1 /*
2 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
3 *
4 * This Source Code Form is subject to the terms of the Mozilla Public
5 * License, v. 2.0. If a copy of the MPL was not distributed with this
6 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
7 *
8 * See the COPYRIGHT file distributed with this work for additional
9 * information regarding copyright ownership.
10 */
11
12 /*! \file */
13
14 #include <bind.keys.h>
15 #include <inttypes.h>
16 #include <stdlib.h>
17
18 #include <isc/buffer.h>
19 #include <isc/log.h>
20 #include <isc/mem.h>
21 #include <isc/parseint.h>
22 #include <isc/region.h>
23 #include <isc/result.h>
24 #include <isc/sockaddr.h>
25 #include <isc/string.h>
26 #include <isc/util.h>
27
28 #include <pk11/site.h>
29
30 #include <dns/fixedname.h>
31 #include <dns/name.h>
32 #include <dns/rdataclass.h>
33 #include <dns/rdatatype.h>
34 #include <dns/tsig.h>
35 #include <dns/zone.h>
36
37 #include <dst/dst.h>
38
39 #include <isccfg/grammar.h>
40 #include <isccfg/namedconf.h>
41
42 #include <named/config.h>
43 #include <named/globals.h>
44
45 /*% default configuration */
46 static char defaultconf[] = "\
47 options {\n\
48 answer-cookie true;\n\
49 automatic-interface-scan yes;\n\
50 bindkeys-file \"" NAMED_SYSCONFDIR "/bind.keys\";\n\
51 # blackhole {none;};\n"
52 " cookie-algorithm siphash24;\n"
53 #ifndef WIN32
54 " coresize default;\n\
55 datasize default;\n"
56 #endif /* ifndef WIN32 */
57 "\
58 # deallocate-on-exit <obsolete>;\n\
59 # directory <none>\n\
60 dnssec-policy \"none\";\n\
61 dump-file \"named_dump.db\";\n\
62 edns-udp-size 4096;\n\
63 # fake-iquery <obsolete>;\n"
64 #ifndef WIN32
65 " files unlimited;\n"
66 #endif /* ifndef WIN32 */
67 #if defined(HAVE_GEOIP2) && !defined(WIN32)
68 " geoip-directory \"" MAXMINDDB_PREFIX "/share/"
69 "GeoIP\";"
70 "\n"
71 #elif defined(HAVE_GEOIP2)
72 " geoip-directory \".\";\n"
73 #endif /* if defined(HAVE_GEOIP2) && !defined(WIN32) */
74 "\
75 # has-old-clients <obsolete>;\n\
76 heartbeat-interval 60;\n\
77 # host-statistics <obsolete>;\n\
78 interface-interval 60;\n\
79 # keep-response-order {none;};\n\
80 listen-on {any;};\n\
81 listen-on-v6 {any;};\n\
82 # lock-file \"" NAMED_LOCALSTATEDIR "/run/named/named.lock\";\n\
83 match-mapped-addresses no;\n\
84 max-rsa-exponent-size 0; /* no limit */\n\
85 max-udp-size 4096;\n\
86 memstatistics-file \"named.memstats\";\n\
87 # multiple-cnames <obsolete>;\n\
88 # named-xfer <obsolete>;\n\
89 nocookie-udp-size 4096;\n\
90 notify-rate 20;\n\
91 nta-lifetime 3600;\n\
92 nta-recheck 300;\n\
93 # pid-file \"" NAMED_LOCALSTATEDIR "/run/named/named.pid\"; \n\
94 port 53;\n\
95 prefetch 2 9;\n\
96 recursing-file \"named.recursing\";\n\
97 recursive-clients 1000;\n\
98 request-nsid false;\n\
99 reserved-sockets 512;\n\
100 resolver-query-timeout 10;\n\
101 rrset-order { order random; };\n\
102 secroots-file \"named.secroots\";\n\
103 send-cookie true;\n\
104 # serial-queries <obsolete>;\n\
105 serial-query-rate 20;\n\
106 server-id none;\n\
107 session-keyalg hmac-sha256;\n\
108 # session-keyfile \"" NAMED_LOCALSTATEDIR "/run/named/session.key\";\n\
109 session-keyname local-ddns;\n"
110 #ifndef WIN32
111 " stacksize default;\n"
112 #endif /* ifndef WIN32 */
113 " startup-notify-rate 20;\n\
114 statistics-file \"named.stats\";\n\
115 # statistics-interval <obsolete>;\n\
116 tcp-advertised-timeout 300;\n\
117 tcp-clients 150;\n\
118 tcp-idle-timeout 300;\n\
119 tcp-initial-timeout 300;\n\
120 tcp-keepalive-timeout 300;\n\
121 tcp-listen-queue 10;\n\
122 # tkey-dhkey <none>\n\
123 # tkey-domain <none>\n\
124 # tkey-gssapi-credential <none>\n\
125 transfer-message-size 20480;\n\
126 transfers-in 10;\n\
127 transfers-out 10;\n\
128 transfers-per-ns 2;\n\
129 # treat-cr-as-space <obsolete>;\n\
130 trust-anchor-telemetry yes;\n\
131 # use-id-pool <obsolete>;\n\
132 # use-ixfr <obsolete>;\n\
133 \n\
134 /* view */\n\
135 allow-new-zones no;\n\
136 allow-notify {none;};\n\
137 allow-query-cache { localnets; localhost; };\n\
138 allow-query-cache-on { any; };\n\
139 allow-recursion { localnets; localhost; };\n\
140 allow-recursion-on { any; };\n\
141 allow-update-forwarding {none;};\n\
142 # allow-v6-synthesis <obsolete>;\n\
143 auth-nxdomain false;\n\
144 check-dup-records warn;\n\
145 check-mx warn;\n\
146 check-names master fail;\n\
147 check-names response ignore;\n\
148 check-names slave warn;\n\
149 check-spf warn;\n\
150 clients-per-query 10;\n\
151 dnssec-accept-expired no;\n\
152 dnssec-validation " VALIDATION_DEFAULT "; \n"
153 #ifdef HAVE_DNSTAP
154 " dnstap-identity hostname;\n"
155 #endif /* ifdef HAVE_DNSTAP */
156 "\
157 # fetch-glue <obsolete>;\n\
158 fetch-quota-params 100 0.1 0.3 0.7;\n\
159 fetches-per-server 0;\n\
160 fetches-per-zone 0;\n\
161 glue-cache yes;\n\
162 lame-ttl 600;\n"
163 #ifdef HAVE_LMDB
164 " lmdb-mapsize 32M;\n"
165 #endif /* ifdef HAVE_LMDB */
166 " max-cache-size 90%;\n\
167 max-cache-ttl 604800; /* 1 week */\n\
168 max-clients-per-query 100;\n\
169 max-ncache-ttl 10800; /* 3 hours */\n\
170 max-recursion-depth 7;\n\
171 max-recursion-queries 75;\n\
172 max-stale-ttl 43200; /* 12 hours */\n\
173 message-compression yes;\n\
174 min-ncache-ttl 0; /* 0 hours */\n\
175 min-cache-ttl 0; /* 0 seconds */\n\
176 # min-roots <obsolete>;\n\
177 minimal-any false;\n\
178 minimal-responses no-auth-recursive;\n\
179 notify-source *;\n\
180 notify-source-v6 *;\n\
181 nsec3-test-zone no;\n\
182 provide-ixfr true;\n\
183 qname-minimization relaxed;\n\
184 query-source address *;\n\
185 query-source-v6 address *;\n\
186 recursion true;\n\
187 request-expire true;\n\
188 request-ixfr true;\n\
189 require-server-cookie no;\n\
190 resolver-nonbackoff-tries 3;\n\
191 resolver-retry-interval 800; /* in milliseconds */\n\
192 # rfc2308-type1 <obsolete>;\n\
193 root-key-sentinel yes;\n\
194 servfail-ttl 1;\n\
195 # sortlist <none>\n\
196 stale-answer-enable false;\n\
197 stale-answer-ttl 1; /* 1 second */\n\
198 synth-from-dnssec no;\n\
199 # topology <none>\n\
200 transfer-format many-answers;\n\
201 v6-bias 50;\n\
202 zero-no-soa-ttl-cache no;\n\
203 \n\
204 /* zone */\n\
205 allow-query {any;};\n\
206 allow-query-on {any;};\n\
207 allow-transfer {any;};\n\
208 # also-notify <none>\n\
209 alt-transfer-source *;\n\
210 alt-transfer-source-v6 *;\n\
211 check-integrity yes;\n\
212 check-mx-cname warn;\n\
213 check-sibling yes;\n\
214 check-srv-cname warn;\n\
215 check-wildcard yes;\n\
216 dialup no;\n\
217 dnssec-dnskey-kskonly no;\n\
218 dnssec-loadkeys-interval 60;\n\
219 dnssec-secure-to-insecure no;\n\
220 dnssec-update-mode maintain;\n\
221 # forward <none>\n\
222 # forwarders <none>\n\
223 inline-signing no;\n\
224 ixfr-from-differences false;\n\
225 # maintain-ixfr-base <obsolete>;\n\
226 # max-ixfr-log-size <obsolete>\n\
227 max-journal-size default;\n\
228 max-records 0;\n\
229 max-refresh-time 2419200; /* 4 weeks */\n\
230 max-retry-time 1209600; /* 2 weeks */\n\
231 max-transfer-idle-in 60;\n\
232 max-transfer-idle-out 60;\n\
233 max-transfer-time-in 120;\n\
234 max-transfer-time-out 120;\n\
235 min-refresh-time 300;\n\
236 min-retry-time 500;\n\
237 multi-master no;\n\
238 notify yes;\n\
239 notify-delay 5;\n\
240 notify-to-soa no;\n\
241 serial-update-method increment;\n\
242 sig-signing-nodes 100;\n\
243 sig-signing-signatures 10;\n\
244 sig-signing-type 65534;\n\
245 sig-validity-interval 30; /* days */\n\
246 dnskey-sig-validity 0; /* default: sig-validity-interval */\n\
247 transfer-source *;\n\
248 transfer-source-v6 *;\n\
249 try-tcp-refresh yes; /* BIND 8 compat */\n\
250 update-check-ksk yes;\n\
251 zero-no-soa-ttl yes;\n\
252 zone-statistics terse;\n\
253 };\n\
254 "
255
256 "#\n\
257 # Zones in the \"_bind\" view are NOT counted in the count of zones.\n\
258 #\n\
259 view \"_bind\" chaos {\n\
260 recursion no;\n\
261 notify no;\n\
262 allow-new-zones no;\n\
263 \n\
264 # Prevent use of this zone in DNS amplified reflection DoS attacks\n\
265 rate-limit {\n\
266 responses-per-second 3;\n\
267 slip 0;\n\
268 min-table-size 10;\n\
269 };\n\
270 \n\
271 zone \"version.bind\" chaos {\n\
272 type master;\n\
273 database \"_builtin version\";\n\
274 };\n\
275 \n\
276 zone \"hostname.bind\" chaos {\n\
277 type master;\n\
278 database \"_builtin hostname\";\n\
279 };\n\
280 \n\
281 zone \"authors.bind\" chaos {\n\
282 type master;\n\
283 database \"_builtin authors\";\n\
284 };\n\
285 \n\
286 zone \"id.server\" chaos {\n\
287 type master;\n\
288 database \"_builtin id\";\n\
289 };\n\
290 };\n\
291 "
292 "#\n\
293 # Default trusted key(s), used if \n\
294 # \"dnssec-validation auto;\" is set and\n\
295 # sysconfdir/bind.keys doesn't exist).\n\
296 #\n\
297 # BEGIN DNSSEC KEYS\n"
298
299 /* Imported from bind.keys.h: */
300 TRUST_ANCHORS
301
302 "# END MANAGED KEYS\n\
303 \n\
304 masters " DEFAULT_IANA_ROOT_ZONE_MASTERS " {\n\
305 2001:500:84::b; # b.root-servers.net\n\
306 2001:500:2f::f; # f.root-servers.net\n\
307 2001:7fd::1; # k.root-servers.net\n\
308 2620:0:2830:202::132; # xfr.cjr.dns.icann.org\n\
309 2620:0:2d0:202::132; # xfr.lax.dns.icann.org\n\
310 192.228.79.201; # b.root-servers.net\n\
311 192.33.4.12; # c.root-servers.net\n\
312 192.5.5.241; # f.root-servers.net\n\
313 192.112.36.4; # g.root-servers.net\n\
314 193.0.14.129; # k.root-servers.net\n\
315 192.0.47.132; # xfr.cjr.dns.icann.org\n\
316 192.0.32.132; # xfr.lax.dns.icann.org\n\
317 };\n\
318 ";
319
320 isc_result_t
named_config_parsedefaults(cfg_parser_t * parser,cfg_obj_t ** conf)321 named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {
322 isc_buffer_t b;
323
324 isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
325 isc_buffer_add(&b, sizeof(defaultconf) - 1);
326 return (cfg_parse_buffer(parser, &b, __FILE__, 0, &cfg_type_namedconf,
327 CFG_PCTX_NODEPRECATED, conf));
328 }
329
330 isc_result_t
named_config_get(cfg_obj_t const * const * maps,const char * name,const cfg_obj_t ** obj)331 named_config_get(cfg_obj_t const *const *maps, const char *name,
332 const cfg_obj_t **obj) {
333 int i;
334
335 for (i = 0;; i++) {
336 if (maps[i] == NULL) {
337 return (ISC_R_NOTFOUND);
338 }
339 if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS) {
340 return (ISC_R_SUCCESS);
341 }
342 }
343 }
344
345 isc_result_t
named_checknames_get(const cfg_obj_t ** maps,const char * which,const cfg_obj_t ** obj)346 named_checknames_get(const cfg_obj_t **maps, const char *which,
347 const cfg_obj_t **obj) {
348 const cfg_listelt_t *element;
349 const cfg_obj_t *checknames;
350 const cfg_obj_t *type;
351 const cfg_obj_t *value;
352 int i;
353
354 REQUIRE(maps != NULL);
355 REQUIRE(which != NULL);
356 REQUIRE(obj != NULL && *obj == NULL);
357
358 for (i = 0;; i++) {
359 if (maps[i] == NULL) {
360 return (ISC_R_NOTFOUND);
361 }
362 checknames = NULL;
363 if (cfg_map_get(maps[i], "check-names", &checknames) ==
364 ISC_R_SUCCESS) {
365 /*
366 * Zone map entry is not a list.
367 */
368 if (checknames != NULL && !cfg_obj_islist(checknames)) {
369 *obj = checknames;
370 return (ISC_R_SUCCESS);
371 }
372 for (element = cfg_list_first(checknames);
373 element != NULL; element = cfg_list_next(element))
374 {
375 value = cfg_listelt_value(element);
376 type = cfg_tuple_get(value, "type");
377 if (strcasecmp(cfg_obj_asstring(type), which) ==
378 0) {
379 *obj = cfg_tuple_get(value, "mode");
380 return (ISC_R_SUCCESS);
381 }
382 }
383 }
384 }
385 }
386
387 int
named_config_listcount(const cfg_obj_t * list)388 named_config_listcount(const cfg_obj_t *list) {
389 const cfg_listelt_t *e;
390 int i = 0;
391
392 for (e = cfg_list_first(list); e != NULL; e = cfg_list_next(e)) {
393 i++;
394 }
395
396 return (i);
397 }
398
399 isc_result_t
named_config_getclass(const cfg_obj_t * classobj,dns_rdataclass_t defclass,dns_rdataclass_t * classp)400 named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
401 dns_rdataclass_t *classp) {
402 isc_textregion_t r;
403 isc_result_t result;
404
405 if (!cfg_obj_isstring(classobj)) {
406 *classp = defclass;
407 return (ISC_R_SUCCESS);
408 }
409 DE_CONST(cfg_obj_asstring(classobj), r.base);
410 r.length = strlen(r.base);
411 result = dns_rdataclass_fromtext(classp, &r);
412 if (result != ISC_R_SUCCESS) {
413 cfg_obj_log(classobj, named_g_lctx, ISC_LOG_ERROR,
414 "unknown class '%s'", r.base);
415 }
416 return (result);
417 }
418
419 isc_result_t
named_config_gettype(const cfg_obj_t * typeobj,dns_rdatatype_t deftype,dns_rdatatype_t * typep)420 named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
421 dns_rdatatype_t *typep) {
422 isc_textregion_t r;
423 isc_result_t result;
424
425 if (!cfg_obj_isstring(typeobj)) {
426 *typep = deftype;
427 return (ISC_R_SUCCESS);
428 }
429 DE_CONST(cfg_obj_asstring(typeobj), r.base);
430 r.length = strlen(r.base);
431 result = dns_rdatatype_fromtext(typep, &r);
432 if (result != ISC_R_SUCCESS) {
433 cfg_obj_log(typeobj, named_g_lctx, ISC_LOG_ERROR,
434 "unknown type '%s'", r.base);
435 }
436 return (result);
437 }
438
439 dns_zonetype_t
named_config_getzonetype(const cfg_obj_t * zonetypeobj)440 named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
441 dns_zonetype_t ztype = dns_zone_none;
442 const char *str;
443
444 str = cfg_obj_asstring(zonetypeobj);
445 if (strcasecmp(str, "primary") == 0 || strcasecmp(str, "master") == 0) {
446 ztype = dns_zone_master;
447 } else if (strcasecmp(str, "secondary") == 0 ||
448 strcasecmp(str, "slave") == 0) {
449 ztype = dns_zone_slave;
450 } else if (strcasecmp(str, "mirror") == 0) {
451 ztype = dns_zone_mirror;
452 } else if (strcasecmp(str, "stub") == 0) {
453 ztype = dns_zone_stub;
454 } else if (strcasecmp(str, "static-stub") == 0) {
455 ztype = dns_zone_staticstub;
456 } else if (strcasecmp(str, "redirect") == 0) {
457 ztype = dns_zone_redirect;
458 } else {
459 INSIST(0);
460 ISC_UNREACHABLE();
461 }
462 return (ztype);
463 }
464
465 isc_result_t
named_config_getiplist(const cfg_obj_t * config,const cfg_obj_t * list,in_port_t defport,isc_mem_t * mctx,isc_sockaddr_t ** addrsp,isc_dscp_t ** dscpsp,uint32_t * countp)466 named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
467 in_port_t defport, isc_mem_t *mctx,
468 isc_sockaddr_t **addrsp, isc_dscp_t **dscpsp,
469 uint32_t *countp) {
470 int count, i = 0;
471 const cfg_obj_t *addrlist;
472 const cfg_obj_t *portobj, *dscpobj;
473 const cfg_listelt_t *element;
474 isc_sockaddr_t *addrs;
475 in_port_t port;
476 isc_dscp_t dscp = -1, *dscps = NULL;
477 isc_result_t result;
478
479 INSIST(addrsp != NULL && *addrsp == NULL);
480 INSIST(dscpsp == NULL || *dscpsp == NULL);
481 INSIST(countp != NULL);
482
483 addrlist = cfg_tuple_get(list, "addresses");
484 count = named_config_listcount(addrlist);
485
486 portobj = cfg_tuple_get(list, "port");
487 if (cfg_obj_isuint32(portobj)) {
488 uint32_t val = cfg_obj_asuint32(portobj);
489 if (val > UINT16_MAX) {
490 cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
491 "port '%u' out of range", val);
492 return (ISC_R_RANGE);
493 }
494 port = (in_port_t)val;
495 } else if (defport != 0) {
496 port = defport;
497 } else {
498 result = named_config_getport(config, &port);
499 if (result != ISC_R_SUCCESS) {
500 return (result);
501 }
502 }
503
504 if (dscpsp != NULL) {
505 dscpobj = cfg_tuple_get(list, "dscp");
506 if (dscpobj != NULL && cfg_obj_isuint32(dscpobj)) {
507 if (cfg_obj_asuint32(dscpobj) > 63) {
508 cfg_obj_log(dscpobj, named_g_lctx,
509 ISC_LOG_ERROR,
510 "dscp value '%u' is out of range",
511 cfg_obj_asuint32(dscpobj));
512 return (ISC_R_RANGE);
513 }
514 dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
515 }
516
517 dscps = isc_mem_get(mctx, count * sizeof(isc_dscp_t));
518 }
519
520 addrs = isc_mem_get(mctx, count * sizeof(isc_sockaddr_t));
521
522 for (element = cfg_list_first(addrlist); element != NULL;
523 element = cfg_list_next(element), i++)
524 {
525 const cfg_obj_t *addr;
526 INSIST(i < count);
527 addr = cfg_listelt_value(element);
528 addrs[i] = *cfg_obj_assockaddr(addr);
529 if (dscpsp != NULL) {
530 isc_dscp_t innerdscp;
531 innerdscp = cfg_obj_getdscp(addr);
532 if (innerdscp == -1) {
533 innerdscp = dscp;
534 }
535 dscps[i] = innerdscp;
536 }
537 if (isc_sockaddr_getport(&addrs[i]) == 0) {
538 isc_sockaddr_setport(&addrs[i], port);
539 }
540 }
541 INSIST(i == count);
542
543 *addrsp = addrs;
544 *countp = count;
545
546 if (dscpsp != NULL) {
547 *dscpsp = dscps;
548 }
549
550 return (ISC_R_SUCCESS);
551 }
552
553 void
named_config_putiplist(isc_mem_t * mctx,isc_sockaddr_t ** addrsp,isc_dscp_t ** dscpsp,uint32_t count)554 named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
555 isc_dscp_t **dscpsp, uint32_t count) {
556 INSIST(addrsp != NULL && *addrsp != NULL);
557 INSIST(dscpsp == NULL || *dscpsp != NULL);
558
559 isc_mem_put(mctx, *addrsp, count * sizeof(isc_sockaddr_t));
560 *addrsp = NULL;
561
562 if (dscpsp != NULL) {
563 isc_mem_put(mctx, *dscpsp, count * sizeof(isc_dscp_t));
564 *dscpsp = NULL;
565 }
566 }
567
568 isc_result_t
named_config_getmastersdef(const cfg_obj_t * cctx,const char * name,const cfg_obj_t ** ret)569 named_config_getmastersdef(const cfg_obj_t *cctx, const char *name,
570 const cfg_obj_t **ret) {
571 isc_result_t result;
572 const cfg_obj_t *masters = NULL;
573 const cfg_listelt_t *elt;
574
575 result = cfg_map_get(cctx, "masters", &masters);
576 if (result != ISC_R_SUCCESS) {
577 return (result);
578 }
579 for (elt = cfg_list_first(masters); elt != NULL;
580 elt = cfg_list_next(elt)) {
581 const cfg_obj_t *list;
582 const char *listname;
583
584 list = cfg_listelt_value(elt);
585 listname = cfg_obj_asstring(cfg_tuple_get(list, "name"));
586
587 if (strcasecmp(listname, name) == 0) {
588 *ret = list;
589 return (ISC_R_SUCCESS);
590 }
591 }
592 return (ISC_R_NOTFOUND);
593 }
594
595 isc_result_t
named_config_getipandkeylist(const cfg_obj_t * config,const cfg_obj_t * list,isc_mem_t * mctx,dns_ipkeylist_t * ipkl)596 named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
597 isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
598 uint32_t addrcount = 0, dscpcount = 0, keycount = 0, i = 0;
599 uint32_t listcount = 0, l = 0, j;
600 uint32_t stackcount = 0, pushed = 0;
601 isc_result_t result;
602 const cfg_listelt_t *element;
603 const cfg_obj_t *addrlist;
604 const cfg_obj_t *portobj;
605 const cfg_obj_t *dscpobj;
606 in_port_t port;
607 isc_dscp_t dscp = -1;
608 dns_fixedname_t fname;
609 isc_sockaddr_t *addrs = NULL;
610 isc_dscp_t *dscps = NULL;
611 dns_name_t **keys = NULL;
612 struct {
613 const char *name;
614 } *lists = NULL;
615 struct {
616 const cfg_listelt_t *element;
617 in_port_t port;
618 isc_dscp_t dscp;
619 } *stack = NULL;
620
621 REQUIRE(ipkl != NULL);
622 REQUIRE(ipkl->count == 0);
623 REQUIRE(ipkl->addrs == NULL);
624 REQUIRE(ipkl->keys == NULL);
625 REQUIRE(ipkl->dscps == NULL);
626 REQUIRE(ipkl->labels == NULL);
627 REQUIRE(ipkl->allocated == 0);
628
629 /*
630 * Get system defaults.
631 */
632 result = named_config_getport(config, &port);
633 if (result != ISC_R_SUCCESS) {
634 goto cleanup;
635 }
636
637 result = named_config_getdscp(config, &dscp);
638 if (result != ISC_R_SUCCESS) {
639 goto cleanup;
640 }
641
642 newlist:
643 addrlist = cfg_tuple_get(list, "addresses");
644 portobj = cfg_tuple_get(list, "port");
645 dscpobj = cfg_tuple_get(list, "dscp");
646
647 if (cfg_obj_isuint32(portobj)) {
648 uint32_t val = cfg_obj_asuint32(portobj);
649 if (val > UINT16_MAX) {
650 cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
651 "port '%u' out of range", val);
652 result = ISC_R_RANGE;
653 goto cleanup;
654 }
655 port = (in_port_t)val;
656 }
657
658 if (dscpobj != NULL && cfg_obj_isuint32(dscpobj)) {
659 if (cfg_obj_asuint32(dscpobj) > 63) {
660 cfg_obj_log(dscpobj, named_g_lctx, ISC_LOG_ERROR,
661 "dscp value '%u' is out of range",
662 cfg_obj_asuint32(dscpobj));
663 result = ISC_R_RANGE;
664 goto cleanup;
665 }
666 dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
667 }
668
669 result = ISC_R_NOMEMORY;
670
671 element = cfg_list_first(addrlist);
672 resume:
673 for (; element != NULL; element = cfg_list_next(element)) {
674 const cfg_obj_t *addr;
675 const cfg_obj_t *key;
676 const char *keystr;
677 isc_buffer_t b;
678
679 addr = cfg_tuple_get(cfg_listelt_value(element),
680 "masterselement");
681 key = cfg_tuple_get(cfg_listelt_value(element), "key");
682
683 if (!cfg_obj_issockaddr(addr)) {
684 const char *listname = cfg_obj_asstring(addr);
685 isc_result_t tresult;
686
687 /* Grow lists? */
688 if (listcount == l) {
689 void *tmp;
690 uint32_t newlen = listcount + 16;
691 size_t newsize, oldsize;
692
693 newsize = newlen * sizeof(*lists);
694 oldsize = listcount * sizeof(*lists);
695 tmp = isc_mem_get(mctx, newsize);
696 if (listcount != 0) {
697 memmove(tmp, lists, oldsize);
698 isc_mem_put(mctx, lists, oldsize);
699 }
700 lists = tmp;
701 listcount = newlen;
702 }
703 /* Seen? */
704 for (j = 0; j < l; j++) {
705 if (strcasecmp(lists[j].name, listname) == 0) {
706 break;
707 }
708 }
709 if (j < l) {
710 continue;
711 }
712 tresult = named_config_getmastersdef(config, listname,
713 &list);
714 if (tresult == ISC_R_NOTFOUND) {
715 cfg_obj_log(addr, named_g_lctx, ISC_LOG_ERROR,
716 "masters \"%s\" not found",
717 listname);
718
719 result = tresult;
720 goto cleanup;
721 }
722 if (tresult != ISC_R_SUCCESS) {
723 goto cleanup;
724 }
725 lists[l++].name = listname;
726 /* Grow stack? */
727 if (stackcount == pushed) {
728 void *tmp;
729 uint32_t newlen = stackcount + 16;
730 size_t newsize, oldsize;
731
732 newsize = newlen * sizeof(*stack);
733 oldsize = stackcount * sizeof(*stack);
734 tmp = isc_mem_get(mctx, newsize);
735 if (stackcount != 0) {
736 memmove(tmp, stack, oldsize);
737 isc_mem_put(mctx, stack, oldsize);
738 }
739 stack = tmp;
740 stackcount = newlen;
741 }
742 /*
743 * We want to resume processing this list on the
744 * next element.
745 */
746 stack[pushed].element = cfg_list_next(element);
747 stack[pushed].port = port;
748 stack[pushed].dscp = dscp;
749 pushed++;
750 goto newlist;
751 }
752
753 if (i == addrcount) {
754 void *tmp;
755 uint32_t newlen = addrcount + 16;
756 size_t newsize, oldsize;
757
758 newsize = newlen * sizeof(isc_sockaddr_t);
759 oldsize = addrcount * sizeof(isc_sockaddr_t);
760 tmp = isc_mem_get(mctx, newsize);
761 if (addrcount != 0) {
762 memmove(tmp, addrs, oldsize);
763 isc_mem_put(mctx, addrs, oldsize);
764 }
765 addrs = tmp;
766 addrcount = newlen;
767
768 newsize = newlen * sizeof(isc_dscp_t);
769 oldsize = dscpcount * sizeof(isc_dscp_t);
770 tmp = isc_mem_get(mctx, newsize);
771 if (dscpcount != 0) {
772 memmove(tmp, dscps, oldsize);
773 isc_mem_put(mctx, dscps, oldsize);
774 }
775 dscps = tmp;
776 dscpcount = newlen;
777
778 newsize = newlen * sizeof(dns_name_t *);
779 oldsize = keycount * sizeof(dns_name_t *);
780 tmp = isc_mem_get(mctx, newsize);
781 if (keycount != 0) {
782 memmove(tmp, keys, oldsize);
783 isc_mem_put(mctx, keys, oldsize);
784 }
785 keys = tmp;
786 keycount = newlen;
787 }
788
789 addrs[i] = *cfg_obj_assockaddr(addr);
790 if (isc_sockaddr_getport(&addrs[i]) == 0) {
791 isc_sockaddr_setport(&addrs[i], port);
792 }
793 dscps[i] = cfg_obj_getdscp(addr);
794 if (dscps[i] == -1) {
795 dscps[i] = dscp;
796 }
797 keys[i] = NULL;
798 i++; /* Increment here so that cleanup on error works. */
799 if (!cfg_obj_isstring(key)) {
800 continue;
801 }
802 keys[i - 1] = isc_mem_get(mctx, sizeof(dns_name_t));
803 dns_name_init(keys[i - 1], NULL);
804
805 keystr = cfg_obj_asstring(key);
806 isc_buffer_constinit(&b, keystr, strlen(keystr));
807 isc_buffer_add(&b, strlen(keystr));
808 dns_fixedname_init(&fname);
809 result = dns_name_fromtext(dns_fixedname_name(&fname), &b,
810 dns_rootname, 0, NULL);
811 if (result != ISC_R_SUCCESS) {
812 goto cleanup;
813 }
814 dns_name_dup(dns_fixedname_name(&fname), mctx, keys[i - 1]);
815 }
816 if (pushed != 0) {
817 pushed--;
818 element = stack[pushed].element;
819 port = stack[pushed].port;
820 dscp = stack[pushed].dscp;
821 goto resume;
822 }
823 if (i < addrcount) {
824 void *tmp;
825 size_t newsize, oldsize;
826
827 newsize = i * sizeof(isc_sockaddr_t);
828 oldsize = addrcount * sizeof(isc_sockaddr_t);
829 if (i != 0) {
830 tmp = isc_mem_get(mctx, newsize);
831 memmove(tmp, addrs, newsize);
832 } else {
833 tmp = NULL;
834 }
835 isc_mem_put(mctx, addrs, oldsize);
836 addrs = tmp;
837 addrcount = i;
838
839 newsize = i * sizeof(isc_dscp_t);
840 oldsize = dscpcount * sizeof(isc_dscp_t);
841 if (i != 0) {
842 tmp = isc_mem_get(mctx, newsize);
843 memmove(tmp, dscps, newsize);
844 } else {
845 tmp = NULL;
846 }
847 isc_mem_put(mctx, dscps, oldsize);
848 dscps = tmp;
849 dscpcount = i;
850
851 newsize = i * sizeof(dns_name_t *);
852 oldsize = keycount * sizeof(dns_name_t *);
853 if (i != 0) {
854 tmp = isc_mem_get(mctx, newsize);
855 memmove(tmp, keys, newsize);
856 } else {
857 tmp = NULL;
858 }
859 isc_mem_put(mctx, keys, oldsize);
860 keys = tmp;
861 keycount = i;
862 }
863
864 if (lists != NULL) {
865 isc_mem_put(mctx, lists, listcount * sizeof(*lists));
866 }
867 if (stack != NULL) {
868 isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
869 }
870
871 INSIST(dscpcount == addrcount);
872 INSIST(keycount == addrcount);
873 INSIST(keycount == dscpcount);
874
875 ipkl->addrs = addrs;
876 ipkl->dscps = dscps;
877 ipkl->keys = keys;
878 ipkl->count = addrcount;
879 ipkl->allocated = addrcount;
880
881 return (ISC_R_SUCCESS);
882
883 cleanup:
884 if (addrs != NULL) {
885 isc_mem_put(mctx, addrs, addrcount * sizeof(isc_sockaddr_t));
886 }
887 if (dscps != NULL) {
888 isc_mem_put(mctx, dscps, dscpcount * sizeof(isc_dscp_t));
889 }
890 if (keys != NULL) {
891 for (j = 0; j < i; j++) {
892 if (keys[j] == NULL) {
893 continue;
894 }
895 if (dns_name_dynamic(keys[j])) {
896 dns_name_free(keys[j], mctx);
897 }
898 isc_mem_put(mctx, keys[j], sizeof(dns_name_t));
899 }
900 isc_mem_put(mctx, keys, keycount * sizeof(dns_name_t *));
901 }
902 if (lists != NULL) {
903 isc_mem_put(mctx, lists, listcount * sizeof(*lists));
904 }
905 if (stack != NULL) {
906 isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
907 }
908 return (result);
909 }
910
911 isc_result_t
named_config_getport(const cfg_obj_t * config,in_port_t * portp)912 named_config_getport(const cfg_obj_t *config, in_port_t *portp) {
913 const cfg_obj_t *maps[3];
914 const cfg_obj_t *options = NULL;
915 const cfg_obj_t *portobj = NULL;
916 isc_result_t result;
917 int i;
918
919 (void)cfg_map_get(config, "options", &options);
920 i = 0;
921 if (options != NULL) {
922 maps[i++] = options;
923 }
924 maps[i++] = named_g_defaults;
925 maps[i] = NULL;
926
927 result = named_config_get(maps, "port", &portobj);
928 INSIST(result == ISC_R_SUCCESS);
929 if (cfg_obj_asuint32(portobj) >= UINT16_MAX) {
930 cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
931 "port '%u' out of range",
932 cfg_obj_asuint32(portobj));
933 return (ISC_R_RANGE);
934 }
935 *portp = (in_port_t)cfg_obj_asuint32(portobj);
936 return (ISC_R_SUCCESS);
937 }
938
939 isc_result_t
named_config_getdscp(const cfg_obj_t * config,isc_dscp_t * dscpp)940 named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp) {
941 const cfg_obj_t *options = NULL;
942 const cfg_obj_t *dscpobj = NULL;
943 isc_result_t result;
944
945 (void)cfg_map_get(config, "options", &options);
946 if (options == NULL) {
947 return (ISC_R_SUCCESS);
948 }
949
950 result = cfg_map_get(options, "dscp", &dscpobj);
951 if (result != ISC_R_SUCCESS || dscpobj == NULL) {
952 *dscpp = -1;
953 return (ISC_R_SUCCESS);
954 }
955 if (cfg_obj_asuint32(dscpobj) >= 64) {
956 cfg_obj_log(dscpobj, named_g_lctx, ISC_LOG_ERROR,
957 "dscp '%u' out of range",
958 cfg_obj_asuint32(dscpobj));
959 return (ISC_R_RANGE);
960 }
961 *dscpp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
962 return (ISC_R_SUCCESS);
963 }
964
965 struct keyalgorithms {
966 const char *str;
967 enum { hmacnone,
968 hmacmd5,
969 hmacsha1,
970 hmacsha224,
971 hmacsha256,
972 hmacsha384,
973 hmacsha512 } hmac;
974 unsigned int type;
975 uint16_t size;
976 } algorithms[] = { { "hmac-md5", hmacmd5, DST_ALG_HMACMD5, 128 },
977 { "hmac-md5.sig-alg.reg.int", hmacmd5, DST_ALG_HMACMD5, 0 },
978 { "hmac-md5.sig-alg.reg.int.", hmacmd5, DST_ALG_HMACMD5, 0 },
979 { "hmac-sha1", hmacsha1, DST_ALG_HMACSHA1, 160 },
980 { "hmac-sha224", hmacsha224, DST_ALG_HMACSHA224, 224 },
981 { "hmac-sha256", hmacsha256, DST_ALG_HMACSHA256, 256 },
982 { "hmac-sha384", hmacsha384, DST_ALG_HMACSHA384, 384 },
983 { "hmac-sha512", hmacsha512, DST_ALG_HMACSHA512, 512 },
984 { NULL, hmacnone, DST_ALG_UNKNOWN, 0 } };
985
986 isc_result_t
named_config_getkeyalgorithm(const char * str,const dns_name_t ** name,uint16_t * digestbits)987 named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
988 uint16_t *digestbits) {
989 return (named_config_getkeyalgorithm2(str, name, NULL, digestbits));
990 }
991
992 isc_result_t
named_config_getkeyalgorithm2(const char * str,const dns_name_t ** name,unsigned int * typep,uint16_t * digestbits)993 named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
994 unsigned int *typep, uint16_t *digestbits) {
995 int i;
996 size_t len = 0;
997 uint16_t bits;
998 isc_result_t result;
999
1000 for (i = 0; algorithms[i].str != NULL; i++) {
1001 len = strlen(algorithms[i].str);
1002 if (strncasecmp(algorithms[i].str, str, len) == 0 &&
1003 (str[len] == '\0' ||
1004 (algorithms[i].size != 0 && str[len] == '-')))
1005 {
1006 break;
1007 }
1008 }
1009 if (algorithms[i].str == NULL) {
1010 return (ISC_R_NOTFOUND);
1011 }
1012 if (str[len] == '-') {
1013 result = isc_parse_uint16(&bits, str + len + 1, 10);
1014 if (result != ISC_R_SUCCESS) {
1015 return (result);
1016 }
1017 if (bits > algorithms[i].size) {
1018 return (ISC_R_RANGE);
1019 }
1020 } else if (algorithms[i].size == 0) {
1021 bits = 128;
1022 } else {
1023 bits = algorithms[i].size;
1024 }
1025
1026 if (name != NULL) {
1027 switch (algorithms[i].hmac) {
1028 case hmacmd5:
1029 *name = dns_tsig_hmacmd5_name;
1030 break;
1031 case hmacsha1:
1032 *name = dns_tsig_hmacsha1_name;
1033 break;
1034 case hmacsha224:
1035 *name = dns_tsig_hmacsha224_name;
1036 break;
1037 case hmacsha256:
1038 *name = dns_tsig_hmacsha256_name;
1039 break;
1040 case hmacsha384:
1041 *name = dns_tsig_hmacsha384_name;
1042 break;
1043 case hmacsha512:
1044 *name = dns_tsig_hmacsha512_name;
1045 break;
1046 default:
1047 INSIST(0);
1048 ISC_UNREACHABLE();
1049 }
1050 }
1051 if (typep != NULL) {
1052 *typep = algorithms[i].type;
1053 }
1054 if (digestbits != NULL) {
1055 *digestbits = bits;
1056 }
1057 return (ISC_R_SUCCESS);
1058 }
1059