
7419 i = 0;
7420 options = NULL;
7421 result = cfg_map_get(config, "options", &options);
7422 if (result == ISC_R_SUCCESS)
7423 maps[i++] = options;
7424 maps[i++] = ns_g_defaults;
7425 maps[i] = NULL;
7426
7427 obj = NULL;
7428 (void) ns_config_get(maps, "lock-file", &obj);
7429
7430 if (!first_time) {
7431 if (obj != NULL && !cfg_obj_isstring(obj) &&
7432 server->lockfile != NULL &&
7433 strcmp(cfg_obj_asstring(obj), server->lockfile) != 0)
7434 isc_log_write(ns_g_lctx,
7435 NS_LOGCATEGORY_GENERAL,
7436 NS_LOGMODULE_SERVER,
7437 ISC_LOG_WARNING,
7438 "changing 'lock-file' "
7439 "has no effect until the "
7440 "server is restarted");
7441
7442 return (ISC_R_SUCCESS);
7443 }
7444
7445 if (obj != NULL) {
7446 if (cfg_obj_isvoid(obj)) {
7447 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
7448 NS_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
7449 "skipping lock-file check ");
7450 return (ISC_R_SUCCESS);
7451 } else if (ns_g_forcelock) {
7452 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
7453 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
7454 "'lock-file' has no effect "
7455 "because the server was run with -X");
7456 server->lockfile = isc_mem_strdup(server->mctx,
7457 ns_g_defaultlockfile);
7458 } else {
7459 filename = cfg_obj_asstring(obj);
7460 server->lockfile = isc_mem_strdup(server->mctx,
7461 filename);
7462 }
7463
7464 if (server->lockfile == NULL)
7465 return (ISC_R_NOMEMORY);
7466 }
7467
7468 if (ns_g_forcelock && ns_g_defaultlockfile != NULL) {
7469 INSIST(server->lockfile == NULL);
7470 server->lockfile = isc_mem_strdup(server->mctx,
7471 ns_g_defaultlockfile);
7472 }
7473
7474 if (server->lockfile == NULL)
7475 return (ISC_R_SUCCESS);
7476
7477 if (ns_os_issingleton(server->lockfile))
7478 return (ISC_R_SUCCESS);
7479
7480 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
7481 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
7482 "could not lock %s; another named "
7483 "process may be running", server->lockfile);
7484 return (ISC_R_FAILURE);
7485 }
7486
7487 static isc_result_t
load_configuration(const char * filename,ns_server_t * server,bool first_time)7488 load_configuration(const char *filename, ns_server_t *server,
7489 bool first_time)
7490 {
7491 cfg_obj_t *config = NULL, *bindkeys = NULL;
7492 cfg_parser_t *conf_parser = NULL, *bindkeys_parser = NULL;
7493 const cfg_listelt_t *element;
7494 const cfg_obj_t *builtin_views;
7495 const cfg_obj_t *maps[3];
7496 const cfg_obj_t *obj;
7497 const cfg_obj_t *options;
7498 const cfg_obj_t *usev4ports, *avoidv4ports, *usev6ports, *avoidv6ports;
7499 const cfg_obj_t *views;
7500 dns_view_t *view = NULL;
7501 dns_view_t *view_next;
7502 dns_viewlist_t tmpviewlist;
7503 dns_viewlist_t viewlist, builtin_viewlist;
7504 in_port_t listen_port, udpport_low, udpport_high;
7505 int i;
7506 int num_zones = 0;
7507 bool exclusive = false;
7508 isc_interval_t interval;
7509 isc_logconfig_t *logc = NULL;
7510 isc_portset_t *v4portset = NULL;
7511 isc_portset_t *v6portset = NULL;
7512 isc_resourcevalue_t nfiles;
7513 isc_result_t result, tresult;
7514 uint32_t heartbeat_interval;
7515 uint32_t interface_interval;
7516 uint32_t reserved;
7517 uint32_t udpsize;
7518 uint32_t transfer_message_size;
7519 ns_cache_t *nsc;
7520 ns_cachelist_t cachelist, tmpcachelist;
7521 ns_altsecret_t *altsecret;
7522 ns_altsecretlist_t altsecrets, tmpaltsecrets;
7523 unsigned int maxsocks;
7524 uint32_t softquota = 0;
7525
7526 ISC_LIST_INIT(viewlist);
7527 ISC_LIST_INIT(builtin_viewlist);
7528 ISC_LIST_INIT(cachelist);
7529 ISC_LIST_INIT(altsecrets);
7530
7531 /* Create the ACL configuration context */
7532 if (ns_g_aclconfctx != NULL) {
7533 cfg_aclconfctx_detach(&ns_g_aclconfctx);
7534 }
7535 CHECK(cfg_aclconfctx_create(ns_g_mctx, &ns_g_aclconfctx));
7536
7537 /*
7538 * Shut down all dyndb instances.
7539 */
7540 dns_dyndb_cleanup(false);
7541
7542 /*
7543 * Parse the global default pseudo-config file.
7544 */
7545 if (first_time) {
7546 result = ns_config_parsedefaults(ns_g_parser, &ns_g_config);
7547 if (result != ISC_R_SUCCESS) {
7548 ns_main_earlyfatal("unable to load "
7549 "internal defaults: %s",
7550 isc_result_totext(result));
7551 }
7552 RUNTIME_CHECK(cfg_map_get(ns_g_config, "options",
7553 &ns_g_defaults) == ISC_R_SUCCESS);
7554 }
7555
7556 /*
7557 * Parse the configuration file using the new config code.
7558 */
7559 config = NULL;
7560
7561 /*
7562 * Unless this is lwresd with the -C option, parse the config file.
7563 */
7564 if (!(ns_g_lwresdonly && lwresd_g_useresolvconf)) {
7565 isc_log_write(ns_g_lctx,
7566 NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
7567 ISC_LOG_INFO, "loading configuration from '%s'",
7568 filename);
7569 CHECK(cfg_parser_create(ns_g_mctx, ns_g_lctx, &conf_parser));
7570 cfg_parser_setcallback(conf_parser, directory_callback, NULL);
7571 result = cfg_parse_file(conf_parser, filename,
7572 &cfg_type_namedconf, &config);
7573 }
7574
7575 /*
7576 * If this is lwresd with the -C option, or lwresd with no -C or -c
7577 * option where the above parsing failed, parse resolv.conf.
7578 */
7579 if (ns_g_lwresdonly &&
7580 (lwresd_g_useresolvconf ||
7581 (!ns_g_conffileset && result == ISC_R_FILENOTFOUND)))
7582 {
7583 isc_log_write(ns_g_lctx,
7584 NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
7585 ISC_LOG_INFO, "loading configuration from '%s'",
7586 lwresd_g_resolvconffile);
7587 if (conf_parser != NULL) {
7588 cfg_parser_destroy(&conf_parser);
7589 }
7590 CHECK(cfg_parser_create(ns_g_mctx, ns_g_lctx, &conf_parser));
7591 result = ns_lwresd_parseeresolvconf(ns_g_mctx, conf_parser,
7592 &config);
7593 }
7594 CHECK(result);
7595
7596 /*
7597 * Check the validity of the configuration.
7598 */
7599 CHECK(bind9_check_namedconf(config, ns_g_lctx, ns_g_mctx));
7600
7601 /*
7602 * Fill in the maps array, used for resolving defaults.
7603 */
7604 i = 0;
7605 options = NULL;
7606 result = cfg_map_get(config, "options", &options);
7607 if (result == ISC_R_SUCCESS) {
7608 maps[i++] = options;
7609 }
7610 maps[i++] = ns_g_defaults;
7611 maps[i] = NULL;
7612
7613 /*
7614 * If bind.keys exists, load it. If "dnssec-validation auto"
7615 * is turned on, the root key found there will be used as a
7616 * default trust anchor.
7617 */
7618 obj = NULL;
7619 result = ns_config_get(maps, "bindkeys-file", &obj);
7620 INSIST(result == ISC_R_SUCCESS);
7621 CHECKM(setstring(server, &server->bindkeysfile,
7622 cfg_obj_asstring(obj)), "strdup");
7623 INSIST(server->bindkeysfile != NULL);
7624
7625 if (access(server->bindkeysfile, R_OK) == 0) {
7626 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
7627 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
7628 "reading built-in trust anchors "
7629 "from file '%s'", server->bindkeysfile);
7630
7631 CHECK(cfg_parser_create(ns_g_mctx, ns_g_lctx,
7632 &bindkeys_parser));
7633
7634 result = cfg_parse_file(bindkeys_parser, server->bindkeysfile,
7635 &cfg_type_bindkeys, &bindkeys);
7636 if (result != ISC_R_SUCCESS) {
7637 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
7638 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
7639 "unable to parse '%s' error '%s'; using "
7640 "built-in keys instead",
7641 server->bindkeysfile,
7642 isc_result_totext(result));
7643 }
7644 } else {
7645 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
7646 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
7647 "unable to open '%s'; using built-in keys "
7648 "instead", server->bindkeysfile);
7649 }
7650
7651 /* Ensure exclusive access to configuration data. */
7652 if (!exclusive) {
7653 result = isc_task_beginexclusive(server->task);
7654 RUNTIME_CHECK(result == ISC_R_SUCCESS);
7655 exclusive = true;
7656 }
7657
7658 /*
7659 * Set process limits, which (usually) needs to be done as root.
7660 */
7661 set_limits(maps);
7662
7663 /*
7664 * Check the process lockfile.
7665 */
7666 CHECK(check_lockfile(server, config, first_time));
7667
7668 /*
7669 * Check if max number of open sockets that the system allows is
7670 * sufficiently large. Failing this condition is not necessarily fatal,
7671 * but may cause subsequent runtime failures for a busy recursive
7672 * server.
7673 */
7674 result = isc_socketmgr_getmaxsockets(ns_g_socketmgr, &maxsocks);
7675 if (result != ISC_R_SUCCESS) {
7676 maxsocks = 0;
7677 }
7678 result = isc_resource_getcurlimit(isc_resource_openfiles, &nfiles);
7679 if (result == ISC_R_SUCCESS && (isc_resourcevalue_t)maxsocks > nfiles) {
7680 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
7681 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
7682 "max open files (%" PRIu64 ")"
7683 " is smaller than max sockets (%u)",
7684 nfiles, maxsocks);
7685 }
7686
7687 /*
7688 * Set the number of socket reserved for TCP, stdio etc.
7689 */
7690 obj = NULL;
7691 result = ns_config_get(maps, "reserved-sockets", &obj);
7692 INSIST(result == ISC_R_SUCCESS);
7693 reserved = cfg_obj_asuint32(obj);
7694 if (maxsocks != 0) {
7695 if (maxsocks < 128U) { /* Prevent underflow. */
7696 reserved = 0;
7697 } else if (reserved > maxsocks - 128U) { /* Minimum UDP space. */
7698 reserved = maxsocks - 128;
7699 }
7700 }
7701 /* Minimum TCP/stdio space. */
7702 if (reserved < 128U) {
7703 reserved = 128;
7704 }
7705 if (reserved + 128U > maxsocks && maxsocks != 0) {
7706 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
7707 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
7708 "less than 128 UDP sockets available after "
7709 "applying 'reserved-sockets' and 'maxsockets'");
7710 }
7711 isc__socketmgr_setreserved(ns_g_socketmgr, reserved);
7712
7713 #if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
7714 /*
7715 * Release any previously opened GeoIP2 databases.
7716 */
7717 ns_geoip_shutdown();
7718 /*
7719 * Initialize GeoIP databases from the configured location.
7720 * This should happen before configuring any ACLs, so that we
7721 * know what databases are available and can reject any GeoIP
7722 * ACLs that can't work.
7723 */
7724 obj = NULL;
7725 result = ns_config_get(maps, "geoip-directory", &obj);
7726 if (result == ISC_R_SUCCESS && cfg_obj_isstring(obj)) {
7727 char *dir;
7728 DE_CONST(cfg_obj_asstring(obj), dir);
7729 ns_geoip_load(dir);
7730 }
7731 ns_g_aclconfctx->geoip = ns_g_geoip;
7732
7733 obj = NULL;
7734 result = ns_config_get(maps, "geoip-use-ecs", &obj);
7735 INSIST(result == ISC_R_SUCCESS);
7736 ns_g_server->aclenv.geoip_use_ecs = cfg_obj_asboolean(obj);
7737 #endif /* HAVE_GEOIP || HAVE_GEOIP2 */
7738
7739 /*
7740 * Configure various server options.
7741 */
7742 configure_server_quota(maps, "transfers-out", &server->xfroutquota);
7743 configure_server_quota(maps, "tcp-clients", &server->tcpquota);
7744 configure_server_quota(maps, "recursive-clients",
7745 &server->recursionquota);
7746
7747 if (server->recursionquota.max > 1000) {
7748 int margin = ISC_MAX(100, ns_g_cpus + 1);
7749 if (margin > server->recursionquota.max - 100) {
7750 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
7751 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
7752 "'recursive-clients %d' too low when "
7753 "running with %d worker threads",
7754 server->recursionquota.max, ns_g_cpus);
7755 CHECK(ISC_R_RANGE);
7756 }
7757 softquota = server->recursionquota.max - margin;
7758 } else {
7759 softquota = (server->recursionquota.max * 90) / 100;
7760 }
7761
7762 isc_quota_soft(&server->recursionquota, softquota);
7763
7764 /*
7765 * Set "blackhole". Only legal at options level; there is
7766 * no default.
7767 */
7768 CHECK(configure_view_acl(NULL, config, NULL, "blackhole", NULL,
7769 ns_g_aclconfctx, ns_g_mctx,
7770 &server->blackholeacl));
7771 if (server->blackholeacl != NULL) {
7772 dns_dispatchmgr_setblackhole(ns_g_dispatchmgr,
7773 server->blackholeacl);
7774 }
7775
7776 /*
7777 * Set "keep-response-order". Only legal at options or
7778 * global defaults level.
7779 */
7780 CHECK(configure_view_acl(NULL, config, ns_g_config,
7781 "keep-response-order", NULL,
7782 ns_g_aclconfctx, ns_g_mctx,
7783 &server->keepresporder));
7784
7785 obj = NULL;
7786 result = ns_config_get(maps, "match-mapped-addresses", &obj);
7787 INSIST(result == ISC_R_SUCCESS);
7788 server->aclenv.match_mapped = cfg_obj_asboolean(obj);
7789
7790 CHECKM(ns_statschannels_configure(ns_g_server, config, ns_g_aclconfctx),
7791 "configuring statistics server(s)");
7792
7793 /*
7794 * Configure sets of UDP query source ports.
7795 */
7796 CHECKM(isc_portset_create(ns_g_mctx, &v4portset),
7797 "creating UDP port set");
7798 CHECKM(isc_portset_create(ns_g_mctx, &v6portset),
7799 "creating UDP port set");
7800
7801 usev4ports = NULL;
7802 usev6ports = NULL;
7803 avoidv4ports = NULL;
7804 avoidv6ports = NULL;
7805
7806 (void)ns_config_get(maps, "use-v4-udp-ports", &usev4ports);
7807 if (usev4ports != NULL) {
7808 portset_fromconf(v4portset, usev4ports, true);
7809 } else {
7810 CHECKM(isc_net_getudpportrange(AF_INET, &udpport_low,
7811 &udpport_high),
7812 "get the default UDP/IPv4 port range");
7813 if (udpport_low == udpport_high) {
7814 isc_portset_add(v4portset, udpport_low);
7815 } else {
7816 isc_portset_addrange(v4portset, udpport_low,
7817 udpport_high);
7818 }
7819 if (!ns_g_disable4) {
7820 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
7821 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
7822 "using default UDP/IPv4 port range: "
7823 "[%d, %d]", udpport_low, udpport_high);
7824 }
7825 }
7826 (void)ns_config_get(maps, "avoid-v4-udp-ports", &avoidv4ports);
7827 if (avoidv4ports != NULL) {
7828 portset_fromconf(v4portset, avoidv4ports, false);
7829 }
7830
7831 (void)ns_config_get(maps, "use-v6-udp-ports", &usev6ports);
7832 if (usev6ports != NULL) {
7833 portset_fromconf(v6portset, usev6ports, true);
7834 } else {
7835 CHECKM(isc_net_getudpportrange(AF_INET6, &udpport_low,
7836 &udpport_high),
7837 "get the default UDP/IPv6 port range");
7838 if (udpport_low == udpport_high) {
7839 isc_portset_add(v6portset, udpport_low);
7840 } else {
7841 isc_portset_addrange(v6portset, udpport_low,
7842 udpport_high);
7843 }
7844 if (!ns_g_disable6) {
7845 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
7846 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
7847 "using default UDP/IPv6 port range: "
7848 "[%d, %d]", udpport_low, udpport_high);
7849 }
7850 }
7851 (void)ns_config_get(maps, "avoid-v6-udp-ports", &avoidv6ports);
7852 if (avoidv6ports != NULL) {
7853 portset_fromconf(v6portset, avoidv6ports, false);
7854 }
7855
7856 dns_dispatchmgr_setavailports(ns_g_dispatchmgr, v4portset, v6portset);
7857
7858 /*
7859 * Set the EDNS UDP size when we don't match a view.
7860 */
7861 obj = NULL;
7862 result = ns_config_get(maps, "edns-udp-size", &obj);
7863 INSIST(result == ISC_R_SUCCESS);
7864 udpsize = cfg_obj_asuint32(obj);
7865 if (udpsize < 512) {
7866 udpsize = 512;
7867 }
7868 if (udpsize > 4096) {
7869 udpsize = 4096;
7870 }
7871 ns_g_udpsize = (uint16_t)udpsize;
7872
7873 /* Set the transfer message size for TCP */
7874 obj = NULL;
7875 result = ns_config_get(maps, "transfer-message-size", &obj);
7876 INSIST(result == ISC_R_SUCCESS);
7877 transfer_message_size = cfg_obj_asuint32(obj);
7878 if (transfer_message_size < 512) {
7879 transfer_message_size = 512;
7880 } else if (transfer_message_size > 65535) {
7881 transfer_message_size = 65535;
7882 }
7883 server->transfer_tcp_message_size = (uint16_t) transfer_message_size;
7884
7885 /*
7886 * Configure the zone manager.
7887 */
7888 obj = NULL;
7889 result = ns_config_get(maps, "transfers-in", &obj);
7890 INSIST(result == ISC_R_SUCCESS);
7891 dns_zonemgr_settransfersin(server->zonemgr, cfg_obj_asuint32(obj));
7892
7893 obj = NULL;
7894 result = ns_config_get(maps, "transfers-per-ns", &obj);
7895 INSIST(result == ISC_R_SUCCESS);
7896 dns_zonemgr_settransfersperns(server->zonemgr, cfg_obj_asuint32(obj));
7897
7898 obj = NULL;
7899 result = ns_config_get(maps, "notify-rate", &obj);
7900 INSIST(result == ISC_R_SUCCESS);
7901 dns_zonemgr_setnotifyrate(server->zonemgr, cfg_obj_asuint32(obj));
7902
7903 obj = NULL;
7904 result = ns_config_get(maps, "startup-notify-rate", &obj);
7905 INSIST(result == ISC_R_SUCCESS);
7906 dns_zonemgr_setstartupnotifyrate(server->zonemgr, cfg_obj_asuint32(obj));
7907
7908 obj = NULL;
7909 result = ns_config_get(maps, "serial-query-rate", &obj);
7910 INSIST(result == ISC_R_SUCCESS);
7911 dns_zonemgr_setserialqueryrate(server->zonemgr, cfg_obj_asuint32(obj));
7912
7913 /*
7914 * Determine which port to use for listening for incoming connections.
7915 */
7916 if (ns_g_port != 0) {
7917 listen_port = ns_g_port;
7918 } else {
7919 CHECKM(ns_config_getport(config, &listen_port), "port");
7920 }
7921
7922 /*
7923 * Determining the default DSCP code point.
7924 */
7925 CHECKM(ns_config_getdscp(config, &ns_g_dscp), "dscp");
7926
7927 /*
7928 * Find the listen queue depth.
7929 */
7930 obj = NULL;
7931 result = ns_config_get(maps, "tcp-listen-queue", &obj);
7932 INSIST(result == ISC_R_SUCCESS);
7933 ns_g_listen = cfg_obj_asuint32(obj);
7934 if ((ns_g_listen > 0) && (ns_g_listen < 10)) {
7935 ns_g_listen = 10;
7936 }
7937
7938 /*
7939 * Configure the interface manager according to the "listen-on"
7940 * statement.
7941 */
7942 {
7943 const cfg_obj_t *clistenon = NULL;
7944 ns_listenlist_t *listenon = NULL;
7945
7946 clistenon = NULL;
7947 /*
7948 * Even though listen-on is present in the default
7949 * configuration, we can't use it here, since it isn't
7950 * used if we're in lwresd mode. This way is easier.
7951 */
7952 if (options != NULL) {
7953 (void)cfg_map_get(options, "listen-on", &clistenon);
7954 }
7955 if (clistenon != NULL) {
7956 /* check return code? */
7957 (void)ns_listenlist_fromconfig(clistenon, config,
7958 ns_g_aclconfctx,
7959 ns_g_mctx, AF_INET,
7960 &listenon);
7961 } else if (!ns_g_lwresdonly) {
7962 /*
7963 * Not specified, use default.
7964 */
7965 CHECK(ns_listenlist_default(ns_g_mctx, listen_port,
7966 -1, true, &listenon));
7967 }
7968 if (listenon != NULL) {
7969 ns_interfacemgr_setlistenon4(server->interfacemgr,
7970 listenon);
7971 ns_listenlist_detach(&listenon);
7972 }
7973 }
7974 /*
7975 * Ditto for IPv6.
7976 */
7977 {
7978 const cfg_obj_t *clistenon = NULL;
7979 ns_listenlist_t *listenon = NULL;
7980
7981 if (options != NULL) {
7982 (void)cfg_map_get(options, "listen-on-v6", &clistenon);
7983 }
7984 if (clistenon != NULL) {
7985 /* check return code? */
7986 (void)ns_listenlist_fromconfig(clistenon, config,
7987 ns_g_aclconfctx,
7988 ns_g_mctx, AF_INET6,
7989 &listenon);
7990 } else if (!ns_g_lwresdonly) {
7991 /*
7992 * Not specified, use default.
7993 */
7994 CHECK(ns_listenlist_default(ns_g_mctx, listen_port,
7995 -1, true, &listenon));
7996 }
7997 if (listenon != NULL) {
7998 ns_interfacemgr_setlistenon6(server->interfacemgr,
7999 listenon);
8000 ns_listenlist_detach(&listenon);
8001 }
8002 }
8003
8004 /*
8005 * Rescan the interface list to pick up changes in the
8006 * listen-on option. It's important that we do this before we try
8007 * to configure the query source, since the dispatcher we use might
8008 * be shared with an interface.
8009 */
8010 result = scan_interfaces(server, true);
8011
8012 /*
8013 * Check that named is able to TCP listen on at least one
8014 * interface. Otherwise, another named process could be running
8015 * and we should fail.
8016 */
8017 if (first_time && (result == ISC_R_ADDRINUSE)) {
8018 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
8019 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
8020 "unable to listen on any configured interfaces");
8021 result = ISC_R_FAILURE;
8022 goto cleanup;
8023 }
8024
8025 /*
8026 * Arrange for further interface scanning to occur periodically
8027 * as specified by the "interface-interval" option.
8028 */
8029 obj = NULL;
8030 result = ns_config_get(maps, "interface-interval", &obj);
8031 INSIST(result == ISC_R_SUCCESS);
8032 interface_interval = cfg_obj_asuint32(obj) * 60;
8033 if (interface_interval == 0) {
8034 CHECK(isc_timer_reset(server->interface_timer,
8035 isc_timertype_inactive,
8036 NULL, NULL, true));
8037 } else if (server->interface_interval != interface_interval) {
8038 isc_interval_set(&interval, interface_interval, 0);
8039 CHECK(isc_timer_reset(server->interface_timer,
8040 isc_timertype_ticker,
8041 NULL, &interval, false));
8042 }
8043 server->interface_interval = interface_interval;
8044
8045 /*
8046 * Enable automatic interface scans.
8047 */
8048 obj = NULL;
8049 result = ns_config_get(maps, "automatic-interface-scan", &obj);
8050 INSIST(result == ISC_R_SUCCESS);
8051 server->interface_auto = cfg_obj_asboolean(obj);
8052
8053 /*
8054 * Configure the dialup heartbeat timer.
8055 */
8056 obj = NULL;
8057 result = ns_config_get(maps, "heartbeat-interval", &obj);
8058 INSIST(result == ISC_R_SUCCESS);
8059 heartbeat_interval = cfg_obj_asuint32(obj) * 60;
8060 if (heartbeat_interval == 0) {
8061 CHECK(isc_timer_reset(server->heartbeat_timer,
8062 isc_timertype_inactive,
8063 NULL, NULL, true));
8064 } else if (server->heartbeat_interval != heartbeat_interval) {
8065 isc_interval_set(&interval, heartbeat_interval, 0);
8066 CHECK(isc_timer_reset(server->heartbeat_timer,
8067 isc_timertype_ticker,
8068 NULL, &interval, false));
8069 }
8070 server->heartbeat_interval = heartbeat_interval;
8071
8072 isc_interval_set(&interval, 1200, 0);
8073 CHECK(isc_timer_reset(server->pps_timer, isc_timertype_ticker, NULL,
8074 &interval, false));
8075
8076 isc_interval_set(&interval, ns_g_tat_interval, 0);
8077 CHECK(isc_timer_reset(server->tat_timer, isc_timertype_ticker, NULL,
8078 &interval, false));
8079
8080 /*
8081 * Write the PID file.
8082 */
8083 obj = NULL;
8084 if (ns_config_get(maps, "pid-file", &obj) == ISC_R_SUCCESS) {
8085 if (cfg_obj_isvoid(obj)) {
8086 ns_os_writepidfile(NULL, first_time);
8087 } else {
8088 ns_os_writepidfile(cfg_obj_asstring(obj), first_time);
8089 }
8090 } else if (ns_g_lwresdonly) {
8091 ns_os_writepidfile(lwresd_g_defaultpidfile, first_time);
8092 } else {
8093 ns_os_writepidfile(ns_g_defaultpidfile, first_time);
8094 }
8095
8096 /*
8097 * Configure the server-wide session key. This must be done before
8098 * configure views because zone configuration may need to know
8099 * session-keyname.
8100 *
8101 * Failure of session key generation isn't fatal at this time; if it
8102 * turns out that a session key is really needed but doesn't exist,
8103 * we'll treat it as a fatal error then.
8104 */
8105 (void)configure_session_key(maps, server, ns_g_mctx, first_time);
8106
8107 views = NULL;
8108 (void)cfg_map_get(config, "view", &views);
8109
8110 /*
8111 * Create the views and count all the configured zones in
8112 * order to correctly size the zone manager's task table.
8113 * (We only count zones for configured views; the built-in
8114 * "bind" view can be ignored as it only adds a negligible
8115 * number of zones.)
8116 *
8117 * If we're allowing new zones, we need to be able to find the
8118 * new zone file and count those as well. So we setup the new
8119 * zone configuration context, but otherwise view configuration
8120 * waits until after the zone manager's task list has been sized.
8121 */
8122 for (element = cfg_list_first(views);
8123 element != NULL;
8124 element = cfg_list_next(element))
8125 {
8126 cfg_obj_t *vconfig = cfg_listelt_value(element);
8127 const cfg_obj_t *voptions = cfg_tuple_get(vconfig, "options");
8128 int nzf_num_zones;
8129
8130 view = NULL;
8131
8132 CHECK(create_view(vconfig, &viewlist, &view));
8133 INSIST(view != NULL);
8134
8135 num_zones += count_zones(voptions);
8136
8137 CHECK(setup_newzones(view, config, vconfig, conf_parser,
8138 ns_g_aclconfctx, &nzf_num_zones));
8139 num_zones += nzf_num_zones;
8140
8141 dns_view_detach(&view);
8142 }
8143
8144 /*
8145 * If there were no explicit views then we do the default
8146 * view here.
8147 */
8148 if (views == NULL) {
8149 int nzf_num_zones;
8150
8151 CHECK(create_view(NULL, &viewlist, &view));
8152 INSIST(view != NULL);
8153
8154 num_zones = count_zones(config);
8155
8156 CHECK(setup_newzones(view, config, NULL, conf_parser,
8157 ns_g_aclconfctx, &nzf_num_zones));
8158 num_zones += nzf_num_zones;
8159
8160 dns_view_detach(&view);
8161 }
8162
8163 /*
8164 * Zones have been counted; set the zone manager task pool size.
8165 */
8166 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
8167 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
8168 "sizing zone task pool based on %d zones", num_zones);
8169 CHECK(dns_zonemgr_setsize(ns_g_server->zonemgr, num_zones));
8170
8171 /*
8172 * Configure and freeze all explicit views. Explicit
8173 * views that have zones were already created at parsing
8174 * time, but views with no zones must be created here.
8175 */
8176 for (element = cfg_list_first(views);
8177 element != NULL;
8178 element = cfg_list_next(element))
8179 {
8180 cfg_obj_t *vconfig = cfg_listelt_value(element);
8181
8182 view = NULL;
8183 CHECK(find_view(vconfig, &viewlist, &view));
8184 CHECK(configure_view(view, &viewlist, config, vconfig,
8185 &cachelist, bindkeys, ns_g_mctx,
8186 ns_g_aclconfctx, true));
8187 dns_view_freeze(view);
8188 dns_view_detach(&view);
8189 }
8190
8191 /*
8192 * Make sure we have a default view if and only if there
8193 * were no explicit views.
8194 */
8195 if (views == NULL) {
8196 view = NULL;
8197 CHECK(find_view(NULL, &viewlist, &view));
8198 CHECK(configure_view(view, &viewlist, config, NULL,
8199 &cachelist, bindkeys,
8200 ns_g_mctx, ns_g_aclconfctx, true));
8201 dns_view_freeze(view);
8202 dns_view_detach(&view);
8203 }
8204
8205 /*
8206 * Create (or recreate) the built-in views.
8207 */
8208 builtin_views = NULL;
8209 RUNTIME_CHECK(cfg_map_get(ns_g_config, "view",
8210 &builtin_views) == ISC_R_SUCCESS);
8211 for (element = cfg_list_first(builtin_views);
8212 element != NULL;
8213 element = cfg_list_next(element))
8214 {
8215 cfg_obj_t *vconfig = cfg_listelt_value(element);
8216
8217 CHECK(create_view(vconfig, &builtin_viewlist, &view));
8218 CHECK(configure_view(view, &viewlist, config, vconfig,
8219 &cachelist, bindkeys,
8220 ns_g_mctx, ns_g_aclconfctx, false));
8221 dns_view_freeze(view);
8222 dns_view_detach(&view);
8223 view = NULL;
8224 }
8225
8226 /* Now combine the two viewlists into one */
8227 ISC_LIST_APPENDLIST(viewlist, builtin_viewlist, link);
8228
8229 /*
8230 * Commit any dns_zone_setview() calls on all zones in the new
8231 * view.
8232 */
8233 for (view = ISC_LIST_HEAD(viewlist);
8234 view != NULL;
8235 view = ISC_LIST_NEXT(view, link))
8236 {
8237 dns_view_setviewcommit(view);
8238 }
8239
8240 /* Swap our new view list with the production one. */
8241 tmpviewlist = server->viewlist;
8242 server->viewlist = viewlist;
8243 viewlist = tmpviewlist;
8244
8245 /* Make the view list available to each of the views */
8246 view = ISC_LIST_HEAD(server->viewlist);
8247 while (view != NULL) {
8248 view->viewlist = &server->viewlist;
8249 view = ISC_LIST_NEXT(view, link);
8250 }
8251
8252 /* Swap our new cache list with the production one. */
8253 tmpcachelist = server->cachelist;
8254 server->cachelist = cachelist;
8255 cachelist = tmpcachelist;
8256
8257 /* Load the TKEY information from the configuration. */
8258 if (options != NULL) {
8259 dns_tkeyctx_t *t = NULL;
8260 CHECKM(ns_tkeyctx_fromconfig(options, ns_g_mctx, ns_g_entropy,
8261 &t),
8262 "configuring TKEY");
8263 if (server->tkeyctx != NULL) {
8264 dns_tkeyctx_destroy(&server->tkeyctx);
8265 }
8266 server->tkeyctx = t;
8267 }
8268
8269 /*
8270 * Bind the control port(s).
8271 */
8272 CHECKM(ns_controls_configure(ns_g_server->controls, config,
8273 ns_g_aclconfctx),
8274 "binding control channel(s)");
8275
8276 /*
8277 * Bind the lwresd port(s).
8278 */
8279 CHECKM(ns_lwresd_configure(ns_g_mctx, config),
8280 "binding lightweight resolver ports");
8281
8282 /*
8283 * Open the source of entropy.
8284 */
8285 if (first_time) {
8286 obj = NULL;
8287 result = ns_config_get(maps, "random-device", &obj);
8288 if (result != ISC_R_SUCCESS) {
8289 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
8290 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
8291 "no source of entropy found");
8292 } else {
8293 const char *randomdev = cfg_obj_asstring(obj);
8294 int level = ISC_LOG_ERROR;
8295 result = isc_entropy_createfilesource(ns_g_entropy,
8296 randomdev);
8297 #ifdef PATH_RANDOMDEV
8298 if (ns_g_fallbackentropy != NULL) {
8299 level = ISC_LOG_INFO;
8300 }
8301 #endif
8302 if (result != ISC_R_SUCCESS) {
8303 isc_log_write(ns_g_lctx,
8304 NS_LOGCATEGORY_GENERAL,
8305 NS_LOGMODULE_SERVER,
8306 level,
8307 "could not open entropy source "
8308 "%s: %s",
8309 randomdev,
8310 isc_result_totext(result));
8311 }
8312 #ifdef PATH_RANDOMDEV
8313 if (ns_g_fallbackentropy != NULL) {
8314 if (result != ISC_R_SUCCESS) {
8315 isc_log_write(ns_g_lctx,
8316 NS_LOGCATEGORY_GENERAL,
8317 NS_LOGMODULE_SERVER,
8318 ISC_LOG_INFO,
8319 "using pre-chroot entropy source "
8320 "%s",
8321 PATH_RANDOMDEV);
8322 isc_entropy_detach(&ns_g_entropy);
8323 isc_entropy_attach(ns_g_fallbackentropy,
8324 &ns_g_entropy);
8325 }
8326 isc_entropy_detach(&ns_g_fallbackentropy);
8327 }
8328 #endif
8329 }
8330
8331 #ifdef HAVE_LMDB
8332 /*
8333 * If we're using LMDB, we may have created newzones
8334 * databases as root, making it impossible to reopen
8335 * them later after switching to a new userid. We
8336 * close them now, and reopen after relinquishing
8337 * privileges them.
8338 */
8339 for (view = ISC_LIST_HEAD(server->viewlist);
8340 view != NULL; view = ISC_LIST_NEXT(view, link))
8341 {
8342 nzd_env_close(view);
8343 }
8344 #endif /* HAVE_LMDB */
8345
8346 /*
8347 * Relinquish root privileges.
8348 */
8349 ns_os_changeuser();
8350 }
8351
8352 /*
8353 * Check that the working directory is writable.
8354 */
8355 if (!isc_file_isdirwritable(".")) {
8356 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
8357 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
8358 "the working directory is not writable");
8359 }
8360
8361 #ifdef HAVE_LMDB
8362 /*
8363 * Reopen NZD databases.
8364 */
8365 if (first_time) {
8366 for (view = ISC_LIST_HEAD(server->viewlist);
8367 view != NULL;
8368 view = ISC_LIST_NEXT(view, link))
8369 {
8370 nzd_env_reopen(view);
8371 }
8372 }
8373 #endif /* HAVE_LMDB */
8374
8375 /*
8376 * Configure the logging system.
8377 *
8378 * Do this after changing UID to make sure that any log
8379 * files specified in named.conf get created by the
8380 * unprivileged user, not root.
8381 */
8382 if (ns_g_logstderr) {
8383 const cfg_obj_t *logobj = NULL;
8384
8385 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
8386 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
8387 "not using config file logging "
8388 "statement for logging due to "
8389 "-g option");
8390
8391 (void)cfg_map_get(config, "logging", &logobj);
8392 if (logobj != NULL) {
8393 result = ns_log_configure(NULL, logobj);
8394 if (result != ISC_R_SUCCESS) {
8395 isc_log_write(ns_g_lctx,
8396 NS_LOGCATEGORY_GENERAL,
8397 NS_LOGMODULE_SERVER,
8398 ISC_LOG_ERROR,
8399 "checking logging configuration "
8400 "failed: %s",
8401 isc_result_totext(result));
8402 goto cleanup;
8403 }
8404 }
8405 } else {
8406 const cfg_obj_t *logobj = NULL;
8407
8408 CHECKM(isc_logconfig_create(ns_g_lctx, &logc),
8409 "creating new logging configuration");
8410
8411 logobj = NULL;
8412 (void)cfg_map_get(config, "logging", &logobj);
8413 if (logobj != NULL) {
8414 CHECKM(ns_log_configure(logc, logobj),
8415 "configuring logging");
8416 } else {
8417 CHECKM(ns_log_setdefaultchannels(logc),
8418 "setting up default logging channels");
8419 CHECKM(ns_log_setunmatchedcategory(logc),
8420 "setting up default 'category unmatched'");
8421 CHECKM(ns_log_setdefaultcategory(logc),
8422 "setting up default 'category default'");
8423 }
8424
8425 CHECKM(isc_logconfig_use(ns_g_lctx, logc),
8426 "installing logging configuration");
8427 logc = NULL;
8428
8429 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
8430 NS_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
8431 "now using logging configuration from "
8432 "config file");
8433 }
8434
8435 /*
8436 * Set the default value of the query logging flag depending
8437 * whether a "queries" category has been defined. This is
8438 * a disgusting hack, but we need to do this for BIND 8
8439 * compatibility.
8440 */
8441 if (first_time) {
8442 const cfg_obj_t *logobj = NULL;
8443 const cfg_obj_t *categories = NULL;
8444
8445 obj = NULL;
8446 if (ns_config_get(maps, "querylog", &obj) == ISC_R_SUCCESS) {
8447 server->log_queries = cfg_obj_asboolean(obj);
8448 } else {
8449
8450 (void)cfg_map_get(config, "logging", &logobj);
8451 if (logobj != NULL)
8452 (void)cfg_map_get(logobj, "category",
8453 &categories);
8454 if (categories != NULL) {
8455 for (element = cfg_list_first(categories);
8456 element != NULL;
8457 element = cfg_list_next(element))
8458 {
8459 const cfg_obj_t *catobj;
8460 const char *str;
8461
8462 obj = cfg_listelt_value(element);
8463 catobj = cfg_tuple_get(obj, "name");
8464 str = cfg_obj_asstring(catobj);
8465 if (strcasecmp(str, "queries") == 0)
8466 server->log_queries = true;
8467 }
8468 }
8469 }
8470 }
8471
8472 obj = NULL;
8473 if (options != NULL &&
8474 cfg_map_get(options, "memstatistics", &obj) == ISC_R_SUCCESS) {
8475 ns_g_memstatistics = cfg_obj_asboolean(obj);
8476 } else {
8477 ns_g_memstatistics =
8478 ((isc_mem_debugging & ISC_MEM_DEBUGRECORD) != 0);
8479 }
8480
8481 obj = NULL;
8482 if (ns_config_get(maps, "memstatistics-file", &obj) == ISC_R_SUCCESS) {
8483 ns_main_setmemstats(cfg_obj_asstring(obj));
8484 } else if (ns_g_memstatistics) {
8485 ns_main_setmemstats("named.memstats");
8486 } else {
8487 ns_main_setmemstats(NULL);
8488 }
8489
8490 obj = NULL;
8491 result = ns_config_get(maps, "statistics-file", &obj);
8492 INSIST(result == ISC_R_SUCCESS);
8493 CHECKM(setstring(server, &server->statsfile, cfg_obj_asstring(obj)),
8494 "strdup");
8495
8496 obj = NULL;
8497 result = ns_config_get(maps, "dump-file", &obj);
8498 INSIST(result == ISC_R_SUCCESS);
8499 CHECKM(setstring(server, &server->dumpfile, cfg_obj_asstring(obj)),
8500 "strdup");
8501
8502 obj = NULL;
8503 result = ns_config_get(maps, "secroots-file", &obj);
8504 INSIST(result == ISC_R_SUCCESS);
8505 CHECKM(setstring(server, &server->secrootsfile, cfg_obj_asstring(obj)),
8506 "strdup");
8507
8508 obj = NULL;
8509 result = ns_config_get(maps, "recursing-file", &obj);
8510 INSIST(result == ISC_R_SUCCESS);
8511 CHECKM(setstring(server, &server->recfile, cfg_obj_asstring(obj)),
8512 "strdup");
8513
8514 obj = NULL;
8515 result = ns_config_get(maps, "version", &obj);
8516 if (result == ISC_R_SUCCESS) {
8517 CHECKM(setoptstring(server, &server->version, obj), "strdup");
8518 server->version_set = true;
8519 } else {
8520 server->version_set = false;
8521 }
8522
8523 obj = NULL;
8524 result = ns_config_get(maps, "hostname", &obj);
8525 if (result == ISC_R_SUCCESS) {
8526 CHECKM(setoptstring(server, &server->hostname, obj), "strdup");
8527 server->hostname_set = true;
8528 } else {
8529 server->hostname_set = false;
8530 }
8531
8532 obj = NULL;
8533 result = ns_config_get(maps, "server-id", &obj);
8534 server->server_usehostname = false;
8535 if (result == ISC_R_SUCCESS && cfg_obj_isboolean(obj)) {
8536 /* The parser translates "hostname" to true */
8537 server->server_usehostname = cfg_obj_asboolean(obj);
8538 result = setstring(server, &server->server_id, NULL);
8539 RUNTIME_CHECK(result == ISC_R_SUCCESS);
8540 } else if (result == ISC_R_SUCCESS) {
8541 /* Found a quoted string */
8542 CHECKM(setoptstring(server, &server->server_id, obj), "strdup");
8543 } else {
8544 result = setstring(server, &server->server_id, NULL);
8545 RUNTIME_CHECK(result == ISC_R_SUCCESS);
8546 }
8547
8548 obj = NULL;
8549 result = ns_config_get(maps, "flush-zones-on-shutdown", &obj);
8550 if (result == ISC_R_SUCCESS) {
8551 server->flushonshutdown = cfg_obj_asboolean(obj);
8552 } else {
8553 server->flushonshutdown = false;
8554 }
8555
8556 obj = NULL;
8557 result = ns_config_get(maps, "answer-cookie", &obj);
8558 INSIST(result == ISC_R_SUCCESS);
8559 server->answercookie = cfg_obj_asboolean(obj);
8560
8561 obj = NULL;
8562 result = ns_config_get(maps, "cookie-algorithm", &obj);
8563 INSIST(result == ISC_R_SUCCESS);
8564 if (strcasecmp(cfg_obj_asstring(obj), "siphash24") == 0) {
8565 server->cookiealg = ns_cookiealg_siphash24;
8566 } else if (strcasecmp(cfg_obj_asstring(obj), "aes") == 0) {
8567 #if defined(HAVE_OPENSSL_AES) || defined(HAVE_OPENSSL_EVP_AES)
8568 server->cookiealg = ns_cookiealg_aes;
8569 #else
8570 INSIST(0);
8571 ISC_UNREACHABLE();
8572 #endif
8573 } else if (strcasecmp(cfg_obj_asstring(obj), "sha1") == 0) {
8574 server->cookiealg = ns_cookiealg_sha1;
8575 } else if (strcasecmp(cfg_obj_asstring(obj), "sha256") == 0) {
8576 server->cookiealg = ns_cookiealg_sha256;
8577 } else {
8578 INSIST(0);
8579 ISC_UNREACHABLE();
8580 }
8581
8582 obj = NULL;
8583 result = ns_config_get(maps, "cookie-secret", &obj);
8584 if (result == ISC_R_SUCCESS) {
8585 const char *str;
8586 bool first = true;
8587 isc_buffer_t b;
8588 unsigned int usedlength;
8589
8590 for (element = cfg_list_first(obj);
8591 element != NULL;
8592 element = cfg_list_next(element))
8593 {
8594 obj = cfg_listelt_value(element);
8595 str = cfg_obj_asstring(obj);
8596
8597 if (first) {
8598 memset(server->secret, 0,
8599 sizeof(server->secret));
8600 isc_buffer_init(&b, server->secret,
8601 sizeof(server->secret));
8602 result = isc_hex_decodestring(str, &b);
8603 if (result != ISC_R_SUCCESS &&
8604 result != ISC_R_NOSPACE)
8605 goto cleanup;
8606 first = false;
8607 } else {
8608 altsecret = isc_mem_get(server->mctx,
8609 sizeof(*altsecret));
8610 if (altsecret == NULL) {
8611 result = ISC_R_NOMEMORY;
8612 goto cleanup;
8613 }
8614 isc_buffer_init(&b, altsecret->secret,
8615 sizeof(altsecret->secret));
8616 result = isc_hex_decodestring(str, &b);
8617 if (result != ISC_R_SUCCESS &&
8618 result != ISC_R_NOSPACE) {
8619 isc_mem_put(server->mctx, altsecret,
8620 sizeof(*altsecret));
8621 goto cleanup;
8622 }
8623 ISC_LIST_INITANDAPPEND(altsecrets,
8624 altsecret, link);
8625 }
8626
8627 usedlength = isc_buffer_usedlength(&b);
8628 switch (server->cookiealg) {
8629 case ns_cookiealg_siphash24:
8630 if (usedlength != ISC_SIPHASH24_KEY_LENGTH) {
8631 CHECKM(ISC_R_RANGE,
8632 "SipHash-2-4 cookie-secret must be 128 bits");
8633 }
8634 break;
8635 case ns_cookiealg_aes:
8636 if (usedlength != ISC_AES128_KEYLENGTH) {
8637 CHECKM(ISC_R_RANGE,
8638 "AES cookie-secret must be 128 bits");
8639 }
8640 break;
8641 case ns_cookiealg_sha1:
8642 if (usedlength != ISC_SHA1_DIGESTLENGTH) {
8643 CHECKM(ISC_R_RANGE,
8644 "SHA1 cookie-secret must be "
8645 "160 bits");
8646 }
8647 break;
8648 case ns_cookiealg_sha256:
8649 if (usedlength != ISC_SHA256_DIGESTLENGTH) {
8650 CHECKM(ISC_R_RANGE,
8651 "SHA256 cookie-secret must be "
8652 "256 bits");
8653 }
8654 break;
8655 }
8656 }
8657 } else {
8658 result = isc_entropy_getdata(ns_g_entropy,
8659 server->secret,
8660 sizeof(server->secret),
8661 NULL,
8662 0);
8663 if (result != ISC_R_SUCCESS) {
8664 goto cleanup;
8665 }
8666 }
8667
8668 /*
8669 * Swap altsecrets lists.
8670 */
8671 tmpaltsecrets = server->altsecrets;
8672 server->altsecrets = altsecrets;
8673 altsecrets = tmpaltsecrets;
8674
8675 (void) ns_server_loadnta(server);
8676
8677 result = ISC_R_SUCCESS;
8678
8679 cleanup:
8680 if (logc != NULL) {
8681 isc_logconfig_destroy(&logc);
8682 }
8683
8684 if (v4portset != NULL) {
8685 isc_portset_destroy(ns_g_mctx, &v4portset);
8686 }
8687
8688 if (v6portset != NULL) {
8689 isc_portset_destroy(ns_g_mctx, &v6portset);
8690 }
8691
8692 if (conf_parser != NULL) {
8693 if (config != NULL) {
8694 cfg_obj_destroy(conf_parser, &config);
8695 }
8696 cfg_parser_destroy(&conf_parser);
8697 }
8698
8699 if (bindkeys_parser != NULL) {
8700 if (bindkeys != NULL) {
8701 cfg_obj_destroy(bindkeys_parser, &bindkeys);
8702 }
8703 cfg_parser_destroy(&bindkeys_parser);
8704 }
8705
8706 if (view != NULL) {
8707 dns_view_detach(&view);
8708 }
8709
8710 ISC_LIST_APPENDLIST(viewlist, builtin_viewlist, link);
8711
8712 /*
8713 * This cleans up either the old production view list
8714 * or our temporary list depending on whether they
8715 * were swapped above or not.
8716 */
8717 for (view = ISC_LIST_HEAD(viewlist);
8718 view != NULL;
8719 view = view_next) {
8720 view_next = ISC_LIST_NEXT(view, link);
8721 ISC_LIST_UNLINK(viewlist, view, link);
8722 if (result == ISC_R_SUCCESS &&
8723 strcmp(view->name, "_bind") != 0)
8724 {
8725 dns_view_setviewrevert(view);
8726 (void)dns_zt_apply(view->zonetable, false,
8727 removed, view);
8728 }
8729 dns_view_detach(&view);
8730 }
8731
8732 /* Same cleanup for cache list. */
8733 while ((nsc = ISC_LIST_HEAD(cachelist)) != NULL) {
8734 ISC_LIST_UNLINK(cachelist, nsc, link);
8735 dns_cache_detach(&nsc->cache);
8736 isc_mem_put(server->mctx, nsc, sizeof(*nsc));
8737 }
8738
8739 /* Same cleanup for altsecrets list. */
8740 while ((altsecret = ISC_LIST_HEAD(altsecrets)) != NULL) {
8741 ISC_LIST_UNLINK(altsecrets, altsecret, link);
8742 isc_mem_put(server->mctx, altsecret, sizeof(*altsecret));
8743 }
8744
8745 /*
8746 * Adjust the listening interfaces in accordance with the source
8747 * addresses specified in views and zones.
8748 */
8749 if (isc_net_probeipv6() == ISC_R_SUCCESS) {
8750 adjust_interfaces(server, ns_g_mctx);
8751 }
8752
8753 /*
8754 * Record the time of most recent configuration
8755 */
8756 tresult = isc_time_now(&ns_g_configtime);
8757 if (tresult != ISC_R_SUCCESS) {
8758 ns_main_earlyfatal("isc_time_now() failed: %s",
8759 isc_result_totext(result));
8760 }
8761
8762 /* Relinquish exclusive access to configuration data. */
8763 if (exclusive) {
8764 isc_task_endexclusive(server->task);
8765 }
8766
8767 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
8768 ISC_LOG_DEBUG(1), "load_configuration: %s",
8769 isc_result_totext(result));
8770
8771 return (result);
8772 }
8773
8774 static isc_result_t
view_loaded(void * arg)8775 view_loaded(void *arg) {
8776 isc_result_t result;
8777 ns_zoneload_t *zl = (ns_zoneload_t *) arg;
8778 ns_server_t *server;
8779 bool reconfig;
8780 unsigned int refs;
8781
8782
8783 /*
8784 * Force zone maintenance. Do this after loading
8785 * so that we know when we need to force AXFR of
8786 * slave zones whose master files are missing.
8787 *
8788 * We use the zoneload reference counter to let us
8789 * know when all views are finished.
8790 */
8791 isc_refcount_decrement(&zl->refs, &refs);
8792 if (refs != 0)
8793 return (ISC_R_SUCCESS);
8794
8795 server = zl->server;
8796 reconfig = zl->reconfig;
8797
8798 isc_refcount_destroy(&zl->refs);
8799 isc_mem_put(server->mctx, zl, sizeof (*zl));
8800
8801 /*
8802 * To maintain compatibility with log parsing tools that might
8803 * be looking for this string after "rndc reconfig", we keep it
8804 * as it is
8805 */
8806 if (reconfig) {
8807 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
8808 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
8809 "any newly configured zones are now loaded");
8810 } else {
8811 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
8812 NS_LOGMODULE_SERVER, ISC_LOG_NOTICE,
8813 "all zones loaded");
8814 }
8815
8816 CHECKFATAL(dns_zonemgr_forcemaint(server->zonemgr),
8817 "forcing zone maintenance");
8818
8819 ns_os_started();
8820 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
8821 ISC_LOG_NOTICE, "running");
8822
8823 return (ISC_R_SUCCESS);
8824 }
8825
8826 static isc_result_t
load_zones(ns_server_t * server,bool init,bool reconfig)8827 load_zones(ns_server_t *server, bool init, bool reconfig) {
8828 isc_result_t result;
8829 dns_view_t *view;
8830 ns_zoneload_t *zl;
8831 unsigned int refs = 0;
8832
8833 zl = isc_mem_get(server->mctx, sizeof (*zl));
8834 if (zl == NULL)
8835 return (ISC_R_NOMEMORY);
8836 zl->server = server;
8837 zl->reconfig = reconfig;
8838
8839 result = isc_task_beginexclusive(server->task);
8840 RUNTIME_CHECK(result == ISC_R_SUCCESS);
8841
8842 isc_refcount_init(&zl->refs, 1);
8843
8844 /*
8845 * Schedule zones to be loaded from disk.
8846 */
8847 for (view = ISC_LIST_HEAD(server->viewlist);
8848 view != NULL;
8849 view = ISC_LIST_NEXT(view, link))
8850 {
8851 if (view->managed_keys != NULL) {
8852 result = dns_zone_load(view->managed_keys);
8853 if (result != ISC_R_SUCCESS &&
8854 result != DNS_R_UPTODATE &&
8855 result != DNS_R_CONTINUE)
8856 goto cleanup;
8857 }
8858 if (view->redirect != NULL) {
8859 result = dns_zone_load(view->redirect);
8860 if (result != ISC_R_SUCCESS &&
8861 result != DNS_R_UPTODATE &&
8862 result != DNS_R_CONTINUE)
8863 goto cleanup;
8864 }
8865
8866 /*
8867 * 'dns_view_asyncload' calls view_loaded if there are no
8868 * zones.
8869 */
8870 isc_refcount_increment(&zl->refs, NULL);
8871 CHECK(dns_view_asyncload2(view, view_loaded, zl, reconfig));
8872 }
8873
8874 cleanup:
8875 isc_refcount_decrement(&zl->refs, &refs);
8876 if (refs == 0) {
8877 isc_refcount_destroy(&zl->refs);
8878 isc_mem_put(server->mctx, zl, sizeof (*zl));
8879 } else if (init) {
8880 /*
8881 * Place the task manager into privileged mode. This
8882 * ensures that after we leave task-exclusive mode, no
8883 * other tasks will be able to run except for the ones
8884 * that are loading zones. (This should only be done during
8885 * the initial server setup; it isn't necessary during
8886 * a reload.)
8887 */
8888 isc_taskmgr_setmode(ns_g_taskmgr, isc_taskmgrmode_privileged);
8889 }
8890
8891 isc_task_endexclusive(server->task);
8892 return (result);
8893 }
8894
8895 static void
run_server(isc_task_t * task,isc_event_t * event)8896 run_server(isc_task_t *task, isc_event_t *event) {
8897 isc_result_t result;
8898 ns_server_t *server = (ns_server_t *)event->ev_arg;
8899
8900 INSIST(task == server->task);
8901
8902 isc_event_free(&event);
8903
8904 CHECKFATAL(dns_dispatchmgr_create(ns_g_mctx, ns_g_entropy,
8905 &ns_g_dispatchmgr),
8906 "creating dispatch manager");
8907
8908 dns_dispatchmgr_setstats(ns_g_dispatchmgr, server->resolverstats);
8909
8910 CHECKFATAL(ns_interfacemgr_create(ns_g_mctx, ns_g_taskmgr,
8911 ns_g_socketmgr, ns_g_dispatchmgr,
8912 server->task, &server->interfacemgr),
8913 "creating interface manager");
8914
8915 CHECKFATAL(isc_timer_create(ns_g_timermgr, isc_timertype_inactive,
8916 NULL, NULL, server->task,
8917 interface_timer_tick,
8918 server, &server->interface_timer),
8919 "creating interface timer");
8920
8921 CHECKFATAL(isc_timer_create(ns_g_timermgr, isc_timertype_inactive,
8922 NULL, NULL, server->task,
8923 heartbeat_timer_tick,
8924 server, &server->heartbeat_timer),
8925 "creating heartbeat timer");
8926
8927 CHECKFATAL(isc_timer_create(ns_g_timermgr, isc_timertype_inactive,
8928 NULL, NULL, server->task, tat_timer_tick,
8929 server, &server->tat_timer),
8930 "creating trust anchor telemetry timer");
8931
8932 CHECKFATAL(isc_timer_create(ns_g_timermgr, isc_timertype_inactive,
8933 NULL, NULL, server->task, pps_timer_tick,
8934 server, &server->pps_timer),
8935 "creating pps timer");
8936
8937 CHECKFATAL(cfg_parser_create(ns_g_mctx, ns_g_lctx, &ns_g_parser),
8938 "creating default configuration parser");
8939
8940 CHECKFATAL(cfg_parser_create(ns_g_mctx, ns_g_lctx, &ns_g_addparser),
8941 "creating additional configuration parser");
8942
8943 if (ns_g_lwresdonly)
8944 CHECKFATAL(load_configuration(lwresd_g_conffile, server,
8945 true),
8946 "loading configuration");
8947 else
8948 CHECKFATAL(load_configuration(ns_g_conffile, server, true),
8949 "loading configuration");
8950
8951 isc_hash_init();
8952
8953 CHECKFATAL(load_zones(server, true, false), "loading zones");
8954 #ifdef ENABLE_AFL
8955 ns_g_run_done = true;
8956 #endif
8957 }
8958
8959 void
ns_server_flushonshutdown(ns_server_t * server,bool flush)8960 ns_server_flushonshutdown(ns_server_t *server, bool flush) {
8961
8962 REQUIRE(NS_SERVER_VALID(server));
8963
8964 server->flushonshutdown = flush;
8965 }
8966
8967 static void
shutdown_server(isc_task_t * task,isc_event_t * event)8968 shutdown_server(isc_task_t *task, isc_event_t *event) {
8969 isc_result_t result;
8970 dns_view_t *view, *view_next;
8971 ns_server_t *server = (ns_server_t *)event->ev_arg;
8972 bool flush = server->flushonshutdown;
8973 ns_cache_t *nsc;
8974 ns_altsecret_t *altsecret;
8975
8976 UNUSED(task);
8977 INSIST(task == server->task);
8978
8979 result = isc_task_beginexclusive(server->task);
8980 RUNTIME_CHECK(result == ISC_R_SUCCESS);
8981
8982 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
8983 ISC_LOG_INFO, "shutting down%s",
8984 flush ? ": flushing changes" : "");
8985
8986 ns_statschannels_shutdown(server);
8987 ns_controls_shutdown(server->controls);
8988 end_reserved_dispatches(server, true);
8989 cleanup_session_key(server, server->mctx);
8990
8991 if (ns_g_aclconfctx != NULL)
8992 cfg_aclconfctx_detach(&ns_g_aclconfctx);
8993
8994 cfg_obj_destroy(ns_g_parser, &ns_g_config);
8995 cfg_parser_destroy(&ns_g_parser);
8996 cfg_parser_destroy(&ns_g_addparser);
8997
8998 (void) ns_server_saventa(server);
8999
9000 for (view = ISC_LIST_HEAD(server->viewlist);
9001 view != NULL;
9002 view = view_next) {
9003 view_next = ISC_LIST_NEXT(view, link);
9004 ISC_LIST_UNLINK(server->viewlist, view, link);
9005 if (flush)
9006 dns_view_flushanddetach(&view);
9007 else
9008 dns_view_detach(&view);
9009 }
9010
9011 dns_dyndb_cleanup(true);
9012
9013 while ((nsc = ISC_LIST_HEAD(server->cachelist)) != NULL) {
9014 ISC_LIST_UNLINK(server->cachelist, nsc, link);
9015 dns_cache_detach(&nsc->cache);
9016 isc_mem_put(server->mctx, nsc, sizeof(*nsc));
9017 }
9018
9019 while ((altsecret = ISC_LIST_HEAD(server->altsecrets)) != NULL) {
9020 ISC_LIST_UNLINK(server->altsecrets, altsecret, link);
9021 isc_mem_put(server->mctx, altsecret, sizeof(*altsecret));
9022 }
9023
9024 isc_timer_detach(&server->interface_timer);
9025 isc_timer_detach(&server->heartbeat_timer);
9026 isc_timer_detach(&server->pps_timer);
9027 isc_timer_detach(&server->tat_timer);
9028
9029 ns_interfacemgr_shutdown(server->interfacemgr);
9030 ns_interfacemgr_detach(&server->interfacemgr);
9031
9032 dns_dispatchmgr_destroy(&ns_g_dispatchmgr);
9033
9034 dns_zonemgr_shutdown(server->zonemgr);
9035
9036 if (ns_g_sessionkey != NULL) {
9037 dns_tsigkey_detach(&ns_g_sessionkey);
9038 dns_name_free(&ns_g_sessionkeyname, server->mctx);
9039 }
9040
9041 if (server->keepresporder != NULL)
9042 dns_acl_detach(&server->keepresporder);
9043
9044 if (server->blackholeacl != NULL)
9045 dns_acl_detach(&server->blackholeacl);
9046
9047 #ifdef HAVE_DNSTAP
9048 dns_dt_shutdown();
9049 #endif
9050 #if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
9051 ns_geoip_shutdown();
9052 dns_geoip_shutdown();
9053 #endif /* HAVE_GEOIP || HAVE_GEOIP2 */
9054
9055 dns_db_detach(&server->in_roothints);
9056
9057 isc_task_endexclusive(server->task);
9058
9059 isc_task_detach(&server->task);
9060
9061 isc_event_free(&event);
9062 }
9063
9064 void
ns_server_create(isc_mem_t * mctx,ns_server_t ** serverp)9065 ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
9066 isc_result_t result;
9067 ns_server_t *server = isc_mem_get(mctx, sizeof(*server));
9068
9069 if (server == NULL)
9070 fatal(server, "allocating server object", ISC_R_NOMEMORY);
9071
9072 server->mctx = mctx;
9073 server->task = NULL;
9074
9075 /* Initialize configuration data with default values. */
9076 result = isc_quota_init(&server->xfroutquota, 10);
9077 RUNTIME_CHECK(result == ISC_R_SUCCESS);
9078 result = isc_quota_init(&server->tcpquota, 10);
9079 RUNTIME_CHECK(result == ISC_R_SUCCESS);
9080 result = isc_quota_init(&server->recursionquota, 100);
9081 RUNTIME_CHECK(result == ISC_R_SUCCESS);
9082
9083 result = dns_aclenv_init(mctx, &server->aclenv);
9084 RUNTIME_CHECK(result == ISC_R_SUCCESS);
9085
9086 #if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
9087 /* Initialize GeoIP before using ACL environment */
9088 ns_geoip_init();
9089 server->aclenv.geoip = ns_g_geoip;
9090 #endif
9091
9092 /* Initialize server data structures. */
9093 server->zonemgr = NULL;
9094 server->interfacemgr = NULL;
9095 ISC_LIST_INIT(server->viewlist);
9096 server->in_roothints = NULL;
9097 server->blackholeacl = NULL;
9098 server->keepresporder = NULL;
9099
9100 /* Must be first. */
9101 CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
9102 ns_g_engine, ISC_ENTROPY_GOODONLY),
9103 "initializing DST");
9104
9105 CHECKFATAL(dns_rootns_create(mctx, dns_rdataclass_in, NULL,
9106 &server->in_roothints),
9107 "setting up root hints");
9108
9109 CHECKFATAL(isc_mutex_init(&server->reload_event_lock),
9110 "initializing reload event lock");
9111 server->reload_event =
9112 isc_event_allocate(ns_g_mctx, server,
9113 NS_EVENT_RELOAD,
9114 ns_server_reload,
9115 server,
9116 sizeof(isc_event_t));
9117 CHECKFATAL(server->reload_event == NULL ?
9118 ISC_R_NOMEMORY : ISC_R_SUCCESS,
9119 "allocating reload event");
9120
9121 server->tkeyctx = NULL;
9122 CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
9123 &server->tkeyctx),
9124 "creating TKEY context");
9125
9126 /*
9127 * Setup the server task, which is responsible for coordinating
9128 * startup and shutdown of the server, as well as all exclusive
9129 * tasks.
9130 */
9131 CHECKFATAL(isc_task_create(ns_g_taskmgr, 0, &server->task),
9132 "creating server task");
9133 isc_task_setname(server->task, "server", server);
9134 isc_taskmgr_setexcltask(ns_g_taskmgr, server->task);
9135 CHECKFATAL(isc_task_onshutdown(server->task, shutdown_server, server),
9136 "isc_task_onshutdown");
9137 CHECKFATAL(isc_app_onrun(ns_g_mctx, server->task, run_server, server),
9138 "isc_app_onrun");
9139
9140 server->interface_timer = NULL;
9141 server->heartbeat_timer = NULL;
9142 server->pps_timer = NULL;
9143 server->tat_timer = NULL;
9144
9145 server->interface_interval = 0;
9146 server->heartbeat_interval = 0;
9147
9148 CHECKFATAL(dns_zonemgr_create(ns_g_mctx, ns_g_taskmgr, ns_g_timermgr,
9149 ns_g_socketmgr, &server->zonemgr),
9150 "dns_zonemgr_create");
9151 CHECKFATAL(dns_zonemgr_setsize(server->zonemgr, 1000),
9152 "dns_zonemgr_setsize");
9153
9154 server->statsfile = isc_mem_strdup(server->mctx, "named.stats");
9155 CHECKFATAL(server->statsfile == NULL ? ISC_R_NOMEMORY : ISC_R_SUCCESS,
9156 "isc_mem_strdup");
9157 server->nsstats = NULL;
9158 server->rcvquerystats = NULL;
9159 server->opcodestats = NULL;
9160 server->rcodestats = NULL;
9161 server->zonestats = NULL;
9162 server->resolverstats = NULL;
9163 server->sockstats = NULL;
9164 server->udpinstats4 = NULL;
9165 server->udpoutstats4 = NULL;
9166 server->udpinstats6 = NULL;
9167 server->udpoutstats6 = NULL;
9168 server->tcpinstats4 = NULL;
9169 server->tcpoutstats4 = NULL;
9170 server->tcpinstats6 = NULL;
9171 server->tcpoutstats6 = NULL;
9172 CHECKFATAL(isc_stats_create(server->mctx, &server->sockstats,
9173 isc_sockstatscounter_max),
9174 "isc_stats_create");
9175 isc_socketmgr_setstats(ns_g_socketmgr, server->sockstats);
9176
9177 server->bindkeysfile = isc_mem_strdup(server->mctx, "bind.keys");
9178 CHECKFATAL(server->bindkeysfile == NULL ? ISC_R_NOMEMORY :
9179 ISC_R_SUCCESS,
9180 "isc_mem_strdup");
9181
9182 server->dumpfile = isc_mem_strdup(server->mctx, "named_dump.db");
9183 CHECKFATAL(server->dumpfile == NULL ? ISC_R_NOMEMORY : ISC_R_SUCCESS,
9184 "isc_mem_strdup");
9185
9186 server->secrootsfile = isc_mem_strdup(server->mctx, "named.secroots");
9187 CHECKFATAL(server->secrootsfile == NULL ? ISC_R_NOMEMORY :
9188 ISC_R_SUCCESS,
9189 "isc_mem_strdup");
9190
9191 server->recfile = isc_mem_strdup(server->mctx, "named.recursing");
9192 CHECKFATAL(server->recfile == NULL ? ISC_R_NOMEMORY : ISC_R_SUCCESS,
9193 "isc_mem_strdup");
9194
9195 server->hostname_set = false;
9196 server->hostname = NULL;
9197 server->version_set = false;
9198 server->version = NULL;
9199 server->server_usehostname = false;
9200 server->server_id = NULL;
9201
9202 CHECKFATAL(isc_stats_create(ns_g_mctx, &server->nsstats,
9203 dns_nsstatscounter_max),
9204 "dns_stats_create (server)");
9205
9206 CHECKFATAL(dns_rdatatypestats_create(ns_g_mctx,
9207 &server->rcvquerystats),
9208 "dns_stats_create (rcvquery)");
9209
9210 CHECKFATAL(dns_opcodestats_create(ns_g_mctx, &server->opcodestats),
9211 "dns_stats_create (opcode)");
9212
9213 CHECKFATAL(dns_rcodestats_create(ns_g_mctx, &server->rcodestats),
9214 "dns_stats_create (rcode)");
9215
9216 CHECKFATAL(isc_stats_create(ns_g_mctx, &server->zonestats,
9217 dns_zonestatscounter_max),
9218 "dns_stats_create (zone)");
9219
9220 CHECKFATAL(isc_stats_create(ns_g_mctx, &server->resolverstats,
9221 dns_resstatscounter_max),
9222 "dns_stats_create (resolver)");
9223
9224 CHECKFATAL(isc_stats_create(ns_g_mctx, &server->udpinstats4,
9225 dns_sizecounter_in_max),
9226 "dns_stats_create (inbound UDP IPv4 traffic size)");
9227
9228 CHECKFATAL(isc_stats_create(ns_g_mctx, &server->udpoutstats4,
9229 dns_sizecounter_out_max),
9230 "dns_stats_create (outbound UDP IPv4 traffic size)");
9231
9232 CHECKFATAL(isc_stats_create(ns_g_mctx, &server->udpinstats6,
9233 dns_sizecounter_in_max),
9234 "dns_stats_create (inbound UDP IPv6 traffic size)");
9235
9236 CHECKFATAL(isc_stats_create(ns_g_mctx, &server->udpoutstats6,
9237 dns_sizecounter_out_max),
9238 "dns_stats_create (outbound UDP IPv6 traffic size)");
9239
9240 CHECKFATAL(isc_stats_create(ns_g_mctx, &server->tcpinstats4,
9241 dns_sizecounter_in_max),
9242 "dns_stats_create (inbound TCP IPv4 traffic size)");
9243
9244 CHECKFATAL(isc_stats_create(ns_g_mctx, &server->tcpoutstats4,
9245 dns_sizecounter_out_max),
9246 "dns_stats_create (outbound TCP IPv4 traffic size)");
9247
9248 CHECKFATAL(isc_stats_create(ns_g_mctx, &server->tcpinstats6,
9249 dns_sizecounter_in_max),
9250 "dns_stats_create (inbound TCP IPv6 traffic size)");
9251
9252 CHECKFATAL(isc_stats_create(ns_g_mctx, &server->tcpoutstats6,
9253 dns_sizecounter_out_max),
9254 "dns_stats_create (outbound TCP IPv6 traffic size)");
9255
9256 server->flushonshutdown = false;
9257 server->log_queries = false;
9258
9259 server->controls = NULL;
9260 CHECKFATAL(ns_controls_create(server, &server->controls),
9261 "ns_controls_create");
9262 server->dispatchgen = 0;
9263 ISC_LIST_INIT(server->dispatches);
9264
9265 ISC_LIST_INIT(server->statschannels);
9266
9267 ISC_LIST_INIT(server->cachelist);
9268
9269 ISC_LIST_INIT(server->altsecrets);
9270
9271 server->sessionkey = NULL;
9272 server->session_keyfile = NULL;
9273 server->session_keyname = NULL;
9274 server->session_keyalg = DST_ALG_UNKNOWN;
9275 server->session_keybits = 0;
9276
9277 server->lockfile = NULL;
9278
9279 server->dtenv = NULL;
9280 server->answercookie = true;
9281
9282 server->magic = NS_SERVER_MAGIC;
9283 *serverp = server;
9284 }
9285
9286 void
ns_server_destroy(ns_server_t ** serverp)9287 ns_server_destroy(ns_server_t **serverp) {
9288 ns_server_t *server = *serverp;
9289 REQUIRE(NS_SERVER_VALID(server));
9290
9291 #ifdef HAVE_DNSTAP
9292 if (server->dtenv != NULL)
9293 dns_dt_detach(&server->dtenv);
9294 #endif /* HAVE_DNSTAP */
9295
9296 ns_controls_destroy(&server->controls);
9297
9298 isc_stats_detach(&server->nsstats);
9299 dns_stats_detach(&server->rcvquerystats);
9300 dns_stats_detach(&server->opcodestats);
9301 dns_stats_detach(&server->rcodestats);
9302 isc_stats_detach(&server->zonestats);
9303 isc_stats_detach(&server->resolverstats);
9304 isc_stats_detach(&server->sockstats);
9305 isc_stats_detach(&server->udpinstats4);
9306 isc_stats_detach(&server->udpoutstats4);
9307 isc_stats_detach(&server->udpinstats6);
9308 isc_stats_detach(&server->udpoutstats6);
9309 isc_stats_detach(&server->tcpinstats4);
9310 isc_stats_detach(&server->tcpoutstats4);
9311 isc_stats_detach(&server->tcpinstats6);
9312 isc_stats_detach(&server->tcpoutstats6);
9313
9314 isc_mem_free(server->mctx, server->statsfile);
9315 isc_mem_free(server->mctx, server->bindkeysfile);
9316 isc_mem_free(server->mctx, server->dumpfile);
9317 isc_mem_free(server->mctx, server->secrootsfile);
9318 isc_mem_free(server->mctx, server->recfile);
9319
9320 if (server->version != NULL)
9321 isc_mem_free(server->mctx, server->version);
9322 if (server->hostname != NULL)
9323 isc_mem_free(server->mctx, server->hostname);
9324 if (server->server_id != NULL)
9325 isc_mem_free(server->mctx, server->server_id);
9326 if (server->lockfile != NULL)
9327 isc_mem_free(server->mctx, server->lockfile);
9328
9329 if (server->zonemgr != NULL)
9330 dns_zonemgr_detach(&server->zonemgr);
9331
9332 if (server->tkeyctx != NULL)
9333 dns_tkeyctx_destroy(&server->tkeyctx);
9334
9335 dst_lib_destroy();
9336
9337 isc_event_free(&server->reload_event);
9338
9339 INSIST(ISC_LIST_EMPTY(server->viewlist));
9340 INSIST(ISC_LIST_EMPTY(server->cachelist));
9341
9342 dns_aclenv_destroy(&server->aclenv);
9343
9344 isc_quota_destroy(&server->recursionquota);
9345 isc_quota_destroy(&server->tcpquota);
9346 isc_quota_destroy(&server->xfroutquota);
9347
9348 server->magic = 0;
9349 isc_mem_put(server->mctx, server, sizeof(*server));
9350 *serverp = NULL;
9351 }
9352
9353 static void
fatal(ns_server_t * server,const char * msg,isc_result_t result)9354 fatal(ns_server_t *server, const char *msg, isc_result_t result) {
9355 if (server != NULL && server->task != NULL) {
9356 /*
9357 * Prevent races between the OpenSSL on_exit registered
9358 * function and any other OpenSSL calls from other tasks
9359 * by requesting exclusive access to the task manager.
9360 */
9361 (void)isc_task_beginexclusive(server->task);
9362 }
9363 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
9364 ISC_LOG_CRITICAL, "%s: %s", msg,
9365 isc_result_totext(result));
9366 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
9367 ISC_LOG_CRITICAL, "exiting (due to fatal error)");
9368 ns_os_shutdown();
9369 exit(1);
9370 }
9371
9372 static void
start_reserved_dispatches(ns_server_t * server)9373 start_reserved_dispatches(ns_server_t *server) {
9374
9375 REQUIRE(NS_SERVER_VALID(server));
9376
9377 server->dispatchgen++;
9378 }
9379
9380 static void
end_reserved_dispatches(ns_server_t * server,bool all)9381 end_reserved_dispatches(ns_server_t *server, bool all) {
9382 ns_dispatch_t *dispatch, *nextdispatch;
9383
9384 REQUIRE(NS_SERVER_VALID(server));
9385
9386 for (dispatch = ISC_LIST_HEAD(server->dispatches);
9387 dispatch != NULL;
9388 dispatch = nextdispatch) {
9389 nextdispatch = ISC_LIST_NEXT(dispatch, link);
9390 if (!all && server->dispatchgen == dispatch-> dispatchgen)
9391 continue;
9392 ISC_LIST_UNLINK(server->dispatches, dispatch, link);
9393 dns_dispatch_detach(&dispatch->dispatch);
9394 isc_mem_put(server->mctx, dispatch, sizeof(*dispatch));
9395 }
9396 }
9397
9398 void
ns_add_reserved_dispatch(ns_server_t * server,const isc_sockaddr_t * addr)9399 ns_add_reserved_dispatch(ns_server_t *server, const isc_sockaddr_t *addr) {
9400 ns_dispatch_t *dispatch;
9401 in_port_t port;
9402 char addrbuf[ISC_SOCKADDR_FORMATSIZE];
9403 isc_result_t result;
9404 unsigned int attrs, attrmask;
9405
9406 REQUIRE(NS_SERVER_VALID(server));
9407
9408 port = isc_sockaddr_getport(addr);
9409 if (port == 0 || port >= 1024)
9410 return;
9411
9412 for (dispatch = ISC_LIST_HEAD(server->dispatches);
9413 dispatch != NULL;
9414 dispatch = ISC_LIST_NEXT(dispatch, link)) {
9415 if (isc_sockaddr_equal(&dispatch->addr, addr))
9416 break;
9417 }
9418 if (dispatch != NULL) {
9419 dispatch->dispatchgen = server->dispatchgen;
9420 return;
9421 }
9422
9423 dispatch = isc_mem_get(server->mctx, sizeof(*dispatch));
9424 if (dispatch == NULL) {
9425 result = ISC_R_NOMEMORY;
9426 goto cleanup;
9427 }
9428
9429 dispatch->addr = *addr;
9430 dispatch->dispatchgen = server->dispatchgen;
9431 dispatch->dispatch = NULL;
9432
9433 attrs = 0;
9434 attrs |= DNS_DISPATCHATTR_UDP;
9435 switch (isc_sockaddr_pf(addr)) {
9436 case AF_INET:
9437 attrs |= DNS_DISPATCHATTR_IPV4;
9438 break;
9439 case AF_INET6:
9440 attrs |= DNS_DISPATCHATTR_IPV6;
9441 break;
9442 default:
9443 result = ISC_R_NOTIMPLEMENTED;
9444 goto cleanup;
9445 }
9446 attrmask = 0;
9447 attrmask |= DNS_DISPATCHATTR_UDP;
9448 attrmask |= DNS_DISPATCHATTR_TCP;
9449 attrmask |= DNS_DISPATCHATTR_IPV4;
9450 attrmask |= DNS_DISPATCHATTR_IPV6;
9451
9452 result = dns_dispatch_getudp(ns_g_dispatchmgr, ns_g_socketmgr,
9453 ns_g_taskmgr, &dispatch->addr, 4096,
9454 UDPBUFFERS, 32768, 16411, 16433,
9455 attrs, attrmask, &dispatch->dispatch);
9456 if (result != ISC_R_SUCCESS)
9457 goto cleanup;
9458
9459 ISC_LIST_INITANDPREPEND(server->dispatches, dispatch, link);
9460
9461 return;
9462
9463 cleanup:
9464 if (dispatch != NULL)
9465 isc_mem_put(server->mctx, dispatch, sizeof(*dispatch));
9466 isc_sockaddr_format(addr, addrbuf, sizeof(addrbuf));
9467 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
9468 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
9469 "unable to create dispatch for reserved port %s: %s",
9470 addrbuf, isc_result_totext(result));
9471 }
9472
9473
9474 static isc_result_t
loadconfig(ns_server_t * server)9475 loadconfig(ns_server_t *server) {
9476 isc_result_t result;
9477 start_reserved_dispatches(server);
9478 result = load_configuration(ns_g_lwresdonly ?
9479 lwresd_g_conffile : ns_g_conffile,
9480 server, false);
9481 if (result == ISC_R_SUCCESS) {
9482 end_reserved_dispatches(server, false);
9483 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
9484 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
9485 "reloading configuration succeeded");
9486 } else {
9487 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
9488 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
9489 "reloading configuration failed: %s",
9490 isc_result_totext(result));
9491 }
9492
9493 return (result);
9494 }
9495
9496 static isc_result_t
reload(ns_server_t * server)9497 reload(ns_server_t *server) {
9498 isc_result_t result;
9499 CHECK(loadconfig(server));
9500
9501 result = load_zones(server, false, false);
9502 if (result == ISC_R_SUCCESS)
9503 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
9504 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
9505 "reloading zones succeeded");
9506 else
9507 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
9508 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
9509 "reloading zones failed: %s",
9510 isc_result_totext(result));
9511
9512 cleanup:
9513 return (result);
9514 }
9515
9516 /*
9517 * Handle a reload event (from SIGHUP).
9518 */
9519 static void
ns_server_reload(isc_task_t * task,isc_event_t * event)9520 ns_server_reload(isc_task_t *task, isc_event_t *event) {
9521 ns_server_t *server = (ns_server_t *)event->ev_arg;
9522
9523 INSIST(task == server->task);
9524 UNUSED(task);
9525
9526 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
9527 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
9528 "received SIGHUP signal to reload zones");
9529 (void)reload(server);
9530
9531 LOCK(&server->reload_event_lock);
9532 INSIST(server->reload_event == NULL);
9533 server->reload_event = event;
9534 UNLOCK(&server->reload_event_lock);
9535 }
9536
9537 void
ns_server_reloadwanted(ns_server_t * server)9538 ns_server_reloadwanted(ns_server_t *server) {
9539 LOCK(&server->reload_event_lock);
9540 if (server->reload_event != NULL)
9541 isc_task_send(server->task, &server->reload_event);
9542 UNLOCK(&server->reload_event_lock);
9543 }
9544
9545 void
ns_server_scan_interfaces(ns_server_t * server)9546 ns_server_scan_interfaces(ns_server_t *server) {
9547 isc_result_t result;
9548
9549 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
9550 NS_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
9551 "automatic interface rescan");
9552
9553 result = isc_task_beginexclusive(server->task);
9554 RUNTIME_CHECK(result == ISC_R_SUCCESS);
9555 scan_interfaces(server, true);
9556 isc_task_endexclusive(server->task);
9557 }
9558
9559 /*
9560 * Get the next token from lexer 'lex'.
9561 *
9562 * NOTE: the token value for string tokens always uses the same pointer
9563 * value. Multiple calls to this function on the same lexer will always
9564 * return either that value (lex->data) or NULL. It is necessary to copy
9565 * the token into local storage if it needs to be referenced after the next
9566 * call to next_token().
9567 */
9568 static char *
next_token(isc_lex_t * lex,isc_buffer_t ** text)9569 next_token(isc_lex_t *lex, isc_buffer_t **text) {
9570 isc_result_t result;
9571 isc_token_t token;
9572
9573 token.type = isc_tokentype_unknown;
9574 result = isc_lex_gettoken(lex, ISC_LEXOPT_EOF|ISC_LEXOPT_QSTRING,
9575 &token);
9576
9577 switch (result) {
9578 case ISC_R_NOMORE:
9579 (void) isc_lex_close(lex);
9580 break;
9581 case ISC_R_SUCCESS:
9582 if (token.type == isc_tokentype_eof)
9583 (void) isc_lex_close(lex);
9584 break;
9585 case ISC_R_NOSPACE:
9586 if (text != NULL) {
9587 (void) putstr(text, "token too large");
9588 (void) putnull(text);
9589 }
9590 return (NULL);
9591 default:
9592 if (text != NULL) {
9593 (void) putstr(text, isc_result_totext(result));
9594 (void) putnull(text);
9595 }
9596 return (NULL);
9597 }
9598
9599 if (token.type == isc_tokentype_string ||
9600 token.type == isc_tokentype_qstring)
9601 return (token.value.as_textregion.base);
9602
9603 return (NULL);
9604 }
9605
9606 /*
9607 * Find the zone specified in the control channel command, if any.
9608 * If a zone is specified, point '*zonep' at it, otherwise
9609 * set '*zonep' to NULL, and f 'zonename' is not NULL, copy
9610 * the zone name into it (N.B. 'zonename' must have space to hold
9611 * a full DNS name).
9612 *
9613 * If 'zonetxt' is set, the caller has already pulled a token
9614 * off the command line that is to be used as the zone name. (This
9615 * is sometimes done when it's necessary to check for an optional
9616 * argument before the zone name, as in "rndc sync [-clean] zone".)
9617 */
9618 static isc_result_t
zone_from_args(ns_server_t * server,isc_lex_t * lex,const char * zonetxt,dns_zone_t ** zonep,char * zonename,isc_buffer_t ** text,bool skip)9619 zone_from_args(ns_server_t *server, isc_lex_t *lex, const char *zonetxt,
9620 dns_zone_t **zonep, char *zonename,
9621 isc_buffer_t **text, bool skip)
9622 {
9623 char *ptr;
9624 char *classtxt;
9625 const char *viewtxt = NULL;
9626 dns_fixedname_t fname;
9627 dns_name_t *name;
9628 isc_result_t result;
9629 dns_view_t *view = NULL;
9630 dns_rdataclass_t rdclass;
9631 char problem[DNS_NAME_FORMATSIZE + 500] = "";
9632 char zonebuf[DNS_NAME_FORMATSIZE];
9633
9634 REQUIRE(zonep != NULL && *zonep == NULL);
9635
9636 if (skip) {
9637 /* Skip the command name. */
9638 ptr = next_token(lex, text);
9639 if (ptr == NULL)
9640 return (ISC_R_UNEXPECTEDEND);
9641 }
9642
9643 /* Look for the zone name. */
9644 if (zonetxt == NULL)
9645 zonetxt = next_token(lex, text);
9646 if (zonetxt == NULL)
9647 return (ISC_R_SUCCESS);
9648
9649 /* Copy zonetxt because it'll be overwritten by next_token() */
9650 strlcpy(zonebuf, zonetxt, DNS_NAME_FORMATSIZE);
9651 if (zonename != NULL)
9652 strlcpy(zonename, zonetxt, DNS_NAME_FORMATSIZE);
9653
9654 name = dns_fixedname_initname(&fname);
9655 CHECK(dns_name_fromstring(name, zonebuf, 0, NULL));
9656
9657 /* Look for the optional class name. */
9658 classtxt = next_token(lex, text);
9659 if (classtxt != NULL) {
9660 isc_textregion_t r;
9661 r.base = classtxt;
9662 r.length = strlen(classtxt);
9663 CHECK(dns_rdataclass_fromtext(&rdclass, &r));
9664
9665 /* Look for the optional view name. */
9666 viewtxt = next_token(lex, text);
9667 } else
9668 rdclass = dns_rdataclass_in;
9669
9670 if (viewtxt == NULL) {
9671 result = dns_viewlist_findzone(&server->viewlist, name,
9672 (classtxt == NULL),
9673 rdclass, zonep);
9674 if (result == ISC_R_NOTFOUND)
9675 snprintf(problem, sizeof(problem),
9676 "no matching zone '%s' in any view",
9677 zonebuf);
9678 else if (result == ISC_R_MULTIPLE)
9679 snprintf(problem, sizeof(problem),
9680 "zone '%s' was found in multiple views",
9681 zonebuf);
9682 } else {
9683 result = dns_viewlist_find(&server->viewlist, viewtxt,
9684 rdclass, &view);
9685 if (result != ISC_R_SUCCESS) {
9686 snprintf(problem, sizeof(problem),
9687 "no matching view '%s'", viewtxt);
9688 goto report;
9689 }
9690
9691 result = dns_zt_find(view->zonetable, name, 0, NULL, zonep);
9692 if (result != ISC_R_SUCCESS)
9693 snprintf(problem, sizeof(problem),
9694 "no matching zone '%s' in view '%s'",
9695 zonebuf, viewtxt);
9696 }
9697
9698 /* Partial match? */
9699 if (result != ISC_R_SUCCESS && *zonep != NULL)
9700 dns_zone_detach(zonep);
9701 if (result == DNS_R_PARTIALMATCH)
9702 result = ISC_R_NOTFOUND;
9703 report:
9704 if (result != ISC_R_SUCCESS) {
9705 isc_result_t tresult;
9706
9707 tresult = putstr(text, problem);
9708 if (tresult == ISC_R_SUCCESS)
9709 (void) putnull(text);
9710 }
9711
9712 cleanup:
9713 if (view != NULL)
9714 dns_view_detach(&view);
9715
9716 return (result);
9717 }
9718
9719 /*
9720 * Act on a "retransfer" command from the command channel.
9721 */
9722 isc_result_t
ns_server_retransfercommand(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)9723 ns_server_retransfercommand(ns_server_t *server, isc_lex_t *lex,
9724 isc_buffer_t **text)
9725 {
9726 isc_result_t result;
9727 dns_zone_t *zone = NULL;
9728 dns_zone_t *raw = NULL;
9729 dns_zonetype_t type;
9730
9731 result = zone_from_args(server, lex, NULL, &zone, NULL,
9732 text, true);
9733 if (result != ISC_R_SUCCESS)
9734 return (result);
9735 if (zone == NULL)
9736 return (ISC_R_UNEXPECTEDEND);
9737 dns_zone_getraw(zone, &raw);
9738 if (raw != NULL) {
9739 dns_zone_detach(&zone);
9740 dns_zone_attach(raw, &zone);
9741 dns_zone_detach(&raw);
9742 }
9743 type = dns_zone_gettype(zone);
9744 if (type == dns_zone_slave || type == dns_zone_stub)
9745 dns_zone_forcereload(zone);
9746 else
9747 result = ISC_R_NOTFOUND;
9748 dns_zone_detach(&zone);
9749 return (result);
9750 }
9751
9752 /*
9753 * Act on a "reload" command from the command channel.
9754 */
9755 isc_result_t
ns_server_reloadcommand(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)9756 ns_server_reloadcommand(ns_server_t *server, isc_lex_t *lex,
9757 isc_buffer_t **text)
9758 {
9759 isc_result_t result;
9760 dns_zone_t *zone = NULL;
9761 dns_zonetype_t type;
9762 const char *msg = NULL;
9763
9764 result = zone_from_args(server, lex, NULL, &zone, NULL,
9765 text, true);
9766 if (result != ISC_R_SUCCESS)
9767 return (result);
9768 if (zone == NULL) {
9769 result = reload(server);
9770 if (result == ISC_R_SUCCESS)
9771 msg = "server reload successful";
9772 } else {
9773 type = dns_zone_gettype(zone);
9774 if (type == dns_zone_slave || type == dns_zone_stub) {
9775 dns_zone_refresh(zone);
9776 dns_zone_detach(&zone);
9777 msg = "zone refresh queued";
9778 } else {
9779 result = dns_zone_load(zone);
9780 dns_zone_detach(&zone);
9781 switch (result) {
9782 case ISC_R_SUCCESS:
9783 msg = "zone reload successful";
9784 break;
9785 case DNS_R_CONTINUE:
9786 msg = "zone reload queued";
9787 result = ISC_R_SUCCESS;
9788 break;
9789 case DNS_R_UPTODATE:
9790 msg = "zone reload up-to-date";
9791 result = ISC_R_SUCCESS;
9792 break;
9793 default:
9794 /* failure message will be generated by rndc */
9795 break;
9796 }
9797 }
9798 }
9799 if (msg != NULL) {
9800 (void) putstr(text, msg);
9801 (void) putnull(text);
9802 }
9803 return (result);
9804 }
9805
9806 /*
9807 * Act on a "reconfig" command from the command channel.
9808 */
9809 isc_result_t
ns_server_reconfigcommand(ns_server_t * server)9810 ns_server_reconfigcommand(ns_server_t *server) {
9811 isc_result_t result;
9812
9813 CHECK(loadconfig(server));
9814
9815 result = load_zones(server, false, true);
9816 if (result == ISC_R_SUCCESS)
9817 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
9818 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
9819 "scheduled loading new zones");
9820 else
9821 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
9822 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
9823 "loading new zones failed: %s",
9824 isc_result_totext(result));
9825 cleanup:
9826 return (result);
9827 }
9828
9829 /*
9830 * Act on a "notify" command from the command channel.
9831 */
9832 isc_result_t
ns_server_notifycommand(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)9833 ns_server_notifycommand(ns_server_t *server, isc_lex_t *lex,
9834 isc_buffer_t **text)
9835 {
9836 isc_result_t result;
9837 dns_zone_t *zone = NULL;
9838 const char msg[] = "zone notify queued";
9839
9840 result = zone_from_args(server, lex, NULL, &zone, NULL,
9841 text, true);
9842 if (result != ISC_R_SUCCESS)
9843 return (result);
9844 if (zone == NULL)
9845 return (ISC_R_UNEXPECTEDEND);
9846
9847 dns_zone_notify(zone);
9848 dns_zone_detach(&zone);
9849 (void) putstr(text, msg);
9850 (void) putnull(text);
9851
9852 return (ISC_R_SUCCESS);
9853 }
9854
9855 /*
9856 * Act on a "refresh" command from the command channel.
9857 */
9858 isc_result_t
ns_server_refreshcommand(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)9859 ns_server_refreshcommand(ns_server_t *server, isc_lex_t *lex,
9860 isc_buffer_t **text)
9861 {
9862 isc_result_t result;
9863 dns_zone_t *zone = NULL, *raw = NULL;
9864 const char msg1[] = "zone refresh queued";
9865 const char msg2[] = "not a slave or stub zone";
9866 dns_zonetype_t type;
9867
9868 result = zone_from_args(server, lex, NULL, &zone, NULL,
9869 text, true);
9870 if (result != ISC_R_SUCCESS)
9871 return (result);
9872 if (zone == NULL)
9873 return (ISC_R_UNEXPECTEDEND);
9874
9875 dns_zone_getraw(zone, &raw);
9876 if (raw != NULL) {
9877 dns_zone_detach(&zone);
9878 dns_zone_attach(raw, &zone);
9879 dns_zone_detach(&raw);
9880 }
9881
9882 type = dns_zone_gettype(zone);
9883 if (type == dns_zone_slave || type == dns_zone_stub) {
9884 dns_zone_refresh(zone);
9885 dns_zone_detach(&zone);
9886 (void) putstr(text, msg1);
9887 (void) putnull(text);
9888 return (ISC_R_SUCCESS);
9889 }
9890
9891 dns_zone_detach(&zone);
9892 (void) putstr(text, msg2);
9893 (void) putnull(text);
9894 return (ISC_R_FAILURE);
9895 }
9896
9897 isc_result_t
ns_server_togglequerylog(ns_server_t * server,isc_lex_t * lex)9898 ns_server_togglequerylog(ns_server_t *server, isc_lex_t *lex) {
9899 bool value;
9900 char *ptr;
9901
9902 /* Skip the command name. */
9903 ptr = next_token(lex, NULL);
9904 if (ptr == NULL)
9905 return (ISC_R_UNEXPECTEDEND);
9906
9907 ptr = next_token(lex, NULL);
9908 if (ptr == NULL) {
9909 value = server->log_queries ? false : true;
9910 } else if (!strcasecmp(ptr, "on") || !strcasecmp(ptr, "yes") ||
9911 !strcasecmp(ptr, "enable") || !strcasecmp(ptr, "true")) {
9912 value = true;
9913 } else if (!strcasecmp(ptr, "off") || !strcasecmp(ptr, "no") ||
9914 !strcasecmp(ptr, "disable") || !strcasecmp(ptr, "false")) {
9915 value = false;
9916 } else {
9917 return (DNS_R_SYNTAX);
9918 }
9919
9920 if (server->log_queries == value)
9921 return (ISC_R_SUCCESS);
9922
9923 server->log_queries = value;
9924
9925 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
9926 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
9927 "query logging is now %s",
9928 server->log_queries ? "on" : "off");
9929 return (ISC_R_SUCCESS);
9930 }
9931
9932 static isc_result_t
ns_listenlist_fromconfig(const cfg_obj_t * listenlist,const cfg_obj_t * config,cfg_aclconfctx_t * actx,isc_mem_t * mctx,uint16_t family,ns_listenlist_t ** target)9933 ns_listenlist_fromconfig(const cfg_obj_t *listenlist, const cfg_obj_t *config,
9934 cfg_aclconfctx_t *actx, isc_mem_t *mctx,
9935 uint16_t family, ns_listenlist_t **target)
9936 {
9937 isc_result_t result;
9938 const cfg_listelt_t *element;
9939 ns_listenlist_t *dlist = NULL;
9940
9941 REQUIRE(target != NULL && *target == NULL);
9942
9943 result = ns_listenlist_create(mctx, &dlist);
9944 if (result != ISC_R_SUCCESS)
9945 return (result);
9946
9947 for (element = cfg_list_first(listenlist);
9948 element != NULL;
9949 element = cfg_list_next(element))
9950 {
9951 ns_listenelt_t *delt = NULL;
9952 const cfg_obj_t *listener = cfg_listelt_value(element);
9953 result = ns_listenelt_fromconfig(listener, config, actx,
9954 mctx, family, &delt);
9955 if (result != ISC_R_SUCCESS)
9956 goto cleanup;
9957 ISC_LIST_APPEND(dlist->elts, delt, link);
9958 }
9959 *target = dlist;
9960 return (ISC_R_SUCCESS);
9961
9962 cleanup:
9963 ns_listenlist_detach(&dlist);
9964 return (result);
9965 }
9966
9967 /*
9968 * Create a listen list from the corresponding configuration
9969 * data structure.
9970 */
9971 static isc_result_t
ns_listenelt_fromconfig(const cfg_obj_t * listener,const cfg_obj_t * config,cfg_aclconfctx_t * actx,isc_mem_t * mctx,uint16_t family,ns_listenelt_t ** target)9972 ns_listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
9973 cfg_aclconfctx_t *actx, isc_mem_t *mctx,
9974 uint16_t family, ns_listenelt_t **target)
9975 {
9976 isc_result_t result;
9977 const cfg_obj_t *portobj, *dscpobj;
9978 in_port_t port;
9979 isc_dscp_t dscp = -1;
9980 ns_listenelt_t *delt = NULL;
9981 REQUIRE(target != NULL && *target == NULL);
9982
9983 portobj = cfg_tuple_get(listener, "port");
9984 if (!cfg_obj_isuint32(portobj)) {
9985 if (ns_g_port != 0) {
9986 port = ns_g_port;
9987 } else {
9988 result = ns_config_getport(config, &port);
9989 if (result != ISC_R_SUCCESS)
9990 return (result);
9991 }
9992 } else {
9993 if (cfg_obj_asuint32(portobj) >= UINT16_MAX) {
9994 cfg_obj_log(portobj, ns_g_lctx, ISC_LOG_ERROR,
9995 "port value '%u' is out of range",
9996 cfg_obj_asuint32(portobj));
9997 return (ISC_R_RANGE);
9998 }
9999 port = (in_port_t)cfg_obj_asuint32(portobj);
10000 }
10001
10002 dscpobj = cfg_tuple_get(listener, "dscp");
10003 if (!cfg_obj_isuint32(dscpobj))
10004 dscp = ns_g_dscp;
10005 else {
10006 if (cfg_obj_asuint32(dscpobj) > 63) {
10007 cfg_obj_log(dscpobj, ns_g_lctx, ISC_LOG_ERROR,
10008 "dscp value '%u' is out of range",
10009 cfg_obj_asuint32(dscpobj));
10010 return (ISC_R_RANGE);
10011 }
10012 dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
10013 }
10014
10015 result = ns_listenelt_create(mctx, port, dscp, NULL, &delt);
10016 if (result != ISC_R_SUCCESS)
10017 return (result);
10018
10019 result = cfg_acl_fromconfig2(cfg_tuple_get(listener, "acl"),
10020 config, ns_g_lctx, actx, mctx, 0,
10021 family, &delt->acl);
10022 if (result != ISC_R_SUCCESS) {
10023 ns_listenelt_destroy(delt);
10024 return (result);
10025 }
10026 *target = delt;
10027 return (ISC_R_SUCCESS);
10028 }
10029
10030 isc_result_t
ns_server_dumpstats(ns_server_t * server)10031 ns_server_dumpstats(ns_server_t *server) {
10032 isc_result_t result;
10033 FILE *fp = NULL;
10034
10035 CHECKMF(isc_stdio_open(server->statsfile, "a", &fp),
10036 "could not open statistics dump file", server->statsfile);
10037
10038 result = ns_stats_dump(server, fp);
10039
10040 cleanup:
10041 if (fp != NULL)
10042 (void)isc_stdio_close(fp);
10043 if (result == ISC_R_SUCCESS)
10044 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10045 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
10046 "dumpstats complete");
10047 else
10048 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10049 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
10050 "dumpstats failed: %s",
10051 dns_result_totext(result));
10052 return (result);
10053 }
10054
10055 static isc_result_t
add_zone_tolist(dns_zone_t * zone,void * uap)10056 add_zone_tolist(dns_zone_t *zone, void *uap) {
10057 struct dumpcontext *dctx = uap;
10058 struct zonelistentry *zle;
10059
10060 zle = isc_mem_get(dctx->mctx, sizeof *zle);
10061 if (zle == NULL)
10062 return (ISC_R_NOMEMORY);
10063 zle->zone = NULL;
10064 dns_zone_attach(zone, &zle->zone);
10065 ISC_LINK_INIT(zle, link);
10066 ISC_LIST_APPEND(ISC_LIST_TAIL(dctx->viewlist)->zonelist, zle, link);
10067 return (ISC_R_SUCCESS);
10068 }
10069
10070 static isc_result_t
add_view_tolist(struct dumpcontext * dctx,dns_view_t * view)10071 add_view_tolist(struct dumpcontext *dctx, dns_view_t *view) {
10072 struct viewlistentry *vle;
10073 isc_result_t result = ISC_R_SUCCESS;
10074
10075 /*
10076 * Prevent duplicate views.
10077 */
10078 for (vle = ISC_LIST_HEAD(dctx->viewlist);
10079 vle != NULL;
10080 vle = ISC_LIST_NEXT(vle, link))
10081 if (vle->view == view)
10082 return (ISC_R_SUCCESS);
10083
10084 vle = isc_mem_get(dctx->mctx, sizeof *vle);
10085 if (vle == NULL)
10086 return (ISC_R_NOMEMORY);
10087 vle->view = NULL;
10088 dns_view_attach(view, &vle->view);
10089 ISC_LINK_INIT(vle, link);
10090 ISC_LIST_INIT(vle->zonelist);
10091 ISC_LIST_APPEND(dctx->viewlist, vle, link);
10092 if (dctx->dumpzones)
10093 result = dns_zt_apply(view->zonetable, true,
10094 add_zone_tolist, dctx);
10095 return (result);
10096 }
10097
10098 static void
dumpcontext_destroy(struct dumpcontext * dctx)10099 dumpcontext_destroy(struct dumpcontext *dctx) {
10100 struct viewlistentry *vle;
10101 struct zonelistentry *zle;
10102
10103 vle = ISC_LIST_HEAD(dctx->viewlist);
10104 while (vle != NULL) {
10105 ISC_LIST_UNLINK(dctx->viewlist, vle, link);
10106 zle = ISC_LIST_HEAD(vle->zonelist);
10107 while (zle != NULL) {
10108 ISC_LIST_UNLINK(vle->zonelist, zle, link);
10109 dns_zone_detach(&zle->zone);
10110 isc_mem_put(dctx->mctx, zle, sizeof *zle);
10111 zle = ISC_LIST_HEAD(vle->zonelist);
10112 }
10113 dns_view_detach(&vle->view);
10114 isc_mem_put(dctx->mctx, vle, sizeof *vle);
10115 vle = ISC_LIST_HEAD(dctx->viewlist);
10116 }
10117 if (dctx->version != NULL)
10118 dns_db_closeversion(dctx->db, &dctx->version, false);
10119 if (dctx->db != NULL)
10120 dns_db_detach(&dctx->db);
10121 if (dctx->cache != NULL)
10122 dns_db_detach(&dctx->cache);
10123 if (dctx->task != NULL)
10124 isc_task_detach(&dctx->task);
10125 if (dctx->fp != NULL)
10126 (void)isc_stdio_close(dctx->fp);
10127 if (dctx->mdctx != NULL)
10128 dns_dumpctx_detach(&dctx->mdctx);
10129 isc_mem_put(dctx->mctx, dctx, sizeof *dctx);
10130 }
10131
10132 static void
dumpdone(void * arg,isc_result_t result)10133 dumpdone(void *arg, isc_result_t result) {
10134 struct dumpcontext *dctx = arg;
10135 char buf[1024+32];
10136 const dns_master_style_t *style;
10137
10138 if (result != ISC_R_SUCCESS) {
10139 goto cleanup;
10140 }
10141 if (dctx->mdctx != NULL) {
10142 dns_dumpctx_detach(&dctx->mdctx);
10143 }
10144 if (dctx->view == NULL) {
10145 dctx->view = ISC_LIST_HEAD(dctx->viewlist);
10146 if (dctx->view == NULL) {
10147 goto done;
10148 }
10149 INSIST(dctx->zone == NULL);
10150 } else {
10151 goto resume;
10152 }
10153 nextview:
10154 fprintf(dctx->fp, ";\n; Start view %s\n;\n", dctx->view->view->name);
10155 resume:
10156 if (dctx->dumpcache && dns_view_iscacheshared(dctx->view->view)) {
10157 fprintf(dctx->fp,
10158 ";\n; Cache of view '%s' is shared as '%s'\n",
10159 dctx->view->view->name,
10160 dns_cache_getname(dctx->view->view->cache));
10161 } else if (dctx->zone == NULL && dctx->cache == NULL &&
10162 dctx->dumpcache)
10163 {
10164 style = &dns_master_style_cache;
10165 /* start cache dump */
10166 if (dctx->view->view->cachedb != NULL) {
10167 dns_db_attach(dctx->view->view->cachedb, &dctx->cache);
10168 }
10169 if (dctx->cache != NULL) {
10170 fprintf(dctx->fp,
10171 ";\n; Cache dump of view '%s' (cache %s)\n;\n",
10172 dctx->view->view->name,
10173 dns_cache_getname(dctx->view->view->cache));
10174 result = dns_master_dumptostreaminc(dctx->mctx,
10175 dctx->cache, NULL,
10176 style, dctx->fp,
10177 dctx->task,
10178 dumpdone, dctx,
10179 &dctx->mdctx);
10180 if (result == DNS_R_CONTINUE) {
10181 return;
10182 }
10183 if (result == ISC_R_NOTIMPLEMENTED) {
10184 fprintf(dctx->fp, "; %s\n",
10185 dns_result_totext(result));
10186 } else if (result != ISC_R_SUCCESS) {
10187 goto cleanup;
10188 }
10189 }
10190 }
10191
10192 if ((dctx->dumpadb || dctx->dumpbad || dctx->dumpfail) &&
10193 dctx->cache == NULL && dctx->view->view->cachedb != NULL) {
10194 dns_db_attach(dctx->view->view->cachedb, &dctx->cache);
10195 }
10196
10197 if (dctx->cache != NULL) {
10198 if (dctx->dumpadb) {
10199 dns_adb_dump(dctx->view->view->adb, dctx->fp);
10200 }
10201 if (dctx->dumpbad) {
10202 dns_resolver_printbadcache(dctx->view->view->resolver,
10203 dctx->fp);
10204 }
10205 if (dctx->dumpfail) {
10206 dns_badcache_print(dctx->view->view->failcache,
10207 "SERVFAIL cache", dctx->fp);
10208 }
10209 dns_db_detach(&dctx->cache);
10210 }
10211 if (dctx->dumpzones) {
10212 style = &dns_master_style_full;
10213 nextzone:
10214 if (dctx->version != NULL) {
10215 dns_db_closeversion(dctx->db, &dctx->version,
10216 false);
10217 }
10218 if (dctx->db != NULL) {
10219 dns_db_detach(&dctx->db);
10220 }
10221 if (dctx->zone == NULL) {
10222 dctx->zone = ISC_LIST_HEAD(dctx->view->zonelist);
10223 } else {
10224 dctx->zone = ISC_LIST_NEXT(dctx->zone, link);
10225 }
10226 if (dctx->zone != NULL) {
10227 /* start zone dump */
10228 dns_zone_name(dctx->zone->zone, buf, sizeof(buf));
10229 fprintf(dctx->fp, ";\n; Zone dump of '%s'\n;\n", buf);
10230 result = dns_zone_getdb(dctx->zone->zone, &dctx->db);
10231 if (result != ISC_R_SUCCESS) {
10232 fprintf(dctx->fp, "; %s\n",
10233 dns_result_totext(result));
10234 goto nextzone;
10235 }
10236 dns_db_currentversion(dctx->db, &dctx->version);
10237 result = dns_master_dumptostreaminc(dctx->mctx,
10238 dctx->db,
10239 dctx->version,
10240 style, dctx->fp,
10241 dctx->task,
10242 dumpdone, dctx,
10243 &dctx->mdctx);
10244 if (result == DNS_R_CONTINUE) {
10245 return;
10246 }
10247 if (result == ISC_R_NOTIMPLEMENTED) {
10248 fprintf(dctx->fp, "; %s\n",
10249 dns_result_totext(result));
10250 result = ISC_R_SUCCESS;
10251 POST(result);
10252 goto nextzone;
10253 }
10254 if (result != ISC_R_SUCCESS) {
10255 goto cleanup;
10256 }
10257 }
10258 }
10259 if (dctx->view != NULL) {
10260 dctx->view = ISC_LIST_NEXT(dctx->view, link);
10261 if (dctx->view != NULL) {
10262 goto nextview;
10263 }
10264 }
10265 done:
10266 fprintf(dctx->fp, "; Dump complete\n");
10267 result = isc_stdio_flush(dctx->fp);
10268 if (result == ISC_R_SUCCESS) {
10269 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10270 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
10271 "dumpdb complete");
10272 }
10273 cleanup:
10274 if (result != ISC_R_SUCCESS) {
10275 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10276 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
10277 "dumpdb failed: %s", dns_result_totext(result));
10278 }
10279 dumpcontext_destroy(dctx);
10280 }
10281
10282 isc_result_t
ns_server_dumpdb(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)10283 ns_server_dumpdb(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
10284 struct dumpcontext *dctx = NULL;
10285 dns_view_t *view;
10286 isc_result_t result;
10287 char *ptr;
10288 const char *sep;
10289 bool found;
10290
10291 /* Skip the command name. */
10292 ptr = next_token(lex, NULL);
10293 if (ptr == NULL)
10294 return (ISC_R_UNEXPECTEDEND);
10295
10296 dctx = isc_mem_get(server->mctx, sizeof(*dctx));
10297 if (dctx == NULL)
10298 return (ISC_R_NOMEMORY);
10299
10300 dctx->mctx = server->mctx;
10301 dctx->dumpcache = true;
10302 dctx->dumpadb = true;
10303 dctx->dumpbad = true;
10304 dctx->dumpfail = true;
10305 dctx->dumpzones = false;
10306 dctx->fp = NULL;
10307 ISC_LIST_INIT(dctx->viewlist);
10308 dctx->view = NULL;
10309 dctx->zone = NULL;
10310 dctx->cache = NULL;
10311 dctx->mdctx = NULL;
10312 dctx->db = NULL;
10313 dctx->cache = NULL;
10314 dctx->task = NULL;
10315 dctx->version = NULL;
10316 isc_task_attach(server->task, &dctx->task);
10317
10318 CHECKMF(isc_stdio_open(server->dumpfile, "w", &dctx->fp),
10319 "could not open dump file", server->dumpfile);
10320
10321 ptr = next_token(lex, NULL);
10322 sep = (ptr == NULL) ? "" : ": ";
10323 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10324 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
10325 "dumpdb started%s%s", sep, (ptr != NULL) ? ptr : "");
10326
10327 if (ptr != NULL && strcmp(ptr, "-all") == 0) {
10328 /* also dump zones */
10329 dctx->dumpzones = true;
10330 ptr = next_token(lex, NULL);
10331 } else if (ptr != NULL && strcmp(ptr, "-cache") == 0) {
10332 /* this is the default */
10333 ptr = next_token(lex, NULL);
10334 } else if (ptr != NULL && strcmp(ptr, "-zones") == 0) {
10335 /* only dump zones, suppress caches */
10336 dctx->dumpadb = false;
10337 dctx->dumpbad = false;
10338 dctx->dumpcache = false;
10339 dctx->dumpfail = false;
10340 dctx->dumpzones = true;
10341 ptr = next_token(lex, NULL);
10342 } else if (ptr != NULL && strcmp(ptr, "-adb") == 0) {
10343 /* only dump adb, suppress other caches */
10344 dctx->dumpbad = false;
10345 dctx->dumpcache = false;
10346 dctx->dumpfail = false;
10347 ptr = next_token(lex, NULL);
10348 } else if (ptr != NULL && strcmp(ptr, "-bad") == 0) {
10349 /* only dump badcache, suppress other caches */
10350 dctx->dumpadb = false;
10351 dctx->dumpcache = false;
10352 dctx->dumpfail = false;
10353 ptr = next_token(lex, NULL);
10354 } else if (ptr != NULL && strcmp(ptr, "-fail") == 0) {
10355 /* only dump servfail cache, suppress other caches */
10356 dctx->dumpadb = false;
10357 dctx->dumpbad = false;
10358 dctx->dumpcache = false;
10359 ptr = next_token(lex, NULL);
10360 }
10361
10362 nextview:
10363 found = false;
10364 for (view = ISC_LIST_HEAD(server->viewlist);
10365 view != NULL;
10366 view = ISC_LIST_NEXT(view, link))
10367 {
10368 if (ptr != NULL && strcmp(view->name, ptr) != 0)
10369 continue;
10370 found = true;
10371 CHECK(add_view_tolist(dctx, view));
10372 }
10373 if (ptr != NULL) {
10374 if (!found) {
10375 CHECK(putstr(text, "view '"));
10376 CHECK(putstr(text, ptr));
10377 CHECK(putstr(text, "' not found"));
10378 CHECK(putnull(text));
10379 result = ISC_R_NOTFOUND;
10380 dumpdone(dctx, result);
10381 return (result);
10382 }
10383 ptr = next_token(lex, NULL);
10384 if (ptr != NULL)
10385 goto nextview;
10386 }
10387 dumpdone(dctx, ISC_R_SUCCESS);
10388 return (ISC_R_SUCCESS);
10389
10390 cleanup:
10391 if (dctx != NULL)
10392 dumpcontext_destroy(dctx);
10393 return (result);
10394 }
10395
10396 isc_result_t
ns_server_dumpsecroots(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)10397 ns_server_dumpsecroots(ns_server_t *server, isc_lex_t *lex,
10398 isc_buffer_t **text)
10399 {
10400 dns_view_t *view;
10401 dns_keytable_t *secroots = NULL;
10402 dns_ntatable_t *ntatable = NULL;
10403 isc_result_t result;
10404 char *ptr;
10405 FILE *fp = NULL;
10406 isc_time_t now;
10407 char tbuf[64];
10408 unsigned int used = isc_buffer_usedlength(*text);
10409 bool first = true;
10410
10411 /* Skip the command name. */
10412 ptr = next_token(lex, text);
10413 if (ptr == NULL) {
10414 return (ISC_R_UNEXPECTEDEND);
10415 }
10416
10417 /* "-" here means print the output instead of dumping to file */
10418 ptr = next_token(lex, text);
10419 if (ptr != NULL && strcmp(ptr, "-") == 0) {
10420 ptr = next_token(lex, text);
10421 } else {
10422 result = isc_stdio_open(server->secrootsfile, "w", &fp);
10423 if (result != ISC_R_SUCCESS) {
10424 (void) putstr(text, "could not open ");
10425 (void) putstr(text, server->secrootsfile);
10426 CHECKMF(result, "could not open secroots dump file",
10427 server->secrootsfile);
10428 }
10429 }
10430
10431 TIME_NOW(&now);
10432 isc_time_formattimestamp(&now, tbuf, sizeof(tbuf));
10433 CHECK(putstr(text, "secure roots as of "));
10434 CHECK(putstr(text, tbuf));
10435 CHECK(putstr(text, ":\n"));
10436 used = isc_buffer_usedlength(*text);
10437
10438 do {
10439 for (view = ISC_LIST_HEAD(server->viewlist);
10440 view != NULL;
10441 view = ISC_LIST_NEXT(view, link))
10442 {
10443 if (ptr != NULL && strcmp(view->name, ptr) != 0) {
10444 continue;
10445 }
10446 if (secroots != NULL) {
10447 dns_keytable_detach(&secroots);
10448 }
10449 result = dns_view_getsecroots(view, &secroots);
10450 if (result == ISC_R_NOTFOUND) {
10451 result = ISC_R_SUCCESS;
10452 continue;
10453 }
10454 if (first || used != isc_buffer_usedlength(*text)) {
10455 CHECK(putstr(text, "\n"));
10456 first = false;
10457 }
10458 CHECK(putstr(text, " Start view "));
10459 CHECK(putstr(text, view->name));
10460 CHECK(putstr(text, "\n Secure roots:\n\n"));
10461 used = isc_buffer_usedlength(*text);
10462 CHECK(dns_keytable_totext(secroots, text));
10463
10464 if (ntatable != NULL) {
10465 dns_ntatable_detach(&ntatable);
10466 }
10467 result = dns_view_getntatable(view, &ntatable);
10468 if (result == ISC_R_NOTFOUND) {
10469 result = ISC_R_SUCCESS;
10470 continue;
10471 }
10472 if (used != isc_buffer_usedlength(*text)) {
10473 CHECK(putstr(text, "\n"));
10474 }
10475 CHECK(putstr(text, " Negative trust anchors:\n\n"));
10476 used = isc_buffer_usedlength(*text);
10477 CHECK(dns_ntatable_totext(ntatable, text));
10478 }
10479
10480 if (ptr != NULL) {
10481 ptr = next_token(lex, text);
10482 }
10483 } while (ptr != NULL);
10484
10485 cleanup:
10486 if (secroots != NULL) {
10487 dns_keytable_detach(&secroots);
10488 }
10489 if (ntatable != NULL) {
10490 dns_ntatable_detach(&ntatable);
10491 }
10492
10493 if (fp != NULL) {
10494 if (used != isc_buffer_usedlength(*text)) {
10495 (void)putstr(text, "\n");
10496 }
10497 fprintf(fp, "%.*s", (int) isc_buffer_usedlength(*text),
10498 (char *) isc_buffer_base(*text));
10499 isc_buffer_clear(*text);
10500 (void)isc_stdio_close(fp);
10501 } else if (isc_buffer_usedlength(*text) > 0) {
10502 (void)putnull(text);
10503 }
10504
10505 if (result == ISC_R_SUCCESS) {
10506 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10507 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
10508 "dumpsecroots complete");
10509 } else {
10510 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10511 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
10512 "dumpsecroots failed: %s",
10513 dns_result_totext(result));
10514 }
10515 return (result);
10516 }
10517
10518 isc_result_t
ns_server_dumprecursing(ns_server_t * server)10519 ns_server_dumprecursing(ns_server_t *server) {
10520 FILE *fp = NULL;
10521 dns_view_t *view;
10522 isc_result_t result;
10523
10524 CHECKMF(isc_stdio_open(server->recfile, "w", &fp),
10525 "could not open dump file", server->recfile);
10526 fprintf(fp, ";\n; Recursing Queries\n;\n");
10527 ns_interfacemgr_dumprecursing(fp, server->interfacemgr);
10528
10529 for (view = ISC_LIST_HEAD(server->viewlist);
10530 view != NULL;
10531 view = ISC_LIST_NEXT(view, link))
10532 {
10533 fprintf(fp, ";\n; Active fetch domains [view: %s]\n;\n",
10534 view->name);
10535 dns_resolver_dumpfetches(view->resolver,
10536 isc_statsformat_file, fp);
10537 }
10538
10539 fprintf(fp, "; Dump complete\n");
10540
10541 cleanup:
10542 if (fp != NULL)
10543 result = isc_stdio_close(fp);
10544 if (result == ISC_R_SUCCESS)
10545 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10546 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
10547 "dumprecursing complete");
10548 else
10549 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10550 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
10551 "dumprecursing failed: %s",
10552 dns_result_totext(result));
10553 return (result);
10554 }
10555
10556 isc_result_t
ns_server_setdebuglevel(ns_server_t * server,isc_lex_t * lex)10557 ns_server_setdebuglevel(ns_server_t *server, isc_lex_t *lex) {
10558 char *ptr;
10559 char *endp;
10560 long newlevel;
10561
10562 UNUSED(server);
10563
10564 /* Skip the command name. */
10565 ptr = next_token(lex, NULL);
10566 if (ptr == NULL)
10567 return (ISC_R_UNEXPECTEDEND);
10568
10569 /* Look for the new level name. */
10570 ptr = next_token(lex, NULL);
10571 if (ptr == NULL) {
10572 if (ns_g_debuglevel < 99)
10573 ns_g_debuglevel++;
10574 } else {
10575 newlevel = strtol(ptr, &endp, 10);
10576 if (*endp != '\0' || newlevel < 0 || newlevel > 99)
10577 return (ISC_R_RANGE);
10578 ns_g_debuglevel = (unsigned int)newlevel;
10579 }
10580 isc_log_setdebuglevel(ns_g_lctx, ns_g_debuglevel);
10581 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10582 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
10583 "debug level is now %u", ns_g_debuglevel);
10584 return (ISC_R_SUCCESS);
10585 }
10586
10587 isc_result_t
ns_server_validation(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)10588 ns_server_validation(ns_server_t *server, isc_lex_t *lex,
10589 isc_buffer_t **text)
10590 {
10591 char *ptr;
10592 dns_view_t *view;
10593 bool changed = false;
10594 isc_result_t result;
10595 bool enable = true, set = true, first = true;
10596
10597 /* Skip the command name. */
10598 ptr = next_token(lex, text);
10599 if (ptr == NULL)
10600 return (ISC_R_UNEXPECTEDEND);
10601
10602 /* Find out what we are to do. */
10603 ptr = next_token(lex, text);
10604 if (ptr == NULL)
10605 return (ISC_R_UNEXPECTEDEND);
10606
10607 if (!strcasecmp(ptr, "on") || !strcasecmp(ptr, "yes") ||
10608 !strcasecmp(ptr, "enable") || !strcasecmp(ptr, "true")) {
10609 enable = true;
10610 } else if (!strcasecmp(ptr, "off") || !strcasecmp(ptr, "no") ||
10611 !strcasecmp(ptr, "disable") || !strcasecmp(ptr, "false")) {
10612 enable = false;
10613 } else if (!strcasecmp(ptr, "check") || !strcasecmp(ptr, "status")) {
10614 set = false;
10615 } else {
10616 return (DNS_R_SYNTAX);
10617 }
10618
10619 /* Look for the view name. */
10620 ptr = next_token(lex, text);
10621
10622 result = isc_task_beginexclusive(server->task);
10623 RUNTIME_CHECK(result == ISC_R_SUCCESS);
10624 for (view = ISC_LIST_HEAD(server->viewlist);
10625 view != NULL;
10626 view = ISC_LIST_NEXT(view, link))
10627 {
10628 if (ptr != NULL && strcasecmp(ptr, view->name) != 0)
10629 continue;
10630 CHECK(dns_view_flushcache(view));
10631
10632 if (set) {
10633 view->enablevalidation = enable;
10634 changed = true;
10635 } else {
10636 if (!first)
10637 CHECK(putstr(text, "\n"));
10638 CHECK(putstr(text, "DNSSEC validation is "));
10639 CHECK(putstr(text, view->enablevalidation
10640 ? "enabled" : "disabled"));
10641 CHECK(putstr(text, " (view "));
10642 CHECK(putstr(text, view->name));
10643 CHECK(putstr(text, ")"));
10644 CHECK(putnull(text));
10645 first = false;
10646 }
10647 }
10648
10649 if (!set)
10650 result = ISC_R_SUCCESS;
10651 else if (changed)
10652 result = ISC_R_SUCCESS;
10653 else
10654 result = ISC_R_FAILURE;
10655 cleanup:
10656 isc_task_endexclusive(server->task);
10657 return (result);
10658 }
10659
10660 isc_result_t
ns_server_flushcache(ns_server_t * server,isc_lex_t * lex)10661 ns_server_flushcache(ns_server_t *server, isc_lex_t *lex) {
10662 char *ptr;
10663 dns_view_t *view;
10664 bool flushed;
10665 bool found;
10666 isc_result_t result;
10667 ns_cache_t *nsc;
10668
10669 /* Skip the command name. */
10670 ptr = next_token(lex, NULL);
10671 if (ptr == NULL)
10672 return (ISC_R_UNEXPECTEDEND);
10673
10674 /* Look for the view name. */
10675 ptr = next_token(lex, NULL);
10676
10677 result = isc_task_beginexclusive(server->task);
10678 RUNTIME_CHECK(result == ISC_R_SUCCESS);
10679 flushed = true;
10680 found = false;
10681
10682 /*
10683 * Flushing a cache is tricky when caches are shared by multiple views.
10684 * We first identify which caches should be flushed in the local cache
10685 * list, flush these caches, and then update other views that refer to
10686 * the flushed cache DB.
10687 */
10688 if (ptr != NULL) {
10689 /*
10690 * Mark caches that need to be flushed. This is an O(#view^2)
10691 * operation in the very worst case, but should be normally
10692 * much more lightweight because only a few (most typically just
10693 * one) views will match.
10694 */
10695 for (view = ISC_LIST_HEAD(server->viewlist);
10696 view != NULL;
10697 view = ISC_LIST_NEXT(view, link))
10698 {
10699 if (strcasecmp(ptr, view->name) != 0)
10700 continue;
10701 found = true;
10702 for (nsc = ISC_LIST_HEAD(server->cachelist);
10703 nsc != NULL;
10704 nsc = ISC_LIST_NEXT(nsc, link)) {
10705 if (nsc->cache == view->cache)
10706 break;
10707 }
10708 INSIST(nsc != NULL);
10709 nsc->needflush = true;
10710 }
10711 } else
10712 found = true;
10713
10714 /* Perform flush */
10715 for (nsc = ISC_LIST_HEAD(server->cachelist);
10716 nsc != NULL;
10717 nsc = ISC_LIST_NEXT(nsc, link)) {
10718 if (ptr != NULL && !nsc->needflush)
10719 continue;
10720 nsc->needflush = true;
10721 result = dns_view_flushcache2(nsc->primaryview, false);
10722 if (result != ISC_R_SUCCESS) {
10723 flushed = false;
10724 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10725 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
10726 "flushing cache in view '%s' failed: %s",
10727 nsc->primaryview->name,
10728 isc_result_totext(result));
10729 }
10730 }
10731
10732 /*
10733 * Fix up views that share a flushed cache: let the views update the
10734 * cache DB they're referring to. This could also be an expensive
10735 * operation, but should typically be marginal: the inner loop is only
10736 * necessary for views that share a cache, and if there are many such
10737 * views the number of shared cache should normally be small.
10738 * A worst case is that we have n views and n/2 caches, each shared by
10739 * two views. Then this will be a O(n^2/4) operation.
10740 */
10741 for (view = ISC_LIST_HEAD(server->viewlist);
10742 view != NULL;
10743 view = ISC_LIST_NEXT(view, link))
10744 {
10745 if (!dns_view_iscacheshared(view))
10746 continue;
10747 for (nsc = ISC_LIST_HEAD(server->cachelist);
10748 nsc != NULL;
10749 nsc = ISC_LIST_NEXT(nsc, link)) {
10750 if (!nsc->needflush || nsc->cache != view->cache)
10751 continue;
10752 result = dns_view_flushcache2(view, true);
10753 if (result != ISC_R_SUCCESS) {
10754 flushed = false;
10755 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10756 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
10757 "fixing cache in view '%s' "
10758 "failed: %s", view->name,
10759 isc_result_totext(result));
10760 }
10761 }
10762 }
10763
10764 /* Cleanup the cache list. */
10765 for (nsc = ISC_LIST_HEAD(server->cachelist);
10766 nsc != NULL;
10767 nsc = ISC_LIST_NEXT(nsc, link)) {
10768 nsc->needflush = false;
10769 }
10770
10771 if (flushed && found) {
10772 if (ptr != NULL)
10773 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10774 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
10775 "flushing cache in view '%s' succeeded",
10776 ptr);
10777 else
10778 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10779 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
10780 "flushing caches in all views succeeded");
10781 result = ISC_R_SUCCESS;
10782 } else {
10783 if (!found) {
10784 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10785 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
10786 "flushing cache in view '%s' failed: "
10787 "view not found", ptr);
10788 result = ISC_R_NOTFOUND;
10789 } else
10790 result = ISC_R_FAILURE;
10791 }
10792 isc_task_endexclusive(server->task);
10793 return (result);
10794 }
10795
10796 isc_result_t
ns_server_flushnode(ns_server_t * server,isc_lex_t * lex,bool tree)10797 ns_server_flushnode(ns_server_t *server, isc_lex_t *lex, bool tree) {
10798 char *ptr, *viewname;
10799 char target[DNS_NAME_FORMATSIZE];
10800 dns_view_t *view;
10801 bool flushed;
10802 bool found;
10803 isc_result_t result;
10804 isc_buffer_t b;
10805 dns_fixedname_t fixed;
10806 dns_name_t *name;
10807
10808 /* Skip the command name. */
10809 ptr = next_token(lex, NULL);
10810 if (ptr == NULL)
10811 return (ISC_R_UNEXPECTEDEND);
10812
10813 /* Find the domain name to flush. */
10814 ptr = next_token(lex, NULL);
10815 if (ptr == NULL)
10816 return (ISC_R_UNEXPECTEDEND);
10817
10818 strlcpy(target, ptr, DNS_NAME_FORMATSIZE);
10819 isc_buffer_constinit(&b, target, strlen(target));
10820 isc_buffer_add(&b, strlen(target));
10821 name = dns_fixedname_initname(&fixed);
10822 result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
10823 if (result != ISC_R_SUCCESS)
10824 return (result);
10825
10826 /* Look for the view name. */
10827 viewname = next_token(lex, NULL);
10828
10829 result = isc_task_beginexclusive(server->task);
10830 RUNTIME_CHECK(result == ISC_R_SUCCESS);
10831 flushed = true;
10832 found = false;
10833 for (view = ISC_LIST_HEAD(server->viewlist);
10834 view != NULL;
10835 view = ISC_LIST_NEXT(view, link))
10836 {
10837 if (viewname != NULL && strcasecmp(viewname, view->name) != 0)
10838 continue;
10839 found = true;
10840 /*
10841 * It's a little inefficient to try flushing name for all views
10842 * if some of the views share a single cache. But since the
10843 * operation is lightweight we prefer simplicity here.
10844 */
10845 result = dns_view_flushnode(view, name, tree);
10846 if (result != ISC_R_SUCCESS) {
10847 flushed = false;
10848 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10849 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
10850 "flushing %s '%s' in cache view '%s' "
10851 "failed: %s",
10852 tree ? "tree" : "name",
10853 target, view->name,
10854 isc_result_totext(result));
10855 }
10856 }
10857 if (flushed && found) {
10858 if (viewname != NULL)
10859 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10860 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
10861 "flushing %s '%s' in cache view '%s' "
10862 "succeeded",
10863 tree ? "tree" : "name",
10864 target, viewname);
10865 else
10866 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10867 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
10868 "flushing %s '%s' in all cache views "
10869 "succeeded",
10870 tree ? "tree" : "name",
10871 target);
10872 result = ISC_R_SUCCESS;
10873 } else {
10874 if (!found)
10875 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
10876 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
10877 "flushing %s '%s' in cache view '%s' "
10878 "failed: view not found",
10879 tree ? "tree" : "name",
10880 target, viewname);
10881 result = ISC_R_FAILURE;
10882 }
10883 isc_task_endexclusive(server->task);
10884 return (result);
10885 }
10886
10887 isc_result_t
ns_server_status(ns_server_t * server,isc_buffer_t ** text)10888 ns_server_status(ns_server_t *server, isc_buffer_t **text) {
10889 isc_result_t result;
10890 unsigned int zonecount, xferrunning, xferdeferred, soaqueries;
10891 unsigned int automatic;
10892 const char *ob = "", *cb = "", *alt = "";
10893 char boottime[ISC_FORMATHTTPTIMESTAMP_SIZE];
10894 char configtime[ISC_FORMATHTTPTIMESTAMP_SIZE];
10895 char line[1024], hostname[256];
10896
10897 if (ns_g_server->version_set) {
10898 ob = " (";
10899 cb = ")";
10900 if (ns_g_server->version == NULL)
10901 alt = "version.bind/txt/ch disabled";
10902 else
10903 alt = ns_g_server->version;
10904 }
10905 zonecount = dns_zonemgr_getcount(server->zonemgr, DNS_ZONESTATE_ANY);
10906 xferrunning = dns_zonemgr_getcount(server->zonemgr,
10907 DNS_ZONESTATE_XFERRUNNING);
10908 xferdeferred = dns_zonemgr_getcount(server->zonemgr,
10909 DNS_ZONESTATE_XFERDEFERRED);
10910 soaqueries = dns_zonemgr_getcount(server->zonemgr,
10911 DNS_ZONESTATE_SOAQUERY);
10912 automatic = dns_zonemgr_getcount(server->zonemgr,
10913 DNS_ZONESTATE_AUTOMATIC);
10914
10915 isc_time_formathttptimestamp(&ns_g_boottime, boottime,
10916 sizeof(boottime));
10917 isc_time_formathttptimestamp(&ns_g_configtime, configtime,
10918 sizeof(configtime));
10919
10920 snprintf(line, sizeof(line), "version: %s %s%s%s <id:%s>%s%s%s\n",
10921 ns_g_product, ns_g_version,
10922 (*ns_g_description != '\0') ? " " : "",
10923 ns_g_description, ns_g_srcid, ob, alt, cb);
10924 CHECK(putstr(text, line));
10925
10926 result = ns_os_gethostname(hostname, sizeof(hostname));
10927 if (result != ISC_R_SUCCESS)
10928 strlcpy(hostname, "localhost", sizeof(hostname));
10929 snprintf(line, sizeof(line), "running on %s: %s\n",
10930 hostname, ns_os_uname());
10931 CHECK(putstr(text, line));
10932
10933 snprintf(line, sizeof(line), "boot time: %s\n", boottime);
10934 CHECK(putstr(text, line));
10935
10936 snprintf(line, sizeof(line), "last configured: %s\n", configtime);
10937 CHECK(putstr(text, line));
10938
10939 if (ns_g_chrootdir != NULL) {
10940 snprintf(line, sizeof(line), "configuration file: %s (%s%s)\n",
10941 ns_g_conffile, ns_g_chrootdir, ns_g_conffile);
10942 } else {
10943 snprintf(line, sizeof(line), "configuration file: %s\n",
10944 ns_g_conffile);
10945 }
10946 CHECK(putstr(text, line));
10947
10948 #ifdef ISC_PLATFORM_USETHREADS
10949 snprintf(line, sizeof(line), "CPUs found: %u\n", ns_g_cpus_detected);
10950 CHECK(putstr(text, line));
10951
10952 snprintf(line, sizeof(line), "worker threads: %u\n", ns_g_cpus);
10953 CHECK(putstr(text, line));
10954
10955 snprintf(line, sizeof(line), "UDP listeners per interface: %u\n",
10956 ns_g_udpdisp);
10957 CHECK(putstr(text, line));
10958 #else
10959 snprintf(line, sizeof(line), "CPUs found: N/A (threads disabled)\n");
10960 CHECK(putstr(text, line));
10961 #endif
10962
10963 snprintf(line, sizeof(line), "number of zones: %u (%u automatic)\n",
10964 zonecount, automatic);
10965 CHECK(putstr(text, line));
10966
10967 snprintf(line, sizeof(line), "debug level: %u\n", ns_g_debuglevel);
10968 CHECK(putstr(text, line));
10969
10970 snprintf(line, sizeof(line), "xfers running: %u\n", xferrunning);
10971 CHECK(putstr(text, line));
10972
10973 snprintf(line, sizeof(line), "xfers deferred: %u\n", xferdeferred);
10974 CHECK(putstr(text, line));
10975
10976 snprintf(line, sizeof(line), "soa queries in progress: %u\n",
10977 soaqueries);
10978 CHECK(putstr(text, line));
10979
10980 snprintf(line, sizeof(line), "query logging is %s\n",
10981 server->log_queries ? "ON" : "OFF");
10982 CHECK(putstr(text, line));
10983
10984 LOCK(&server->recursionquota.lock);
10985 snprintf(line, sizeof(line), "recursive clients: %d/%d/%d\n",
10986 server->recursionquota.used, server->recursionquota.soft,
10987 server->recursionquota.max);
10988 UNLOCK(&server->recursionquota.lock);
10989 CHECK(putstr(text, line));
10990
10991 snprintf(line, sizeof(line), "tcp clients: %d/%d\n",
10992 server->tcpquota.used, server->tcpquota.max);
10993 CHECK(putstr(text, line));
10994
10995 snprintf(line, sizeof(line), "TCP high-water: %" PRIu64 "\n",
10996 isc_stats_get_counter(ns_g_server->nsstats,
10997 dns_nsstatscounter_tcphighwater));
10998 CHECK(putstr(text, line));
10999
11000 CHECK(putstr(text, "server is up and running"));
11001 CHECK(putnull(text));
11002
11003 return (ISC_R_SUCCESS);
11004 cleanup:
11005 return (result);
11006 }
11007
11008 isc_result_t
ns_server_testgen(isc_lex_t * lex,isc_buffer_t ** text)11009 ns_server_testgen(isc_lex_t *lex, isc_buffer_t **text) {
11010 isc_result_t result;
11011 char *ptr;
11012 unsigned long count;
11013 unsigned long i;
11014 const unsigned char chars[] = "abcdefghijklmnopqrstuvwxyz0123456789";
11015
11016 /* Skip the command name. */
11017 ptr = next_token(lex, text);
11018 if (ptr == NULL)
11019 return (ISC_R_UNEXPECTEDEND);
11020
11021 ptr = next_token(lex, text);
11022 if (ptr == NULL)
11023 count = 26;
11024 else
11025 count = strtoul(ptr, NULL, 10);
11026
11027 CHECK(isc_buffer_reserve(text, count));
11028 for (i = 0; i < count; i++)
11029 CHECK(putuint8(text, chars[i % (sizeof(chars) - 1)]));
11030
11031 CHECK(putnull(text));
11032
11033 cleanup:
11034 return (result);
11035 }
11036
11037 static isc_result_t
delete_keynames(dns_tsig_keyring_t * ring,char * target,unsigned int * foundkeys)11038 delete_keynames(dns_tsig_keyring_t *ring, char *target,
11039 unsigned int *foundkeys)
11040 {
11041 char namestr[DNS_NAME_FORMATSIZE];
11042 isc_result_t result;
11043 dns_rbtnodechain_t chain;
11044 dns_name_t foundname;
11045 dns_fixedname_t fixedorigin;
11046 dns_name_t *origin;
11047 dns_rbtnode_t *node;
11048 dns_tsigkey_t *tkey;
11049
11050 dns_name_init(&foundname, NULL);
11051 origin = dns_fixedname_initname(&fixedorigin);
11052
11053 again:
11054 dns_rbtnodechain_init(&chain, ring->mctx);
11055 result = dns_rbtnodechain_first(&chain, ring->keys, &foundname,
11056 origin);
11057 if (result == ISC_R_NOTFOUND) {
11058 dns_rbtnodechain_invalidate(&chain);
11059 return (ISC_R_SUCCESS);
11060 }
11061 if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
11062 dns_rbtnodechain_invalidate(&chain);
11063 return (result);
11064 }
11065
11066 for (;;) {
11067 node = NULL;
11068 dns_rbtnodechain_current(&chain, &foundname, origin, &node);
11069 tkey = node->data;
11070
11071 if (tkey != NULL) {
11072 if (!tkey->generated)
11073 goto nextkey;
11074
11075 dns_name_format(&tkey->name, namestr, sizeof(namestr));
11076 if (strcmp(namestr, target) == 0) {
11077 (*foundkeys)++;
11078 dns_rbtnodechain_invalidate(&chain);
11079 (void)dns_rbt_deletename(ring->keys,
11080 &tkey->name,
11081 false);
11082 goto again;
11083 }
11084 }
11085
11086 nextkey:
11087 result = dns_rbtnodechain_next(&chain, &foundname, origin);
11088 if (result == ISC_R_NOMORE)
11089 break;
11090 if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
11091 dns_rbtnodechain_invalidate(&chain);
11092 return (result);
11093 }
11094 }
11095
11096 return (ISC_R_SUCCESS);
11097 }
11098
11099 isc_result_t
ns_server_tsigdelete(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)11100 ns_server_tsigdelete(ns_server_t *server, isc_lex_t *lex,
11101 isc_buffer_t **text)
11102 {
11103 isc_result_t result;
11104 dns_view_t *view;
11105 unsigned int foundkeys = 0;
11106 char *ptr, *viewname;
11107 char target[DNS_NAME_FORMATSIZE];
11108 char fbuf[16];
11109
11110 (void)next_token(lex, text); /* skip command name */
11111
11112 ptr = next_token(lex, text);
11113 if (ptr == NULL)
11114 return (ISC_R_UNEXPECTEDEND);
11115 strlcpy(target, ptr, DNS_NAME_FORMATSIZE);
11116
11117 viewname = next_token(lex, text);
11118
11119 result = isc_task_beginexclusive(server->task);
11120 RUNTIME_CHECK(result == ISC_R_SUCCESS);
11121 for (view = ISC_LIST_HEAD(server->viewlist);
11122 view != NULL;
11123 view = ISC_LIST_NEXT(view, link)) {
11124 if (viewname == NULL || strcmp(view->name, viewname) == 0) {
11125 RWLOCK(&view->dynamickeys->lock, isc_rwlocktype_write);
11126 result = delete_keynames(view->dynamickeys, target,
11127 &foundkeys);
11128 RWUNLOCK(&view->dynamickeys->lock,
11129 isc_rwlocktype_write);
11130 if (result != ISC_R_SUCCESS) {
11131 isc_task_endexclusive(server->task);
11132 return (result);
11133 }
11134 }
11135 }
11136 isc_task_endexclusive(server->task);
11137
11138 snprintf(fbuf, sizeof(fbuf), "%u", foundkeys);
11139
11140 CHECK(putstr(text, fbuf));
11141 CHECK(putstr(text, " tsig keys deleted."));
11142 CHECK(putnull(text));
11143
11144 cleanup:
11145 return (result);
11146 }
11147
11148 static isc_result_t
list_keynames(dns_view_t * view,dns_tsig_keyring_t * ring,isc_buffer_t ** text,unsigned int * foundkeys)11149 list_keynames(dns_view_t *view, dns_tsig_keyring_t *ring, isc_buffer_t **text,
11150 unsigned int *foundkeys)
11151 {
11152 char namestr[DNS_NAME_FORMATSIZE];
11153 char creatorstr[DNS_NAME_FORMATSIZE];
11154 isc_result_t result;
11155 dns_rbtnodechain_t chain;
11156 dns_name_t foundname;
11157 dns_fixedname_t fixedorigin;
11158 dns_name_t *origin;
11159 dns_rbtnode_t *node;
11160 dns_tsigkey_t *tkey;
11161 const char *viewname;
11162
11163 if (view != NULL)
11164 viewname = view->name;
11165 else
11166 viewname = "(global)";
11167
11168 dns_name_init(&foundname, NULL);
11169 origin = dns_fixedname_initname(&fixedorigin);
11170 dns_rbtnodechain_init(&chain, ring->mctx);
11171 result = dns_rbtnodechain_first(&chain, ring->keys, &foundname,
11172 origin);
11173 if (result == ISC_R_NOTFOUND) {
11174 dns_rbtnodechain_invalidate(&chain);
11175 return (ISC_R_SUCCESS);
11176 }
11177 if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN) {
11178 dns_rbtnodechain_invalidate(&chain);
11179 return (result);
11180 }
11181
11182 for (;;) {
11183 node = NULL;
11184 dns_rbtnodechain_current(&chain, &foundname, origin, &node);
11185 tkey = node->data;
11186
11187 if (tkey != NULL) {
11188 dns_name_format(&tkey->name, namestr, sizeof(namestr));
11189 if (tkey->generated) {
11190 dns_name_format(tkey->creator, creatorstr,
11191 sizeof(creatorstr));
11192 if (*foundkeys != 0)
11193 CHECK(putstr(text, "\n"));
11194 CHECK(putstr(text, "view \""));
11195 CHECK(putstr(text, viewname));
11196 CHECK(putstr(text,
11197 "\"; type \"dynamic\"; key \""));
11198 CHECK(putstr(text, namestr));
11199 CHECK(putstr(text, "\"; creator \""));
11200 CHECK(putstr(text, creatorstr));
11201 CHECK(putstr(text, "\";"));
11202 } else {
11203 if (*foundkeys != 0)
11204 CHECK(putstr(text, "\n"));
11205 CHECK(putstr(text, "view \""));
11206 CHECK(putstr(text, viewname));
11207 CHECK(putstr(text,
11208 "\"; type \"static\"; key \""));
11209 CHECK(putstr(text, namestr));
11210 CHECK(putstr(text, "\";"));
11211 }
11212 (*foundkeys)++;
11213 }
11214 result = dns_rbtnodechain_next(&chain, &foundname, origin);
11215 if (result == ISC_R_NOMORE || result == DNS_R_NEWORIGIN)
11216 break;
11217 }
11218
11219 return (ISC_R_SUCCESS);
11220 cleanup:
11221 dns_rbtnodechain_invalidate(&chain);
11222 return (result);
11223 }
11224
11225 isc_result_t
ns_server_tsiglist(ns_server_t * server,isc_buffer_t ** text)11226 ns_server_tsiglist(ns_server_t *server, isc_buffer_t **text) {
11227 isc_result_t result;
11228 dns_view_t *view;
11229 unsigned int foundkeys = 0;
11230
11231 result = isc_task_beginexclusive(server->task);
11232 RUNTIME_CHECK(result == ISC_R_SUCCESS);
11233 for (view = ISC_LIST_HEAD(server->viewlist);
11234 view != NULL;
11235 view = ISC_LIST_NEXT(view, link)) {
11236 RWLOCK(&view->statickeys->lock, isc_rwlocktype_read);
11237 result = list_keynames(view, view->statickeys, text,
11238 &foundkeys);
11239 RWUNLOCK(&view->statickeys->lock, isc_rwlocktype_read);
11240 if (result != ISC_R_SUCCESS) {
11241 isc_task_endexclusive(server->task);
11242 return (result);
11243 }
11244 RWLOCK(&view->dynamickeys->lock, isc_rwlocktype_read);
11245 result = list_keynames(view, view->dynamickeys, text,
11246 &foundkeys);
11247 RWUNLOCK(&view->dynamickeys->lock, isc_rwlocktype_read);
11248 if (result != ISC_R_SUCCESS) {
11249 isc_task_endexclusive(server->task);
11250 return (result);
11251 }
11252 }
11253 isc_task_endexclusive(server->task);
11254
11255 if (foundkeys == 0)
11256 CHECK(putstr(text, "no tsig keys found."));
11257
11258 if (isc_buffer_usedlength(*text) > 0)
11259 CHECK(putnull(text));
11260
11261 cleanup:
11262 return (result);
11263 }
11264
11265 /*
11266 * Act on a "sign" or "loadkeys" command from the command channel.
11267 */
11268 isc_result_t
ns_server_rekey(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)11269 ns_server_rekey(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
11270 isc_result_t result;
11271 dns_zone_t *zone = NULL;
11272 dns_zonetype_t type;
11273 uint16_t keyopts;
11274 bool fullsign = false;
11275 char *ptr;
11276
11277 ptr = next_token(lex, text);
11278 if (ptr == NULL)
11279 return (ISC_R_UNEXPECTEDEND);
11280
11281 if (strcasecmp(ptr, NS_COMMAND_SIGN) == 0)
11282 fullsign = true;
11283
11284 result = zone_from_args(server, lex, NULL, &zone, NULL,
11285 text, false);
11286 if (result != ISC_R_SUCCESS)
11287 return (result);
11288 if (zone == NULL)
11289 return (ISC_R_UNEXPECTEDEND); /* XXX: or do all zones? */
11290
11291 type = dns_zone_gettype(zone);
11292 if (type != dns_zone_master) {
11293 dns_zone_detach(&zone);
11294 return (DNS_R_NOTMASTER);
11295 }
11296
11297 keyopts = dns_zone_getkeyopts(zone);
11298
11299 /* "rndc loadkeys" requires "auto-dnssec maintain". */
11300 if ((keyopts & DNS_ZONEKEY_ALLOW) == 0)
11301 result = ISC_R_NOPERM;
11302 else if ((keyopts & DNS_ZONEKEY_MAINTAIN) == 0 && !fullsign)
11303 result = ISC_R_NOPERM;
11304 else
11305 dns_zone_rekey(zone, fullsign);
11306
11307 dns_zone_detach(&zone);
11308 return (result);
11309 }
11310
11311 /*
11312 * Act on a "sync" command from the command channel.
11313 */
11314 static isc_result_t
synczone(dns_zone_t * zone,void * uap)11315 synczone(dns_zone_t *zone, void *uap) {
11316 bool cleanup = *(bool *)uap;
11317 isc_result_t result;
11318 dns_zone_t *raw = NULL;
11319 char *journal;
11320
11321 dns_zone_getraw(zone, &raw);
11322 if (raw != NULL) {
11323 synczone(raw, uap);
11324 dns_zone_detach(&raw);
11325 }
11326
11327 result = dns_zone_flush(zone);
11328 if (result != ISC_R_SUCCESS)
11329 cleanup = false;
11330 if (cleanup) {
11331 journal = dns_zone_getjournal(zone);
11332 if (journal != NULL)
11333 (void)isc_file_remove(journal);
11334 }
11335
11336 return (result);
11337 }
11338
11339 isc_result_t
ns_server_sync(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)11340 ns_server_sync(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
11341 isc_result_t result, tresult;
11342 dns_view_t *view;
11343 dns_zone_t *zone = NULL;
11344 char classstr[DNS_RDATACLASS_FORMATSIZE];
11345 char zonename[DNS_NAME_FORMATSIZE];
11346 const char *vname, *sep, *arg;
11347 bool cleanup = false;
11348
11349 (void) next_token(lex, text);
11350
11351 arg = next_token(lex, text);
11352 if (arg != NULL &&
11353 (strcmp(arg, "-clean") == 0 || strcmp(arg, "-clear") == 0)) {
11354 cleanup = true;
11355 arg = next_token(lex, text);
11356 }
11357
11358 result = zone_from_args(server, lex, arg, &zone, NULL,
11359 text, false);
11360 if (result != ISC_R_SUCCESS)
11361 return (result);
11362
11363 if (zone == NULL) {
11364 result = isc_task_beginexclusive(server->task);
11365 RUNTIME_CHECK(result == ISC_R_SUCCESS);
11366 tresult = ISC_R_SUCCESS;
11367 for (view = ISC_LIST_HEAD(server->viewlist);
11368 view != NULL;
11369 view = ISC_LIST_NEXT(view, link)) {
11370 result = dns_zt_apply(view->zonetable, false,
11371 synczone, &cleanup);
11372 if (result != ISC_R_SUCCESS &&
11373 tresult == ISC_R_SUCCESS)
11374 tresult = result;
11375 }
11376 isc_task_endexclusive(server->task);
11377 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
11378 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
11379 "dumping all zones%s: %s",
11380 cleanup ? ", removing journal files" : "",
11381 isc_result_totext(result));
11382 return (tresult);
11383 }
11384
11385 result = isc_task_beginexclusive(server->task);
11386 RUNTIME_CHECK(result == ISC_R_SUCCESS);
11387 result = synczone(zone, &cleanup);
11388 isc_task_endexclusive(server->task);
11389
11390 view = dns_zone_getview(zone);
11391 if (strcmp(view->name, "_default") == 0 ||
11392 strcmp(view->name, "_bind") == 0)
11393 {
11394 vname = "";
11395 sep = "";
11396 } else {
11397 vname = view->name;
11398 sep = " ";
11399 }
11400 dns_rdataclass_format(dns_zone_getclass(zone), classstr,
11401 sizeof(classstr));
11402 dns_name_format(dns_zone_getorigin(zone),
11403 zonename, sizeof(zonename));
11404 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
11405 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
11406 "sync: dumping zone '%s/%s'%s%s%s: %s",
11407 zonename, classstr, sep, vname,
11408 cleanup ? ", removing journal file" : "",
11409 isc_result_totext(result));
11410 dns_zone_detach(&zone);
11411 return (result);
11412 }
11413
11414 /*
11415 * Act on a "freeze" or "thaw" command from the command channel.
11416 */
11417 isc_result_t
ns_server_freeze(ns_server_t * server,bool freeze,isc_lex_t * lex,isc_buffer_t ** text)11418 ns_server_freeze(ns_server_t *server, bool freeze,
11419 isc_lex_t *lex, isc_buffer_t **text)
11420 {
11421 isc_result_t result, tresult;
11422 dns_zone_t *mayberaw = NULL, *raw = NULL;
11423 dns_zonetype_t type;
11424 char classstr[DNS_RDATACLASS_FORMATSIZE];
11425 char zonename[DNS_NAME_FORMATSIZE];
11426 dns_view_t *view;
11427 const char *vname, *sep;
11428 bool frozen;
11429 const char *msg = NULL;
11430
11431 result = zone_from_args(server, lex, NULL, &mayberaw, NULL,
11432 text, true);
11433 if (result != ISC_R_SUCCESS)
11434 return (result);
11435 if (mayberaw == NULL) {
11436 result = isc_task_beginexclusive(server->task);
11437 RUNTIME_CHECK(result == ISC_R_SUCCESS);
11438 tresult = ISC_R_SUCCESS;
11439 for (view = ISC_LIST_HEAD(server->viewlist);
11440 view != NULL;
11441 view = ISC_LIST_NEXT(view, link)) {
11442 result = dns_view_freezezones(view, freeze);
11443 if (result != ISC_R_SUCCESS &&
11444 tresult == ISC_R_SUCCESS)
11445 tresult = result;
11446 }
11447 isc_task_endexclusive(server->task);
11448 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
11449 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
11450 "%s all zones: %s",
11451 freeze ? "freezing" : "thawing",
11452 isc_result_totext(tresult));
11453 return (tresult);
11454 }
11455 dns_zone_getraw(mayberaw, &raw);
11456 if (raw != NULL) {
11457 dns_zone_detach(&mayberaw);
11458 dns_zone_attach(raw, &mayberaw);
11459 dns_zone_detach(&raw);
11460 }
11461 type = dns_zone_gettype(mayberaw);
11462 if (type != dns_zone_master) {
11463 dns_zone_detach(&mayberaw);
11464 return (DNS_R_NOTMASTER);
11465 }
11466
11467 if (freeze && !dns_zone_isdynamic(mayberaw, true)) {
11468 dns_zone_detach(&mayberaw);
11469 return (DNS_R_NOTDYNAMIC);
11470 }
11471
11472 result = isc_task_beginexclusive(server->task);
11473 RUNTIME_CHECK(result == ISC_R_SUCCESS);
11474 frozen = dns_zone_getupdatedisabled(mayberaw);
11475 if (freeze) {
11476 if (frozen) {
11477 msg = "WARNING: The zone was already frozen.\n"
11478 "Someone else may be editing it or "
11479 "it may still be re-loading.";
11480 result = DNS_R_FROZEN;
11481 }
11482 if (result == ISC_R_SUCCESS) {
11483 result = dns_zone_flush(mayberaw);
11484 if (result != ISC_R_SUCCESS)
11485 msg = "Flushing the zone updates to "
11486 "disk failed.";
11487 }
11488 if (result == ISC_R_SUCCESS)
11489 dns_zone_setupdatedisabled(mayberaw, freeze);
11490 } else {
11491 if (frozen) {
11492 result = dns_zone_loadandthaw(mayberaw);
11493 switch (result) {
11494 case ISC_R_SUCCESS:
11495 case DNS_R_UPTODATE:
11496 msg = "The zone reload and thaw was "
11497 "successful.";
11498 result = ISC_R_SUCCESS;
11499 break;
11500 case DNS_R_CONTINUE:
11501 msg = "A zone reload and thaw was started.\n"
11502 "Check the logs to see the result.";
11503 result = ISC_R_SUCCESS;
11504 break;
11505 }
11506 }
11507 }
11508 isc_task_endexclusive(server->task);
11509
11510 if (msg != NULL) {
11511 (void) putstr(text, msg);
11512 (void) putnull(text);
11513 }
11514
11515 view = dns_zone_getview(mayberaw);
11516 if (strcmp(view->name, "_default") == 0 ||
11517 strcmp(view->name, "_bind") == 0)
11518 {
11519 vname = "";
11520 sep = "";
11521 } else {
11522 vname = view->name;
11523 sep = " ";
11524 }
11525 dns_rdataclass_format(dns_zone_getclass(mayberaw), classstr,
11526 sizeof(classstr));
11527 dns_name_format(dns_zone_getorigin(mayberaw),
11528 zonename, sizeof(zonename));
11529 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
11530 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
11531 "%s zone '%s/%s'%s%s: %s",
11532 freeze ? "freezing" : "thawing",
11533 zonename, classstr, sep, vname,
11534 isc_result_totext(result));
11535 dns_zone_detach(&mayberaw);
11536 return (result);
11537 }
11538
11539 #ifdef HAVE_LIBSCF
11540 /*
11541 * This function adds a message for rndc to echo if named
11542 * is managed by smf and is also running chroot.
11543 */
11544 isc_result_t
ns_smf_add_message(isc_buffer_t ** text)11545 ns_smf_add_message(isc_buffer_t **text) {
11546 return (putstr(text, "use svcadm(1M) to manage named"));
11547 }
11548 #endif /* HAVE_LIBSCF */
11549
11550 #ifndef HAVE_LMDB
11551
11552 /*
11553 * Emit a comment at the top of the nzf file containing the viewname
11554 * Expects the fp to already be open for writing
11555 */
11556 #define HEADER1 "# New zone file for view: "
11557 #define HEADER2 "\n# This file contains configuration for zones added by\n" \
11558 "# the 'rndc addzone' command. DO NOT EDIT BY HAND.\n"
11559 static isc_result_t
add_comment(FILE * fp,const char * viewname)11560 add_comment(FILE *fp, const char *viewname) {
11561 isc_result_t result;
11562 CHECK(isc_stdio_write(HEADER1, sizeof(HEADER1) - 1, 1, fp, NULL));
11563 CHECK(isc_stdio_write(viewname, strlen(viewname), 1, fp, NULL));
11564 CHECK(isc_stdio_write(HEADER2, sizeof(HEADER2) - 1, 1, fp, NULL));
11565 cleanup:
11566 return (result);
11567 }
11568
11569 static void
dumpzone(void * arg,const char * buf,int len)11570 dumpzone(void *arg, const char *buf, int len) {
11571 FILE *fp = arg;
11572
11573 (void) isc_stdio_write(buf, len, 1, fp, NULL);
11574 }
11575
11576 static isc_result_t
nzf_append(dns_view_t * view,const cfg_obj_t * zconfig)11577 nzf_append(dns_view_t *view, const cfg_obj_t *zconfig) {
11578 isc_result_t result;
11579 off_t offset;
11580 FILE *fp = NULL;
11581 bool offsetok = false;
11582
11583 LOCK(&view->new_zone_lock);
11584
11585 CHECK(isc_stdio_open(view->new_zone_file, "a", &fp));
11586 CHECK(isc_stdio_seek(fp, 0, SEEK_END));
11587
11588 CHECK(isc_stdio_tell(fp, &offset));
11589 offsetok = true;
11590 if (offset == 0)
11591 CHECK(add_comment(fp, view->name));
11592
11593 CHECK(isc_stdio_write("zone ", 5, 1, fp, NULL));
11594 cfg_printx(zconfig, CFG_PRINTER_ONELINE, dumpzone, fp);
11595 CHECK(isc_stdio_write(";\n", 2, 1, fp, NULL));
11596 CHECK(isc_stdio_flush(fp));
11597 result = isc_stdio_close(fp);
11598 fp = NULL;
11599
11600 cleanup:
11601 if (fp != NULL) {
11602 (void)isc_stdio_close(fp);
11603 if (offsetok) {
11604 isc_result_t result2;
11605
11606 result2 = isc_file_truncate(view->new_zone_file,
11607 offset);
11608 if (result2 != ISC_R_SUCCESS) {
11609 isc_log_write(ns_g_lctx,
11610 NS_LOGCATEGORY_GENERAL,
11611 NS_LOGMODULE_SERVER,
11612 ISC_LOG_ERROR,
11613 "Error truncating NZF file '%s' "
11614 "during rollback from append: "
11615 "%s",
11616 view->new_zone_file,
11617 isc_result_totext(result2));
11618 }
11619 }
11620 }
11621 UNLOCK(&view->new_zone_lock);
11622 return (result);
11623 }
11624
11625 static isc_result_t
nzf_writeconf(const cfg_obj_t * config,dns_view_t * view)11626 nzf_writeconf(const cfg_obj_t *config, dns_view_t *view) {
11627 const cfg_obj_t *zl = NULL;
11628 cfg_list_t *list;
11629 const cfg_listelt_t *elt;
11630
11631 FILE *fp = NULL;
11632 char tmp[1024];
11633 isc_result_t result;
11634
11635 result = isc_file_template("", "nzf-XXXXXXXX", tmp, sizeof(tmp));
11636 if (result == ISC_R_SUCCESS)
11637 result = isc_file_openunique(tmp, &fp);
11638 if (result != ISC_R_SUCCESS)
11639 return (result);
11640
11641 cfg_map_get(config, "zone", &zl);
11642 if (!cfg_obj_islist(zl))
11643 CHECK(ISC_R_FAILURE);
11644
11645 DE_CONST(&zl->value.list, list);
11646
11647 CHECK(add_comment(fp, view->name)); /* force a comment */
11648
11649 for (elt = ISC_LIST_HEAD(*list);
11650 elt != NULL;
11651 elt = ISC_LIST_NEXT(elt, link))
11652 {
11653 const cfg_obj_t *zconfig = cfg_listelt_value(elt);
11654
11655 CHECK(isc_stdio_write("zone ", 5, 1, fp, NULL));
11656 cfg_printx(zconfig, CFG_PRINTER_ONELINE, dumpzone, fp);
11657 CHECK(isc_stdio_write(";\n", 2, 1, fp, NULL));
11658 }
11659
11660 CHECK(isc_stdio_flush(fp));
11661 result = isc_stdio_close(fp);
11662 fp = NULL;
11663 if (result != ISC_R_SUCCESS)
11664 goto cleanup;
11665 CHECK(isc_file_rename(tmp, view->new_zone_file));
11666 return (result);
11667
11668 cleanup:
11669 if (fp != NULL)
11670 (void)isc_stdio_close(fp);
11671 (void)isc_file_remove(tmp);
11672 return (result);
11673 }
11674
11675 #else /* HAVE_LMDB */
11676
11677 static void
nzd_setkey(MDB_val * key,dns_name_t * name,char * namebuf,size_t buflen)11678 nzd_setkey(MDB_val *key, dns_name_t *name, char *namebuf, size_t buflen) {
11679 dns_fixedname_t fixed;
11680
11681 dns_fixedname_init(&fixed);
11682 dns_name_downcase(name, dns_fixedname_name(&fixed), NULL);
11683 dns_name_format(dns_fixedname_name(&fixed), namebuf, buflen);
11684
11685 key->mv_data = namebuf;
11686 key->mv_size = strlen(namebuf);
11687 }
11688
11689 static void
dumpzone(void * arg,const char * buf,int len)11690 dumpzone(void *arg, const char *buf, int len) {
11691 ns_dzarg_t *dzarg = arg;
11692 isc_result_t result;
11693
11694 REQUIRE(dzarg != NULL && ISC_MAGIC_VALID(dzarg, DZARG_MAGIC));
11695
11696 result = putmem(dzarg->text, buf, len);
11697 if (result != ISC_R_SUCCESS && dzarg->result == ISC_R_SUCCESS) {
11698 dzarg->result = result;
11699 }
11700 }
11701
11702 static isc_result_t
nzd_save(MDB_txn ** txnp,MDB_dbi dbi,dns_zone_t * zone,const cfg_obj_t * zconfig)11703 nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
11704 const cfg_obj_t *zconfig)
11705 {
11706 isc_result_t result;
11707 int status;
11708 dns_view_t *view;
11709 bool commit = false;
11710 isc_buffer_t *text = NULL;
11711 char namebuf[1024];
11712 MDB_val key, data;
11713 ns_dzarg_t dzarg;
11714
11715 view = dns_zone_getview(zone);
11716
11717 nzd_setkey(&key, dns_zone_getorigin(zone), namebuf, sizeof(namebuf));
11718
11719 if (zconfig == NULL) {
11720 /* We're deleting the zone from the database */
11721 status = mdb_del(*txnp, dbi, &key, NULL);
11722 if (status != MDB_SUCCESS && status != MDB_NOTFOUND) {
11723 isc_log_write(ns_g_lctx,
11724 NS_LOGCATEGORY_GENERAL,
11725 NS_LOGMODULE_SERVER,
11726 ISC_LOG_ERROR,
11727 "Error deleting zone %s "
11728 "from NZD database: %s",
11729 namebuf, mdb_strerror(status));
11730 result = ISC_R_FAILURE;
11731 goto cleanup;
11732 } else if (status != MDB_NOTFOUND) {
11733 commit = true;
11734 }
11735 } else {
11736 /* We're creating or overwriting the zone */
11737 const cfg_obj_t *zoptions;
11738
11739 result = isc_buffer_allocate(view->mctx, &text, 256);
11740 if (result != ISC_R_SUCCESS) {
11741 isc_log_write(ns_g_lctx,
11742 NS_LOGCATEGORY_GENERAL,
11743 NS_LOGMODULE_SERVER,
11744 ISC_LOG_ERROR,
11745 "Unable to allocate buffer in "
11746 "nzd_save(): %s",
11747 isc_result_totext(result));
11748 goto cleanup;
11749 }
11750
11751 zoptions = cfg_tuple_get(zconfig, "options");
11752 if (zoptions == NULL) {
11753 isc_log_write(ns_g_lctx,
11754 NS_LOGCATEGORY_GENERAL,
11755 NS_LOGMODULE_SERVER,
11756 ISC_LOG_ERROR,
11757 "Unable to get options from config in "
11758 "nzd_save()");
11759 result = ISC_R_FAILURE;
11760 goto cleanup;
11761 }
11762
11763 dzarg.magic = DZARG_MAGIC;
11764 dzarg.text = &text;
11765 dzarg.result = ISC_R_SUCCESS;
11766 cfg_printx(zoptions, CFG_PRINTER_ONELINE, dumpzone, &dzarg);
11767 if (dzarg.result != ISC_R_SUCCESS) {
11768 isc_log_write(ns_g_lctx,
11769 NS_LOGCATEGORY_GENERAL,
11770 NS_LOGMODULE_SERVER,
11771 ISC_LOG_ERROR,
11772 "Error writing zone config to "
11773 "buffer in nzd_save(): %s",
11774 isc_result_totext(result));
11775 result = dzarg.result;
11776 goto cleanup;
11777 }
11778
11779 data.mv_data = isc_buffer_base(text);
11780 data.mv_size = isc_buffer_usedlength(text);
11781
11782 status = mdb_put(*txnp, dbi, &key, &data, 0);
11783 if (status != MDB_SUCCESS) {
11784 isc_log_write(ns_g_lctx,
11785 NS_LOGCATEGORY_GENERAL,
11786 NS_LOGMODULE_SERVER,
11787 ISC_LOG_ERROR,
11788 "Error inserting zone in "
11789 "NZD database: %s",
11790 mdb_strerror(status));
11791 result = ISC_R_FAILURE;
11792 goto cleanup;
11793 }
11794
11795 commit = true;
11796 }
11797
11798 result = ISC_R_SUCCESS;
11799
11800 cleanup:
11801 if (!commit || result != ISC_R_SUCCESS) {
11802 (void) mdb_txn_abort(*txnp);
11803 } else {
11804 status = mdb_txn_commit(*txnp);
11805 if (status != MDB_SUCCESS) {
11806 isc_log_write(ns_g_lctx,
11807 NS_LOGCATEGORY_GENERAL,
11808 NS_LOGMODULE_SERVER,
11809 ISC_LOG_ERROR,
11810 "Error committing "
11811 "NZD database: %s",
11812 mdb_strerror(status));
11813 result = ISC_R_FAILURE;
11814 }
11815 }
11816 *txnp = NULL;
11817
11818 if (text != NULL) {
11819 isc_buffer_free(&text);
11820 }
11821
11822 return (result);
11823 }
11824
11825 /*
11826 * Check whether the new zone database for 'view' can be opened for writing.
11827 *
11828 * Caller must hold 'view->new_zone_lock'.
11829 */
11830 static isc_result_t
nzd_writable(dns_view_t * view)11831 nzd_writable(dns_view_t *view) {
11832 isc_result_t result = ISC_R_SUCCESS;
11833 int status;
11834 MDB_dbi dbi;
11835 MDB_txn *txn = NULL;
11836
11837 REQUIRE(view != NULL);
11838
11839 status = mdb_txn_begin((MDB_env *) view->new_zone_dbenv, 0, 0, &txn);
11840 if (status != MDB_SUCCESS) {
11841 isc_log_write(ns_g_lctx,
11842 NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
11843 ISC_LOG_WARNING, "mdb_txn_begin: %s",
11844 mdb_strerror(status));
11845 return (ISC_R_FAILURE);
11846 }
11847
11848 status = mdb_dbi_open(txn, NULL, 0, &dbi);
11849 if (status != MDB_SUCCESS) {
11850 isc_log_write(ns_g_lctx,
11851 NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
11852 ISC_LOG_WARNING, "mdb_dbi_open: %s",
11853 mdb_strerror(status));
11854 result = ISC_R_FAILURE;
11855 }
11856
11857 mdb_txn_abort(txn);
11858 return (result);
11859 }
11860
11861 /*
11862 * Open the new zone database for 'view' and start a transaction for it.
11863 *
11864 * Caller must hold 'view->new_zone_lock'.
11865 */
11866 static isc_result_t
nzd_open(dns_view_t * view,unsigned int flags,MDB_txn ** txnp,MDB_dbi * dbi)11867 nzd_open(dns_view_t *view, unsigned int flags, MDB_txn **txnp, MDB_dbi *dbi) {
11868 int status;
11869 MDB_txn *txn = NULL;
11870
11871 REQUIRE(view != NULL);
11872 REQUIRE(txnp != NULL && *txnp == NULL);
11873 REQUIRE(dbi != NULL);
11874
11875 status = mdb_txn_begin((MDB_env *) view->new_zone_dbenv, 0,
11876 flags, &txn);
11877 if (status != MDB_SUCCESS) {
11878 isc_log_write(ns_g_lctx,
11879 NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
11880 ISC_LOG_WARNING, "mdb_txn_begin: %s",
11881 mdb_strerror(status));
11882 goto cleanup;
11883 }
11884
11885 status = mdb_dbi_open(txn, NULL, 0, dbi);
11886 if (status != MDB_SUCCESS) {
11887 isc_log_write(ns_g_lctx,
11888 NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
11889 ISC_LOG_WARNING, "mdb_dbi_open: %s",
11890 mdb_strerror(status));
11891 goto cleanup;
11892 }
11893
11894 *txnp = txn;
11895
11896 cleanup:
11897 if (status != MDB_SUCCESS) {
11898 if (txn != NULL) {
11899 mdb_txn_abort(txn);
11900 }
11901 return (ISC_R_FAILURE);
11902 }
11903
11904 return (ISC_R_SUCCESS);
11905 }
11906
11907 /*
11908 * nzd_env_close() and nzd_env_reopen are a kluge to address the
11909 * problem of an NZD file possibly being created before we drop
11910 * root privileges.
11911 */
11912 static void
nzd_env_close(dns_view_t * view)11913 nzd_env_close(dns_view_t *view) {
11914 const char *dbpath = NULL;
11915 char dbpath_copy[PATH_MAX];
11916 char lockpath[PATH_MAX];
11917 int status, ret;
11918
11919 if (view->new_zone_dbenv == NULL) {
11920 return;
11921 }
11922
11923 status = mdb_env_get_path(view->new_zone_dbenv, &dbpath);
11924 INSIST(status == MDB_SUCCESS);
11925 snprintf(lockpath, sizeof(lockpath), "%s-lock", dbpath);
11926 strlcpy(dbpath_copy, dbpath, sizeof(dbpath_copy));
11927 mdb_env_close((MDB_env *) view->new_zone_dbenv);
11928
11929 /*
11930 * Database files must be owned by the eventual user, not by root.
11931 */
11932 ret = chown(dbpath_copy, ns_os_uid(), -1);
11933 UNUSED(ret);
11934
11935 /*
11936 * Some platforms need the lockfile not to exist when we reopen the
11937 * environment.
11938 */
11939 (void) isc_file_remove(lockpath);
11940
11941 view->new_zone_dbenv = NULL;
11942 }
11943
11944 static isc_result_t
nzd_env_reopen(dns_view_t * view)11945 nzd_env_reopen(dns_view_t *view) {
11946 isc_result_t result;
11947 MDB_env *env = NULL;
11948 int status;
11949
11950 if (view->new_zone_db == NULL) {
11951 return (ISC_R_SUCCESS);
11952 }
11953
11954 nzd_env_close(view);
11955
11956 status = mdb_env_create(&env);
11957 if (status != MDB_SUCCESS) {
11958 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
11959 ISC_LOGMODULE_OTHER, ISC_LOG_ERROR,
11960 "mdb_env_create failed: %s",
11961 mdb_strerror(status));
11962 CHECK(ISC_R_FAILURE);
11963 }
11964
11965 if (view->new_zone_mapsize != 0ULL) {
11966 status = mdb_env_set_mapsize(env, view->new_zone_mapsize);
11967 if (status != MDB_SUCCESS) {
11968 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
11969 ISC_LOGMODULE_OTHER, ISC_LOG_ERROR,
11970 "mdb_env_set_mapsize failed: %s",
11971 mdb_strerror(status));
11972 CHECK(ISC_R_FAILURE);
11973 }
11974 }
11975
11976 status = mdb_env_open(env, view->new_zone_db, DNS_LMDB_FLAGS, 0600);
11977 if (status != MDB_SUCCESS) {
11978 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
11979 ISC_LOGMODULE_OTHER, ISC_LOG_ERROR,
11980 "mdb_env_open of '%s' failed: %s",
11981 view->new_zone_db, mdb_strerror(status));
11982 CHECK(ISC_R_FAILURE);
11983 }
11984
11985 view->new_zone_dbenv = env;
11986 env = NULL;
11987 result = ISC_R_SUCCESS;
11988
11989 cleanup:
11990 if (env != NULL) {
11991 mdb_env_close(env);
11992 }
11993 return (result);
11994 }
11995
11996 /*
11997 * If 'commit' is true, commit the new zone database transaction pointed to by
11998 * 'txnp'; otherwise, abort that transaction.
11999 *
12000 * Caller must hold 'view->new_zone_lock' for the view that the transaction
12001 * pointed to by 'txnp' was started for.
12002 */
12003 static isc_result_t
nzd_close(MDB_txn ** txnp,bool commit)12004 nzd_close(MDB_txn **txnp, bool commit) {
12005 isc_result_t result = ISC_R_SUCCESS;
12006 int status;
12007
12008 REQUIRE(txnp != NULL);
12009
12010 if (*txnp != NULL) {
12011 if (commit) {
12012 status = mdb_txn_commit(*txnp);
12013 if (status != MDB_SUCCESS) {
12014 result = ISC_R_FAILURE;
12015 }
12016 } else {
12017 mdb_txn_abort(*txnp);
12018 }
12019 *txnp = NULL;
12020 }
12021
12022 return (result);
12023 }
12024
12025 /*
12026 * Count the zones configured in the new zone database for 'view' and store the
12027 * result in 'countp'.
12028 *
12029 * Caller must hold 'view->new_zone_lock'.
12030 */
12031 static isc_result_t
nzd_count(dns_view_t * view,int * countp)12032 nzd_count(dns_view_t *view, int *countp) {
12033 isc_result_t result;
12034 int status;
12035 MDB_txn *txn = NULL;
12036 MDB_dbi dbi;
12037 MDB_stat statbuf;
12038
12039 REQUIRE(countp != NULL);
12040
12041 result = nzd_open(view, MDB_RDONLY, &txn, &dbi);
12042 if (result != ISC_R_SUCCESS) {
12043 goto cleanup;
12044 }
12045
12046 status = mdb_stat(txn, dbi, &statbuf);
12047 if (status != MDB_SUCCESS) {
12048 isc_log_write(ns_g_lctx,
12049 NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
12050 ISC_LOG_WARNING, "mdb_stat: %s",
12051 mdb_strerror(status));
12052 result = ISC_R_FAILURE;
12053 goto cleanup;
12054 }
12055
12056 *countp = statbuf.ms_entries;
12057
12058 cleanup:
12059 (void) nzd_close(&txn, false);
12060
12061 return (result);
12062 }
12063
12064 /*
12065 * Migrate zone configuration from an NZF file to an NZD database.
12066 * Caller must hold view->new_zone_lock.
12067 */
12068 static isc_result_t
migrate_nzf(dns_view_t * view)12069 migrate_nzf(dns_view_t *view) {
12070 isc_result_t result;
12071 cfg_obj_t *nzf_config = NULL;
12072 int status, n;
12073 isc_buffer_t *text = NULL;
12074 bool commit = false;
12075 const cfg_obj_t *zonelist;
12076 const cfg_listelt_t *element;
12077 char tempname[PATH_MAX];
12078 MDB_txn *txn = NULL;
12079 MDB_dbi dbi;
12080 MDB_val key, data;
12081 ns_dzarg_t dzarg;
12082
12083 /*
12084 * If NZF file doesn't exist, or NZD DB exists and already
12085 * has data, return without attempting migration.
12086 */
12087 if (!isc_file_exists(view->new_zone_file)) {
12088 result = ISC_R_SUCCESS;
12089 goto cleanup;
12090 }
12091
12092 result = nzd_count(view, &n);
12093 if (result == ISC_R_SUCCESS && n > 0) {
12094 result = ISC_R_SUCCESS;
12095 goto cleanup;
12096 }
12097
12098 isc_log_write(ns_g_lctx,
12099 NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
12100 ISC_LOG_INFO,
12101 "Migrating zones from NZF file '%s' to "
12102 "NZD database '%s'",
12103 view->new_zone_file, view->new_zone_db);
12104 /*
12105 * Instead of blindly copying lines, we parse the NZF file using
12106 * the configuration parser, because it validates it against the
12107 * config type, giving us a guarantee that valid configuration
12108 * will be written to DB.
12109 */
12110 cfg_parser_reset(ns_g_addparser);
12111 result = cfg_parse_file(ns_g_addparser, view->new_zone_file,
12112 &cfg_type_addzoneconf, &nzf_config);
12113 if (result != ISC_R_SUCCESS) {
12114 isc_log_write(ns_g_lctx,
12115 NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
12116 ISC_LOG_ERROR,
12117 "Error parsing NZF file '%s': %s",
12118 view->new_zone_file,
12119 isc_result_totext(result));
12120 goto cleanup;
12121 }
12122
12123 zonelist = NULL;
12124 CHECK(cfg_map_get(nzf_config, "zone", &zonelist));
12125 if (!cfg_obj_islist(zonelist)) {
12126 CHECK(ISC_R_FAILURE);
12127 }
12128
12129 CHECK(nzd_open(view, 0, &txn, &dbi));
12130
12131 CHECK(isc_buffer_allocate(view->mctx, &text, 256));
12132
12133 for (element = cfg_list_first(zonelist);
12134 element != NULL;
12135 element = cfg_list_next(element))
12136 {
12137 const cfg_obj_t *zconfig;
12138 const cfg_obj_t *zoptions;
12139 char zname[DNS_NAME_FORMATSIZE];
12140 dns_fixedname_t fname;
12141 dns_name_t *name;
12142 const char *origin;
12143 isc_buffer_t b;
12144
12145 zconfig = cfg_listelt_value(element);
12146
12147 origin = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
12148 if (origin == NULL) {
12149 result = ISC_R_FAILURE;
12150 goto cleanup;
12151 }
12152
12153 /* Normalize zone name */
12154 isc_buffer_constinit(&b, origin, strlen(origin));
12155 isc_buffer_add(&b, strlen(origin));
12156 name = dns_fixedname_initname(&fname);
12157 CHECK(dns_name_fromtext(name, &b, dns_rootname,
12158 DNS_NAME_DOWNCASE, NULL));
12159 dns_name_format(name, zname, sizeof(zname));
12160
12161 key.mv_data = zname;
12162 key.mv_size = strlen(zname);
12163
12164 zoptions = cfg_tuple_get(zconfig, "options");
12165 if (zoptions == NULL) {
12166 result = ISC_R_FAILURE;
12167 goto cleanup;
12168 }
12169
12170 isc_buffer_clear(text);
12171 dzarg.magic = DZARG_MAGIC;
12172 dzarg.text = &text;
12173 dzarg.result = ISC_R_SUCCESS;
12174 cfg_printx(zoptions, CFG_PRINTER_ONELINE, dumpzone, &dzarg);
12175 if (dzarg.result != ISC_R_SUCCESS) {
12176 isc_log_write(ns_g_lctx,
12177 NS_LOGCATEGORY_GENERAL,
12178 NS_LOGMODULE_SERVER,
12179 ISC_LOG_ERROR,
12180 "Error writing zone config to "
12181 "buffer in migrate_nzf(): %s",
12182 isc_result_totext(result));
12183 result = dzarg.result;
12184 goto cleanup;
12185 }
12186
12187 data.mv_data = isc_buffer_base(text);
12188 data.mv_size = isc_buffer_usedlength(text);
12189
12190 status = mdb_put(txn, dbi, &key, &data, MDB_NOOVERWRITE);
12191 if (status != MDB_SUCCESS) {
12192 isc_log_write(ns_g_lctx,
12193 NS_LOGCATEGORY_GENERAL,
12194 NS_LOGMODULE_SERVER,
12195 ISC_LOG_ERROR,
12196 "Error inserting zone in "
12197 "NZD database: %s",
12198 mdb_strerror(status));
12199 result = ISC_R_FAILURE;
12200 goto cleanup;
12201 }
12202
12203 commit = true;
12204 }
12205
12206 result = ISC_R_SUCCESS;
12207
12208 /*
12209 * Leaving the NZF file in place is harmless as we won't use it
12210 * if an NZD database is found for the view. But we rename NZF file
12211 * to a backup name here.
12212 */
12213 strlcpy(tempname, view->new_zone_file, sizeof(tempname));
12214 if (strlen(tempname) < sizeof(tempname) - 1) {
12215 strlcat(tempname, "~", sizeof(tempname));
12216 isc_file_rename(view->new_zone_file, tempname);
12217 }
12218
12219 cleanup:
12220 if (result != ISC_R_SUCCESS) {
12221 (void) nzd_close(&txn, false);
12222 } else {
12223 result = nzd_close(&txn, commit);
12224 }
12225
12226 if (text != NULL) {
12227 isc_buffer_free(&text);
12228 }
12229
12230 if (nzf_config != NULL) {
12231 cfg_obj_destroy(ns_g_addparser, &nzf_config);
12232 }
12233
12234 return (result);
12235 }
12236
12237 #endif /* HAVE_LMDB */
12238
12239 static isc_result_t
newzone_parse(ns_server_t * server,char * command,dns_view_t ** viewp,cfg_obj_t ** zoneconfp,const cfg_obj_t ** zoneobjp,isc_buffer_t ** text)12240 newzone_parse(ns_server_t *server, char *command, dns_view_t **viewp,
12241 cfg_obj_t **zoneconfp, const cfg_obj_t **zoneobjp,
12242 isc_buffer_t **text)
12243 {
12244 isc_result_t result;
12245 isc_buffer_t argbuf;
12246 cfg_obj_t *zoneconf = NULL;
12247 const cfg_obj_t *zlist = NULL;
12248 const cfg_obj_t *zoneobj = NULL;
12249 const cfg_obj_t *zoptions = NULL;
12250 const cfg_obj_t *obj = NULL;
12251 const char *viewname = NULL;
12252 dns_rdataclass_t rdclass;
12253 dns_view_t *view = NULL;
12254 const char *bn = NULL;
12255
12256 REQUIRE(viewp != NULL && *viewp == NULL);
12257 REQUIRE(zoneobjp != NULL && *zoneobjp == NULL);
12258 REQUIRE(zoneconfp != NULL && *zoneconfp == NULL);
12259
12260 /* Try to parse the argument string */
12261 isc_buffer_init(&argbuf, command, (unsigned int) strlen(command));
12262 isc_buffer_add(&argbuf, strlen(command));
12263
12264 if (strncasecmp(command, "add", 3) == 0) {
12265 bn = "addzone";
12266 } else if (strncasecmp(command, "mod", 3) == 0) {
12267 bn = "modzone";
12268 } else {
12269 INSIST(0);
12270 ISC_UNREACHABLE();
12271 }
12272
12273 /*
12274 * Convert the "addzone" or "modzone" to just "zone", for
12275 * the benefit of the parser
12276 */
12277 isc_buffer_forward(&argbuf, 3);
12278
12279 cfg_parser_reset(ns_g_addparser);
12280 CHECK(cfg_parse_buffer3(ns_g_addparser, &argbuf, bn, 0,
12281 &cfg_type_addzoneconf, &zoneconf));
12282 CHECK(cfg_map_get(zoneconf, "zone", &zlist));
12283 if (!cfg_obj_islist(zlist))
12284 CHECK(ISC_R_FAILURE);
12285
12286 /* For now we only support adding one zone at a time */
12287 zoneobj = cfg_listelt_value(cfg_list_first(zlist));
12288
12289 /* Check the zone type for ones that are not supported by addzone. */
12290 zoptions = cfg_tuple_get(zoneobj, "options");
12291
12292 obj = NULL;
12293 (void)cfg_map_get(zoptions, "type", &obj);
12294 if (obj == NULL) {
12295 (void) cfg_map_get(zoptions, "in-view", &obj);
12296 if (obj != NULL) {
12297 (void) putstr(text,
12298 "'in-view' zones not supported by ");
12299 (void) putstr(text, bn);
12300 } else
12301 (void) putstr(text, "zone type not specified");
12302 CHECK(ISC_R_FAILURE);
12303 }
12304
12305 if (strcasecmp(cfg_obj_asstring(obj), "hint") == 0 ||
12306 strcasecmp(cfg_obj_asstring(obj), "forward") == 0 ||
12307 strcasecmp(cfg_obj_asstring(obj), "redirect") == 0 ||
12308 strcasecmp(cfg_obj_asstring(obj), "delegation-only") == 0)
12309 {
12310 (void) putstr(text, "'");
12311 (void) putstr(text, cfg_obj_asstring(obj));
12312 (void) putstr(text, "' zones not supported by ");
12313 (void) putstr(text, bn);
12314 CHECK(ISC_R_FAILURE);
12315 }
12316
12317 /* Make sense of optional class argument */
12318 obj = cfg_tuple_get(zoneobj, "class");
12319 CHECK(ns_config_getclass(obj, dns_rdataclass_in, &rdclass));
12320
12321 /* Make sense of optional view argument */
12322 obj = cfg_tuple_get(zoneobj, "view");
12323 if (obj && cfg_obj_isstring(obj))
12324 viewname = cfg_obj_asstring(obj);
12325 if (viewname == NULL || *viewname == '\0')
12326 viewname = "_default";
12327 result = dns_viewlist_find(&server->viewlist, viewname, rdclass,
12328 &view);
12329 if (result == ISC_R_NOTFOUND) {
12330 (void) putstr(text, "no matching view found for '");
12331 (void) putstr(text, viewname);
12332 (void) putstr(text, "'");
12333 goto cleanup;
12334 } else if (result != ISC_R_SUCCESS) {
12335 goto cleanup;
12336 }
12337
12338 *viewp = view;
12339 *zoneobjp = zoneobj;
12340 *zoneconfp = zoneconf;
12341
12342 return (ISC_R_SUCCESS);
12343
12344 cleanup:
12345 if (zoneconf != NULL)
12346 cfg_obj_destroy(ns_g_addparser, &zoneconf);
12347 if (view != NULL)
12348 dns_view_detach(&view);
12349
12350 return (result);
12351 }
12352
12353 static isc_result_t
delete_zoneconf(dns_view_t * view,cfg_parser_t * pctx,const cfg_obj_t * config,const dns_name_t * zname,nzfwriter_t nzfwriter)12354 delete_zoneconf(dns_view_t *view, cfg_parser_t *pctx,
12355 const cfg_obj_t *config, const dns_name_t *zname,
12356 nzfwriter_t nzfwriter)
12357 {
12358 isc_result_t result = ISC_R_NOTFOUND;
12359 const cfg_listelt_t *elt = NULL;
12360 const cfg_obj_t *zl = NULL;
12361 cfg_list_t *list;
12362 dns_fixedname_t myfixed;
12363 dns_name_t *myname;
12364
12365 REQUIRE(view != NULL);
12366 REQUIRE(pctx != NULL);
12367 REQUIRE(config != NULL);
12368 REQUIRE(zname != NULL);
12369
12370 LOCK(&view->new_zone_lock);
12371
12372 cfg_map_get(config, "zone", &zl);
12373
12374 if (!cfg_obj_islist(zl))
12375 CHECK(ISC_R_FAILURE);
12376
12377 DE_CONST(&zl->value.list, list);
12378
12379 myname = dns_fixedname_initname(&myfixed);
12380
12381 for (elt = ISC_LIST_HEAD(*list);
12382 elt != NULL;
12383 elt = ISC_LIST_NEXT(elt, link))
12384 {
12385 const cfg_obj_t *zconf = cfg_listelt_value(elt);
12386 const char *zn;
12387 cfg_listelt_t *e;
12388
12389 zn = cfg_obj_asstring(cfg_tuple_get(zconf, "name"));
12390 result = dns_name_fromstring(myname, zn, 0, NULL);
12391 if (result != ISC_R_SUCCESS ||
12392 !dns_name_equal(zname, myname))
12393 continue;
12394
12395 DE_CONST(elt, e);
12396 ISC_LIST_UNLINK(*list, e, link);
12397 cfg_obj_destroy(pctx, &e->obj);
12398 isc_mem_put(pctx->mctx, e, sizeof(*e));
12399 result = ISC_R_SUCCESS;
12400 break;
12401 }
12402
12403 /*
12404 * Write config to NZF file if appropriate
12405 */
12406 if (nzfwriter != NULL && view->new_zone_file != NULL)
12407 result = nzfwriter(config, view);
12408
12409 cleanup:
12410 UNLOCK(&view->new_zone_lock);
12411 return (result);
12412 }
12413
12414 static isc_result_t
do_addzone(ns_server_t * server,ns_cfgctx_t * cfg,dns_view_t * view,dns_name_t * name,cfg_obj_t * zoneconf,const cfg_obj_t * zoneobj,isc_buffer_t ** text)12415 do_addzone(ns_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
12416 dns_name_t *name, cfg_obj_t *zoneconf, const cfg_obj_t *zoneobj,
12417 isc_buffer_t **text)
12418 {
12419 isc_result_t result, tresult;
12420 dns_zone_t *zone = NULL;
12421 #ifndef HAVE_LMDB
12422 FILE *fp = NULL;
12423 bool cleanup_config = false;
12424 #else /* HAVE_LMDB */
12425 MDB_txn *txn = NULL;
12426 MDB_dbi dbi;
12427
12428 UNUSED(zoneconf);
12429 LOCK(&view->new_zone_lock);
12430 #endif /* HAVE_LMDB */
12431
12432 /* Zone shouldn't already exist */
12433 result = dns_zt_find(view->zonetable, name, 0, NULL, &zone);
12434 if (result == ISC_R_SUCCESS) {
12435 result = ISC_R_EXISTS;
12436 goto cleanup;
12437 } else if (result == DNS_R_PARTIALMATCH) {
12438 /* Create our sub-zone anyway */
12439 dns_zone_detach(&zone);
12440 zone = NULL;
12441 } else if (result != ISC_R_NOTFOUND)
12442 goto cleanup;
12443
12444 #ifndef HAVE_LMDB
12445 /*
12446 * Make sure we can open the configuration save file
12447 */
12448 result = isc_stdio_open(view->new_zone_file, "a", &fp);
12449 if (result != ISC_R_SUCCESS) {
12450 TCHECK(putstr(text, "unable to create '"));
12451 TCHECK(putstr(text, view->new_zone_file));
12452 TCHECK(putstr(text, "': "));
12453 TCHECK(putstr(text, isc_result_totext(result)));
12454 goto cleanup;
12455 }
12456
12457 (void)isc_stdio_close(fp);
12458 fp = NULL;
12459 #else /* HAVE_LMDB */
12460 /* Make sure we can open the NZD database */
12461 result = nzd_writable(view);
12462 if (result != ISC_R_SUCCESS) {
12463 TCHECK(putstr(text, "unable to open NZD database for '"));
12464 TCHECK(putstr(text, view->new_zone_db));
12465 TCHECK(putstr(text, "'"));
12466 result = ISC_R_FAILURE;
12467 goto cleanup;
12468 }
12469 #endif /* HAVE_LMDB */
12470
12471 result = isc_task_beginexclusive(server->task);
12472 RUNTIME_CHECK(result == ISC_R_SUCCESS);
12473
12474 /* Mark view unfrozen and configure zone */
12475 dns_view_thaw(view);
12476 result = configure_zone(cfg->config, zoneobj, cfg->vconfig,
12477 server->mctx, view, &server->viewlist,
12478 cfg->actx, true, false, false);
12479 dns_view_freeze(view);
12480
12481 isc_task_endexclusive(server->task);
12482
12483 if (result != ISC_R_SUCCESS) {
12484 TCHECK(putstr(text, "configure_zone failed: "));
12485 TCHECK(putstr(text, isc_result_totext(result)));
12486 goto cleanup;
12487 }
12488
12489 /* Is it there yet? */
12490 result = dns_zt_find(view->zonetable, name, 0, NULL, &zone);
12491 if (result != ISC_R_SUCCESS) {
12492 isc_log_write(ns_g_lctx,
12493 NS_LOGCATEGORY_GENERAL,
12494 NS_LOGMODULE_SERVER,
12495 ISC_LOG_ERROR,
12496 "added new zone was not found: %s",
12497 isc_result_totext(result));
12498 goto cleanup;
12499 }
12500
12501 #ifndef HAVE_LMDB
12502 /*
12503 * If there wasn't a previous newzone config, just save the one
12504 * we've created. If there was a previous one, merge the new
12505 * zone into it.
12506 */
12507 if (cfg->nzf_config == NULL) {
12508 cfg_obj_attach(zoneconf, &cfg->nzf_config);
12509 } else {
12510 cfg_obj_t *z;
12511 DE_CONST(zoneobj, z);
12512 CHECK(cfg_parser_mapadd(cfg->add_parser,
12513 cfg->nzf_config, z, "zone"));
12514 }
12515 cleanup_config = true;
12516 #endif /* HAVE_LMDB */
12517
12518 /*
12519 * Load the zone from the master file. If this fails, we'll
12520 * need to undo the configuration we've done already.
12521 */
12522 result = dns_zone_loadnew(zone);
12523 if (result != ISC_R_SUCCESS) {
12524 dns_db_t *dbp = NULL;
12525
12526 TCHECK(putstr(text, "dns_zone_loadnew failed: "));
12527 TCHECK(putstr(text, isc_result_totext(result)));
12528
12529 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
12530 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
12531 "addzone failed; reverting.");
12532
12533 /* If the zone loaded partially, unload it */
12534 if (dns_zone_getdb(zone, &dbp) == ISC_R_SUCCESS) {
12535 dns_db_detach(&dbp);
12536 dns_zone_unload(zone);
12537 }
12538
12539 /* Remove the zone from the zone table */
12540 dns_zt_unmount(view->zonetable, zone);
12541 goto cleanup;
12542 }
12543
12544 /* Flag the zone as having been added at runtime */
12545 dns_zone_setadded(zone, true);
12546
12547 #ifdef HAVE_LMDB
12548 /* Save the new zone configuration into the NZD */
12549 CHECK(nzd_open(view, 0, &txn, &dbi));
12550 CHECK(nzd_save(&txn, dbi, zone, zoneobj));
12551 #else
12552 /* Append the zone configuration to the NZF */
12553 result = nzf_append(view, zoneobj);
12554 #endif /* HAVE_LMDB */
12555
12556 cleanup:
12557
12558 #ifndef HAVE_LMDB
12559 if (fp != NULL)
12560 (void)isc_stdio_close(fp);
12561 if (result != ISC_R_SUCCESS && cleanup_config) {
12562 tresult = delete_zoneconf(view, cfg->add_parser,
12563 cfg->nzf_config, name,
12564 NULL);
12565 RUNTIME_CHECK(tresult == ISC_R_SUCCESS);
12566 }
12567 #else /* HAVE_LMDB */
12568 if (txn != NULL)
12569 (void) nzd_close(&txn, false);
12570 UNLOCK(&view->new_zone_lock);
12571 #endif /* HAVE_LMDB */
12572
12573 if (zone != NULL)
12574 dns_zone_detach(&zone);
12575
12576 return (result);
12577 }
12578
12579 static isc_result_t
do_modzone(ns_server_t * server,ns_cfgctx_t * cfg,dns_view_t * view,dns_name_t * name,const char * zname,const cfg_obj_t * zoneobj,isc_buffer_t ** text)12580 do_modzone(ns_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
12581 dns_name_t *name, const char *zname, const cfg_obj_t *zoneobj,
12582 isc_buffer_t **text)
12583 {
12584 isc_result_t result, tresult;
12585 dns_zone_t *zone = NULL;
12586 bool added;
12587 bool exclusive = false;
12588 #ifndef HAVE_LMDB
12589 FILE *fp = NULL;
12590 cfg_obj_t *z;
12591 #else /* HAVE_LMDB */
12592 MDB_txn *txn = NULL;
12593 MDB_dbi dbi;
12594 LOCK(&view->new_zone_lock);
12595 #endif /* HAVE_LMDB */
12596
12597 /* Zone must already exist */
12598 result = dns_zt_find(view->zonetable, name, 0, NULL, &zone);
12599 if (result != ISC_R_SUCCESS)
12600 goto cleanup;
12601
12602 added = dns_zone_getadded(zone);
12603 dns_zone_detach(&zone);
12604
12605 #ifndef HAVE_LMDB
12606 cfg = (ns_cfgctx_t *) view->new_zone_config;
12607 if (cfg == NULL) {
12608 TCHECK(putstr(text, "new zone config is not set"));
12609 CHECK(ISC_R_FAILURE);
12610 }
12611 #endif
12612
12613 result = isc_task_beginexclusive(server->task);
12614 RUNTIME_CHECK(result == ISC_R_SUCCESS);
12615 exclusive = true;
12616
12617 #ifndef HAVE_LMDB
12618 /* Make sure we can open the configuration save file */
12619 result = isc_stdio_open(view->new_zone_file, "a", &fp);
12620 if (result != ISC_R_SUCCESS) {
12621 TCHECK(putstr(text, "unable to open '"));
12622 TCHECK(putstr(text, view->new_zone_file));
12623 TCHECK(putstr(text, "': "));
12624 TCHECK(putstr(text, isc_result_totext(result)));
12625 goto cleanup;
12626 }
12627 (void)isc_stdio_close(fp);
12628 fp = NULL;
12629 #else /* HAVE_LMDB */
12630 /* Make sure we can open the NZD database */
12631 result = nzd_writable(view);
12632 if (result != ISC_R_SUCCESS) {
12633 TCHECK(putstr(text, "unable to open NZD database for '"));
12634 TCHECK(putstr(text, view->new_zone_db));
12635 TCHECK(putstr(text, "'"));
12636 result = ISC_R_FAILURE;
12637 goto cleanup;
12638 }
12639 #endif /* HAVE_LMDB */
12640
12641 /* Reconfigure the zone */
12642 dns_view_thaw(view);
12643 result = configure_zone(cfg->config, zoneobj, cfg->vconfig,
12644 server->mctx, view, &server->viewlist,
12645 cfg->actx, true, false, true);
12646 dns_view_freeze(view);
12647
12648 exclusive = false;
12649 isc_task_endexclusive(server->task);
12650
12651 if (result != ISC_R_SUCCESS) {
12652 TCHECK(putstr(text, "configure_zone failed: "));
12653 TCHECK(putstr(text, isc_result_totext(result)));
12654 goto cleanup;
12655 }
12656
12657 /* Is it there yet? */
12658 CHECK(dns_zt_find(view->zonetable, name, 0, NULL, &zone));
12659
12660 #ifndef HAVE_LMDB
12661 /* Remove old zone from configuration (and NZF file if applicable) */
12662 if (added) {
12663 result = delete_zoneconf(view, cfg->add_parser,
12664 cfg->nzf_config,
12665 dns_zone_getorigin(zone),
12666 nzf_writeconf);
12667 if (result != ISC_R_SUCCESS) {
12668 TCHECK(putstr(text, "former zone configuration "
12669 "not deleted: "));
12670 TCHECK(putstr(text, isc_result_totext(result)));
12671 goto cleanup;
12672 }
12673 }
12674 #endif /* HAVE_LMDB */
12675
12676 if (!added) {
12677 if (cfg->vconfig == NULL) {
12678 result = delete_zoneconf(view, cfg->conf_parser,
12679 cfg->config,
12680 dns_zone_getorigin(zone),
12681 NULL);
12682 } else {
12683 const cfg_obj_t *voptions =
12684 cfg_tuple_get(cfg->vconfig, "options");
12685 result = delete_zoneconf(view, cfg->conf_parser,
12686 voptions,
12687 dns_zone_getorigin(zone),
12688 NULL);
12689 }
12690
12691 if (result != ISC_R_SUCCESS) {
12692 TCHECK(putstr(text, "former zone configuration "
12693 "not deleted: "));
12694 TCHECK(putstr(text, isc_result_totext(result)));
12695 goto cleanup;
12696 }
12697 }
12698
12699 /* Load the zone from the master file if it needs reloading. */
12700 result = dns_zone_loadnew(zone);
12701
12702 /*
12703 * Dynamic zones need no reloading, so we can pass this result.
12704 */
12705 if (result == DNS_R_DYNAMIC)
12706 result = ISC_R_SUCCESS;
12707
12708 if (result != ISC_R_SUCCESS) {
12709 dns_db_t *dbp = NULL;
12710
12711 TCHECK(putstr(text, "failed to load zone '"));
12712 TCHECK(putstr(text, zname));
12713 TCHECK(putstr(text, "': "));
12714 TCHECK(putstr(text, isc_result_totext(result)));
12715 TCHECK(putstr(text, "\nThe zone is no longer being served. "));
12716 TCHECK(putstr(text, "Use 'rndc addzone' to correct\n"));
12717 TCHECK(putstr(text, "the problem and restore service."));
12718
12719 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
12720 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
12721 "modzone failed; removing zone.");
12722
12723 /* If the zone loaded partially, unload it */
12724 if (dns_zone_getdb(zone, &dbp) == ISC_R_SUCCESS) {
12725 dns_db_detach(&dbp);
12726 dns_zone_unload(zone);
12727 }
12728
12729 /* Remove the zone from the zone table */
12730 dns_zt_unmount(view->zonetable, zone);
12731 goto cleanup;
12732 }
12733
12734 #ifndef HAVE_LMDB
12735 /* Store the new zone configuration; also in NZF if applicable */
12736 DE_CONST(zoneobj, z);
12737 CHECK(cfg_parser_mapadd(cfg->add_parser, cfg->nzf_config, z, "zone"));
12738 #endif /* HAVE_LMDB */
12739
12740 if (added) {
12741 #ifdef HAVE_LMDB
12742 CHECK(nzd_open(view, 0, &txn, &dbi));
12743 CHECK(nzd_save(&txn, dbi, zone, zoneobj));
12744 #else
12745 result = nzf_append(view, zoneobj);
12746 if (result != ISC_R_SUCCESS) {
12747 TCHECK(putstr(text, "\nNew zone config not saved: "));
12748 TCHECK(putstr(text, isc_result_totext(result)));
12749 goto cleanup;
12750 }
12751 #endif /* HAVE_LMDB */
12752
12753 TCHECK(putstr(text, "zone '"));
12754 TCHECK(putstr(text, zname));
12755 TCHECK(putstr(text, "' reconfigured."));
12756
12757 } else {
12758 TCHECK(putstr(text, "zone '"));
12759 TCHECK(putstr(text, zname));
12760 TCHECK(putstr(text, "' must also be reconfigured in\n"));
12761 TCHECK(putstr(text, "named.conf to make changes permanent."));
12762 }
12763
12764 cleanup:
12765 if (exclusive)
12766 isc_task_endexclusive(server->task);
12767
12768 #ifndef HAVE_LMDB
12769 if (fp != NULL)
12770 (void)isc_stdio_close(fp);
12771 #else /* HAVE_LMDB */
12772 if (txn != NULL)
12773 (void) nzd_close(&txn, false);
12774 UNLOCK(&view->new_zone_lock);
12775 #endif /* HAVE_LMDB */
12776
12777 if (zone != NULL)
12778 dns_zone_detach(&zone);
12779
12780 return (result);
12781 }
12782
12783 /*
12784 * Act on an "addzone" or "modzone" command from the command channel.
12785 */
12786 isc_result_t
ns_server_changezone(ns_server_t * server,char * command,isc_buffer_t ** text)12787 ns_server_changezone(ns_server_t *server, char *command, isc_buffer_t **text) {
12788 isc_result_t result;
12789 bool addzone;
12790 ns_cfgctx_t *cfg = NULL;
12791 cfg_obj_t *zoneconf = NULL;
12792 const cfg_obj_t *zoneobj = NULL;
12793 const char *zonename;
12794 dns_view_t *view = NULL;
12795 isc_buffer_t buf;
12796 dns_fixedname_t fname;
12797 dns_name_t *dnsname;
12798
12799 if (strncasecmp(command, "add", 3) == 0)
12800 addzone = true;
12801 else {
12802 INSIST(strncasecmp(command, "mod", 3) == 0);
12803 addzone = false;
12804 }
12805
12806 CHECK(newzone_parse(server, command, &view, &zoneconf,
12807 &zoneobj, text));
12808
12809 /* Are we accepting new zones in this view? */
12810 #ifdef HAVE_LMDB
12811 if (view->new_zone_db == NULL)
12812 #else
12813 if (view->new_zone_file == NULL)
12814 #endif /* HAVE_LMDB */
12815 {
12816 (void) putstr(text, "Not allowing new zones in view '");
12817 (void) putstr(text, view->name);
12818 (void) putstr(text, "'");
12819 result = ISC_R_NOPERM;
12820 goto cleanup;
12821 }
12822
12823 cfg = (ns_cfgctx_t *) view->new_zone_config;
12824 if (cfg == NULL) {
12825 result = ISC_R_FAILURE;
12826 goto cleanup;
12827 }
12828
12829 zonename = cfg_obj_asstring(cfg_tuple_get(zoneobj, "name"));
12830 isc_buffer_constinit(&buf, zonename, strlen(zonename));
12831 isc_buffer_add(&buf, strlen(zonename));
12832
12833 dnsname = dns_fixedname_initname(&fname);
12834 CHECK(dns_name_fromtext(dnsname, &buf, dns_rootname, 0, NULL));
12835
12836 if (addzone)
12837 CHECK(do_addzone(server, cfg, view, dnsname, zoneconf,
12838 zoneobj, text));
12839 else
12840 CHECK(do_modzone(server, cfg, view, dnsname, zonename,
12841 zoneobj, text));
12842
12843 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
12844 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
12845 "%s zone %s in view %s via %s",
12846 addzone ? "added" : "updated",
12847 zonename, view->name,
12848 addzone ? NS_COMMAND_ADDZONE : NS_COMMAND_MODZONE);
12849
12850 /* Changing a zone counts as reconfiguration */
12851 CHECK(isc_time_now(&ns_g_configtime));
12852
12853 cleanup:
12854 if (isc_buffer_usedlength(*text) > 0)
12855 (void) putnull(text);
12856 if (zoneconf != NULL)
12857 cfg_obj_destroy(ns_g_addparser, &zoneconf);
12858 if (view != NULL)
12859 dns_view_detach(&view);
12860
12861 return (result);
12862 }
12863
12864 static bool
inuse(const char * file,bool first,isc_buffer_t ** text)12865 inuse(const char* file, bool first, isc_buffer_t **text) {
12866 if (file != NULL && isc_file_exists(file)) {
12867 if (first)
12868 (void) putstr(text,
12869 "The following files were in use "
12870 "and may now be removed:\n");
12871 else
12872 (void) putstr(text, "\n");
12873 (void) putstr(text, file);
12874 (void) putnull(text);
12875 return (false);
12876 }
12877 return (first);
12878 }
12879
12880 typedef struct {
12881 dns_zone_t *zone;
12882 bool cleanup;
12883 } ns_dzctx_t;
12884
12885 /*
12886 * Carry out a zone deletion scheduled by ns_server_delzone().
12887 */
12888 static void
rmzone(isc_task_t * task,isc_event_t * event)12889 rmzone(isc_task_t *task, isc_event_t *event) {
12890 ns_dzctx_t *dz = (ns_dzctx_t *)event->ev_arg;
12891 dns_zone_t *zone, *raw = NULL, *mayberaw;
12892 char zonename[DNS_NAME_FORMATSIZE];
12893 dns_view_t *view;
12894 ns_cfgctx_t *cfg;
12895 dns_db_t *dbp = NULL;
12896 bool added;
12897 isc_result_t result;
12898 #ifdef HAVE_LMDB
12899 MDB_txn *txn = NULL;
12900 MDB_dbi dbi;
12901 #endif
12902
12903 REQUIRE(dz != NULL);
12904
12905 isc_event_free(&event);
12906
12907 /* Dig out configuration for this zone */
12908 zone = dz->zone;
12909 view = dns_zone_getview(zone);
12910 cfg = (ns_cfgctx_t *) view->new_zone_config;
12911 dns_name_format(dns_zone_getorigin(zone), zonename, sizeof(zonename));
12912
12913 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
12914 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
12915 "deleting zone %s in view %s via delzone",
12916 zonename, view->name);
12917
12918 /* Remove the zone from configuration (and NZF file if applicable) */
12919 added = dns_zone_getadded(zone);
12920
12921 if (added && cfg != NULL) {
12922 #ifdef HAVE_LMDB
12923 /* Make sure we can open the NZD database */
12924 LOCK(&view->new_zone_lock);
12925 result = nzd_open(view, 0, &txn, &dbi);
12926 if (result != ISC_R_SUCCESS) {
12927 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
12928 NS_LOGMODULE_SERVER,
12929 ISC_LOG_ERROR,
12930 "unable to open NZD database for '%s'",
12931 view->new_zone_db);
12932 } else {
12933 result = nzd_save(&txn, dbi, zone, NULL);
12934 }
12935
12936 if (result != ISC_R_SUCCESS) {
12937 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
12938 NS_LOGMODULE_SERVER,
12939 ISC_LOG_ERROR, "unable to "
12940 "delete zone configuration: %s",
12941 isc_result_totext(result));
12942 }
12943
12944 if (txn != NULL) {
12945 (void)nzd_close(&txn, false);
12946 }
12947 UNLOCK(&view->new_zone_lock);
12948 #else
12949 result = delete_zoneconf(view, cfg->add_parser,
12950 cfg->nzf_config,
12951 dns_zone_getorigin(zone),
12952 nzf_writeconf);
12953 if (result != ISC_R_SUCCESS) {
12954 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
12955 NS_LOGMODULE_SERVER,
12956 ISC_LOG_ERROR, "unable to "
12957 "delete zone configuration: %s",
12958 isc_result_totext(result));
12959 }
12960 #endif /* HAVE_LMDB */
12961 }
12962
12963 if (!added && cfg != NULL) {
12964 if (cfg->vconfig != NULL) {
12965 const cfg_obj_t *voptions =
12966 cfg_tuple_get(cfg->vconfig, "options");
12967 result = delete_zoneconf(view, cfg->conf_parser,
12968 voptions,
12969 dns_zone_getorigin(zone),
12970 NULL);
12971 } else {
12972 result = delete_zoneconf(view, cfg->conf_parser,
12973 cfg->config,
12974 dns_zone_getorigin(zone),
12975 NULL);
12976 }
12977 if (result != ISC_R_SUCCESS){
12978 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
12979 NS_LOGMODULE_SERVER,
12980 ISC_LOG_ERROR, "unable to "
12981 "delete zone configuration: %s",
12982 isc_result_totext(result));
12983 }
12984 }
12985
12986 /* Unload zone database */
12987 if (dns_zone_getdb(zone, &dbp) == ISC_R_SUCCESS) {
12988 dns_db_detach(&dbp);
12989 dns_zone_unload(zone);
12990 }
12991
12992 /* Clean up stub/slave zone files if requested to do so */
12993 dns_zone_getraw(zone, &raw);
12994 mayberaw = (raw != NULL) ? raw : zone;
12995
12996 if (added && dz->cleanup) {
12997 const char *file;
12998
12999 file = dns_zone_getfile(mayberaw);
13000 result = isc_file_remove(file);
13001 if (result != ISC_R_SUCCESS) {
13002 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
13003 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
13004 "file %s not removed: %s",
13005 file, isc_result_totext(result));
13006 }
13007
13008 file = dns_zone_getjournal(mayberaw);
13009 result = isc_file_remove(file);
13010 if (result != ISC_R_SUCCESS) {
13011 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
13012 NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
13013 "file %s not removed: %s",
13014 file, isc_result_totext(result));
13015 }
13016
13017 if (zone != mayberaw) {
13018 file = dns_zone_getfile(zone);
13019 result = isc_file_remove(file);
13020 if (result != ISC_R_SUCCESS) {
13021 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
13022 NS_LOGMODULE_SERVER,
13023 ISC_LOG_WARNING,
13024 "file %s not removed: %s",
13025 file, isc_result_totext(result));
13026 }
13027
13028 file = dns_zone_getjournal(zone);
13029 result = isc_file_remove(file);
13030 if (result != ISC_R_SUCCESS) {
13031 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
13032 NS_LOGMODULE_SERVER,
13033 ISC_LOG_WARNING,
13034 "file %s not removed: %s",
13035 file, isc_result_totext(result));
13036 }
13037 }
13038 }
13039
13040 if (raw != NULL)
13041 dns_zone_detach(&raw);
13042 dns_zone_detach(&zone);
13043 isc_mem_put(ns_g_mctx, dz, sizeof(*dz));
13044 isc_task_detach(&task);
13045 }
13046
13047 /*
13048 * Act on a "delzone" command from the command channel.
13049 */
13050 isc_result_t
ns_server_delzone(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)13051 ns_server_delzone(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
13052 isc_result_t result, tresult;
13053 dns_zone_t *zone = NULL;
13054 dns_zone_t *raw = NULL;
13055 dns_zone_t *mayberaw;
13056 dns_view_t *view = NULL;
13057 char zonename[DNS_NAME_FORMATSIZE];
13058 bool cleanup = false;
13059 const char *ptr;
13060 bool added;
13061 ns_dzctx_t *dz = NULL;
13062 isc_event_t *dzevent = NULL;
13063 isc_task_t *task = NULL;
13064
13065 /* Skip the command name. */
13066 ptr = next_token(lex, text);
13067 if (ptr == NULL)
13068 return (ISC_R_UNEXPECTEDEND);
13069
13070 /* Find out what we are to do. */
13071 ptr = next_token(lex, text);
13072 if (ptr == NULL)
13073 return (ISC_R_UNEXPECTEDEND);
13074
13075 if (strcmp(ptr, "-clean") == 0 || strcmp(ptr, "-clear") == 0) {
13076 cleanup = true;
13077 ptr = next_token(lex, text);
13078 }
13079
13080 CHECK(zone_from_args(server, lex, ptr, &zone, zonename,
13081 text, false));
13082 if (zone == NULL) {
13083 result = ISC_R_UNEXPECTEDEND;
13084 goto cleanup;
13085 }
13086
13087 INSIST(zonename != NULL);
13088
13089 /* Is this a policy zone? */
13090 if (dns_zone_get_rpz_num(zone) != DNS_RPZ_INVALID_NUM) {
13091 TCHECK(putstr(text, "zone '"));
13092 TCHECK(putstr(text, zonename));
13093 TCHECK(putstr(text,
13094 "' cannot be deleted: response-policy zone."));
13095 result = ISC_R_FAILURE;
13096 goto cleanup;
13097 }
13098
13099 view = dns_zone_getview(zone);
13100 CHECK(dns_zt_unmount(view->zonetable, zone));
13101
13102 /* Send cleanup event */
13103 dz = isc_mem_get(ns_g_mctx, sizeof(*dz));
13104 if (dz == NULL)
13105 CHECK(ISC_R_NOMEMORY);
13106
13107 dz->cleanup = cleanup;
13108 dz->zone = NULL;
13109 dns_zone_attach(zone, &dz->zone);
13110 dzevent = isc_event_allocate(ns_g_mctx, server, NS_EVENT_DELZONE,
13111 rmzone, dz, sizeof(isc_event_t));
13112 if (dzevent == NULL)
13113 CHECK(ISC_R_NOMEMORY);
13114
13115 dns_zone_gettask(zone, &task);
13116 isc_task_send(task, &dzevent);
13117 dz = NULL;
13118
13119 /* Inform user about cleaning up stub/slave zone files */
13120 dns_zone_getraw(zone, &raw);
13121 mayberaw = (raw != NULL) ? raw : zone;
13122
13123 added = dns_zone_getadded(zone);
13124 if (!added) {
13125 TCHECK(putstr(text, "zone '"));
13126 TCHECK(putstr(text, zonename));
13127 TCHECK(putstr(text,
13128 "' is no longer active and will be deleted.\n"));
13129 TCHECK(putstr(text, "To keep it from returning "));
13130 TCHECK(putstr(text, "when the server is restarted, it\n"));
13131 TCHECK(putstr(text, "must also be removed from named.conf."));
13132 } else if (cleanup) {
13133 TCHECK(putstr(text, "zone '"));
13134 TCHECK(putstr(text, zonename));
13135 TCHECK(putstr(text, "' and associated files will be deleted."));
13136 } else if (dns_zone_gettype(mayberaw) == dns_zone_slave ||
13137 dns_zone_gettype(mayberaw) == dns_zone_stub)
13138 {
13139 bool first;
13140 const char *file;
13141
13142 TCHECK(putstr(text, "zone '"));
13143 TCHECK(putstr(text, zonename));
13144 TCHECK(putstr(text, "' will be deleted."));
13145
13146 file = dns_zone_getfile(mayberaw);
13147 first = inuse(file, true, text);
13148
13149 file = dns_zone_getjournal(mayberaw);
13150 first = inuse(file, first, text);
13151
13152 if (zone != mayberaw) {
13153 file = dns_zone_getfile(zone);
13154 first = inuse(file, first, text);
13155
13156 file = dns_zone_getjournal(zone);
13157 (void) inuse(file, first, text);
13158 }
13159 }
13160
13161 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
13162 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
13163 "zone %s scheduled for removal via delzone", zonename);
13164
13165 /* Removing a zone counts as reconfiguration */
13166 CHECK(isc_time_now(&ns_g_configtime));
13167
13168 result = ISC_R_SUCCESS;
13169
13170 cleanup:
13171 if (isc_buffer_usedlength(*text) > 0)
13172 (void) putnull(text);
13173 if (raw != NULL)
13174 dns_zone_detach(&raw);
13175 if (zone != NULL)
13176 dns_zone_detach(&zone);
13177 if (dz != NULL) {
13178 dns_zone_detach(&dz->zone);
13179 isc_mem_put(ns_g_mctx, dz, sizeof(*dz));
13180 }
13181
13182 return (result);
13183 }
13184
13185 static const cfg_obj_t *
find_name_in_list_from_map(const cfg_obj_t * config,const char * map_key_for_list,const char * name)13186 find_name_in_list_from_map(const cfg_obj_t *config,
13187 const char *map_key_for_list,
13188 const char *name)
13189 {
13190 const cfg_obj_t *list = NULL;
13191 const cfg_listelt_t *element;
13192 const cfg_obj_t *obj = NULL;
13193 dns_fixedname_t fixed1, fixed2;
13194 dns_name_t *name1 = NULL, *name2 = NULL;
13195 isc_result_t result;
13196
13197 if (strcmp(map_key_for_list, "zone") == 0) {
13198 name1 = dns_fixedname_initname(&fixed1);
13199 name2 = dns_fixedname_initname(&fixed2);
13200 result = dns_name_fromstring(name1, name, 0, NULL);
13201 RUNTIME_CHECK(result == ISC_R_SUCCESS);
13202 }
13203
13204 cfg_map_get(config, map_key_for_list, &list);
13205 for (element = cfg_list_first(list);
13206 element != NULL;
13207 element = cfg_list_next(element))
13208 {
13209 const char *vname;
13210
13211 obj = cfg_listelt_value(element);
13212 INSIST(obj != NULL);
13213 vname = cfg_obj_asstring(cfg_tuple_get(obj, "name"));
13214 if (vname == NULL) {
13215 obj = NULL;
13216 continue;
13217 }
13218
13219 if (name1 != NULL) {
13220 result = dns_name_fromstring(name2, vname, 0, NULL);
13221 if (result == ISC_R_SUCCESS &&
13222 dns_name_equal(name1, name2))
13223 break;
13224 } else if (strcasecmp(vname, name) == 0)
13225 break;
13226
13227 obj = NULL;
13228 }
13229
13230 return (obj);
13231 }
13232
13233 static void
emitzone(void * arg,const char * buf,int len)13234 emitzone(void *arg, const char *buf, int len) {
13235 ns_dzarg_t *dzarg = arg;
13236 isc_result_t result;
13237
13238 REQUIRE(dzarg != NULL && ISC_MAGIC_VALID(dzarg, DZARG_MAGIC));
13239 result = putmem(dzarg->text, buf, len);
13240 if (result != ISC_R_SUCCESS && dzarg->result == ISC_R_SUCCESS) {
13241 dzarg->result = result;
13242 }
13243 }
13244
13245 /*
13246 * Act on a "showzone" command from the command channel.
13247 */
13248 isc_result_t
ns_server_showzone(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)13249 ns_server_showzone(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
13250 isc_result_t result;
13251 const cfg_obj_t *vconfig = NULL, *zconfig = NULL;
13252 char zonename[DNS_NAME_FORMATSIZE];
13253 const cfg_obj_t *map;
13254 dns_view_t *view = NULL;
13255 dns_zone_t *zone = NULL;
13256 ns_cfgctx_t *cfg = NULL;
13257 bool exclusive = false;
13258 #ifdef HAVE_LMDB
13259 cfg_obj_t *nzconfig = NULL;
13260 #endif /* HAVE_LMDB */
13261 ns_dzarg_t dzarg;
13262
13263 /* Parse parameters */
13264 CHECK(zone_from_args(server, lex, NULL, &zone, zonename,
13265 text, true));
13266 if (zone == NULL) {
13267 result = ISC_R_UNEXPECTEDEND;
13268 goto cleanup;
13269 }
13270
13271 view = dns_zone_getview(zone);
13272 dns_zone_detach(&zone);
13273
13274 cfg = (ns_cfgctx_t *) view->new_zone_config;
13275 if (cfg == NULL) {
13276 result = ISC_R_FAILURE;
13277 goto cleanup;
13278 }
13279
13280 result = isc_task_beginexclusive(server->task);
13281 RUNTIME_CHECK(result == ISC_R_SUCCESS);
13282 exclusive = true;
13283
13284 /* Find the view statement */
13285 vconfig = find_name_in_list_from_map(cfg->config, "view", view->name);
13286
13287 /* Find the zone statement */
13288 if (vconfig != NULL)
13289 map = cfg_tuple_get(vconfig, "options");
13290 else
13291 map = cfg->config;
13292
13293 zconfig = find_name_in_list_from_map(map, "zone", zonename);
13294
13295 #ifndef HAVE_LMDB
13296 if (zconfig == NULL && cfg->nzf_config != NULL)
13297 zconfig = find_name_in_list_from_map(cfg->nzf_config,
13298 "zone", zonename);
13299 #else /* HAVE_LMDB */
13300 if (zconfig == NULL) {
13301 const cfg_obj_t *zlist = NULL;
13302 CHECK(get_newzone_config(view, zonename, &nzconfig));
13303 CHECK(cfg_map_get(nzconfig, "zone", &zlist));
13304 if (!cfg_obj_islist(zlist))
13305 CHECK(ISC_R_FAILURE);
13306
13307 zconfig = cfg_listelt_value(cfg_list_first(zlist));
13308 }
13309 #endif /* HAVE_LMDB */
13310
13311 if (zconfig == NULL)
13312 CHECK(ISC_R_NOTFOUND);
13313
13314 CHECK(putstr(text, "zone "));
13315 dzarg.magic = DZARG_MAGIC;
13316 dzarg.text = text;
13317 dzarg.result = ISC_R_SUCCESS;
13318 cfg_printx(zconfig, CFG_PRINTER_ONELINE, emitzone, &dzarg);
13319 CHECK(dzarg.result);
13320
13321 CHECK(putstr(text, ";"));
13322
13323 result = ISC_R_SUCCESS;
13324
13325 cleanup:
13326 #ifdef HAVE_LMDB
13327 if (nzconfig != NULL)
13328 cfg_obj_destroy(ns_g_addparser, &nzconfig);
13329 #endif /* HAVE_LMDB */
13330 if (isc_buffer_usedlength(*text) > 0)
13331 (void) putnull(text);
13332 if (exclusive)
13333 isc_task_endexclusive(server->task);
13334
13335 return (result);
13336 }
13337
13338 static void
newzone_cfgctx_destroy(void ** cfgp)13339 newzone_cfgctx_destroy(void **cfgp) {
13340 ns_cfgctx_t *cfg;
13341
13342 REQUIRE(cfgp != NULL && *cfgp != NULL);
13343
13344 cfg = *cfgp;
13345
13346 if (cfg->conf_parser != NULL) {
13347 if (cfg->config != NULL)
13348 cfg_obj_destroy(cfg->conf_parser, &cfg->config);
13349 if (cfg->vconfig != NULL)
13350 cfg_obj_destroy(cfg->conf_parser, &cfg->vconfig);
13351 cfg_parser_destroy(&cfg->conf_parser);
13352 }
13353 if (cfg->add_parser != NULL) {
13354 if (cfg->nzf_config != NULL)
13355 cfg_obj_destroy(cfg->add_parser, &cfg->nzf_config);
13356 cfg_parser_destroy(&cfg->add_parser);
13357 }
13358
13359 if (cfg->actx != NULL)
13360 cfg_aclconfctx_detach(&cfg->actx);
13361
13362 isc_mem_putanddetach(&cfg->mctx, cfg, sizeof(*cfg));
13363 *cfgp = NULL;
13364 }
13365
13366 static isc_result_t
generate_salt(unsigned char * salt,size_t saltlen)13367 generate_salt(unsigned char *salt, size_t saltlen) {
13368 int i, n;
13369 union {
13370 unsigned char rnd[256];
13371 uint32_t rnd32[64];
13372 } rnd;
13373 unsigned char text[512 + 1];
13374 isc_region_t r;
13375 isc_buffer_t buf;
13376 isc_result_t result;
13377
13378 if (saltlen > 256U)
13379 return (ISC_R_RANGE);
13380
13381 n = (int) (saltlen + sizeof(uint32_t) - 1) / sizeof(uint32_t);
13382 for (i = 0; i < n; i++)
13383 isc_random_get(&rnd.rnd32[i]);
13384
13385 memmove(salt, rnd.rnd, saltlen);
13386
13387 r.base = rnd.rnd;
13388 r.length = (unsigned int) saltlen;
13389
13390 isc_buffer_init(&buf, text, sizeof(text));
13391 result = isc_hex_totext(&r, 2, "", &buf);
13392 RUNTIME_CHECK(result == ISC_R_SUCCESS);
13393 text[saltlen * 2] = 0;
13394
13395 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
13396 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
13397 "generated salt: %s", text);
13398
13399 return (ISC_R_SUCCESS);
13400 }
13401
13402 isc_result_t
ns_server_signing(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)13403 ns_server_signing(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
13404 isc_result_t result = ISC_R_SUCCESS;
13405 dns_zone_t *zone = NULL;
13406 dns_name_t *origin;
13407 dns_db_t *db = NULL;
13408 dns_dbnode_t *node = NULL;
13409 dns_dbversion_t *version = NULL;
13410 dns_rdatatype_t privatetype;
13411 dns_rdataset_t privset;
13412 bool first = true;
13413 bool list = false, clear = false;
13414 bool chain = false;
13415 bool setserial = false;
13416 uint32_t serial = 0;
13417 char keystr[DNS_SECALG_FORMATSIZE + 7]; /* <5-digit keyid>/<alg> */
13418 unsigned short hash = 0, flags = 0, iter = 0, saltlen = 0;
13419 unsigned char salt[255];
13420 const char *ptr;
13421 size_t n;
13422
13423 dns_rdataset_init(&privset);
13424
13425 /* Skip the command name. */
13426 ptr = next_token(lex, text);
13427 if (ptr == NULL)
13428 return (ISC_R_UNEXPECTEDEND);
13429
13430 /* Find out what we are to do. */
13431 ptr = next_token(lex, text);
13432 if (ptr == NULL)
13433 return (ISC_R_UNEXPECTEDEND);
13434
13435 if (strcasecmp(ptr, "-list") == 0)
13436 list = true;
13437 else if ((strcasecmp(ptr, "-clear") == 0) ||
13438 (strcasecmp(ptr, "-clean") == 0))
13439 {
13440 clear = true;
13441 ptr = next_token(lex, text);
13442 if (ptr == NULL)
13443 return (ISC_R_UNEXPECTEDEND);
13444 strlcpy(keystr, ptr, sizeof(keystr));
13445 } else if (strcasecmp(ptr, "-nsec3param") == 0) {
13446 char hashbuf[64], flagbuf[64], iterbuf[64];
13447 char nbuf[256];
13448
13449 chain = true;
13450 ptr = next_token(lex, text);
13451 if (ptr == NULL)
13452 return (ISC_R_UNEXPECTEDEND);
13453
13454 if (strcasecmp(ptr, "none") == 0)
13455 hash = 0;
13456 else {
13457 strlcpy(hashbuf, ptr, sizeof(hashbuf));
13458
13459 ptr = next_token(lex, text);
13460 if (ptr == NULL)
13461 return (ISC_R_UNEXPECTEDEND);
13462 strlcpy(flagbuf, ptr, sizeof(flagbuf));
13463
13464 ptr = next_token(lex, text);
13465 if (ptr == NULL)
13466 return (ISC_R_UNEXPECTEDEND);
13467 strlcpy(iterbuf, ptr, sizeof(iterbuf));
13468
13469 n = snprintf(nbuf, sizeof(nbuf), "%s %s %s",
13470 hashbuf, flagbuf, iterbuf);
13471 if (n == sizeof(nbuf))
13472 return (ISC_R_NOSPACE);
13473 n = sscanf(nbuf, "%hu %hu %hu", &hash, &flags, &iter);
13474 if (n != 3U)
13475 return (ISC_R_BADNUMBER);
13476
13477 if (hash > 0xffU || flags > 0xffU ||
13478 iter > dns_nsec3_maxiterations())
13479 return (ISC_R_RANGE);
13480
13481 ptr = next_token(lex, text);
13482 if (ptr == NULL) {
13483 return (ISC_R_UNEXPECTEDEND);
13484 } else if (strcasecmp(ptr, "auto") == 0) {
13485 /* Auto-generate a random salt.
13486 * XXXMUKS: This currently uses the
13487 * minimum recommended length by RFC
13488 * 5155 (64 bits). It should be made
13489 * configurable.
13490 */
13491 saltlen = 8;
13492 CHECK(generate_salt(salt, saltlen));
13493 } else if (strcmp(ptr, "-") != 0) {
13494 isc_buffer_t buf;
13495
13496 isc_buffer_init(&buf, salt, sizeof(salt));
13497 CHECK(isc_hex_decodestring(ptr, &buf));
13498 saltlen = isc_buffer_usedlength(&buf);
13499 }
13500 }
13501 } else if (strcasecmp(ptr, "-serial") == 0) {
13502 ptr = next_token(lex, text);
13503 if (ptr == NULL)
13504 return (ISC_R_UNEXPECTEDEND);
13505 CHECK(isc_parse_uint32(&serial, ptr, 10));
13506 setserial = true;
13507 } else
13508 CHECK(DNS_R_SYNTAX);
13509
13510 CHECK(zone_from_args(server, lex, NULL, &zone, NULL,
13511 text, false));
13512 if (zone == NULL)
13513 CHECK(ISC_R_UNEXPECTEDEND);
13514
13515 if (clear) {
13516 CHECK(dns_zone_keydone(zone, keystr));
13517 (void) putstr(text, "request queued");
13518 (void) putnull(text);
13519 } else if (chain) {
13520 CHECK(dns_zone_setnsec3param(zone, (uint8_t)hash,
13521 (uint8_t)flags, iter,
13522 (uint8_t)saltlen, salt,
13523 true));
13524 (void) putstr(text, "nsec3param request queued");
13525 (void) putnull(text);
13526 } else if (setserial) {
13527 CHECK(dns_zone_setserial(zone, serial));
13528 (void) putstr(text, "serial request queued");
13529 (void) putnull(text);
13530 } else if (list) {
13531 privatetype = dns_zone_getprivatetype(zone);
13532 origin = dns_zone_getorigin(zone);
13533 CHECK(dns_zone_getdb(zone, &db));
13534 CHECK(dns_db_findnode(db, origin, false, &node));
13535 dns_db_currentversion(db, &version);
13536
13537 result = dns_db_findrdataset(db, node, version, privatetype,
13538 dns_rdatatype_none, 0,
13539 &privset, NULL);
13540 if (result == ISC_R_NOTFOUND) {
13541 (void) putstr(text, "No signing records found");
13542 (void) putnull(text);
13543 result = ISC_R_SUCCESS;
13544 goto cleanup;
13545 }
13546
13547 for (result = dns_rdataset_first(&privset);
13548 result == ISC_R_SUCCESS;
13549 result = dns_rdataset_next(&privset))
13550 {
13551 dns_rdata_t priv = DNS_RDATA_INIT;
13552 char output[BUFSIZ];
13553 isc_buffer_t buf;
13554
13555 dns_rdataset_current(&privset, &priv);
13556
13557 isc_buffer_init(&buf, output, sizeof(output));
13558 CHECK(dns_private_totext(&priv, &buf));
13559 if (!first)
13560 CHECK(putstr(text, "\n"));
13561 CHECK(putstr(text, output));
13562 first = false;
13563 }
13564 if (!first)
13565 CHECK(putnull(text));
13566
13567 if (result == ISC_R_NOMORE)
13568 result = ISC_R_SUCCESS;
13569 }
13570
13571 cleanup:
13572 if (dns_rdataset_isassociated(&privset))
13573 dns_rdataset_disassociate(&privset);
13574 if (node != NULL)
13575 dns_db_detachnode(db, &node);
13576 if (version != NULL)
13577 dns_db_closeversion(db, &version, false);
13578 if (db != NULL)
13579 dns_db_detach(&db);
13580 if (zone != NULL)
13581 dns_zone_detach(&zone);
13582
13583 return (result);
13584 }
13585
13586 static isc_result_t
putmem(isc_buffer_t ** b,const char * str,size_t len)13587 putmem(isc_buffer_t **b, const char *str, size_t len) {
13588 isc_result_t result;
13589
13590 result = isc_buffer_reserve(b, (unsigned int)len);
13591 if (result != ISC_R_SUCCESS)
13592 return (ISC_R_NOSPACE);
13593
13594 isc_buffer_putmem(*b, (const unsigned char *)str, (unsigned int)len);
13595 return (ISC_R_SUCCESS);
13596 }
13597
13598 static inline isc_result_t
putstr(isc_buffer_t ** b,const char * str)13599 putstr(isc_buffer_t **b, const char *str) {
13600 return (putmem(b, str, strlen(str)));
13601 }
13602
13603 static isc_result_t
putuint8(isc_buffer_t ** b,uint8_t val)13604 putuint8(isc_buffer_t **b, uint8_t val) {
13605 isc_result_t result;
13606
13607 result = isc_buffer_reserve(b, 1);
13608 if (result != ISC_R_SUCCESS)
13609 return (ISC_R_NOSPACE);
13610
13611 isc_buffer_putuint8(*b, val);
13612 return (ISC_R_SUCCESS);
13613 }
13614
13615 static inline isc_result_t
putnull(isc_buffer_t ** b)13616 putnull(isc_buffer_t **b) {
13617 return (putuint8(b, 0));
13618 }
13619
13620 isc_result_t
ns_server_zonestatus(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)13621 ns_server_zonestatus(ns_server_t *server, isc_lex_t *lex,
13622 isc_buffer_t **text)
13623 {
13624 isc_result_t result = ISC_R_SUCCESS;
13625 dns_zone_t *zone = NULL, *raw = NULL, *mayberaw = NULL;
13626 const char *type, *file;
13627 char zonename[DNS_NAME_FORMATSIZE];
13628 uint32_t serial, signed_serial, nodes;
13629 char serbuf[16], sserbuf[16], nodebuf[16];
13630 char resignbuf[DNS_NAME_FORMATSIZE + DNS_RDATATYPE_FORMATSIZE + 2];
13631 char lbuf[ISC_FORMATHTTPTIMESTAMP_SIZE];
13632 char xbuf[ISC_FORMATHTTPTIMESTAMP_SIZE];
13633 char rbuf[ISC_FORMATHTTPTIMESTAMP_SIZE];
13634 char kbuf[ISC_FORMATHTTPTIMESTAMP_SIZE];
13635 char rtbuf[ISC_FORMATHTTPTIMESTAMP_SIZE];
13636 isc_time_t loadtime, expiretime, refreshtime;
13637 isc_time_t refreshkeytime, resigntime;
13638 dns_zonetype_t zonetype;
13639 bool dynamic = false, frozen = false;
13640 bool hasraw = false;
13641 bool secure, maintain, allow;
13642 dns_db_t *db = NULL, *rawdb = NULL;
13643 char **incfiles = NULL;
13644 int nfiles = 0;
13645
13646 isc_time_settoepoch(&loadtime);
13647 isc_time_settoepoch(&refreshtime);
13648 isc_time_settoepoch(&expiretime);
13649 isc_time_settoepoch(&refreshkeytime);
13650 isc_time_settoepoch(&resigntime);
13651
13652 CHECK(zone_from_args(server, lex, NULL, &zone, zonename,
13653 text, true));
13654 if (zone == NULL) {
13655 result = ISC_R_UNEXPECTEDEND;
13656 goto cleanup;
13657 }
13658
13659 /* Inline signing? */
13660 CHECK(dns_zone_getdb(zone, &db));
13661 dns_zone_getraw(zone, &raw);
13662 hasraw = (raw != NULL);
13663 if (hasraw) {
13664 mayberaw = raw;
13665 zonetype = dns_zone_gettype(raw);
13666 CHECK(dns_zone_getdb(raw, &rawdb));
13667 } else {
13668 mayberaw = zone;
13669 zonetype = dns_zone_gettype(zone);
13670 }
13671
13672 switch (zonetype) {
13673 case dns_zone_master:
13674 type = "master";
13675 break;
13676 case dns_zone_slave:
13677 type = "slave";
13678 break;
13679 case dns_zone_stub:
13680 type = "stub";
13681 break;
13682 case dns_zone_staticstub:
13683 type = "staticstub";
13684 break;
13685 case dns_zone_redirect:
13686 type = "redirect";
13687 break;
13688 case dns_zone_key:
13689 type = "key";
13690 break;
13691 case dns_zone_dlz:
13692 type = "dlz";
13693 break;
13694 default:
13695 type = "unknown";
13696 }
13697
13698 /* Serial number */
13699 serial = dns_zone_getserial(mayberaw);
13700 snprintf(serbuf, sizeof(serbuf), "%u", serial);
13701 if (hasraw) {
13702 signed_serial = dns_zone_getserial(zone);
13703 snprintf(sserbuf, sizeof(sserbuf), "%u", signed_serial);
13704 }
13705
13706 /* Database node count */
13707 nodes = dns_db_nodecount(hasraw ? rawdb : db);
13708 snprintf(nodebuf, sizeof(nodebuf), "%u", nodes);
13709
13710 /* Security */
13711 secure = dns_db_issecure(db);
13712 allow = ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_ALLOW) != 0);
13713 maintain = ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_MAINTAIN) != 0);
13714
13715 /* Master files */
13716 file = dns_zone_getfile(mayberaw);
13717 nfiles = dns_zone_getincludes(mayberaw, &incfiles);
13718
13719 /* Load time */
13720 dns_zone_getloadtime(zone, &loadtime);
13721 isc_time_formathttptimestamp(&loadtime, lbuf, sizeof(lbuf));
13722
13723 /* Refresh/expire times */
13724 if (zonetype == dns_zone_slave ||
13725 zonetype == dns_zone_stub ||
13726 zonetype == dns_zone_redirect)
13727 {
13728 dns_zone_getexpiretime(mayberaw, &expiretime);
13729 isc_time_formathttptimestamp(&expiretime, xbuf, sizeof(xbuf));
13730 dns_zone_getrefreshtime(mayberaw, &refreshtime);
13731 isc_time_formathttptimestamp(&refreshtime, rbuf, sizeof(rbuf));
13732 }
13733
13734 /* Key refresh time */
13735 if (zonetype == dns_zone_master ||
13736 (zonetype == dns_zone_slave && hasraw))
13737 {
13738 dns_zone_getrefreshkeytime(zone, &refreshkeytime);
13739 isc_time_formathttptimestamp(&refreshkeytime, kbuf,
13740 sizeof(kbuf));
13741 }
13742
13743 /* Dynamic? */
13744 if (zonetype == dns_zone_master) {
13745 dynamic = dns_zone_isdynamic(mayberaw, true);
13746 frozen = dynamic && !dns_zone_isdynamic(mayberaw, false);
13747 }
13748
13749 /* Next resign event */
13750 if (secure && (zonetype == dns_zone_master ||
13751 (zonetype == dns_zone_slave && hasraw)) &&
13752 ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_NORESIGN) == 0))
13753 {
13754 dns_name_t *name;
13755 dns_fixedname_t fixed;
13756 dns_rdataset_t next;
13757
13758 dns_rdataset_init(&next);
13759 name = dns_fixedname_initname(&fixed);
13760
13761 result = dns_db_getsigningtime(db, &next, name);
13762 if (result == ISC_R_SUCCESS) {
13763 isc_stdtime_t timenow;
13764 char namebuf[DNS_NAME_FORMATSIZE];
13765 char typebuf[DNS_RDATATYPE_FORMATSIZE];
13766
13767 isc_stdtime_get(&timenow);
13768 dns_name_format(name, namebuf, sizeof(namebuf));
13769 dns_rdatatype_format(next.covers,
13770 typebuf, sizeof(typebuf));
13771 snprintf(resignbuf, sizeof(resignbuf),
13772 "%s/%s", namebuf, typebuf);
13773 isc_time_set(&resigntime, next.resign -
13774 dns_zone_getsigresigninginterval(zone), 0);
13775 isc_time_formathttptimestamp(&resigntime, rtbuf,
13776 sizeof(rtbuf));
13777 dns_rdataset_disassociate(&next);
13778 }
13779 }
13780
13781 /* Create text */
13782 CHECK(putstr(text, "name: "));
13783 CHECK(putstr(text, zonename));
13784
13785 CHECK(putstr(text, "\ntype: "));
13786 CHECK(putstr(text, type));
13787
13788 if (file != NULL) {
13789 int i;
13790 CHECK(putstr(text, "\nfiles: "));
13791 CHECK(putstr(text, file));
13792 for (i = 0; i < nfiles; i++) {
13793 CHECK(putstr(text, ", "));
13794 if (incfiles[i] != NULL) {
13795 CHECK(putstr(text, incfiles[i]));
13796 }
13797 }
13798 }
13799
13800 CHECK(putstr(text, "\nserial: "));
13801 CHECK(putstr(text, serbuf));
13802 if (hasraw) {
13803 CHECK(putstr(text, "\nsigned serial: "));
13804 CHECK(putstr(text, sserbuf));
13805 }
13806
13807 CHECK(putstr(text, "\nnodes: "));
13808 CHECK(putstr(text, nodebuf));
13809
13810 if (! isc_time_isepoch(&loadtime)) {
13811 CHECK(putstr(text, "\nlast loaded: "));
13812 CHECK(putstr(text, lbuf));
13813 }
13814
13815 if (! isc_time_isepoch(&refreshtime)) {
13816 CHECK(putstr(text, "\nnext refresh: "));
13817 CHECK(putstr(text, rbuf));
13818 }
13819
13820 if (! isc_time_isepoch(&expiretime)) {
13821 CHECK(putstr(text, "\nexpires: "));
13822 CHECK(putstr(text, xbuf));
13823 }
13824
13825 if (secure) {
13826 CHECK(putstr(text, "\nsecure: yes"));
13827 if (hasraw) {
13828 CHECK(putstr(text, "\ninline signing: yes"));
13829 } else {
13830 CHECK(putstr(text, "\ninline signing: no"));
13831 }
13832 } else {
13833 CHECK(putstr(text, "\nsecure: no"));
13834 }
13835
13836 if (maintain) {
13837 CHECK(putstr(text, "\nkey maintenance: automatic"));
13838 if (! isc_time_isepoch(&refreshkeytime)) {
13839 CHECK(putstr(text, "\nnext key event: "));
13840 CHECK(putstr(text, kbuf));
13841 }
13842 } else if (allow) {
13843 CHECK(putstr(text, "\nkey maintenance: on command"));
13844 } else if (secure || hasraw) {
13845 CHECK(putstr(text, "\nkey maintenance: none"));
13846 }
13847
13848 if (!isc_time_isepoch(&resigntime)) {
13849 CHECK(putstr(text, "\nnext resign node: "));
13850 CHECK(putstr(text, resignbuf));
13851 CHECK(putstr(text, "\nnext resign time: "));
13852 CHECK(putstr(text, rtbuf));
13853 }
13854
13855 if (dynamic) {
13856 CHECK(putstr(text, "\ndynamic: yes"));
13857 if (frozen) {
13858 CHECK(putstr(text, "\nfrozen: yes"));
13859 } else {
13860 CHECK(putstr(text, "\nfrozen: no"));
13861 }
13862 } else {
13863 CHECK(putstr(text, "\ndynamic: no"));
13864 }
13865
13866 CHECK(putstr(text, "\nreconfigurable via modzone: "));
13867 CHECK(putstr(text, dns_zone_getadded(zone) ? "yes" : "no"));
13868
13869 cleanup:
13870 /* Indicate truncated output if possible. */
13871 if (result == ISC_R_NOSPACE) {
13872 (void) putstr(text, "\n...");
13873 }
13874 if ((result == ISC_R_SUCCESS || result == ISC_R_NOSPACE)) {
13875 (void) putnull(text);
13876 }
13877
13878 if (db != NULL) {
13879 dns_db_detach(&db);
13880 }
13881 if (rawdb != NULL) {
13882 dns_db_detach(&rawdb);
13883 }
13884 if (incfiles != NULL && mayberaw != NULL) {
13885 int i;
13886 isc_mem_t *mctx = dns_zone_getmctx(mayberaw);
13887
13888 for (i = 0; i < nfiles; i++) {
13889 if (incfiles[i] != NULL) {
13890 isc_mem_free(mctx, incfiles[i]);
13891 }
13892 }
13893 isc_mem_free(mctx, incfiles);
13894 }
13895 if (raw != NULL) {
13896 dns_zone_detach(&raw);
13897 }
13898 if (zone != NULL) {
13899 dns_zone_detach(&zone);
13900 }
13901 return (result);
13902 }
13903
13904 static inline bool
argcheck(char * cmd,const char * full)13905 argcheck(char *cmd, const char *full) {
13906 size_t l;
13907
13908 if (cmd == NULL || cmd[0] != '-')
13909 return (false);
13910
13911 cmd++;
13912 l = strlen(cmd);
13913 if (l > strlen(full) || strncasecmp(cmd, full, l) != 0)
13914 return (false);
13915
13916 return (true);
13917 }
13918
13919 isc_result_t
ns_server_nta(ns_server_t * server,isc_lex_t * lex,bool readonly,isc_buffer_t ** text)13920 ns_server_nta(ns_server_t *server, isc_lex_t *lex, bool readonly,
13921 isc_buffer_t **text)
13922 {
13923 dns_view_t *view;
13924 dns_ntatable_t *ntatable = NULL;
13925 isc_result_t result = ISC_R_SUCCESS;
13926 char *ptr, *nametext = NULL, *viewname;
13927 char namebuf[DNS_NAME_FORMATSIZE];
13928 isc_stdtime_t now, when;
13929 isc_time_t t;
13930 char tbuf[64];
13931 const char *msg = NULL;
13932 bool dump = false, force = false;
13933 dns_fixedname_t fn;
13934 dns_name_t *ntaname;
13935 dns_ttl_t ntattl;
13936 bool ttlset = false, excl = false;
13937 dns_rdataclass_t rdclass = dns_rdataclass_in;
13938
13939 UNUSED(force);
13940
13941 ntaname = dns_fixedname_initname(&fn);
13942
13943 /* Skip the command name. */
13944 ptr = next_token(lex, text);
13945 if (ptr == NULL) {
13946 return (ISC_R_UNEXPECTEDEND);
13947 }
13948
13949 for (;;) {
13950 /* Check for options */
13951 ptr = next_token(lex, text);
13952 if (ptr == NULL) {
13953 return (ISC_R_UNEXPECTEDEND);
13954 }
13955
13956 if (argcheck(ptr, "dump")) {
13957 dump = true;
13958 } else if (argcheck(ptr, "remove")) {
13959 ntattl = 0;
13960 ttlset = true;
13961 } else if (argcheck(ptr, "force")) {
13962 force = true;
13963 continue;
13964 } else if (argcheck(ptr, "lifetime")) {
13965 isc_textregion_t tr;
13966
13967 ptr = next_token(lex, text);
13968 if (ptr == NULL) {
13969 msg = "No lifetime specified";
13970 CHECK(ISC_R_UNEXPECTEDEND);
13971 }
13972
13973 tr.base = ptr;
13974 tr.length = strlen(ptr);
13975 result = dns_ttl_fromtext(&tr, &ntattl);
13976 if (result != ISC_R_SUCCESS) {
13977 msg = "could not parse NTA lifetime";
13978 CHECK(result);
13979 }
13980
13981 if (ntattl > 604800) {
13982 msg = "NTA lifetime cannot exceed one week";
13983 CHECK(ISC_R_RANGE);
13984 }
13985
13986 ttlset = true;
13987 continue;
13988 } else if (argcheck(ptr, "class")) {
13989 isc_textregion_t tr;
13990
13991 ptr = next_token(lex, text);
13992 if (ptr == NULL) {
13993 msg = "No class specified";
13994 CHECK(ISC_R_UNEXPECTEDEND);
13995 }
13996
13997 tr.base = ptr;
13998 tr.length = strlen(ptr);
13999 CHECK(dns_rdataclass_fromtext(&rdclass, &tr));
14000 continue;
14001 } else {
14002 nametext = ptr;
14003 }
14004
14005 break;
14006 }
14007
14008 /*
14009 * If -dump was specified, list NTA's and return
14010 */
14011 if (dump) {
14012 for (view = ISC_LIST_HEAD(server->viewlist);
14013 view != NULL;
14014 view = ISC_LIST_NEXT(view, link))
14015 {
14016 if (ntatable != NULL) {
14017 dns_ntatable_detach(&ntatable);
14018 }
14019 result = dns_view_getntatable(view, &ntatable);
14020 if (result == ISC_R_NOTFOUND) {
14021 continue;
14022 }
14023 CHECK(dns_ntatable_totext(ntatable, text));
14024 }
14025 CHECK(putnull(text));
14026
14027 goto cleanup;
14028 }
14029
14030 if (readonly) {
14031 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
14032 NS_LOGMODULE_CONTROL, ISC_LOG_INFO,
14033 "rejecting restricted control channel "
14034 "NTA command");
14035 CHECK(ISC_R_FAILURE);
14036 }
14037
14038 /* Get the NTA name. */
14039 if (nametext == NULL) {
14040 nametext = next_token(lex, text);
14041 }
14042 if (nametext == NULL) {
14043 return (ISC_R_UNEXPECTEDEND);
14044 }
14045
14046 /* Copy nametext as it'll be overwritten by next_token() */
14047 strlcpy(namebuf, nametext, DNS_NAME_FORMATSIZE);
14048
14049 if (strcmp(namebuf, ".") == 0) {
14050 ntaname = dns_rootname;
14051 } else {
14052 isc_buffer_t b;
14053 isc_buffer_init(&b, namebuf, strlen(namebuf));
14054 isc_buffer_add(&b, strlen(namebuf));
14055 CHECK(dns_name_fromtext(ntaname, &b, dns_rootname, 0, NULL));
14056 }
14057
14058 /* Look for the view name. */
14059 viewname = next_token(lex, text);
14060
14061 isc_stdtime_get(&now);
14062
14063 result = isc_task_beginexclusive(server->task);
14064 RUNTIME_CHECK(result == ISC_R_SUCCESS);
14065 excl = true;
14066 for (view = ISC_LIST_HEAD(server->viewlist);
14067 view != NULL;
14068 view = ISC_LIST_NEXT(view, link))
14069 {
14070 static bool first = true;
14071
14072 if (viewname != NULL && strcmp(view->name, viewname) != 0) {
14073 continue;
14074 }
14075
14076 if (view->rdclass != rdclass && rdclass != dns_rdataclass_any) {
14077 continue;
14078 }
14079
14080 if (view->nta_lifetime == 0) {
14081 continue;
14082 }
14083
14084 if (!ttlset) {
14085 ntattl = view->nta_lifetime;
14086 }
14087
14088 if (ntatable != NULL) {
14089 dns_ntatable_detach(&ntatable);
14090 }
14091
14092 result = dns_view_getntatable(view, &ntatable);
14093 if (result == ISC_R_NOTFOUND) {
14094 result = ISC_R_SUCCESS;
14095 continue;
14096 }
14097
14098 result = dns_view_flushnode(view, ntaname, true);
14099 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
14100 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
14101 "flush tree '%s' in cache view '%s': %s",
14102 namebuf, view->name,
14103 isc_result_totext(result));
14104
14105 if (ntattl != 0) {
14106 CHECK(dns_ntatable_add(ntatable, ntaname,
14107 force, now, ntattl));
14108
14109 when = now + ntattl;
14110 isc_time_set(&t, when, 0);
14111 isc_time_formattimestamp(&t, tbuf, sizeof(tbuf));
14112
14113 if (!first) {
14114 CHECK(putstr(text, "\n"));
14115 }
14116 first = false;
14117
14118 CHECK(putstr(text, "Negative trust anchor added: "));
14119 CHECK(putstr(text, namebuf));
14120 CHECK(putstr(text, "/"));
14121 CHECK(putstr(text, view->name));
14122 CHECK(putstr(text, ", expires "));
14123 CHECK(putstr(text, tbuf));
14124
14125 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
14126 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
14127 "added NTA '%s' (%d sec) in view '%s'",
14128 namebuf, ntattl, view->name);
14129 } else {
14130 CHECK(dns_ntatable_delete(ntatable, ntaname));
14131
14132 if (!first) {
14133 CHECK(putstr(text, "\n"));
14134 }
14135 first = false;
14136
14137 CHECK(putstr(text, "Negative trust anchor removed: "));
14138 CHECK(putstr(text, namebuf));
14139 CHECK(putstr(text, "/"));
14140 CHECK(putstr(text, view->name));
14141
14142 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
14143 NS_LOGMODULE_SERVER, ISC_LOG_INFO,
14144 "removed NTA '%s' in view %s",
14145 namebuf, view->name);
14146 }
14147
14148 result = dns_view_saventa(view);
14149 if (result != ISC_R_SUCCESS) {
14150 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
14151 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
14152 "error writing NTA file "
14153 "for view '%s': %s",
14154 view->name, isc_result_totext(result));
14155 }
14156 }
14157
14158 (void) putnull(text);
14159
14160 cleanup:
14161 if (msg != NULL) {
14162 (void) putstr(text, msg);
14163 (void) putnull(text);
14164 }
14165 if (excl) {
14166 isc_task_endexclusive(server->task);
14167 }
14168 if (ntatable != NULL) {
14169 dns_ntatable_detach(&ntatable);
14170 }
14171 return (result);
14172 }
14173
14174 isc_result_t
ns_server_saventa(ns_server_t * server)14175 ns_server_saventa(ns_server_t *server) {
14176 dns_view_t *view;
14177
14178 for (view = ISC_LIST_HEAD(server->viewlist);
14179 view != NULL;
14180 view = ISC_LIST_NEXT(view, link))
14181 {
14182 isc_result_t result = dns_view_saventa(view);
14183
14184 if (result != ISC_R_SUCCESS) {
14185 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
14186 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
14187 "error writing NTA file "
14188 "for view '%s': %s",
14189 view->name, isc_result_totext(result));
14190 }
14191 }
14192
14193 return (ISC_R_SUCCESS);
14194 }
14195
14196 isc_result_t
ns_server_loadnta(ns_server_t * server)14197 ns_server_loadnta(ns_server_t *server) {
14198 dns_view_t *view;
14199
14200 for (view = ISC_LIST_HEAD(server->viewlist);
14201 view != NULL;
14202 view = ISC_LIST_NEXT(view, link))
14203 {
14204 isc_result_t result = dns_view_loadnta(view);
14205
14206 if ((result != ISC_R_SUCCESS) &&
14207 (result != ISC_R_FILENOTFOUND) &&
14208 (result != ISC_R_NOTFOUND))
14209 {
14210 isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
14211 NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
14212 "error loading NTA file "
14213 "for view '%s': %s",
14214 view->name, isc_result_totext(result));
14215 }
14216 }
14217
14218 return (ISC_R_SUCCESS);
14219 }
14220
14221 static isc_result_t
mkey_refresh(dns_view_t * view,isc_buffer_t ** text)14222 mkey_refresh(dns_view_t *view, isc_buffer_t **text) {
14223 isc_result_t result;
14224 char msg[DNS_NAME_FORMATSIZE + 500] = "";
14225
14226 snprintf(msg, sizeof(msg),
14227 "refreshing managed keys for '%s'", view->name);
14228 CHECK(putstr(text, msg));
14229 CHECK(dns_zone_synckeyzone(view->managed_keys));
14230
14231 cleanup:
14232 return (result);
14233 }
14234
14235 static isc_result_t
mkey_dumpzone(dns_view_t * view,isc_buffer_t ** text)14236 mkey_dumpzone(dns_view_t *view, isc_buffer_t **text) {
14237 isc_result_t result;
14238 dns_db_t *db = NULL;
14239 dns_dbversion_t *ver = NULL;
14240 dns_rriterator_t rrit;
14241 isc_stdtime_t now;
14242 dns_name_t *prevname = NULL;
14243
14244 isc_stdtime_get(&now);
14245
14246 CHECK(dns_zone_getdb(view->managed_keys, &db));
14247 dns_db_currentversion(db, &ver);
14248 dns_rriterator_init(&rrit, db, ver, 0);
14249 for (result = dns_rriterator_first(&rrit);
14250 result == ISC_R_SUCCESS;
14251 result = dns_rriterator_nextrrset(&rrit))
14252 {
14253 char buf[DNS_NAME_FORMATSIZE + 500];
14254 dns_name_t *name = NULL;
14255 dns_rdataset_t *kdset = NULL;
14256 dns_rdata_t rdata = DNS_RDATA_INIT;
14257 dns_rdata_keydata_t kd;
14258 uint32_t ttl;
14259
14260 dns_rriterator_current(&rrit, &name, &ttl, &kdset, NULL);
14261 if (kdset == NULL || kdset->type != dns_rdatatype_keydata ||
14262 !dns_rdataset_isassociated(kdset))
14263 continue;
14264
14265 if (name != prevname) {
14266 char nbuf[DNS_NAME_FORMATSIZE];
14267 dns_name_format(name, nbuf, sizeof(nbuf));
14268 snprintf(buf, sizeof(buf), "\n\n name: %s", nbuf);
14269 CHECK(putstr(text, buf));
14270 }
14271
14272
14273 for (result = dns_rdataset_first(kdset);
14274 result == ISC_R_SUCCESS;
14275 result = dns_rdataset_next(kdset))
14276 {
14277 char alg[DNS_SECALG_FORMATSIZE];
14278 char tbuf[ISC_FORMATHTTPTIMESTAMP_SIZE];
14279 dns_keytag_t keyid;
14280 isc_region_t r;
14281 isc_time_t t;
14282 bool revoked;
14283
14284 dns_rdata_reset(&rdata);
14285 dns_rdataset_current(kdset, &rdata);
14286 result = dns_rdata_tostruct(&rdata, &kd, NULL);
14287 RUNTIME_CHECK(result == ISC_R_SUCCESS);
14288
14289 dns_rdata_toregion(&rdata, &r);
14290 isc_region_consume(&r, 12);
14291 keyid = dst_region_computeid(&r, kd.algorithm);
14292
14293 snprintf(buf, sizeof(buf), "\n keyid: %u", keyid);
14294 CHECK(putstr(text, buf));
14295
14296 dns_secalg_format(kd.algorithm, alg, sizeof(alg));
14297 snprintf(buf, sizeof(buf), "\n\talgorithm: %s", alg);
14298 CHECK(putstr(text, buf));
14299
14300 revoked = ((kd.flags & DNS_KEYFLAG_REVOKE) != 0);
14301 snprintf(buf, sizeof(buf), "\n\tflags:%s%s%s",
14302 revoked ? " REVOKE" : "",
14303 ((kd.flags & DNS_KEYFLAG_KSK) != 0)
14304 ? " SEP" : "",
14305 (kd.flags == 0) ? " (none)" : "");
14306 CHECK(putstr(text, buf));
14307
14308 isc_time_set(&t, kd.refresh, 0);
14309 isc_time_formathttptimestamp(&t, tbuf, sizeof(tbuf));
14310 snprintf(buf, sizeof(buf),
14311 "\n\tnext refresh: %s", tbuf);
14312 CHECK(putstr(text, buf));
14313
14314 if (kd.removehd != 0) {
14315 isc_time_set(&t, kd.removehd, 0);
14316 isc_time_formathttptimestamp(&t, tbuf,
14317 sizeof(tbuf));
14318 snprintf(buf, sizeof(buf),
14319 "\n\tremove at: %s", tbuf);
14320 CHECK(putstr(text, buf));
14321 }
14322
14323 isc_time_set(&t, kd.addhd, 0);
14324 isc_time_formathttptimestamp(&t, tbuf, sizeof(tbuf));
14325 if (kd.addhd == 0)
14326 snprintf(buf, sizeof(buf), "\n\tno trust");
14327 else if (revoked)
14328 snprintf(buf, sizeof(buf),
14329 "\n\ttrust revoked");
14330 else if (kd.addhd <= now)
14331 snprintf(buf, sizeof(buf),
14332 "\n\ttrusted since: %s", tbuf);
14333 else if (kd.addhd > now)
14334 snprintf(buf, sizeof(buf),
14335 "\n\ttrust pending: %s", tbuf);
14336 CHECK(putstr(text, buf));
14337 }
14338 }
14339
14340 if (result == ISC_R_NOMORE)
14341 result = ISC_R_SUCCESS;
14342
14343 cleanup:
14344 if (ver != NULL) {
14345 dns_rriterator_destroy(&rrit);
14346 dns_db_closeversion(db, &ver, false);
14347 }
14348 if (db != NULL)
14349 dns_db_detach(&db);
14350
14351 return (result);
14352 }
14353
14354 static isc_result_t
mkey_status(dns_view_t * view,isc_buffer_t ** text)14355 mkey_status(dns_view_t *view, isc_buffer_t **text) {
14356 isc_result_t result;
14357 char msg[ISC_FORMATHTTPTIMESTAMP_SIZE];
14358 isc_time_t t;
14359
14360 CHECK(putstr(text, "view: "));
14361 CHECK(putstr(text, view->name));
14362
14363 CHECK(putstr(text, "\nnext scheduled event: "));
14364
14365 dns_zone_getrefreshkeytime(view->managed_keys, &t);
14366 if (isc_time_isepoch(&t)) {
14367 CHECK(putstr(text, "never"));
14368 } else {
14369 isc_time_formathttptimestamp(&t, msg, sizeof(msg));
14370 CHECK(putstr(text, msg));
14371 }
14372
14373 CHECK(mkey_dumpzone(view, text));
14374
14375 cleanup:
14376 return (result);
14377 }
14378
14379 isc_result_t
ns_server_mkeys(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)14380 ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
14381 char *cmd, *classtxt, *viewtxt = NULL;
14382 isc_result_t result = ISC_R_SUCCESS;
14383 dns_view_t *view = NULL;
14384 dns_rdataclass_t rdclass;
14385 char msg[DNS_NAME_FORMATSIZE + 500] = "";
14386 enum { NONE, STATUS, REFRESH, SYNC } opt = NONE;
14387 bool found = false;
14388 bool first = true;
14389
14390 /* Skip rndc command name */
14391 cmd = next_token(lex, text);
14392 if (cmd == NULL) {
14393 return (ISC_R_UNEXPECTEDEND);
14394 }
14395
14396 /* Get managed-keys subcommand */
14397 cmd = next_token(lex, text);
14398 if (cmd == NULL) {
14399 return (ISC_R_UNEXPECTEDEND);
14400 }
14401
14402 if (strcasecmp(cmd, "status") == 0) {
14403 opt = STATUS;
14404 } else if (strcasecmp(cmd, "refresh") == 0) {
14405 opt = REFRESH;
14406 } else if (strcasecmp(cmd, "sync") == 0) {
14407 opt = SYNC;
14408 } else {
14409 snprintf(msg, sizeof(msg), "unknown command '%s'", cmd);
14410 (void) putstr(text, msg);
14411 result = ISC_R_UNEXPECTED;
14412 goto cleanup;
14413 }
14414
14415 /* Look for the optional class name. */
14416 classtxt = next_token(lex, text);
14417 if (classtxt != NULL) {
14418 isc_textregion_t r;
14419 r.base = classtxt;
14420 r.length = strlen(classtxt);
14421 result = dns_rdataclass_fromtext(&rdclass, &r);
14422 if (result != ISC_R_SUCCESS) {
14423 snprintf(msg, sizeof(msg),
14424 "unknown class '%s'", classtxt);
14425 (void) putstr(text, msg);
14426 goto cleanup;
14427 }
14428 viewtxt = next_token(lex, text);
14429 }
14430
14431 for (view = ISC_LIST_HEAD(server->viewlist);
14432 view != NULL;
14433 view = ISC_LIST_NEXT(view, link))
14434 {
14435 if (viewtxt != NULL &&
14436 (rdclass != view->rdclass ||
14437 strcmp(view->name, viewtxt) != 0))
14438 {
14439 continue;
14440 }
14441
14442 if (view->managed_keys == NULL) {
14443 if (viewtxt != NULL) {
14444 snprintf(msg, sizeof(msg),
14445 "view '%s': no managed keys", viewtxt);
14446 CHECK(putstr(text, msg));
14447 goto cleanup;
14448 } else {
14449 continue;
14450 }
14451 }
14452
14453 found = true;
14454
14455 switch (opt) {
14456 case REFRESH:
14457 if (!first) {
14458 CHECK(putstr(text, "\n"));
14459 }
14460 CHECK(mkey_refresh(view, text));
14461 break;
14462 case STATUS:
14463 if (!first) {
14464 CHECK(putstr(text, "\n\n"));
14465 }
14466 CHECK(mkey_status(view, text));
14467 break;
14468 case SYNC:
14469 CHECK(dns_zone_flush(view->managed_keys));
14470 break;
14471 default:
14472 INSIST(0);
14473 ISC_UNREACHABLE();
14474 }
14475
14476 if (viewtxt != NULL) {
14477 break;
14478 }
14479
14480 first = false;
14481 }
14482
14483 if (!found) {
14484 CHECK(putstr(text, "no views with managed keys"));
14485 }
14486
14487 cleanup:
14488 if (isc_buffer_usedlength(*text) > 0)
14489 (void) putnull(text);
14490
14491 return (result);
14492 }
14493
14494 isc_result_t
ns_server_dnstap(ns_server_t * server,isc_lex_t * lex,isc_buffer_t ** text)14495 ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
14496 #ifdef HAVE_DNSTAP
14497 char *ptr;
14498 isc_result_t result;
14499 bool reopen = false;
14500 int backups = 0;
14501
14502 if (server->dtenv == NULL)
14503 return (ISC_R_NOTFOUND);
14504
14505 /* Check the command name. */
14506 ptr = next_token(lex, text);
14507 if (ptr == NULL)
14508 return (ISC_R_UNEXPECTEDEND);
14509
14510 /* "dnstap-reopen" was used in 9.11.0b1 */
14511 if (strcasecmp(ptr, "dnstap-reopen") == 0) {
14512 reopen = true;
14513 } else {
14514 ptr = next_token(lex, text);
14515 if (ptr == NULL)
14516 return (ISC_R_UNEXPECTEDEND);
14517 }
14518
14519 if (reopen || strcasecmp(ptr, "-reopen") == 0) {
14520 backups = -1;
14521 } else if ((strcasecmp(ptr, "-roll") == 0)) {
14522 unsigned int n;
14523 ptr = next_token(lex, text);
14524 if (ptr != NULL) {
14525 unsigned int u;
14526 n = sscanf(ptr, "%u", &u);
14527 if (n != 1U || u > INT_MAX)
14528 return (ISC_R_BADNUMBER);
14529 backups = u;
14530 }
14531 } else
14532 return (DNS_R_SYNTAX);
14533
14534 result = isc_task_beginexclusive(server->task);
14535 RUNTIME_CHECK(result == ISC_R_SUCCESS);
14536 result = dns_dt_reopen(server->dtenv, backups);
14537 isc_task_endexclusive(server->task);
14538 return (result);
14539 #else
14540 UNUSED(server);
14541 UNUSED(lex);
14542 UNUSED(text);
14543 return (ISC_R_NOTIMPLEMENTED);
14544 #endif
14545 }
14546