ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

introducing dns_acl_t; other restructuring of server

Browse Source 
configuration process aiming to reduce the degree of mutual dependency
between lib/dns/config and the rest of libdns
This commit is contained in:
Andreas Gustafsson
1999-12-16 23:11:07 +00:00
parent b24e559dee
commit 6017f424ee
27 changed files with 1979 additions and 701 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/named/aclconf.c
+208
View File
@@ -0,0 +1,208 @@
/*
* Copyright (C) 1999 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
* ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
* CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
* DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
* PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
* ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
* SOFTWARE.
*/
#include <config.h>
#include <isc/assertions.h>
#include <isc/mem.h>
#include <isc/result.h>
#include <dns/aclconf.h>
#include <dns/fixedname.h>
#include <dns/types.h>
#include <dns/zone.h>
void dns_aclconfctx_init(dns_aclconfctx_t *ctx)
{
ISC_LIST_INIT(ctx->named_acl_cache);
}
void dns_aclconfctx_destroy(dns_aclconfctx_t *ctx)
{
dns_acl_t *dacl, *next;
for (dacl = ISC_LIST_HEAD(ctx->named_acl_cache);
dacl != NULL;
dacl = next)
{
next = ISC_LIST_NEXT(dacl, nextincache);
dacl->name = NULL;
dns_acl_detach(&dacl);
}
}
static isc_result_t
convert_named_acl(char *aclname, dns_c_ctx_t *cctx,
dns_aclconfctx_t *ctx, isc_mem_t *mctx,
dns_acl_t **target)
{
isc_result_t result;
dns_c_acl_t *cacl;
dns_acl_t *dacl;
/* Look for an already-converted version. */
for (dacl = ISC_LIST_HEAD(ctx->named_acl_cache);
dacl != NULL;
dacl = ISC_LIST_NEXT(dacl, nextincache))
{
if (strcmp(aclname, dacl->name) == 0) {
dns_acl_attach(dacl, target);
return ISC_R_SUCCESS;
}
}
/* Not yet converted. Convert now. */
result = dns_c_acltable_getacl(cctx->acls, aclname, &cacl);
if (result != DNS_R_SUCCESS) {
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
DNS_LOGMODULE_ACL, ISC_LOG_WARNING,
"undefined ACL \"%s\"", aclname);
return (result);
}
result = dns_acl_fromconfig(cacl->ipml, cctx, ctx, mctx, &dacl);
if (result != DNS_R_SUCCESS)
return (result);
dacl->name = aclname;
ISC_LIST_APPEND(ctx->named_acl_cache, dacl, nextincache);
dns_acl_attach(dacl, target);
return (ISC_R_SUCCESS);
}
static isc_result_t
convert_keyname(char *txtname, isc_mem_t *mctx, dns_name_t *dnsname) {
isc_result_t result;
isc_buffer_t buf;
dns_fixedname_t fixname;
unsigned int keylen;
keylen = strlen(txtname);
isc_buffer_init(&buf, txtname, keylen, ISC_BUFFERTYPE_TEXT);
isc_buffer_add(&buf, keylen);
dns_fixedname_init(&fixname);
result = dns_name_fromtext(dns_fixedname_name(&fixname), &buf,
dns_rootname, ISC_FALSE, NULL);
if (result != ISC_R_SUCCESS) {
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
DNS_LOGMODULE_ACL, ISC_LOG_WARNING,
"key name \"%s\" is not a valid domain name",
txtname);
return (result);
}
return (dns_name_dup(dns_fixedname_name(&fixname), mctx, dnsname));
}
isc_result_t
dns_acl_fromconfig(dns_c_ipmatchlist_t *caml,
dns_c_ctx_t *cctx,
dns_aclconfctx_t *ctx,
isc_mem_t *mctx,
dns_acl_t **target)
{
isc_result_t result;
unsigned int count;
dns_acl_t *dacl = NULL;
dns_aclelement_t *de;
dns_c_ipmatchelement_t *ce;
REQUIRE(target != NULL && *target == NULL);
count = 0;
for (ce = ISC_LIST_HEAD(caml->elements);
ce != NULL;
ce = ISC_LIST_NEXT(ce, next))
count++;
dacl = isc_mem_get(mctx, sizeof(*dacl));
if (dacl == NULL)
return (ISC_R_NOMEMORY);
dacl->mctx = mctx;
dacl->name = NULL;
dacl->refcount = 1;
dacl->elements = NULL;
dacl->alloc = 0;
dacl->length = 0;
ISC_LINK_INIT(dacl, nextincache);
/* Must set magic early because we use dns_acl_detach() to clean up. */
dacl->magic = DNS_ACL_MAGIC;
dacl->elements = isc_mem_get(mctx, count * sizeof(dns_aclelement_t));
if (dacl->elements == NULL) {
result = ISC_R_NOMEMORY;
goto cleanup;
}
dacl->alloc = count;
memset(dacl->elements, 0, count * sizeof(dns_aclelement_t));
de = dacl->elements;
for (ce = ISC_LIST_HEAD(caml->elements);
ce != NULL;
ce = ISC_LIST_NEXT(ce, next))
{
de->negative = dns_c_ipmatchelement_isneg(ce);
switch (ce->type) {
case dns_c_ipmatch_pattern:
de->type = dns_aclelementtype_ipprefix;
de->u.ip_prefix.address = ce->u.direct.address;
/* XXX "mask" is a misnomer */
de->u.ip_prefix.prefixlen = ce->u.direct.mask;
break;
case dns_c_ipmatch_key:
de->type = dns_aclelementtype_keyname;
dns_name_init(&de->u.keyname, NULL);
result = convert_keyname(ce->u.key, mctx, &de->u.keyname);
if (result != ISC_R_SUCCESS)
goto cleanup;
break;
case dns_c_ipmatch_indirect:
de->type = dns_aclelementtype_nestedacl;
result = dns_acl_fromconfig(ce->u.indirect.list, cctx,
ctx, mctx, &de->u.nestedacl);
if (result != ISC_R_SUCCESS)
goto cleanup;
break;
case dns_c_ipmatch_localhost:
de->type = dns_aclelementtype_localhost;
break;
case dns_c_ipmatch_localnets:
de->type = dns_aclelementtype_localnets;
break;
case dns_c_ipmatch_acl:
de->type = dns_aclelementtype_nestedacl;
result = convert_named_acl(ce->u.aclname, cctx,
ctx, mctx, &de->u.nestedacl);
if (result != ISC_R_SUCCESS)
goto cleanup;
break;
default:
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
DNS_LOGMODULE_ACL, ISC_LOG_WARNING,
"address match list contains "
"unsupported element type");
result = ISC_R_FAILURE;
goto cleanup;
}
de++;
dacl->length++;
}
*target = dacl;
return (ISC_R_SUCCESS);
cleanup:
dns_acl_detach(&dacl);
return (result);
}
bin/named/client.c
+7 -8
View File
@@ -25,7 +25,7 @@
#include <isc/timer.h>
#include <isc/util.h>
#include <dns/aml.h>
#include <dns/acl.h>
#include <dns/dispatch.h>
#include <dns/events.h>
#include <dns/message.h>
@@ -39,6 +39,7 @@
#include <named/client.h>
#include <named/log.h>
#include <named/query.h>
#include <named/server.h>
#include <named/update.h>
#include <named/notify.h>
@@ -613,16 +614,14 @@ client_request(isc_task_t *task, isc_event_t *event) {
ra = ISC_FALSE;
} else {
ra = ISC_TRUE;
(void) dns_c_ctx_getrecursion(ns_g_confctx, &ra);
if (ra == ISC_TRUE) {
dns_c_ipmatchlist_t *acl = NULL;
if (ns_g_server->recursion == ISC_TRUE) {
/* XXX ACL should be view specific. */
dns_c_ctx_getrecursionacl(ns_g_confctx, &acl);
/* XXX this will log too much too early */
result = dns_aml_checkrequest(client->signer,
result = dns_acl_checkrequest(client->signer,
ns_client_getsockaddr(client),
ns_g_confctx->acls, "recursion",
acl, NULL, ISC_TRUE);
"recursion",
ns_g_server->recursionacl,
NULL, ISC_TRUE);
if (result != DNS_R_SUCCESS)
ra = ISC_FALSE;
}
bin/named/include/named/aclconf.h
+50
View File
@@ -0,0 +1,50 @@
/*
* Copyright (C) 1999 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
* ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
* CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
* DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
* PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
* ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
* SOFTWARE.
*/
#ifndef DNS_ACLCONF_H
#define DNS_ACLCONF_H 1
#include <dns/acl.h>
#include <dns/aclconf.h>
#include <dns/confacl.h>
#include <dns/confctx.h>
#include <dns/confip.h>
typedef struct {
ISC_LIST(dns_acl_t) named_acl_cache;
} dns_aclconfctx_t;
/***
*** Functions
***/
ISC_LANG_BEGINDECLS
void dns_aclconfctx_init(dns_aclconfctx_t *ctx);
void dns_aclconfctx_destroy(dns_aclconfctx_t *ctx);
isc_result_t
dns_acl_fromconfig(dns_c_ipmatchlist_t *caml,
dns_c_ctx_t *cctx,
dns_aclconfctx_t *ctx,
isc_mem_t *mctx,
dns_acl_t **target);
ISC_LANG_ENDDECLS
#endif /* DNS_ACLCONF_H */
bin/named/include/named/globals.h
+3 -1
View File
@@ -25,8 +25,8 @@
#include <dns/types.h>
#include <dns/confctx.h>
#include <named/types.h>
#include <named/interfacemgr.h>
#include <named/types.h>
#undef EXTERN
#undef INIT
@@ -57,6 +57,8 @@ EXTERN dns_zonemgr_t * ns_g_zonemgr INIT(NULL);
EXTERN dns_viewlist_t ns_g_viewlist;
EXTERN isc_rwlock_t ns_g_viewlock;
EXTERN ns_server_t * ns_g_server INIT(NULL);
/*
* Default root nameserver hints.
*/
bin/named/include/named/server.h
+38 -1
View File
@@ -21,8 +21,45 @@
#include <isc/types.h>
#include <isc/log.h>
#include <dns/types.h>
/*
* Name server state. Better here than in lots of separate global variables.
*/
struct ns_server {
isc_uint32_t magic;
isc_mem_t * mctx;
/* Configurable data. */
isc_boolean_t recursion;
isc_boolean_t auth_nxdomain;
dns_transfer_format_t transfer_format;
dns_acl_t * queryacl;
dns_acl_t * recursionacl;
dns_acl_t * transferacl;
};
#define NS_SERVER_MAGIC 0x53564552 /* SVER */
#define NS_SERVER_VALID(s) ((s) != NULL && \
(s)->magic == NS_SERVER_MAGIC)
isc_result_t
ns_server_init(void);
ns_server_create(isc_mem_t *mctx, ns_server_t **serverp);
/*
* Create a server object with default settings.
*/
void
ns_server_destroy(ns_server_t **serverp);
/*
* Destroy a server object, freeing its memory.
*/
isc_result_t ns_server_init(void);
/*
* Create the singleton names server object of BIND 9.
*/
void
ns_server_fatal(isc_logmodule_t *module, isc_boolean_t want_core,
bin/named/include/named/types.h
+1
View File
@@ -25,5 +25,6 @@
typedef struct ns_client ns_client_t;
typedef struct ns_clientmgr ns_clientmgr_t;
typedef struct ns_query ns_query_t;
typedef struct ns_server ns_server_t;
#endif /* NS_TYPES_H */
bin/named/include/named/zoneconf.h
+51
View File
@@ -0,0 +1,51 @@
/*
* Copyright (C) 1999 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
* ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
* CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
* DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
* PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
* ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
* SOFTWARE.
*/
#ifndef NS_ZONECONF_H
#define NS_ZONECONF_H 1
#include <isc/types.h>
#include <dns/acl.h>
#include <dns/confacl.h>
#include <dns/confip.h>
/*
* Create a dns_acl_t from the corresponding configuration data structure,
* 'caml'. References to named ACLs in caml are resolved against the ACL
* table in 'cctx'.
*/
dns_result_t dns_zone_configure(isc_log_t *lctx, dns_c_ctx_t *ctx,
dns_aclconfctx_t *ac,
dns_c_zone_t *czone, dns_zone_t *zone);
/*
* Configure or reconfigure a zone according to the named.conf
* data in 'ctx' and 'czone'.
*
* Require:
* 'lctx' to be initalised or NULL.
* 'ctx' to be initalised or NULL.
* 'ac' to point to an initialized ns_aclconfctx_t.
* 'czone' to be initalised.
* 'zone' to be initalised.
*/
ISC_LANG_ENDDECLS
#endif /* NS_ZONECONF_H */
bin/named/notify.c
-1
View File
@@ -28,7 +28,6 @@
#include <isc/result.h>
#include <isc/taskpool.h>
#include <dns/aml.h>
#include <dns/confip.h>
#include <dns/db.h>
#include <dns/dbiterator.h>
bin/named/query.c
+19 -22
View File
@@ -29,7 +29,7 @@
#include <isc/util.h>
#include <dns/a6.h>
#include <dns/aml.h>
#include <dns/acl.h>
#include <dns/db.h>
#include <dns/dbtable.h>
#include <dns/dispatch.h>
@@ -49,9 +49,12 @@
#include <named/client.h>
#include <named/globals.h>
#include <named/query.h>
#include <named/xfrout.h>
#include <named/log.h>
#include <named/query.h>
#include <named/server.h>
#include <named/xfrout.h>
#include "../../isc/util.h" /* XXX */
#define PARTIALANSWER(c) (((c)->query.attributes & \
NS_QUERYATTR_PARTIALANSWER) != 0)
@@ -1693,7 +1696,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event) {
dns_fixedname_t fixed;
dns_dbversion_t *version;
dns_zone_t *zone;
dns_c_ipmatchlist_t *queryacl;
/*
* One-time initialization.
@@ -1817,18 +1819,17 @@ query_find(ns_client_t *client, dns_fetchevent_t *event) {
version = NULL;
/*
* Check the query against the "allow-query" AML.
* Check the query against the "allow-query" AMLs.
* XXX there should also be a per-view one.
*/
if (is_zone) {
queryacl = dns_zone_getqueryacl(zone);
} else {
queryacl = NULL;
(void) dns_c_ctx_getqueryacl(ns_g_confctx, &queryacl);
}
result = dns_aml_checkrequest(client->signer,
result = dns_acl_checkrequest(client->signer,
ns_client_getsockaddr(client),
ns_g_confctx->acls, "query",
queryacl, NULL, ISC_TRUE);
"query",
(is_zone ?
dns_zone_getqueryacl(zone) :
ns_g_server->queryacl),
ns_g_server->queryacl,
ISC_TRUE);
if (result != DNS_R_SUCCESS) {
QUERY_ERROR(result);
goto cleanup;
@@ -2485,14 +2486,10 @@ query_find(ns_client_t *client, dns_fetchevent_t *event) {
* auth-nxdomain config option says so, then send the
* response.
*/
if (client->message->rcode == dns_rcode_nxdomain) {
/* Note: default was "true" in BIND 8. */
isc_boolean_t auth_nxdomain = ISC_FALSE;
(void) dns_c_ctx_getauth_nx_domain(ns_g_confctx,
&auth_nxdomain);
if (auth_nxdomain == ISC_TRUE)
client->message->flags |= DNS_MESSAGEFLAG_AA;
}
if (client->message->rcode == dns_rcode_nxdomain &&
ns_g_server->auth_nxdomain == ISC_TRUE)
client->message->flags |= DNS_MESSAGEFLAG_AA;
ns_client_send(client);
}
}
bin/named/server.c
+98 -8
View File
@@ -36,6 +36,7 @@
#include <isc/dir.h>
#include <isc/util.h>
#include <dns/aclconf.h>
#include <dns/cache.h>
#include <dns/confparser.h>
#include <dns/types.h>
@@ -54,6 +55,7 @@
#include <dns/journal.h>
#include <dns/view.h>
#include <dns/zone.h>
#include <dns/zoneconf.h>
#include <dns/tsig.h>
#include <dns/tkey.h>
@@ -66,6 +68,7 @@
typedef struct {
isc_mem_t * mctx;
dns_viewlist_t viewlist;
dns_aclconfctx_t *aclconf;
} ns_load_t;
static isc_task_t * server_task;
@@ -305,7 +308,7 @@ load_zone(dns_c_ctx_t *ctx, dns_c_zone_t *czone, dns_c_view_t *cview,
result = dns_zone_create(&zone, lctx->mctx);
if (result != ISC_R_SUCCESS)
return (result);
result = dns_zone_copy(ns_g_lctx, ctx, czone, zone);
result = dns_zone_configure(ns_g_lctx, ctx, lctx->aclconf, czone, zone);
if (result != ISC_R_SUCCESS)
return (result);
@@ -371,16 +374,39 @@ load_zone(dns_c_ctx_t *ctx, dns_c_zone_t *czone, dns_c_view_t *cview,
return (result);
}
/* XXX will need error recovery for reconfig */
static void
load_configuration(const char *filename) {
configure_server_acl(dns_c_ctx_t *cctx, dns_aclconfctx_t *actx, isc_mem_t *mctx,
isc_result_t (*getcacl)(dns_c_ctx_t *, dns_c_ipmatchlist_t **),
dns_acl_t **aclp)
{
isc_result_t result;
dns_c_ipmatchlist_t *cacl = NULL;
if (*aclp != NULL)
dns_acl_detach(aclp);
(void) (*getcacl)(cctx, &cacl);
if (cacl != NULL) {
result = dns_acl_fromconfig(cacl, cctx, actx, mctx, aclp);
if (result != DNS_R_SUCCESS)
ns_server_fatal(NS_LOGMODULE_SERVER, ISC_FALSE,
"server ACL setup failed");
}
}
static void
load_configuration(const char *filename, ns_server_t *server) {
isc_result_t result;
ns_load_t lctx;
dns_c_cbks_t callbacks;
dns_c_ctx_t *configctx, *oconfigctx;
dns_view_t *view, *view_next;
dns_viewlist_t oviewlist;
dns_aclconfctx_t aclconfctx;
dns_aclconfctx_init(&aclconfctx);
lctx.mctx = ns_g_mctx;
lctx.aclconf = &aclconfctx;
ISC_LIST_INIT(lctx.viewlist);
callbacks.zonecbk = load_zone;
@@ -407,7 +433,23 @@ load_configuration(const char *filename) {
ns_server_fatal(NS_LOGMODULE_SERVER, ISC_FALSE,
"load of '%s' failed", filename);
}
/*
* Configure various server options.
*/
(void) dns_c_ctx_getrecursion(configctx, &server->recursion);
(void) dns_c_ctx_getauth_nx_domain(configctx, &server->auth_nxdomain);
(void) dns_c_ctx_gettransferformat(configctx, &server->transfer_format);
configure_server_acl(configctx, &aclconfctx, ns_g_mctx,
dns_c_ctx_getqueryacl, &server->queryacl);
configure_server_acl(configctx, &aclconfctx, ns_g_mctx,
dns_c_ctx_getrecursionacl, &server->recursionacl);
configure_server_acl(configctx, &aclconfctx, ns_g_mctx,
dns_c_ctx_gettransferacl, &server->transferacl);
/*
* If we haven't created any views, create a default view for class
* IN. (We're a caching-only server.)
@@ -518,16 +560,18 @@ load_configuration(const char *filename) {
"dns_tkey_init() failed: %s",
isc_result_totext(result));
}
dns_aclconfctx_destroy(&aclconfctx);
}
static void
run_server(isc_task_t *task, isc_event_t *event) {
ns_server_t *server = (ns_server_t *) event->arg;
(void)task;
isc_event_free(&event);
load_configuration(ns_g_conffile);
load_configuration(ns_g_conffile, server);
ns_interfacemgr_scan(ns_g_interfacemgr);
@@ -538,7 +582,8 @@ run_server(isc_task_t *task, isc_event_t *event) {
static void
shutdown_server(isc_task_t *task, isc_event_t *event) {
dns_view_t *view, *view_next;
ns_server_t *server = (ns_server_t *) event->arg;
(void)task;
isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
@@ -570,13 +615,58 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
ns_rootns_destroy();
ns_server_destroy(&server);
isc_event_free(&event);
}
isc_result_t
ns_server_init(void) {
ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
ns_server_t *server = isc_mem_get(mctx, sizeof(*server));
if (server == NULL)
return (ISC_R_NOMEMORY);
server->mctx = mctx;
/* Initialize. */
server->recursion = ISC_TRUE;
server->auth_nxdomain = ISC_FALSE; /* Was true in BIND 8 */
server->transfer_format = dns_one_answer;
server->queryacl = NULL;
server->recursionacl = NULL;
server->transferacl = NULL;
server->magic = NS_SERVER_MAGIC;
*serverp = server;
return (ISC_R_SUCCESS);
}
void
ns_server_destroy(ns_server_t **serverp) {
ns_server_t *server = *serverp;
REQUIRE(NS_SERVER_VALID(server));
if (server->queryacl != NULL)
dns_acl_detach(&server->queryacl);
if (server->recursionacl != NULL)
dns_acl_detach(&server->recursionacl);
if (server->transferacl != NULL)
dns_acl_detach(&server->transferacl);
server->magic = 0;
isc_mem_put(server->mctx, server, sizeof(*server));
}
isc_result_t
ns_server_init() {
isc_result_t result;
/*
* Create the server object.
*/
result = ns_server_create(ns_g_mctx, &ns_g_server);
if (result != ISC_R_SUCCESS)
return (result);
/*
* Setup default root server hints.
*/
@@ -596,10 +686,10 @@ ns_server_init(void) {
result = isc_task_create(ns_g_taskmgr, ns_g_mctx, 0, &server_task);
if (result != ISC_R_SUCCESS)
goto cleanup_rootns;
result = isc_task_onshutdown(server_task, shutdown_server, NULL);
result = isc_task_onshutdown(server_task, shutdown_server, ns_g_server);
if (result != ISC_R_SUCCESS)
goto cleanup_task;
result = isc_app_onrun(ns_g_mctx, server_task, run_server, NULL);
result = isc_app_onrun(ns_g_mctx, server_task, run_server, ns_g_server);
if (result != ISC_R_SUCCESS)
goto cleanup_task;
bin/named/update.c
+4 -4
View File
@@ -28,7 +28,7 @@
#include <isc/result.h>
#include <isc/taskpool.h>
#include <dns/aml.h>
#include <dns/acl.h>
#include <dns/confip.h>
#include <dns/db.h>
#include <dns/dbiterator.h>
@@ -1943,9 +1943,9 @@ update_action(isc_task_t *task, isc_event_t *event)
* Check Requestor's Permissions. It seems a bit silly to do this
* only after prerequisite testing, but that is what RFC2136 says.
*/
CHECK(dns_aml_checkrequest(client->signer, ns_client_getsockaddr(client),
ns_g_confctx->acls, "update",
dns_zone_getupdateacl(zone),
CHECK(dns_acl_checkrequest(client->signer,
ns_client_getsockaddr(client),
"update", dns_zone_getupdateacl(zone),
NULL, ISC_FALSE));
/* Perform the Update Section Prescan. */
bin/named/xfrout.c
+6 -6
View File
@@ -15,7 +15,7 @@
* SOFTWARE.
*/
/* $Id: xfrout.c,v 1.29 1999/12/16 02:59:32 gson Exp $ */
/* $Id: xfrout.c,v 1.30 1999/12/16 23:11:02 gson Exp $ */
#include <config.h>
@@ -31,7 +31,7 @@
#include <isc/result.h>
#include <isc/timer.h>
#include <dns/aml.h>
#include <dns/acl.h>
#include <dns/db.h>
#include <dns/dbiterator.h>
#include <dns/fixedname.h>
@@ -52,6 +52,7 @@
#include <named/client.h>
#include <named/globals.h>
#include <named/log.h>
#include <named/server.h>
#include <named/xfrout.h>
/*
@@ -890,12 +891,11 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype)
mnemonic);
/* Decide whether to allow this transfer. */
CHECK(dns_aml_checkrequest(client->signer,
CHECK(dns_acl_checkrequest(client->signer,
ns_client_getsockaddr(client),
ns_g_confctx->acls,
"zone transfer",
dns_zone_getxfracl(zone),
ns_g_confctx->options->transferacl,
ns_g_server->transferacl,
ISC_TRUE));
/* AXFR over UDP is not possible. */
@@ -1275,7 +1275,7 @@ sendstream(xfrout_ctx_t *xfr)
CHECK(result);
/* XXX per-server, too */
if (ns_g_confctx->options->transfer_format == dns_one_answer)
if (ns_g_server->transfer_format == dns_one_answer)
break;
}
bin/named/zoneconf.c
+416
View File
@@ -0,0 +1,416 @@
/*
* Copyright (C) 1999 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
* ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
* CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
* DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
* PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
* ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
* SOFTWARE.
*/
#include <config.h>
#include <isc/assertions.h>
#include <isc/error.h>
#include <isc/mem.h>
#include <isc/result.h>
#include <dns/aclconf.h>
#include <dns/types.h>
#include <dns/zone.h>
#include <dns/zoneconf.h>
/* XXX copied from zone.c */
#define MAX_XFER_TIME (2*3600) /* Documented default is 2 hours. */
/*
* Convenience function for configuring a single zone ACL.
*/
static isc_result_t
configure_zone_acl(dns_c_zone_t *czone, dns_c_ctx_t *cctx,
dns_aclconfctx_t *aclconfctx, dns_zone_t *zone,
isc_result_t (*getcacl)(dns_c_zone_t *, dns_c_ipmatchlist_t **),
void (*setzacl)(dns_zone_t *, dns_acl_t *),
void (*clearzacl)(dns_zone_t *))
{
isc_result_t result;
dns_c_ipmatchlist_t *cacl;
dns_acl_t *dacl = NULL;
result = (*getcacl)(czone, &cacl);
if (result == ISC_R_SUCCESS) {
result = dns_acl_fromconfig(cacl, cctx, aclconfctx,
dns_zone_getmctx(zone), &dacl);
dns_c_ipmatchlist_detach(&cacl);
if (result != DNS_R_SUCCESS)
return (result);
(*setzacl)(zone, dacl);
dns_acl_detach(&dacl);
return (ISC_R_SUCCESS);
} else if (result == ISC_R_NOTFOUND) {
(*clearzacl)(zone);
return (ISC_R_SUCCESS);
} else {
return (result);
}
}
dns_result_t
dns_zone_configure(isc_log_t *lctx, dns_c_ctx_t *ctx, dns_aclconfctx_t *ac,
dns_c_zone_t *czone, dns_zone_t *zone)
{
isc_result_t result;
isc_boolean_t boolean;
const char *filename = NULL;
dns_c_severity_t severity;
dns_c_iplist_t *iplist = NULL;
dns_c_pubkey_t *pubkey = NULL;
dns_c_pklist_t *pubkeylist = NULL;
isc_uint32_t i;
isc_sockaddr_t sockaddr;
isc_int32_t maxxfr;
isc_int32_t idle;
in_port_t port;
const char *origin;
isc_sockaddr_t sockaddr_any;
ctx = ctx; /* unused */
lctx = lctx; /* XXX unused */
isc_sockaddr_fromin6(&sockaddr_any, &in6addr_any, 0);
dns_zone_setclass(zone, czone->zclass);
origin = NULL;
result = dns_c_zone_getname(czone, &origin);
if (result != DNS_R_SUCCESS)
return (result);
/* XXX casting away const */
result = dns_zone_setorigin(zone, (char *) origin);
if (result != DNS_R_SUCCESS)
return (result);
/* XXX needs to be an zone option */
result = dns_zone_setdbtype(zone, "rbt");
if (result != DNS_R_SUCCESS)
return (result);
switch (czone->ztype) {
case dns_c_zone_master:
dns_zone_settype(zone, dns_zone_master);
result = dns_c_zone_getfile(czone, &filename);
if (result != ISC_R_SUCCESS)
return (result);
result = dns_zone_setdatabase(zone, filename);
if (result != DNS_R_SUCCESS)
return (result);
result = dns_c_zone_getchecknames(czone, &severity);
if (result == ISC_R_SUCCESS)
dns_zone_setchecknames(zone, severity);
else
dns_zone_setchecknames(zone, dns_c_severity_fail);
result = configure_zone_acl(czone, ctx, ac, zone,
dns_c_zone_getallowupd,
dns_zone_setupdateacl,
dns_zone_clearupdateacl);
if (result != DNS_R_SUCCESS)
return (result);
result = configure_zone_acl(czone, ctx, ac, zone,
dns_c_zone_getallowquery,
dns_zone_setqueryacl,
dns_zone_clearqueryacl);
if (result != DNS_R_SUCCESS)
return (result);
result = configure_zone_acl(czone, ctx, ac, zone,
dns_c_zone_getallowquery,
dns_zone_setqueryacl,
dns_zone_clearqueryacl);
if (result != DNS_R_SUCCESS)
return (result);
result = configure_zone_acl(czone, ctx, ac, zone,
dns_c_zone_getallowtransfer,
dns_zone_setxfracl,
dns_zone_clearxfracl);
if (result != DNS_R_SUCCESS)
return (result);
result = dns_c_zone_getdialup(czone, &boolean);
if (result == ISC_R_SUCCESS)
dns_zone_setoption(zone, DNS_ZONE_O_DIALUP, boolean);
else
dns_zone_clearoption(zone, DNS_ZONE_O_DIALUP);
result = dns_c_zone_getnotify(czone, &boolean);
if (result == ISC_R_SUCCESS)
dns_zone_setoption(zone, DNS_ZONE_O_NOTIFY, boolean);
else
dns_zone_clearoption(zone, DNS_ZONE_O_NOTIFY);
result = dns_c_zone_getalsonotify(czone, &iplist);
if (result == ISC_R_SUCCESS) {
for (i = 0; i < iplist->nextidx; i++) {
result = dns_zone_addnotify(zone,
&iplist->ips[i]);
if (result != DNS_R_SUCCESS)
return (result);
}
} else
dns_zone_clearnotify(zone);
#if 1 /* XXX brister */
result = dns_c_zone_getpubkeylist(czone, &pubkeylist);
if (result == ISC_R_SUCCESS) {
pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
}
dns_zone_setpubkey(zone, pubkey);
#else
result = dns_c_zone_getpubkey(czone, &pubkey);
if (result == ISC_R_SUCCESS)
dns_zone_setpubkey(zone, pubkey);
else
dns_zone_setpubkey(zone, NULL);
#endif
result = dns_c_zone_getmaxtranstimeout(czone, &maxxfr);
if (result == ISC_R_SUCCESS)
dns_zone_setmaxxfrout(zone, maxxfr);
else
dns_zone_setmaxxfrout(zone, MAX_XFER_TIME);
result = dns_c_zone_getmaxtransidleout(czone, &idle);
if (result == ISC_R_SUCCESS)
dns_zone_setidleout(zone, idle);
else
dns_zone_setidleout(zone, 0);
break;
case dns_c_zone_forward:
#ifdef notyet
/*
* forward zones are still in a state of flux
*/
czone->u.fzone.check_names; /* XXX unused in BIND 8 */
czone->u.fzone.forward; /* XXX*/
czone->u.fzone.forwarders; /* XXX*/
#endif
break;
case dns_c_zone_slave:
dns_zone_settype(zone, dns_zone_slave);
result = dns_c_zone_getfile(czone, &filename);
if (result != ISC_R_SUCCESS)
return (result);
result = dns_zone_setdatabase(zone, filename);
if (result != DNS_R_SUCCESS)
return (result);
result = dns_c_zone_getchecknames(czone, &severity);
if (result == ISC_R_SUCCESS)
dns_zone_setchecknames(zone, severity);
else
dns_zone_setchecknames(zone, dns_c_severity_warn);
result = configure_zone_acl(czone, ctx, ac, zone,
dns_c_zone_getallowquery,
dns_zone_setqueryacl,
dns_zone_clearqueryacl);
if (result != DNS_R_SUCCESS)
return (result);
#if 1 /* XXX brister */
result = dns_c_zone_getpubkeylist(czone, &pubkeylist);
if (result == ISC_R_SUCCESS) {
pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
}
dns_zone_setpubkey(zone, pubkey);
#else
result = dns_c_zone_getpubkey(czone, &pubkey);
if (result == ISC_R_SUCCESS)
dns_zone_setpubkey(zone, pubkey);
else
dns_zone_setpubkey(zone, NULL);
#endif
result = dns_c_zone_getmasterport(czone, &port);
if (result != ISC_R_SUCCESS)
port = 53;
dns_zone_setmasterport(zone, port);
result = dns_c_zone_getmasterips(czone, &iplist);
if (result == ISC_R_SUCCESS) {
for (i = 0; i < iplist->nextidx; i++) {
result = dns_zone_addmaster(zone,
&iplist->ips[i]);
if (result != DNS_R_SUCCESS)
return (result);
}
} else
dns_zone_clearmasters(zone);
result = dns_c_zone_getmaxtranstimein(czone, &maxxfr);
if (result == ISC_R_SUCCESS)
dns_zone_setmaxxfrin(zone, maxxfr);
else
dns_zone_setmaxxfrin(zone, MAX_XFER_TIME);
result = dns_c_zone_gettransfersource(czone, &sockaddr);
if (result == ISC_R_SUCCESS)
dns_zone_setxfrsource(zone, &sockaddr);
else
dns_zone_setxfrsource(zone, &sockaddr_any);
result = dns_c_zone_getmaxtransidlein(czone, &idle);
if (result == ISC_R_SUCCESS)
dns_zone_setidlein(zone, idle);
else
dns_zone_setidlein(zone, 0);
result = dns_c_zone_getmaxtranstimeout(czone, &maxxfr);
if (result == ISC_R_SUCCESS)
dns_zone_setmaxxfrout(zone, maxxfr);
else
dns_zone_setmaxxfrout(zone, MAX_XFER_TIME);
result = dns_c_zone_getmaxtransidleout(czone, &idle);
if (result == ISC_R_SUCCESS)
dns_zone_setidleout(zone, idle);
else
dns_zone_setidleout(zone, 0);
break;
case dns_c_zone_stub:
dns_zone_settype(zone, dns_zone_stub);
result = dns_c_zone_getfile(czone, &filename);
if (result != ISC_R_SUCCESS)
return (result);
result = dns_zone_setdatabase(zone, filename);
if (result != DNS_R_SUCCESS)
return (result);
result = dns_c_zone_getchecknames(czone, &severity);
if (result == ISC_R_SUCCESS)
dns_zone_setchecknames(zone, severity);
else
dns_zone_setchecknames(zone, dns_c_severity_warn);
result = configure_zone_acl(czone, ctx, ac, zone,
dns_c_zone_getallowquery,
dns_zone_setqueryacl,
dns_zone_clearqueryacl);
if (result != DNS_R_SUCCESS)
return (result);
#if 1 /* XXX brister */
result = dns_c_zone_getpubkeylist(czone, &pubkeylist);
if (result == ISC_R_SUCCESS) {
pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
}
dns_zone_setpubkey(zone, pubkey);
#else
result = dns_c_zone_getpubkey(czone, &pubkey);
if (result == ISC_R_SUCCESS)
dns_zone_setpubkey(zone, pubkey);
else
dns_zone_setpubkey(zone, NULL);
#endif
result = dns_c_zone_getmasterport(czone, &port);
if (result != ISC_R_SUCCESS)
port = 53;
dns_zone_setmasterport(zone, port);
result = dns_c_zone_getmasterips(czone, &iplist);
if (result == ISC_R_SUCCESS) {
for (i = 0; i < iplist->nextidx; i++) {
result = dns_zone_addmaster(zone,
&iplist->ips[i]);
if (result != DNS_R_SUCCESS)
return (result);
}
} else
dns_zone_clearmasters(zone);
result = dns_c_zone_getmaxtranstimein(czone, &maxxfr);
if (result == ISC_R_SUCCESS)
dns_zone_setmaxxfrin(zone, maxxfr);
else
dns_zone_setmaxxfrin(zone, MAX_XFER_TIME);
result = dns_c_zone_gettransfersource(czone, &sockaddr);
if (result == ISC_R_SUCCESS)
dns_zone_setxfrsource(zone, &sockaddr);
else
dns_zone_setxfrsource(zone, &sockaddr_any);
result = dns_c_zone_getmaxtransidlein(czone, &idle);
if (result == ISC_R_SUCCESS)
dns_zone_setidlein(zone, idle);
else
dns_zone_setidlein(zone, 0);
break;
case dns_c_zone_hint:
dns_zone_settype(zone, dns_zone_hint);
result = dns_c_zone_getfile(czone, &filename);
if (result != ISC_R_SUCCESS)
return (result);
result = dns_zone_setdatabase(zone, filename);
if (result != DNS_R_SUCCESS)
return (result);
result = dns_c_zone_getchecknames(czone, &severity);
if (result == ISC_R_SUCCESS)
dns_zone_setchecknames(zone, severity);
else
dns_zone_setchecknames(zone, dns_c_severity_fail);
#if 1 /* XXX brister */
result = dns_c_zone_getpubkeylist(czone, &pubkeylist);
if (result == ISC_R_SUCCESS) {
pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
}
dns_zone_setpubkey(zone, pubkey);
#else
result = dns_c_zone_getpubkey(czone, &pubkey);
if (result == ISC_R_SUCCESS)
dns_zone_setpubkey(zone, pubkey);
else
dns_zone_setpubkey(zone, NULL);
#endif
break;
}
return (DNS_R_SUCCESS);
}
lib/dns/Makefile.in
+6 -4
View File
@@ -114,7 +114,8 @@ DNSSAFEOBJS = sec/dnssafe/ahchdig.@O@ sec/dnssafe/ahchencr.@O@ \
sec/dnssafe/seccbce.@O@ sec/dnssafe/surrendr.@O@
# Alphabetically
OBJS = a6.@O@ adb.@O@ aml.@O@ cache.@O@ callbacks.@O@ compress.@O@ \
OBJS = a6.@O@ acl.@O@ aclconf.@O@ adb.@O@ \
cache.@O@ callbacks.@O@ compress.@O@ \
db.@O@ dbiterator.@O@ dbtable.@O@ dispatch.@O@ dnssec.@O@ \
journal.@O@ lib.@O@ log.@O@ \
master.@O@ masterdump.@O@ message.@O@ \
@@ -123,11 +124,12 @@ OBJS = a6.@O@ adb.@O@ aml.@O@ cache.@O@ callbacks.@O@ compress.@O@ \
rdataset.@O@ rdatasetiter.@O@ rdataslab.@O@ resolver.@O@ \
result.@O@ \
tcpmsg.@O@ time.@O@ tkey.@O@ tsig.@O@ ttl.@O@ \
version.@O@ view.@O@ xfrin.@O@ zone.@O@ zt.@O@ \
version.@O@ view.@O@ xfrin.@O@ zone.@O@ zoneconf.@O@ zt.@O@ \
${DSTOBJS} ${OPENSSLOBJS} ${DNSSAFEOBJS} ${CONFOBJS}
# Alphabetically
SRCS = a6.c adb.c aml.c cache.c callbacks.c compress.c \
SRCS = a6.c acl.c aclconf.c adb.c \
cache.c callbacks.c compress.c \
db.c dbiterator.c dbtable.c dispatch.c dnssec.c \
journal.c lib.c log.c \
master.c masterdump.c message.c \
@@ -136,7 +138,7 @@ SRCS = a6.c adb.c aml.c cache.c callbacks.c compress.c \
rdataset.c rdatasetiter.c rdataslab.c resolver.c \
result.c \
tcpmsg.c time.c tkey.c tsig.c ttl.c \
version.c view.c xfrin.c zone.c zt.c
version.c view.c xfrin.c zone.c zoneconf.c zt.c
SUBDIRS = include sec config
TARGETS = include/dns/enumtype.h include/dns/enumclass.h \
lib/dns/acl.c
+226
View File
@@ -0,0 +1,226 @@
/*
* Copyright (C) 1999 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
* ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
* CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
* DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
* PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
* ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
* SOFTWARE.
*/
#include <config.h>
#include <isc/assertions.h>
#include <isc/error.h>
#include <isc/mem.h>
#include <isc/result.h>
#include <dns/acl.h>
#include <dns/log.h>
#include <dns/result.h>
#include <dns/types.h>
isc_result_t
dns_acl_checkrequest(dns_name_t *signer, isc_sockaddr_t *reqaddr,
const char *opname,
dns_acl_t *main_acl,
dns_acl_t *fallback_acl,
isc_boolean_t default_allow)
{
isc_result_t result;
int match;
dns_acl_t *acl = NULL;
if (main_acl != NULL)
acl = main_acl;
else if (fallback_acl != NULL)
acl = fallback_acl;
else if (default_allow)
goto allow;
else
goto deny;
result = dns_acl_match(reqaddr, signer, acl,
&match, NULL);
if (result != DNS_R_SUCCESS)
goto deny; /* Internal error, already logged. */
if (match > 0)
goto allow;
goto deny; /* Negative match or no match. */
allow:
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
DNS_LOGMODULE_ACL, ISC_LOG_DEBUG(3),
"%s approved", opname);
return (DNS_R_SUCCESS);
deny:
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
DNS_LOGMODULE_ACL, ISC_LOG_ERROR,
"%s denied", opname);
return (DNS_R_REFUSED);
}
isc_result_t
dns_acl_match(isc_sockaddr_t *reqaddr,
dns_name_t *reqsigner,
dns_acl_t *acl,
int *match,
dns_aclelement_t **matchelt)
{
isc_result_t result;
unsigned int i;
int indirectmatch;
REQUIRE(matchelt == NULL || *matchelt == NULL);
for (i = 0; i < acl->length; i++) {
dns_aclelement_t *e = &acl->elements[i];
switch (e->type) {
case dns_aclelementtype_ipprefix:
if (isc_sockaddr_eqaddrprefix(reqaddr,
&e->u.ip_prefix.address,
e->u.ip_prefix.prefixlen))
goto matched;
break;
case dns_aclelementtype_keyname:
if (reqsigner != NULL &&
dns_name_equal(reqsigner, &e->u.keyname))
goto matched;
break;
case dns_aclelementtype_nestedacl:
result = dns_acl_match(reqaddr, reqsigner,
e->u.nestedacl,
&indirectmatch, matchelt);
if (result != ISC_R_SUCCESS)
return (result);
/*
* Treat negative matches in indirect ACLs as
* "no match".
* That way, a negated indirect ACL will never become
* a surprise positive match through double negation.
*/
if (indirectmatch > 0)
goto matched;
/*
* A negative indirect match may have set *matchelt,
* but we don't want it set when we return.
*/
if (matchelt != NULL)
*matchelt = NULL;
break;
matched:
*match = e->negative ? -(i+1) : (i+1);
if (matchelt != NULL)
*matchelt = e;
return (ISC_R_SUCCESS);
case dns_aclelementtype_localhost:
case dns_aclelementtype_localnets:
default:
INSIST(0);
break;
}
}
/* No match. */
*match = 0;
return (ISC_R_SUCCESS);
}
void
dns_acl_attach(dns_acl_t *source, dns_acl_t **target)
{
REQUIRE(DNS_ACL_VALID(source));
INSIST(source->refcount > 0);
source->refcount++;
*target = source;
}
static void
destroy(dns_acl_t *dacl)
{
unsigned int i;
for (i = 0; i < dacl->length; i++) {
dns_aclelement_t *de = &dacl->elements[i];
switch (de->type) {
case dns_aclelementtype_keyname:
dns_name_free(&de->u.keyname, dacl->mctx);
break;
case dns_aclelementtype_nestedacl:
dns_acl_detach(&de->u.nestedacl);
break;
default:
break;
}
}
if (dacl->elements != NULL)
isc_mem_put(dacl->mctx, dacl->elements,
dacl->alloc * sizeof(dns_aclelement_t));
dacl->magic = 0;
isc_mem_put(dacl->mctx, dacl, sizeof(*dacl));
}
void
dns_acl_detach(dns_acl_t **aclp)
{
dns_acl_t *acl = *aclp;
REQUIRE(DNS_ACL_VALID(acl));
INSIST(acl->refcount > 0);
acl->refcount--;
if (acl->refcount == 0)
destroy(acl);
*aclp = NULL;
}
isc_boolean_t
dns_aclelement_equal(dns_aclelement_t *ea, dns_aclelement_t *eb)
{
if (ea->type != eb->type)
return (ISC_FALSE);
switch (ea->type) {
case dns_aclelementtype_ipprefix:
if (ea->u.ip_prefix.prefixlen !=
eb->u.ip_prefix.prefixlen)
return (ISC_FALSE);
return (isc_sockaddr_equal(&ea->u.ip_prefix.address,
&eb->u.ip_prefix.address));
case dns_aclelementtype_keyname:
return (dns_name_equal(&ea->u.keyname, &eb->u.keyname));
case dns_aclelementtype_nestedacl:
return (dns_acl_equal(ea->u.nestedacl, eb->u.nestedacl));
case dns_aclelementtype_localhost:
case dns_aclelementtype_localnets:
return (ISC_TRUE);
default:
INSIST(0);
return (ISC_FALSE);
}
}
isc_boolean_t
dns_acl_equal(dns_acl_t *a, dns_acl_t *b) {
unsigned int i;
if (a == b)
return (ISC_TRUE);
if (a->length != b->length)
return (ISC_FALSE);
for (i = 0; i < a->length; i++) {
if (! dns_aclelement_equal(&a->elements[i],
&b->elements[i]))
return (ISC_FALSE);
}
return (ISC_TRUE);
}
lib/dns/aclconf.c
+208
View File
@@ -0,0 +1,208 @@
/*
* Copyright (C) 1999 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
* ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
* CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
* DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
* PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
* ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
* SOFTWARE.
*/
#include <config.h>
#include <isc/assertions.h>
#include <isc/mem.h>
#include <isc/result.h>
#include <dns/aclconf.h>
#include <dns/fixedname.h>
#include <dns/types.h>
#include <dns/zone.h>
void dns_aclconfctx_init(dns_aclconfctx_t *ctx)
{
ISC_LIST_INIT(ctx->named_acl_cache);
}
void dns_aclconfctx_destroy(dns_aclconfctx_t *ctx)
{
dns_acl_t *dacl, *next;
for (dacl = ISC_LIST_HEAD(ctx->named_acl_cache);
dacl != NULL;
dacl = next)
{
next = ISC_LIST_NEXT(dacl, nextincache);
dacl->name = NULL;
dns_acl_detach(&dacl);
}
}
static isc_result_t
convert_named_acl(char *aclname, dns_c_ctx_t *cctx,
dns_aclconfctx_t *ctx, isc_mem_t *mctx,
dns_acl_t **target)
{
isc_result_t result;
dns_c_acl_t *cacl;
dns_acl_t *dacl;
/* Look for an already-converted version. */
for (dacl = ISC_LIST_HEAD(ctx->named_acl_cache);
dacl != NULL;
dacl = ISC_LIST_NEXT(dacl, nextincache))
{
if (strcmp(aclname, dacl->name) == 0) {
dns_acl_attach(dacl, target);
return ISC_R_SUCCESS;
}
}
/* Not yet converted. Convert now. */
result = dns_c_acltable_getacl(cctx->acls, aclname, &cacl);
if (result != DNS_R_SUCCESS) {
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
DNS_LOGMODULE_ACL, ISC_LOG_WARNING,
"undefined ACL \"%s\"", aclname);
return (result);
}
result = dns_acl_fromconfig(cacl->ipml, cctx, ctx, mctx, &dacl);
if (result != DNS_R_SUCCESS)
return (result);
dacl->name = aclname;
ISC_LIST_APPEND(ctx->named_acl_cache, dacl, nextincache);
dns_acl_attach(dacl, target);
return (ISC_R_SUCCESS);
}
static isc_result_t
convert_keyname(char *txtname, isc_mem_t *mctx, dns_name_t *dnsname) {
isc_result_t result;
isc_buffer_t buf;
dns_fixedname_t fixname;
unsigned int keylen;
keylen = strlen(txtname);
isc_buffer_init(&buf, txtname, keylen, ISC_BUFFERTYPE_TEXT);
isc_buffer_add(&buf, keylen);
dns_fixedname_init(&fixname);
result = dns_name_fromtext(dns_fixedname_name(&fixname), &buf,
dns_rootname, ISC_FALSE, NULL);
if (result != ISC_R_SUCCESS) {
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
DNS_LOGMODULE_ACL, ISC_LOG_WARNING,
"key name \"%s\" is not a valid domain name",
txtname);
return (result);
}
return (dns_name_dup(dns_fixedname_name(&fixname), mctx, dnsname));
}
isc_result_t
dns_acl_fromconfig(dns_c_ipmatchlist_t *caml,
dns_c_ctx_t *cctx,
dns_aclconfctx_t *ctx,
isc_mem_t *mctx,
dns_acl_t **target)
{
isc_result_t result;
unsigned int count;
dns_acl_t *dacl = NULL;
dns_aclelement_t *de;
dns_c_ipmatchelement_t *ce;
REQUIRE(target != NULL && *target == NULL);
count = 0;
for (ce = ISC_LIST_HEAD(caml->elements);
ce != NULL;
ce = ISC_LIST_NEXT(ce, next))
count++;
dacl = isc_mem_get(mctx, sizeof(*dacl));
if (dacl == NULL)
return (ISC_R_NOMEMORY);
dacl->mctx = mctx;
dacl->name = NULL;
dacl->refcount = 1;
dacl->elements = NULL;
dacl->alloc = 0;
dacl->length = 0;
ISC_LINK_INIT(dacl, nextincache);
/* Must set magic early because we use dns_acl_detach() to clean up. */
dacl->magic = DNS_ACL_MAGIC;
dacl->elements = isc_mem_get(mctx, count * sizeof(dns_aclelement_t));
if (dacl->elements == NULL) {
result = ISC_R_NOMEMORY;
goto cleanup;
}
dacl->alloc = count;
memset(dacl->elements, 0, count * sizeof(dns_aclelement_t));
de = dacl->elements;
for (ce = ISC_LIST_HEAD(caml->elements);
ce != NULL;
ce = ISC_LIST_NEXT(ce, next))
{
de->negative = dns_c_ipmatchelement_isneg(ce);
switch (ce->type) {
case dns_c_ipmatch_pattern:
de->type = dns_aclelementtype_ipprefix;
de->u.ip_prefix.address = ce->u.direct.address;
/* XXX "mask" is a misnomer */
de->u.ip_prefix.prefixlen = ce->u.direct.mask;
break;
case dns_c_ipmatch_key:
de->type = dns_aclelementtype_keyname;
dns_name_init(&de->u.keyname, NULL);
result = convert_keyname(ce->u.key, mctx, &de->u.keyname);
if (result != ISC_R_SUCCESS)
goto cleanup;
break;
case dns_c_ipmatch_indirect:
de->type = dns_aclelementtype_nestedacl;
result = dns_acl_fromconfig(ce->u.indirect.list, cctx,
ctx, mctx, &de->u.nestedacl);
if (result != ISC_R_SUCCESS)
goto cleanup;
break;
case dns_c_ipmatch_localhost:
de->type = dns_aclelementtype_localhost;
break;
case dns_c_ipmatch_localnets:
de->type = dns_aclelementtype_localnets;
break;
case dns_c_ipmatch_acl:
de->type = dns_aclelementtype_nestedacl;
result = convert_named_acl(ce->u.aclname, cctx,
ctx, mctx, &de->u.nestedacl);
if (result != ISC_R_SUCCESS)
goto cleanup;
break;
default:
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
DNS_LOGMODULE_ACL, ISC_LOG_WARNING,
"address match list contains "
"unsupported element type");
result = ISC_R_FAILURE;
goto cleanup;
}
de++;
dacl->length++;
}
*target = dacl;
return (ISC_R_SUCCESS);
cleanup:
dns_acl_detach(&dacl);
return (result);
}
lib/dns/aml.c
-216
View File
@@ -1,216 +0,0 @@
/*
* Copyright (C) 1999 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
* ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
* CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
* DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
* PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
* ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
* SOFTWARE.
*/
#include <config.h>
#include <isc/assertions.h>
#include <isc/error.h>
#include <isc/mem.h>
#include <isc/result.h>
#include <dns/aml.h>
#include <dns/fixedname.h>
#include <dns/log.h>
#include <dns/result.h>
#include <dns/types.h>
isc_result_t
dns_aml_checkrequest(dns_name_t *signer, isc_sockaddr_t *reqaddr,
dns_c_acltable_t *acltable, const char *opname,
dns_c_ipmatchlist_t *main_aml,
dns_c_ipmatchlist_t *fallback_aml,
isc_boolean_t default_allow)
{
isc_result_t result;
int match;
dns_c_ipmatchlist_t *aml = NULL;
if (main_aml != NULL)
aml = main_aml;
else if (fallback_aml != NULL)
aml = fallback_aml;
else if (default_allow)
goto allow;
else
goto deny;
result = dns_aml_match(reqaddr, signer, aml,
acltable, &match, NULL);
if (result != DNS_R_SUCCESS)
goto deny; /* Internal error, already logged. */
if (match > 0)
goto allow;
goto deny; /* Negative match or no match. */
allow:
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
DNS_LOGMODULE_AML, ISC_LOG_DEBUG(3),
"%s approved", opname);
return (DNS_R_SUCCESS);
deny:
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
DNS_LOGMODULE_AML, ISC_LOG_ERROR,
"%s denied", opname);
return (DNS_R_REFUSED);
}
static isc_result_t
signer_matches(dns_name_t *signer, char *keyname, isc_boolean_t *match)
{
isc_result_t result;
isc_buffer_t buf;
dns_fixedname_t fixname;
unsigned int keylen;
keylen = strlen(keyname);
isc_buffer_init(&buf, keyname, keylen, ISC_BUFFERTYPE_TEXT);
isc_buffer_add(&buf, keylen);
dns_fixedname_init(&fixname);
result = dns_name_fromtext(dns_fixedname_name(&fixname), &buf,
dns_rootname, ISC_FALSE, NULL);
if (result != ISC_R_SUCCESS) {
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
DNS_LOGMODULE_AML, ISC_LOG_WARNING,
"key name \"%s\" is not a valid domain name",
keyname);
return (result);
}
*match = dns_name_equal(signer, dns_fixedname_name(&fixname));
return (ISC_R_SUCCESS);
}
isc_result_t
dns_aml_match(isc_sockaddr_t *reqaddr,
dns_name_t *reqsigner,
dns_c_ipmatchlist_t *aml,
dns_c_acltable_t *acltable,
int *match,
dns_c_ipmatchelement_t **matchelt)
{
isc_result_t result;
dns_c_ipmatchelement_t *e;
int distance;
int indirectmatch;
dns_c_acl_t *acl = NULL;
REQUIRE(matchelt == NULL || *matchelt == NULL);
for (e = ISC_LIST_HEAD(aml->elements), distance = 1;
e != NULL;
e = ISC_LIST_NEXT(e, next), distance++)
{
dns_c_ipmatchlist_t *indirect_acl = NULL;
switch (e->type) {
case dns_c_ipmatch_pattern:
/* XXX "mask" is a misnomer, should be
"prefix length" */
if (isc_sockaddr_eqaddrprefix(reqaddr,
&e->u.direct.address,
e->u.direct.mask))
goto matched;
break;
case dns_c_ipmatch_key:
if (reqsigner != NULL) {
isc_boolean_t match;
result = signer_matches(reqsigner, e->u.key,
&match);
if (result != ISC_R_SUCCESS)
return (result);
if (match == ISC_TRUE)
goto matched;
}
break;
case dns_c_ipmatch_indirect:
indirect_acl = e->u.indirect.list;
goto indirect;
#ifdef notyet
case dns_c_ipmatch_localhost:
indirect_acl = localhost_acl;
goto indirect;
case dns_c_ipmatch_localnets:
indirect_acl = localnets_acl;
goto indirect;
#else
case dns_c_ipmatch_localhost:
case dns_c_ipmatch_localnets:
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
DNS_LOGMODULE_AML, ISC_LOG_WARNING,
"the \"localhost\" and \"localnets\""
"ACLs are not yet supported");
return (ISC_R_NOTIMPLEMENTED);
#endif
case dns_c_ipmatch_acl:
result = dns_c_acltable_getacl(acltable,
e->u.aclname,
&acl);
if (result == ISC_R_SUCCESS) {
indirect_acl = acl->ipml;
goto indirect;
}
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
DNS_LOGMODULE_AML, ISC_LOG_WARNING,
"undefined ACL \"%s\"", e->u.aclname);
return (result);
default:
isc_log_write(dns_lctx, DNS_LOGCATEGORY_SECURITY,
DNS_LOGMODULE_AML, ISC_LOG_WARNING,
"address match list contains "
"unsupported element type");
break;
indirect:
INSIST(indirect_acl != NULL);
result = dns_aml_match(reqaddr, reqsigner,
indirect_acl, acltable,
&indirectmatch, matchelt);
if (result != DNS_R_SUCCESS)
return (result);
/*
* Treat negative matches in indirect AMLs as
* "no match".
* That way, a negated indirect AML will never become
* a surprise positive match through double negation.
*/
if (indirectmatch > 0)
goto matched;
/* A negative indirect match may have set *matchelt. */
if (matchelt != NULL)
*matchelt = NULL;
break;
matched:
*match = dns_c_ipmatchelement_isneg(e) ?
-distance : distance;
if (matchelt != NULL)
*matchelt = e;
return (ISC_R_SUCCESS);
}
}
/* No match. */
*match = 0;
return (ISC_R_SUCCESS);
}
lib/dns/include/dns/aml.h → lib/dns/include/dns/acl.h
+66 -25
View File
@@ -15,8 +15,8 @@
* SOFTWARE.
*/
#ifndef DNS_AML_H
#define DNS_AML_H 1
#ifndef DNS_ACL_H
#define DNS_ACL_H 1
/*****
***** Module Info
@@ -31,35 +31,78 @@
***/
#include <dns/types.h>
#include <dns/name.h>
#include <isc/sockaddr.h>
#include <dns/confacl.h>
#include <dns/confip.h>
/***
*** Types
***/
typedef enum {
dns_aclelementtype_ipprefix,
dns_aclelementtype_keyname,
dns_aclelementtype_nestedacl,
dns_aclelementtype_localhost,
dns_aclelementtype_localnets,
} dns_aclelemettype_t;
struct dns_aclelement {
dns_aclelemettype_t type;
isc_boolean_t negative;
union {
struct {
isc_sockaddr_t address; /* IP4/IP6 */
unsigned int prefixlen;
} ip_prefix;
dns_name_t keyname;
dns_acl_t *nestedacl;
} u;
};
struct dns_acl {
isc_uint32_t magic;
isc_mem_t *mctx;
unsigned int refcount;
dns_aclelement_t *elements;
unsigned int alloc; /* Elements allocated */
unsigned int length; /* Elements initialized */
char *name; /* Temporary use only */
ISC_LINK(dns_acl_t) nextincache; /* Ditto */
};
#define DNS_ACL_MAGIC 0x4461636c /* Dacl */
#define DNS_ACL_VALID(a) ((a) != NULL && \
(a)->magic == DNS_ACL_MAGIC)
/***
*** Functions
***/
ISC_LANG_BEGINDECLS
void dns_acl_attach(dns_acl_t *source, dns_acl_t **target);
void dns_acl_detach(dns_acl_t **aclp);
isc_boolean_t
dns_aclelement_equal(dns_aclelement_t *ea, dns_aclelement_t *eb);
isc_boolean_t dns_acl_equal(dns_acl_t *a, dns_acl_t *b);
isc_result_t
dns_aml_checkrequest(dns_name_t *signer, isc_sockaddr_t *reqaddr,
dns_c_acltable_t *acltable, const char *opname,
dns_c_ipmatchlist_t *main_aml,
dns_c_ipmatchlist_t *fallback_aml,
dns_acl_checkrequest(dns_name_t *signer, isc_sockaddr_t *reqaddr,
const char *opname,
dns_acl_t *main_acl,
dns_acl_t *fallback_acl,
isc_boolean_t default_allow);
/*
* Convenience function for "typical" DNS request permission checking.
*
* Check the DNS request signed by the key whose name is 'signer',
* from IP address 'reqaddr', against the address match list 'main_aml'.
*
* If main_aml is NULL,
* check against 'fallback_aml' instead. If fallback_aml
* from IP address 'reqaddr', against 'main_acl'. If main_acl is NULL,
* check against 'fallback_acl' instead. If fallback_acl
* is also NULL, allow the request iff 'default_allow' is ISC_TRUE.
* Log the outcome of the check if deemed appropriate.
*
* Any ACL references in the address match lists are resolved against
* 'acltable'. Log messages will refer to the request as an 'opname' request.
* Log messages will refer to the request as an 'opname' request.
*
* Notes:
* This is appropriate for checking allow-update,
@@ -71,10 +114,9 @@ dns_aml_checkrequest(dns_name_t *signer, isc_sockaddr_t *reqaddr,
* Requires:
* 'signer' points to a valid name or is NULL.
* 'reqaddr' points to a valid socket address.
* 'acltable' points to a valid ACL table.
* 'opname' points to a null-terminated string.
* 'main_aml' points to a valid address match list, or is NULL.
* 'fallback_aml' points to a valid address match list, or is NULL.
* 'main_acl' points to a valid address match list, or is NULL.
* 'fallback_acl' points to a valid address match list, or is NULL.
*
* Returns:
* ISC_R_SUCCESS if the request should be allowed
@@ -83,18 +125,17 @@ dns_aml_checkrequest(dns_name_t *signer, isc_sockaddr_t *reqaddr,
*/
isc_result_t
dns_aml_match(isc_sockaddr_t *reqaddr,
dns_acl_match(isc_sockaddr_t *reqaddr,
dns_name_t *reqsigner,
dns_c_ipmatchlist_t *aml,
dns_c_acltable_t *acltable,
dns_acl_t *acl,
int *match,
dns_c_ipmatchelement_t **matchelt);
dns_aclelement_t **matchelt);
/*
* General, low-level address match list matching. This is expected to
* General, low-level ACL matching. This is expected to
* be useful even for weird stuff like the topology and sortlist statements.
*
* Match the address 'reqaddr', and optionally the key name 'reqsigner',
* against the address match list 'aml'. 'reqsigner' may be NULL.
* against 'acl'. 'reqsigner' may be NULL.
*
* If there is a positive match, '*match' will be set to a positive value
* indicating the distance from the beginning of the list.
@@ -112,4 +153,4 @@ dns_aml_match(isc_sockaddr_t *reqaddr,
ISC_LANG_ENDDECLS
#endif /* DNS_AML_H */
#endif /* DNS_ACL_H */
lib/dns/include/dns/aclconf.h
+50
View File
@@ -0,0 +1,50 @@
/*
* Copyright (C) 1999 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
* ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
* CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
* DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
* PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
* ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
* SOFTWARE.
*/
#ifndef DNS_ACLCONF_H
#define DNS_ACLCONF_H 1
#include <dns/acl.h>
#include <dns/aclconf.h>
#include <dns/confacl.h>
#include <dns/confctx.h>
#include <dns/confip.h>
typedef struct {
ISC_LIST(dns_acl_t) named_acl_cache;
} dns_aclconfctx_t;
/***
*** Functions
***/
ISC_LANG_BEGINDECLS
void dns_aclconfctx_init(dns_aclconfctx_t *ctx);
void dns_aclconfctx_destroy(dns_aclconfctx_t *ctx);
isc_result_t
dns_acl_fromconfig(dns_c_ipmatchlist_t *caml,
dns_c_ctx_t *cctx,
dns_aclconfctx_t *ctx,
isc_mem_t *mctx,
dns_acl_t **target);
ISC_LANG_ENDDECLS
#endif /* DNS_ACLCONF_H */
lib/dns/include/dns/log.h
+2 -2
View File
@@ -15,7 +15,7 @@
* SOFTWARE.
*/
/* $Id: log.h,v 1.8 1999/11/30 22:04:56 gson Exp $ */
/* $Id: log.h,v 1.9 1999/12/16 23:11:06 gson Exp $ */
/* Principal Authors: DCL */
@@ -56,7 +56,7 @@ extern isc_logmodule_t dns_modules[];
#define DNS_LOGMODULE_ADB (&dns_modules[12])
#define DNS_LOGMODULE_XFER_IN (&dns_modules[13])
#define DNS_LOGMODULE_XFER_OUT (&dns_modules[14])
#define DNS_LOGMODULE_AML (&dns_modules[15])
#define DNS_LOGMODULE_ACL (&dns_modules[15])
dns_result_t
dns_log_init(isc_log_t *lctx);
lib/dns/include/dns/types.h
+2
View File
@@ -87,6 +87,8 @@ typedef struct dns_a6context dns_a6context_t;
typedef struct dns_rbt dns_rbt_t;
typedef struct dns_zt dns_zt_t;
typedef struct dns_cache dns_cache_t;
typedef struct dns_aclelement dns_aclelement_t;
typedef struct dns_acl dns_acl_t;
typedef enum {
dns_labeltype_ordinary = 0,
lib/dns/include/dns/zone.h
+12 -18
View File
@@ -449,7 +449,7 @@ dns_zone_getxfrsource(dns_zone_t *zone);
* 'zone' to be a valid initalised zone.
*/
void dns_zone_setqueryacl(dns_zone_t *zone, dns_c_ipmatchlist_t *acl);
void dns_zone_setqueryacl(dns_zone_t *zone, dns_acl_t *acl);
/*
* Sets the query acl list for the zone.
*
@@ -458,7 +458,7 @@ void dns_zone_setqueryacl(dns_zone_t *zone, dns_c_ipmatchlist_t *acl);
* 'acl' to be initalised.
*/
void dns_zone_setupdateacl(dns_zone_t *zone, dns_c_ipmatchlist_t *acl);
void dns_zone_setupdateacl(dns_zone_t *zone, dns_acl_t *acl);
/*
* Sets the update acl list for the zone.
*
@@ -467,7 +467,7 @@ void dns_zone_setupdateacl(dns_zone_t *zone, dns_c_ipmatchlist_t *acl);
* 'acl' to be initalised.
*/
void dns_zone_setxfracl(dns_zone_t *zone, dns_c_ipmatchlist_t *acl);
void dns_zone_setxfracl(dns_zone_t *zone, dns_acl_t *acl);
/*
* Sets the transfer acl list for the zone.
*
@@ -476,7 +476,7 @@ void dns_zone_setxfracl(dns_zone_t *zone, dns_c_ipmatchlist_t *acl);
* 'acl' to be initalised.
*/
dns_c_ipmatchlist_t * dns_zone_getqueryacl(dns_zone_t *zone);
dns_acl_t * dns_zone_getqueryacl(dns_zone_t *zone);
/*
* Returns the current query acl or NULL.
*
@@ -488,7 +488,7 @@ dns_c_ipmatchlist_t * dns_zone_getqueryacl(dns_zone_t *zone);
* NULL
*/
dns_c_ipmatchlist_t * dns_zone_getupdateacl(dns_zone_t *zone);
dns_acl_t * dns_zone_getupdateacl(dns_zone_t *zone);
/*
* Returns the current update acl or NULL.
*
@@ -500,7 +500,7 @@ dns_c_ipmatchlist_t * dns_zone_getupdateacl(dns_zone_t *zone);
* NULL
*/
dns_c_ipmatchlist_t * dns_zone_getxfracl(dns_zone_t *zone);
dns_acl_t * dns_zone_getxfracl(dns_zone_t *zone);
/*
* Returns the current transfer acl or NULL.
*
@@ -578,18 +578,6 @@ isc_uint16_t dns_zone_getmasterport(dns_zone_t *zone);
void dns_zone_setresolver(dns_zone_t *zone, dns_resolver_t *resolver);
dns_result_t dns_zone_copy(isc_log_t *lctx, dns_c_ctx_t *ctx,
dns_c_zone_t *czone, dns_zone_t *zone);
/*
* Copy the zone configuration information into the zone structure.
*
* Require:
* 'lctx' to be initalised or NULL.
* 'ctx' to be initalised or NULL.
* 'czone' to be initalised.
* 'zone' to be initalised.
*/
dns_result_t dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
dns_message_t *msg);
@@ -784,6 +772,12 @@ dns_zone_print(dns_zone_t *zone);
* test use only
*/
isc_mem_t *
dns_zone_getmctx(dns_zone_t *zone);
/*
* Get the memory context of a zone.
*/
isc_result_t
dns_zonemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
isc_timermgr_t *timermgr, isc_socketmgr_t *socketmgr,
lib/dns/include/dns/zoneconf.h
+51
View File
@@ -0,0 +1,51 @@
/*
* Copyright (C) 1999 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
* ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
* CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
* DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
* PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
* ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
* SOFTWARE.
*/
#ifndef NS_ZONECONF_H
#define NS_ZONECONF_H 1
#include <isc/types.h>
#include <dns/acl.h>
#include <dns/confacl.h>
#include <dns/confip.h>
/*
* Create a dns_acl_t from the corresponding configuration data structure,
* 'caml'. References to named ACLs in caml are resolved against the ACL
* table in 'cctx'.
*/
dns_result_t dns_zone_configure(isc_log_t *lctx, dns_c_ctx_t *ctx,
dns_aclconfctx_t *ac,
dns_c_zone_t *czone, dns_zone_t *zone);
/*
* Configure or reconfigure a zone according to the named.conf
* data in 'ctx' and 'czone'.
*
* Require:
* 'lctx' to be initalised or NULL.
* 'ctx' to be initalised or NULL.
* 'ac' to point to an initialized ns_aclconfctx_t.
* 'czone' to be initalised.
* 'zone' to be initalised.
*/
ISC_LANG_ENDDECLS
#endif /* NS_ZONECONF_H */
lib/dns/log.c
+2 -2
View File
@@ -15,7 +15,7 @@
* SOFTWARE.
*/
/* $Id: log.c,v 1.8 1999/11/30 22:04:56 gson Exp $ */
/* $Id: log.c,v 1.9 1999/12/16 23:11:05 gson Exp $ */
/* Principal Authors: DCL */
@@ -62,7 +62,7 @@ isc_logmodule_t dns_modules[] = {
{ "dns/adb", 0 },
{ "dns/xfrin", 0 },
{ "dns/xfrout", 0 },
{ "dns/aml", 0 },
{ "dns/acl", 0 },
{ NULL, 0 }
};
lib/dns/zone.c
+31 -381
View File
@@ -15,7 +15,7 @@
* SOFTWARE.
*/
/* $Id: zone.c,v 1.47 1999/12/16 22:24:19 explorer Exp $ */
/* $Id: zone.c,v 1.48 1999/12/16 23:11:05 gson Exp $ */
#include <config.h>
@@ -31,6 +31,7 @@
#include <isc/timer.h>
#include <isc/util.h>
#include <dns/acl.h>
#include <dns/confparser.h>
#include <dns/db.h>
#include <dns/dbiterator.h>
@@ -142,9 +143,9 @@ struct dns_zone {
isc_task_t * task;
isc_sockaddr_t xfrsource;
/* Access Control Lists */
dns_c_ipmatchlist_t *update_acl;
dns_c_ipmatchlist_t *query_acl;
dns_c_ipmatchlist_t *xfr_acl;
dns_acl_t *update_acl;
dns_acl_t *query_acl;
dns_acl_t *xfr_acl;
dns_c_severity_t check_names;
dns_c_pubkey_t *pubkey;
ISC_LIST(dns_zone_checkservers_t) checkservers;
@@ -372,11 +373,11 @@ zone_free(dns_zone_t *zone) {
zone->check_names = dns_c_severity_ignore;
zone->pubkey = NULL; /* XXX detach */
if (zone->update_acl != NULL)
dns_c_ipmatchlist_detach(&zone->update_acl);
dns_acl_detach(&zone->update_acl);
if (zone->query_acl != NULL)
dns_c_ipmatchlist_detach(&zone->query_acl);
dns_acl_detach(&zone->query_acl);
if (zone->xfr_acl != NULL)
dns_c_ipmatchlist_detach(&zone->xfr_acl);
dns_acl_detach(&zone->xfr_acl);
if (dns_name_dynamic(&zone->origin))
dns_name_free(&zone->origin, zone->mctx);
@@ -1229,6 +1230,11 @@ dns_zone_print(dns_zone_t *zone) {
PRINT_ZONE_REF(zone);
}
isc_mem_t *
dns_zone_getmctx(dns_zone_t *zone) {
return zone->mctx;
}
static dns_result_t
dns_zone_tostr(dns_zone_t *zone, isc_mem_t *mctx, char **s) {
isc_buffer_t tbuf;
@@ -2420,399 +2426,43 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
return (DNS_R_SUCCESS);
}
/*
* Copy / translate zone configuration data to dns_zone_t.
*/
dns_result_t
dns_zone_copy(isc_log_t *lctx, dns_c_ctx_t *ctx, dns_c_zone_t *czone,
dns_zone_t *zone) {
isc_result_t iresult;
dns_result_t result;
isc_boolean_t boolean;
const char *filename = NULL;
dns_c_ipmatchlist_t *acl = 0;
dns_c_severity_t severity;
dns_c_iplist_t *iplist = NULL;
dns_c_pubkey_t *pubkey = NULL;
dns_c_pklist_t *pubkeylist = NULL;
isc_uint32_t i;
isc_sockaddr_t sockaddr;
isc_int32_t maxxfr;
isc_int32_t idle;
in_port_t port;
const char *origin;
char *o;
isc_sockaddr_t sockaddr_any;
ctx = ctx; /* unused */
lctx = lctx; /* XXX unused */
isc_sockaddr_fromin6(&sockaddr_any, &in6addr_any, 0);
dns_zone_setclass(zone, czone->zclass);
origin = NULL;
result = dns_c_zone_getname(czone, &origin);
if (result != DNS_R_SUCCESS)
return (result);
o = isc_mem_strdup(zone->mctx, origin);
if (o == NULL)
return (DNS_R_NOMEMORY);
result = dns_zone_setorigin(zone, o);
isc_mem_free(zone->mctx, o);
if (result != DNS_R_SUCCESS)
return (result);
/* XXX needs to be an zone option */
result = dns_zone_setdbtype(zone, "rbt");
if (result != DNS_R_SUCCESS)
return (result);
switch (czone->ztype) {
case dns_c_zone_master:
dns_zone_settype(zone, dns_zone_master);
iresult = dns_c_zone_getfile(czone, &filename);
if (iresult != ISC_R_SUCCESS)
return (iresult);
result = dns_zone_setdatabase(zone, filename);
if (result != DNS_R_SUCCESS)
return (iresult);
iresult = dns_c_zone_getchecknames(czone, &severity);
if (iresult == ISC_R_SUCCESS)
dns_zone_setchecknames(zone, severity);
else
dns_zone_setchecknames(zone, dns_c_severity_fail);
iresult = dns_c_zone_getallowupd(czone, &acl);
if (iresult == ISC_R_SUCCESS) {
dns_zone_setupdateacl(zone, acl);
dns_c_ipmatchlist_detach(&acl);
} else
dns_zone_clearupdateacl(zone);
iresult = dns_c_zone_getallowquery(czone, &acl);
if (iresult == ISC_R_SUCCESS) {
dns_zone_setqueryacl(zone, acl);
dns_c_ipmatchlist_detach(&acl);
} else
dns_zone_clearqueryacl(zone);
iresult = dns_c_zone_getallowtransfer(czone, &acl);
if (iresult == ISC_R_SUCCESS) {
dns_zone_setxfracl(zone, acl);
dns_c_ipmatchlist_detach(&acl);
} else
dns_zone_clearxfracl(zone);
iresult = dns_c_zone_getdialup(czone, &boolean);
if (iresult == ISC_R_SUCCESS)
dns_zone_setoption(zone, DNS_ZONE_O_DIALUP, boolean);
else
dns_zone_clearoption(zone, DNS_ZONE_O_DIALUP);
iresult = dns_c_zone_getnotify(czone, &boolean);
if (iresult == ISC_R_SUCCESS)
dns_zone_setoption(zone, DNS_ZONE_O_NOTIFY, boolean);
else
dns_zone_clearoption(zone, DNS_ZONE_O_NOTIFY);
iresult = dns_c_zone_getalsonotify(czone, &iplist);
if (iresult == ISC_R_SUCCESS) {
for (i = 0; i < iplist->nextidx; i++) {
result = dns_zone_addnotify(zone,
&iplist->ips[i]);
if (result != DNS_R_SUCCESS)
return (result);
}
} else
dns_zone_clearnotify(zone);
#if 1 /* XXX brister */
iresult = dns_c_zone_getpubkeylist(czone, &pubkeylist);
if (iresult == ISC_R_SUCCESS) {
pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
}
dns_zone_setpubkey(zone, pubkey);
#else
iresult = dns_c_zone_getpubkey(czone, &pubkey);
if (iresult == ISC_R_SUCCESS)
dns_zone_setpubkey(zone, pubkey);
else
dns_zone_setpubkey(zone, NULL);
#endif
iresult = dns_c_zone_getmaxtranstimeout(czone, &maxxfr);
if (result == ISC_R_SUCCESS)
zone->maxxfrout = maxxfr;
else
zone->maxxfrout = MAX_XFER_TIME;
iresult = dns_c_zone_getmaxtransidleout(czone, &idle);
if (iresult == ISC_R_SUCCESS)
dns_zone_setidleout(zone, idle);
else
dns_zone_setidleout(zone, 0);
break;
case dns_c_zone_forward:
#ifdef notyet
/*
* forward zones are still in a state of flux
*/
czone->u.fzone.check_names; /* XXX unused in BIND 8 */
czone->u.fzone.forward; /* XXX*/
czone->u.fzone.forwarders; /* XXX*/
#endif
break;
case dns_c_zone_slave:
dns_zone_settype(zone, dns_zone_slave);
iresult = dns_c_zone_getfile(czone, &filename);
if (iresult != ISC_R_SUCCESS)
return (iresult);
result = dns_zone_setdatabase(zone, filename);
if (result != DNS_R_SUCCESS)
return (iresult);
iresult = dns_c_zone_getchecknames(czone, &severity);
if (iresult == ISC_R_SUCCESS)
dns_zone_setchecknames(zone, severity);
else
dns_zone_setchecknames(zone, dns_c_severity_warn);
iresult = dns_c_zone_getallowquery(czone, &acl);
if (iresult == ISC_R_SUCCESS) {
dns_zone_setqueryacl(zone, acl);
dns_c_ipmatchlist_detach(&acl);
} else
dns_zone_clearqueryacl(zone);
#if 1 /* XXX brister */
iresult = dns_c_zone_getpubkeylist(czone, &pubkeylist);
if (iresult == ISC_R_SUCCESS) {
pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
}
dns_zone_setpubkey(zone, pubkey);
#else
iresult = dns_c_zone_getpubkey(czone, &pubkey);
if (iresult == ISC_R_SUCCESS)
dns_zone_setpubkey(zone, pubkey);
else
dns_zone_setpubkey(zone, NULL);
#endif
iresult = dns_c_zone_getmasterport(czone, &port);
if (iresult != ISC_R_SUCCESS)
port = 53;
dns_zone_setmasterport(zone, port);
iresult = dns_c_zone_getmasterips(czone, &iplist);
if (iresult == ISC_R_SUCCESS) {
for (i = 0; i < iplist->nextidx; i++) {
result = dns_zone_addmaster(zone,
&iplist->ips[i]);
if (result != DNS_R_SUCCESS)
return (result);
}
} else
dns_zone_clearmasters(zone);
iresult = dns_c_zone_getmaxtranstimein(czone, &maxxfr);
if (result == ISC_R_SUCCESS)
zone->maxxfrin = maxxfr;
else
zone->maxxfrin = MAX_XFER_TIME;
iresult = dns_c_zone_gettransfersource(czone, &sockaddr);
if (iresult == ISC_R_SUCCESS)
zone->xfrsource = sockaddr;
else
zone->xfrsource = sockaddr_any;
iresult = dns_c_zone_getmaxtransidlein(czone, &idle);
if (iresult == ISC_R_SUCCESS)
dns_zone_setidlein(zone, idle);
else
dns_zone_setidlein(zone, 0);
iresult = dns_c_zone_getmaxtranstimeout(czone, &maxxfr);
if (result == ISC_R_SUCCESS)
zone->maxxfrout = maxxfr;
else
zone->maxxfrout = MAX_XFER_TIME;
iresult = dns_c_zone_getmaxtransidleout(czone, &idle);
if (iresult == ISC_R_SUCCESS)
dns_zone_setidleout(zone, idle);
else
dns_zone_setidleout(zone, 0);
break;
case dns_c_zone_stub:
dns_zone_settype(zone, dns_zone_stub);
iresult = dns_c_zone_getfile(czone, &filename);
if (iresult != ISC_R_SUCCESS)
return (iresult);
result = dns_zone_setdatabase(zone, filename);
if (result != DNS_R_SUCCESS)
return (iresult);
iresult = dns_c_zone_getchecknames(czone, &severity);
if (iresult == ISC_R_SUCCESS)
dns_zone_setchecknames(zone, severity);
else
dns_zone_setchecknames(zone, dns_c_severity_warn);
iresult = dns_c_zone_getallowquery(czone, &acl);
if (iresult == ISC_R_SUCCESS) {
dns_zone_setqueryacl(zone, acl);
dns_c_ipmatchlist_detach(&acl);
} else
dns_zone_clearqueryacl(zone);
#if 1 /* XXX brister */
iresult = dns_c_zone_getpubkeylist(czone, &pubkeylist);
if (iresult == ISC_R_SUCCESS) {
pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
}
dns_zone_setpubkey(zone, pubkey);
#else
iresult = dns_c_zone_getpubkey(czone, &pubkey);
if (iresult == ISC_R_SUCCESS)
dns_zone_setpubkey(zone, pubkey);
else
dns_zone_setpubkey(zone, NULL);
#endif
iresult = dns_c_zone_getmasterport(czone, &port);
if (iresult != ISC_R_SUCCESS)
port = 53;
dns_zone_setmasterport(zone, port);
iresult = dns_c_zone_getmasterips(czone, &iplist);
if (iresult == ISC_R_SUCCESS) {
for (i = 0; i < iplist->nextidx; i++) {
result = dns_zone_addmaster(zone,
&iplist->ips[i]);
if (result != DNS_R_SUCCESS)
return (result);
}
} else
dns_zone_clearmasters(zone);
iresult = dns_c_zone_getmaxtranstimein(czone, &maxxfr);
if (result == ISC_R_SUCCESS)
zone->maxxfrin = maxxfr;
else
zone->maxxfrin = MAX_XFER_TIME;
iresult = dns_c_zone_gettransfersource(czone, &sockaddr);
if (iresult == ISC_R_SUCCESS)
zone->xfrsource = sockaddr;
else
zone->xfrsource = sockaddr_any;
iresult = dns_c_zone_getmaxtransidlein(czone, &idle);
if (iresult == ISC_R_SUCCESS)
dns_zone_setidlein(zone, idle);
else
dns_zone_setidlein(zone, 0);
break;
case dns_c_zone_hint:
dns_zone_settype(zone, dns_zone_hint);
iresult = dns_c_zone_getfile(czone, &filename);
if (iresult != ISC_R_SUCCESS)
return (iresult);
result = dns_zone_setdatabase(zone, filename);
if (result != DNS_R_SUCCESS)
return (result);
iresult = dns_c_zone_getchecknames(czone, &severity);
if (iresult == ISC_R_SUCCESS)
dns_zone_setchecknames(zone, severity);
else
dns_zone_setchecknames(zone, dns_c_severity_fail);
#if 1 /* XXX brister */
iresult = dns_c_zone_getpubkeylist(czone, &pubkeylist);
if (iresult == ISC_R_SUCCESS) {
pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
}
dns_zone_setpubkey(zone, pubkey);
#else
iresult = dns_c_zone_getpubkey(czone, &pubkey);
if (iresult == ISC_R_SUCCESS)
dns_zone_setpubkey(zone, pubkey);
else
dns_zone_setpubkey(zone, NULL);
#endif
break;
}
return (DNS_R_SUCCESS);
}
void
dns_zone_setqueryacl(dns_zone_t *zone, dns_c_ipmatchlist_t *acl) {
dns_zone_setqueryacl(dns_zone_t *zone, dns_acl_t *acl) {
REQUIRE(DNS_ZONE_VALID(zone));
LOCK(&zone->lock);
if (zone->query_acl != NULL)
dns_c_ipmatchlist_detach(&zone->query_acl);
dns_c_ipmatchlist_attach(acl, &zone->query_acl);
dns_acl_detach(&zone->query_acl);
dns_acl_attach(acl, &zone->query_acl);
UNLOCK(&zone->lock);
}
void
dns_zone_setupdateacl(dns_zone_t *zone, dns_c_ipmatchlist_t *acl) {
dns_zone_setupdateacl(dns_zone_t *zone, dns_acl_t *acl) {
REQUIRE(DNS_ZONE_VALID(zone));
LOCK(&zone->lock);
if (zone->update_acl != NULL)
dns_c_ipmatchlist_detach(&zone->update_acl);
dns_c_ipmatchlist_attach(acl, &zone->update_acl);
dns_acl_detach(&zone->update_acl);
dns_acl_attach(acl, &zone->update_acl);
UNLOCK(&zone->lock);
}
void
dns_zone_setxfracl(dns_zone_t *zone, dns_c_ipmatchlist_t *acl) {
dns_zone_setxfracl(dns_zone_t *zone, dns_acl_t *acl) {
REQUIRE(DNS_ZONE_VALID(zone));
LOCK(&zone->lock);
if (zone->xfr_acl != NULL)
dns_c_ipmatchlist_detach(&zone->xfr_acl);
dns_c_ipmatchlist_attach(acl, &zone->xfr_acl);
dns_acl_detach(&zone->xfr_acl);
dns_acl_attach(acl, &zone->xfr_acl);
UNLOCK(&zone->lock);
}
dns_c_ipmatchlist_t *
dns_acl_t *
dns_zone_getqueryacl(dns_zone_t *zone) {
REQUIRE(DNS_ZONE_VALID(zone));
@@ -2820,7 +2470,7 @@ dns_zone_getqueryacl(dns_zone_t *zone) {
return (zone->query_acl);
}
dns_c_ipmatchlist_t *
dns_acl_t *
dns_zone_getupdateacl(dns_zone_t *zone) {
REQUIRE(DNS_ZONE_VALID(zone));
@@ -2828,7 +2478,7 @@ dns_zone_getupdateacl(dns_zone_t *zone) {
return (zone->update_acl);
}
dns_c_ipmatchlist_t *
dns_acl_t *
dns_zone_getxfracl(dns_zone_t *zone) {
REQUIRE(DNS_ZONE_VALID(zone));
@@ -2843,7 +2493,7 @@ dns_zone_clearupdateacl(dns_zone_t *zone) {
LOCK(&zone->lock);
if (zone->update_acl != NULL)
dns_c_ipmatchlist_detach(&zone->update_acl);
dns_acl_detach(&zone->update_acl);
UNLOCK(&zone->lock);
}
@@ -2854,7 +2504,7 @@ dns_zone_clearqueryacl(dns_zone_t *zone) {
LOCK(&zone->lock);
if (zone->query_acl != NULL)
dns_c_ipmatchlist_detach(&zone->query_acl);
dns_acl_detach(&zone->query_acl);
UNLOCK(&zone->lock);
}
@@ -2865,7 +2515,7 @@ dns_zone_clearxfracl(dns_zone_t *zone) {
LOCK(&zone->lock);
if (zone->xfr_acl != NULL)
dns_c_ipmatchlist_detach(&zone->xfr_acl);
dns_acl_detach(&zone->xfr_acl);
UNLOCK(&zone->lock);
}
@@ -3160,13 +2810,13 @@ dns_zone_equal(dns_zone_t *oldzone, dns_zone_t *newzone) {
&newzone->masters[i]))
goto false;
if (!dns_c_ipmatchlist_equal(oldzone->update_acl, newzone->update_acl))
if (!dns_acl_equal(oldzone->update_acl, newzone->update_acl))
goto false;
if (!dns_c_ipmatchlist_equal(oldzone->query_acl, newzone->query_acl))
if (!dns_acl_equal(oldzone->query_acl, newzone->query_acl))
goto false;
if (!dns_c_ipmatchlist_equal(oldzone->xfr_acl, newzone->xfr_acl))
if (!dns_acl_equal(oldzone->xfr_acl, newzone->xfr_acl))
goto false;
if (!dns_c_pubkey_equal(oldzone->pubkey, newzone->pubkey))
lib/dns/zoneconf.c
+416
View File
@@ -0,0 +1,416 @@
/*
* Copyright (C) 1999 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
* ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
* CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
* DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
* PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
* ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
* SOFTWARE.
*/
#include <config.h>
#include <isc/assertions.h>
#include <isc/error.h>
#include <isc/mem.h>
#include <isc/result.h>
#include <dns/aclconf.h>
#include <dns/types.h>
#include <dns/zone.h>
#include <dns/zoneconf.h>
/* XXX copied from zone.c */
#define MAX_XFER_TIME (2*3600) /* Documented default is 2 hours. */
/*
* Convenience function for configuring a single zone ACL.
*/
static isc_result_t
configure_zone_acl(dns_c_zone_t *czone, dns_c_ctx_t *cctx,
dns_aclconfctx_t *aclconfctx, dns_zone_t *zone,
isc_result_t (*getcacl)(dns_c_zone_t *, dns_c_ipmatchlist_t **),
void (*setzacl)(dns_zone_t *, dns_acl_t *),
void (*clearzacl)(dns_zone_t *))
{
isc_result_t result;
dns_c_ipmatchlist_t *cacl;
dns_acl_t *dacl = NULL;
result = (*getcacl)(czone, &cacl);
if (result == ISC_R_SUCCESS) {
result = dns_acl_fromconfig(cacl, cctx, aclconfctx,
dns_zone_getmctx(zone), &dacl);
dns_c_ipmatchlist_detach(&cacl);
if (result != DNS_R_SUCCESS)
return (result);
(*setzacl)(zone, dacl);
dns_acl_detach(&dacl);
return (ISC_R_SUCCESS);
} else if (result == ISC_R_NOTFOUND) {
(*clearzacl)(zone);
return (ISC_R_SUCCESS);
} else {
return (result);
}
}
dns_result_t
dns_zone_configure(isc_log_t *lctx, dns_c_ctx_t *ctx, dns_aclconfctx_t *ac,
dns_c_zone_t *czone, dns_zone_t *zone)
{
isc_result_t result;
isc_boolean_t boolean;
const char *filename = NULL;
dns_c_severity_t severity;
dns_c_iplist_t *iplist = NULL;
dns_c_pubkey_t *pubkey = NULL;
dns_c_pklist_t *pubkeylist = NULL;
isc_uint32_t i;
isc_sockaddr_t sockaddr;
isc_int32_t maxxfr;
isc_int32_t idle;
in_port_t port;
const char *origin;
isc_sockaddr_t sockaddr_any;
ctx = ctx; /* unused */
lctx = lctx; /* XXX unused */
isc_sockaddr_fromin6(&sockaddr_any, &in6addr_any, 0);
dns_zone_setclass(zone, czone->zclass);
origin = NULL;
result = dns_c_zone_getname(czone, &origin);
if (result != DNS_R_SUCCESS)
return (result);
/* XXX casting away const */
result = dns_zone_setorigin(zone, (char *) origin);
if (result != DNS_R_SUCCESS)
return (result);
/* XXX needs to be an zone option */
result = dns_zone_setdbtype(zone, "rbt");
if (result != DNS_R_SUCCESS)
return (result);
switch (czone->ztype) {
case dns_c_zone_master:
dns_zone_settype(zone, dns_zone_master);
result = dns_c_zone_getfile(czone, &filename);
if (result != ISC_R_SUCCESS)
return (result);
result = dns_zone_setdatabase(zone, filename);
if (result != DNS_R_SUCCESS)
return (result);
result = dns_c_zone_getchecknames(czone, &severity);
if (result == ISC_R_SUCCESS)
dns_zone_setchecknames(zone, severity);
else
dns_zone_setchecknames(zone, dns_c_severity_fail);
result = configure_zone_acl(czone, ctx, ac, zone,
dns_c_zone_getallowupd,
dns_zone_setupdateacl,
dns_zone_clearupdateacl);
if (result != DNS_R_SUCCESS)
return (result);
result = configure_zone_acl(czone, ctx, ac, zone,
dns_c_zone_getallowquery,
dns_zone_setqueryacl,
dns_zone_clearqueryacl);
if (result != DNS_R_SUCCESS)
return (result);
result = configure_zone_acl(czone, ctx, ac, zone,
dns_c_zone_getallowquery,
dns_zone_setqueryacl,
dns_zone_clearqueryacl);
if (result != DNS_R_SUCCESS)
return (result);
result = configure_zone_acl(czone, ctx, ac, zone,
dns_c_zone_getallowtransfer,
dns_zone_setxfracl,
dns_zone_clearxfracl);
if (result != DNS_R_SUCCESS)
return (result);
result = dns_c_zone_getdialup(czone, &boolean);
if (result == ISC_R_SUCCESS)
dns_zone_setoption(zone, DNS_ZONE_O_DIALUP, boolean);
else
dns_zone_clearoption(zone, DNS_ZONE_O_DIALUP);
result = dns_c_zone_getnotify(czone, &boolean);
if (result == ISC_R_SUCCESS)
dns_zone_setoption(zone, DNS_ZONE_O_NOTIFY, boolean);
else
dns_zone_clearoption(zone, DNS_ZONE_O_NOTIFY);
result = dns_c_zone_getalsonotify(czone, &iplist);
if (result == ISC_R_SUCCESS) {
for (i = 0; i < iplist->nextidx; i++) {
result = dns_zone_addnotify(zone,
&iplist->ips[i]);
if (result != DNS_R_SUCCESS)
return (result);
}
} else
dns_zone_clearnotify(zone);
#if 1 /* XXX brister */
result = dns_c_zone_getpubkeylist(czone, &pubkeylist);
if (result == ISC_R_SUCCESS) {
pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
}
dns_zone_setpubkey(zone, pubkey);
#else
result = dns_c_zone_getpubkey(czone, &pubkey);
if (result == ISC_R_SUCCESS)
dns_zone_setpubkey(zone, pubkey);
else
dns_zone_setpubkey(zone, NULL);
#endif
result = dns_c_zone_getmaxtranstimeout(czone, &maxxfr);
if (result == ISC_R_SUCCESS)
dns_zone_setmaxxfrout(zone, maxxfr);
else
dns_zone_setmaxxfrout(zone, MAX_XFER_TIME);
result = dns_c_zone_getmaxtransidleout(czone, &idle);
if (result == ISC_R_SUCCESS)
dns_zone_setidleout(zone, idle);
else
dns_zone_setidleout(zone, 0);
break;
case dns_c_zone_forward:
#ifdef notyet
/*
* forward zones are still in a state of flux
*/
czone->u.fzone.check_names; /* XXX unused in BIND 8 */
czone->u.fzone.forward; /* XXX*/
czone->u.fzone.forwarders; /* XXX*/
#endif
break;
case dns_c_zone_slave:
dns_zone_settype(zone, dns_zone_slave);
result = dns_c_zone_getfile(czone, &filename);
if (result != ISC_R_SUCCESS)
return (result);
result = dns_zone_setdatabase(zone, filename);
if (result != DNS_R_SUCCESS)
return (result);
result = dns_c_zone_getchecknames(czone, &severity);
if (result == ISC_R_SUCCESS)
dns_zone_setchecknames(zone, severity);
else
dns_zone_setchecknames(zone, dns_c_severity_warn);
result = configure_zone_acl(czone, ctx, ac, zone,
dns_c_zone_getallowquery,
dns_zone_setqueryacl,
dns_zone_clearqueryacl);
if (result != DNS_R_SUCCESS)
return (result);
#if 1 /* XXX brister */
result = dns_c_zone_getpubkeylist(czone, &pubkeylist);
if (result == ISC_R_SUCCESS) {
pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
}
dns_zone_setpubkey(zone, pubkey);
#else
result = dns_c_zone_getpubkey(czone, &pubkey);
if (result == ISC_R_SUCCESS)
dns_zone_setpubkey(zone, pubkey);
else
dns_zone_setpubkey(zone, NULL);
#endif
result = dns_c_zone_getmasterport(czone, &port);
if (result != ISC_R_SUCCESS)
port = 53;
dns_zone_setmasterport(zone, port);
result = dns_c_zone_getmasterips(czone, &iplist);
if (result == ISC_R_SUCCESS) {
for (i = 0; i < iplist->nextidx; i++) {
result = dns_zone_addmaster(zone,
&iplist->ips[i]);
if (result != DNS_R_SUCCESS)
return (result);
}
} else
dns_zone_clearmasters(zone);
result = dns_c_zone_getmaxtranstimein(czone, &maxxfr);
if (result == ISC_R_SUCCESS)
dns_zone_setmaxxfrin(zone, maxxfr);
else
dns_zone_setmaxxfrin(zone, MAX_XFER_TIME);
result = dns_c_zone_gettransfersource(czone, &sockaddr);
if (result == ISC_R_SUCCESS)
dns_zone_setxfrsource(zone, &sockaddr);
else
dns_zone_setxfrsource(zone, &sockaddr_any);
result = dns_c_zone_getmaxtransidlein(czone, &idle);
if (result == ISC_R_SUCCESS)
dns_zone_setidlein(zone, idle);
else
dns_zone_setidlein(zone, 0);
result = dns_c_zone_getmaxtranstimeout(czone, &maxxfr);
if (result == ISC_R_SUCCESS)
dns_zone_setmaxxfrout(zone, maxxfr);
else
dns_zone_setmaxxfrout(zone, MAX_XFER_TIME);
result = dns_c_zone_getmaxtransidleout(czone, &idle);
if (result == ISC_R_SUCCESS)
dns_zone_setidleout(zone, idle);
else
dns_zone_setidleout(zone, 0);
break;
case dns_c_zone_stub:
dns_zone_settype(zone, dns_zone_stub);
result = dns_c_zone_getfile(czone, &filename);
if (result != ISC_R_SUCCESS)
return (result);
result = dns_zone_setdatabase(zone, filename);
if (result != DNS_R_SUCCESS)
return (result);
result = dns_c_zone_getchecknames(czone, &severity);
if (result == ISC_R_SUCCESS)
dns_zone_setchecknames(zone, severity);
else
dns_zone_setchecknames(zone, dns_c_severity_warn);
result = configure_zone_acl(czone, ctx, ac, zone,
dns_c_zone_getallowquery,
dns_zone_setqueryacl,
dns_zone_clearqueryacl);
if (result != DNS_R_SUCCESS)
return (result);
#if 1 /* XXX brister */
result = dns_c_zone_getpubkeylist(czone, &pubkeylist);
if (result == ISC_R_SUCCESS) {
pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
}
dns_zone_setpubkey(zone, pubkey);
#else
result = dns_c_zone_getpubkey(czone, &pubkey);
if (result == ISC_R_SUCCESS)
dns_zone_setpubkey(zone, pubkey);
else
dns_zone_setpubkey(zone, NULL);
#endif
result = dns_c_zone_getmasterport(czone, &port);
if (result != ISC_R_SUCCESS)
port = 53;
dns_zone_setmasterport(zone, port);
result = dns_c_zone_getmasterips(czone, &iplist);
if (result == ISC_R_SUCCESS) {
for (i = 0; i < iplist->nextidx; i++) {
result = dns_zone_addmaster(zone,
&iplist->ips[i]);
if (result != DNS_R_SUCCESS)
return (result);
}
} else
dns_zone_clearmasters(zone);
result = dns_c_zone_getmaxtranstimein(czone, &maxxfr);
if (result == ISC_R_SUCCESS)
dns_zone_setmaxxfrin(zone, maxxfr);
else
dns_zone_setmaxxfrin(zone, MAX_XFER_TIME);
result = dns_c_zone_gettransfersource(czone, &sockaddr);
if (result == ISC_R_SUCCESS)
dns_zone_setxfrsource(zone, &sockaddr);
else
dns_zone_setxfrsource(zone, &sockaddr_any);
result = dns_c_zone_getmaxtransidlein(czone, &idle);
if (result == ISC_R_SUCCESS)
dns_zone_setidlein(zone, idle);
else
dns_zone_setidlein(zone, 0);
break;
case dns_c_zone_hint:
dns_zone_settype(zone, dns_zone_hint);
result = dns_c_zone_getfile(czone, &filename);
if (result != ISC_R_SUCCESS)
return (result);
result = dns_zone_setdatabase(zone, filename);
if (result != DNS_R_SUCCESS)
return (result);
result = dns_c_zone_getchecknames(czone, &severity);
if (result == ISC_R_SUCCESS)
dns_zone_setchecknames(zone, severity);
else
dns_zone_setchecknames(zone, dns_c_severity_fail);
#if 1 /* XXX brister */
result = dns_c_zone_getpubkeylist(czone, &pubkeylist);
if (result == ISC_R_SUCCESS) {
pubkey = ISC_LIST_HEAD(pubkeylist->keylist);
}
dns_zone_setpubkey(zone, pubkey);
#else
result = dns_c_zone_getpubkey(czone, &pubkey);
if (result == ISC_R_SUCCESS)
dns_zone_setpubkey(zone, pubkey);
else
dns_zone_setpubkey(zone, NULL);
#endif
break;
}
return (DNS_R_SUCCESS);
}
util/copyrights
+6 -2
View File
@@ -294,8 +294,9 @@
./lib/dns/.cvsignore X 1999
./lib/dns/Makefile.in MAKE 1998,1999
./lib/dns/a6.c C 1999
./lib/dns/acl.c C 1999
./lib/dns/aclconf.c C 1999
./lib/dns/adb.c C 1999
./lib/dns/aml.c C 1999
./lib/dns/api X 1999
./lib/dns/callbacks.c C 1999
./lib/dns/compress.c C 1999
@@ -330,8 +331,9 @@
./lib/dns/include/dns/.cvsignore X 1999
./lib/dns/include/dns/Makefile.in MAKE 1998,1999
./lib/dns/include/dns/a6.h C 1999
./lib/dns/include/dns/acl.h C 1999
./lib/dns/include/dns/aclconf.h C 1999
./lib/dns/include/dns/adb.h C 1999
./lib/dns/include/dns/aml.h C 1999
./lib/dns/include/dns/callbacks.h C 1999
./lib/dns/include/dns/cert.h C 1999
./lib/dns/include/dns/compress.h C 1999
@@ -391,6 +393,7 @@
./lib/dns/include/dns/view.h C 1999
./lib/dns/include/dns/xfrin.h C 1999
./lib/dns/include/dns/zone.h C 1999
./lib/dns/include/dns/zoneconf.h C 1999
./lib/dns/include/dns/zt.h C 1999
./lib/dns/journal.c C 1999
./lib/dns/lib.c C 1999
@@ -521,6 +524,7 @@
./lib/dns/view.c C 1999
./lib/dns/xfrin.c C 1999
./lib/dns/zone.c C 1999
./lib/dns/zoneconf.c C 1999
./lib/dns/zt.c C 1999
./lib/isc/.cvsignore X 1999
./lib/isc/Makefile.in MAKE 1998,1999