config.c 21.1 KB
Newer Older
1
/*
Automatic Updater's avatar
Automatic Updater committed
2
 * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
Mark Andrews's avatar
Mark Andrews committed
3
 * Copyright (C) 2001-2003  Internet Software Consortium.
4
 *
Automatic Updater's avatar
Automatic Updater committed
5
 * Permission to use, copy, modify, and/or distribute this software for any
6
7
8
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
Mark Andrews's avatar
Mark Andrews committed
9
10
11
12
13
14
15
 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
 * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 * PERFORMANCE OF THIS SOFTWARE.
16
17
 */

Automatic Updater's avatar
Automatic Updater committed
18
/* $Id: config.c,v 1.110 2010/06/22 23:46:52 tbox Exp $ */
19
20

/*! \file */
Brian Wellington's avatar
Brian Wellington committed
21
22

#include <config.h>
23
24
25
26
27
28

#include <stdlib.h>

#include <isc/buffer.h>
#include <isc/log.h>
#include <isc/mem.h>
29
#include <isc/parseint.h>
30
31
32
#include <isc/region.h>
#include <isc/result.h>
#include <isc/sockaddr.h>
Evan Hunt's avatar
Evan Hunt committed
33
#include <isc/string.h>
34
35
#include <isc/util.h>

36
#include <isccfg/namedconf.h>
37
38
39
40

#include <dns/fixedname.h>
#include <dns/name.h>
#include <dns/rdataclass.h>
41
#include <dns/rdatatype.h>
Brian Wellington's avatar
Brian Wellington committed
42
#include <dns/tsig.h>
43
44
#include <dns/zone.h>

45
46
#include <dst/dst.h>

47
48
49
#include <named/config.h>
#include <named/globals.h>

50
51
#include "bind.keys.h"

52
/*% default configuration */
53
54
static char defaultconf[] = "\
options {\n\
55
56
57
#	blackhole {none;};\n"
#ifndef WIN32
"	coresize default;\n\
58
	datasize default;\n\
59
	files unlimited;\n\
60
61
	stacksize default;\n"
#endif
62
63
64
"#	session-keyfile \"" NS_LOCALSTATEDIR "/run/named/session.key\";\n\
	session-keyname local-ddns;\n\
	session-keyalg hmac-sha256;\n\
65
	deallocate-on-exit true;\n\
66
67
68
69
#	directory <none>\n\
	dump-file \"named_dump.db\";\n\
	fake-iquery no;\n\
	has-old-clients false;\n\
70
	heartbeat-interval 60;\n\
71
	host-statistics no;\n\
72
	interface-interval 60;\n\
73
74
	listen-on {any;};\n\
	listen-on-v6 {none;};\n\
75
	match-mapped-addresses no;\n\
76
77
	memstatistics-file \"named.memstats\";\n\
	multiple-cnames no;\n\
78
#	named-xfer <obsolete>;\n\
79
#	pid-file \"" NS_LOCALSTATEDIR "/run/named/named.pid\"; /* or /lwresd.pid */\n\
80
	bindkeys-file \"" NS_SYSCONFDIR "/bind.keys\";\n\
81
	port 53;\n\
82
	recursing-file \"named.recursing\";\n\
83
84
"
#ifdef PATH_RANDOMDEV
85
86
"\
	random-device \"" PATH_RANDOMDEV "\";\n\
87
88
"
#endif
89
90
"\
	recursive-clients 1000;\n\
91
	rrset-order {type NS order random; order cyclic; };\n\
92
	serial-queries 20;\n\
93
	serial-query-rate 20;\n\
94
	server-id none;\n\
95
	statistics-file \"named.stats\";\n\
96
	statistics-interval 60;\n\
97
	tcp-clients 100;\n\
Michael Graff's avatar
Michael Graff committed
98
	tcp-listen-queue 3;\n\
99
100
101
102
103
104
105
106
107
#	tkey-dhkey <none>\n\
#	tkey-gssapi-credential <none>\n\
#	tkey-domain <none>\n\
	transfers-per-ns 2;\n\
	transfers-in 10;\n\
	transfers-out 10;\n\
	treat-cr-as-space true;\n\
	use-id-pool true;\n\
	use-ixfr true;\n\
108
	edns-udp-size 4096;\n\
109
	max-udp-size 4096;\n\
110
	request-nsid false;\n\
111
	reserved-sockets 512;\n\
112
113
114
\n\
	/* DLV */\n\
	dnssec-lookaside . trust-anchor dlv.isc.org;\n\
115
116
117
118
\n\
	/* view */\n\
	allow-notify {none;};\n\
	allow-update-forwarding {none;};\n\
119
	allow-query-cache { localnets; localhost; };\n\
120
	allow-query-cache-on { any; };\n\
121
	allow-recursion { localnets; localhost; };\n\
122
	allow-recursion-on { any; };\n\
123
#	allow-v6-synthesis <obsolete>;\n\
124
125
126
#	sortlist <none>\n\
#	topology <none>\n\
	auth-nxdomain false;\n\
Bob Halley's avatar
Bob Halley committed
127
	minimal-responses false;\n\
128
129
130
131
132
133
134
135
136
137
138
	recursion true;\n\
	provide-ixfr true;\n\
	request-ixfr true;\n\
	fetch-glue no;\n\
	rfc2308-type1 no;\n\
	additional-from-auth true;\n\
	additional-from-cache true;\n\
	query-source address *;\n\
	query-source-v6 address *;\n\
	notify-source *;\n\
	notify-source-v6 *;\n\
139
	cleaning-interval 0;  /* now meaningless */\n\
140
141
142
143
144
	min-roots 2;\n\
	lame-ttl 600;\n\
	max-ncache-ttl 10800; /* 3 hours */\n\
	max-cache-ttl 604800; /* 1 week */\n\
	transfer-format many-answers;\n\
145
	max-cache-size 0;\n\
146
147
	check-names master fail;\n\
	check-names slave warn;\n\
148
	check-names response ignore;\n\
149
	check-dup-records warn;\n\
150
	check-mx warn;\n\
151
	acache-enable no;\n\
152
	acache-cleaning-interval 60;\n\
153
	max-acache-size 16M;\n\
154
	dnssec-enable yes;\n\
155
	dnssec-validation yes; \n\
156
	dnssec-accept-expired no;\n\
157
158
	clients-per-query 10;\n\
	max-clients-per-query 100;\n\
159
	zero-no-soa-ttl-cache no;\n\
160
	nsec3-test-zone no;\n\
Mark Andrews's avatar
Mark Andrews committed
161
"
162
163
#ifdef ALLOW_FILTER_AAAA_ON_V4
"	filter-aaaa-on-v4 no;\n\
Automatic Updater's avatar
Automatic Updater committed
164
	filter-aaaa { any; };\n\
165
166
"
#endif
Mark Andrews's avatar
Mark Andrews committed
167
168

"	/* zone */\n\
169
	allow-query {any;};\n\
170
	allow-query-on {any;};\n\
171
172
173
	allow-transfer {any;};\n\
	notify yes;\n\
#	also-notify <none>\n\
174
	notify-delay 5;\n\
175
	notify-to-soa no;\n\
176
177
178
179
180
181
182
	dialup no;\n\
#	forward <none>\n\
#	forwarders <none>\n\
	maintain-ixfr-base no;\n\
#	max-ixfr-log-size <obsolete>\n\
	transfer-source *;\n\
	transfer-source-v6 *;\n\
183
	alt-transfer-source *;\n\
184
	alt-transfer-source-v6 *;\n\
185
186
187
188
	max-transfer-time-in 120;\n\
	max-transfer-time-out 120;\n\
	max-transfer-idle-in 60;\n\
	max-transfer-idle-out 60;\n\
189
190
191
192
	max-retry-time 1209600; /* 2 weeks */\n\
	min-retry-time 500;\n\
	max-refresh-time 2419200; /* 4 weeks */\n\
	min-refresh-time 300;\n\
193
	multi-master no;\n\
194
	dnssec-secure-to-insecure no;\n\
195
	sig-validity-interval 30; /* days */\n\
196
197
	sig-signing-nodes 100;\n\
	sig-signing-signatures 10;\n\
198
	sig-signing-type 65534;\n\
199
	zone-statistics false;\n\
200
	max-journal-size unlimited;\n\
201
	ixfr-from-differences false;\n\
202
	check-wildcard yes;\n\
203
204
	check-sibling yes;\n\
	check-integrity yes;\n\
205
206
	check-mx-cname warn;\n\
	check-srv-cname warn;\n\
207
	zero-no-soa-ttl yes;\n\
208
	update-check-ksk yes;\n\
209
	dnssec-dnskey-kskonly no;\n\
210
	try-tcp-refresh yes; /* BIND 8 compat */\n\
211
};\n\
Mark Andrews's avatar
Mark Andrews committed
212
213
214
"

"#\n\
Mark Andrews's avatar
Mark Andrews committed
215
#  Zones in the \"_bind\" view are NOT counted in the count of zones.\n\
216
#\n\
217
218
view \"_bind\" chaos {\n\
	recursion no;\n\
219
	notify no;\n\
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
\n\
	zone \"version.bind\" chaos {\n\
		type master;\n\
		database \"_builtin version\";\n\
	};\n\
\n\
	zone \"hostname.bind\" chaos {\n\
		type master;\n\
		database \"_builtin hostname\";\n\
	};\n\
\n\
	zone \"authors.bind\" chaos {\n\
		type master;\n\
		database \"_builtin authors\";\n\
	};\n\
235
\n\
236
237
238
239
	zone \"id.server\" chaos {\n\
		type master;\n\
		database \"_builtin id\";\n\
	};\n\
240
};\n\
241
242
243
244
245
246
"
"#\n\
#  Default trusted key(s) for builtin DLV support\n\
#  (used if \"dnssec-lookaside auto;\" is set and\n\
#  sysconfdir/bind.keys doesn't exist).\n\
#\n\
247
# BEGIN MANAGED KEYS\n"
248
249

/* Imported from bind.keys.h: */
250
MANAGED_KEYS
251

252
"# END MANAGED KEYS\n\
253
";
254
255
256
257
258
259
260
261
262
263
264

isc_result_t
ns_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {
	isc_buffer_t b;

	isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
	isc_buffer_add(&b, sizeof(defaultconf) - 1);
	return (cfg_parse_buffer(parser, &b, &cfg_type_namedconf, conf));
}

isc_result_t
265
ns_config_get(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
266
267
	int i;

268
	for (i = 0;; i++) {
269
270
271
272
273
274
275
		if (maps[i] == NULL)
			return (ISC_R_NOTFOUND);
		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS)
			return (ISC_R_SUCCESS);
	}
}

276
isc_result_t
277
278
279
280
281
282
283
ns_checknames_get(const cfg_obj_t **maps, const char *which,
		  const cfg_obj_t **obj)
{
	const cfg_listelt_t *element;
	const cfg_obj_t *checknames;
	const cfg_obj_t *type;
	const cfg_obj_t *value;
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
	int i;

	for (i = 0;; i++) {
		if (maps[i] == NULL)
			return (ISC_R_NOTFOUND);
		checknames = NULL;
		if (cfg_map_get(maps[i], "check-names", &checknames) == ISC_R_SUCCESS) {
			/*
			 * Zone map entry is not a list.
			 */
			if (checknames != NULL && !cfg_obj_islist(checknames)) {
				*obj = checknames;
				return (ISC_R_SUCCESS);
			}
			for (element = cfg_list_first(checknames);
			     element != NULL;
			     element = cfg_list_next(element)) {
				value = cfg_listelt_value(element);
				type = cfg_tuple_get(value, "type");
				if (strcasecmp(cfg_obj_asstring(type), which) == 0) {
					*obj = cfg_tuple_get(value, "mode");
					return (ISC_R_SUCCESS);
				}
			}

		}
	}
}

313
int
314
315
ns_config_listcount(const cfg_obj_t *list) {
	const cfg_listelt_t *e;
316
317
318
319
320
321
322
323
324
	int i = 0;

	for (e = cfg_list_first(list); e != NULL; e = cfg_list_next(e))
		i++;

	return (i);
}

isc_result_t
325
ns_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
326
		   dns_rdataclass_t *classp) {
327
	isc_textregion_t r;
328
	isc_result_t result;
329
330

	if (!cfg_obj_isstring(classobj)) {
331
		*classp = defclass;
332
333
		return (ISC_R_SUCCESS);
	}
334
335
	DE_CONST(cfg_obj_asstring(classobj), r.base);
	r.length = strlen(r.base);
336
337
338
	result = dns_rdataclass_fromtext(classp, &r);
	if (result != ISC_R_SUCCESS)
		cfg_obj_log(classobj, ns_g_lctx, ISC_LOG_ERROR,
339
			    "unknown class '%s'", r.base);
340
	return (result);
341
342
}

343
isc_result_t
344
ns_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
345
346
347
348
349
350
351
352
		   dns_rdatatype_t *typep) {
	isc_textregion_t r;
	isc_result_t result;

	if (!cfg_obj_isstring(typeobj)) {
		*typep = deftype;
		return (ISC_R_SUCCESS);
	}
353
354
	DE_CONST(cfg_obj_asstring(typeobj), r.base);
	r.length = strlen(r.base);
355
356
357
	result = dns_rdatatype_fromtext(typep, &r);
	if (result != ISC_R_SUCCESS)
		cfg_obj_log(typeobj, ns_g_lctx, ISC_LOG_ERROR,
358
			    "unknown type '%s'", r.base);
359
360
361
	return (result);
}

362
dns_zonetype_t
363
ns_config_getzonetype(const cfg_obj_t *zonetypeobj) {
364
	dns_zonetype_t ztype = dns_zone_none;
365
	const char *str;
366
367

	str = cfg_obj_asstring(zonetypeobj);
368
	if (strcasecmp(str, "master") == 0)
369
		ztype = dns_zone_master;
370
	else if (strcasecmp(str, "slave") == 0)
371
		ztype = dns_zone_slave;
372
	else if (strcasecmp(str, "stub") == 0)
373
374
375
376
377
378
379
		ztype = dns_zone_stub;
	else
		INSIST(0);
	return (ztype);
}

isc_result_t
380
ns_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
381
382
383
384
		    in_port_t defport, isc_mem_t *mctx,
		    isc_sockaddr_t **addrsp, isc_uint32_t *countp)
{
	int count, i = 0;
385
386
387
	const cfg_obj_t *addrlist;
	const cfg_obj_t *portobj;
	const cfg_listelt_t *element;
388
389
390
391
392
	isc_sockaddr_t *addrs;
	in_port_t port;
	isc_result_t result;

	INSIST(addrsp != NULL && *addrsp == NULL);
393
	INSIST(countp != NULL);
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445

	addrlist = cfg_tuple_get(list, "addresses");
	count = ns_config_listcount(addrlist);

	portobj = cfg_tuple_get(list, "port");
	if (cfg_obj_isuint32(portobj)) {
		isc_uint32_t val = cfg_obj_asuint32(portobj);
		if (val > ISC_UINT16_MAX) {
			cfg_obj_log(portobj, ns_g_lctx, ISC_LOG_ERROR,
				    "port '%u' out of range", val);
			return (ISC_R_RANGE);
		}
		port = (in_port_t) val;
	} else if (defport != 0)
		port = defport;
	else {
		result = ns_config_getport(config, &port);
		if (result != ISC_R_SUCCESS)
			return (result);
	}

	addrs = isc_mem_get(mctx, count * sizeof(isc_sockaddr_t));
	if (addrs == NULL)
		return (ISC_R_NOMEMORY);

	for (element = cfg_list_first(addrlist);
	     element != NULL;
	     element = cfg_list_next(element), i++)
	{
		INSIST(i < count);
		addrs[i] = *cfg_obj_assockaddr(cfg_listelt_value(element));
		if (isc_sockaddr_getport(&addrs[i]) == 0)
			isc_sockaddr_setport(&addrs[i], port);
	}
	INSIST(i == count);

	*addrsp = addrs;
	*countp = count;

	return (ISC_R_SUCCESS);
}

void
ns_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
		    isc_uint32_t count)
{
	INSIST(addrsp != NULL && *addrsp != NULL);

	isc_mem_put(mctx, *addrsp, count * sizeof(isc_sockaddr_t));
	*addrsp = NULL;
}

446
static isc_result_t
447
get_masters_def(const cfg_obj_t *cctx, const char *name,
Automatic Updater's avatar
Automatic Updater committed
448
		const cfg_obj_t **ret)
449
{
450
	isc_result_t result;
451
452
	const cfg_obj_t *masters = NULL;
	const cfg_listelt_t *elt;
453
454
455
456
457
458
459

	result = cfg_map_get(cctx, "masters", &masters);
	if (result != ISC_R_SUCCESS)
		return (result);
	for (elt = cfg_list_first(masters);
	     elt != NULL;
	     elt = cfg_list_next(elt)) {
460
		const cfg_obj_t *list;
461
462
463
464
465
466
467
468
469
470
471
472
473
		const char *listname;

		list = cfg_listelt_value(elt);
		listname = cfg_obj_asstring(cfg_tuple_get(list, "name"));

		if (strcasecmp(listname, name) == 0) {
			*ret = list;
			return (ISC_R_SUCCESS);
		}
	}
	return (ISC_R_NOTFOUND);
}

474
isc_result_t
475
476
477
ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
			  isc_mem_t *mctx, isc_sockaddr_t **addrsp,
			  dns_name_t ***keysp, isc_uint32_t *countp)
478
{
479
480
481
	isc_uint32_t addrcount = 0, keycount = 0, i = 0;
	isc_uint32_t listcount = 0, l = 0, j;
	isc_uint32_t stackcount = 0, pushed = 0;
482
	isc_result_t result;
483
484
485
	const cfg_listelt_t *element;
	const cfg_obj_t *addrlist;
	const cfg_obj_t *portobj;
486
487
488
489
	in_port_t port;
	dns_fixedname_t fname;
	isc_sockaddr_t *addrs = NULL;
	dns_name_t **keys = NULL;
Mark Andrews's avatar
Mark Andrews committed
490
	struct { const char *name; } *lists = NULL;
491
	struct {
492
		const cfg_listelt_t *element;
493
494
		in_port_t port;
	} *stack = NULL;
495

496
497
498
	REQUIRE(addrsp != NULL && *addrsp == NULL);
	REQUIRE(keysp != NULL && *keysp == NULL);
	REQUIRE(countp != NULL);
499

500
 newlist:
501
502
503
504
505
506
507
	addrlist = cfg_tuple_get(list, "addresses");
	portobj = cfg_tuple_get(list, "port");
	if (cfg_obj_isuint32(portobj)) {
		isc_uint32_t val = cfg_obj_asuint32(portobj);
		if (val > ISC_UINT16_MAX) {
			cfg_obj_log(portobj, ns_g_lctx, ISC_LOG_ERROR,
				    "port '%u' out of range", val);
508
509
			result = ISC_R_RANGE;
			goto cleanup;
510
511
512
513
514
		}
		port = (in_port_t) val;
	} else {
		result = ns_config_getport(config, &port);
		if (result != ISC_R_SUCCESS)
515
			goto cleanup;
516
517
518
519
	}

	result = ISC_R_NOMEMORY;

520
521
522
	element = cfg_list_first(addrlist);
 resume:
	for ( ;
523
	     element != NULL;
524
	     element = cfg_list_next(element))
525
	{
526
527
		const cfg_obj_t *addr;
		const cfg_obj_t *key;
528
		const char *keystr;
529
530
		isc_buffer_t b;

531
532
		addr = cfg_tuple_get(cfg_listelt_value(element),
				     "masterselement");
533
534
		key = cfg_tuple_get(cfg_listelt_value(element), "key");

535
		if (!cfg_obj_issockaddr(addr)) {
536
			const char *listname = cfg_obj_asstring(addr);
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
			isc_result_t tresult;

			/* Grow lists? */
			if (listcount == l) {
				void * new;
				isc_uint32_t newlen = listcount + 16;
				size_t newsize, oldsize;

				newsize = newlen * sizeof(*lists);
				oldsize = listcount * sizeof(*lists);
				new = isc_mem_get(mctx, newsize);
				if (new == NULL)
					goto cleanup;
				if (listcount != 0) {
					memcpy(new, lists, oldsize);
					isc_mem_put(mctx, lists, oldsize);
				}
				lists = new;
				listcount = newlen;
			}
			/* Seen? */
			for (j = 0; j < l; j++)
Mark Andrews's avatar
Mark Andrews committed
559
				if (strcasecmp(lists[j].name, listname) == 0)
560
561
562
563
564
565
					break;
			if (j < l)
				continue;
			tresult = get_masters_def(config, listname, &list);
			if (tresult == ISC_R_NOTFOUND) {
				cfg_obj_log(addr, ns_g_lctx, ISC_LOG_ERROR,
Automatic Updater's avatar
Automatic Updater committed
566
				    "masters \"%s\" not found", listname);
567
568
569
570
571
572

				result = tresult;
				goto cleanup;
			}
			if (tresult != ISC_R_SUCCESS)
				goto cleanup;
Mark Andrews's avatar
Mark Andrews committed
573
			lists[l++].name = listname;
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
			/* Grow stack? */
			if (stackcount == pushed) {
				void * new;
				isc_uint32_t newlen = stackcount + 16;
				size_t newsize, oldsize;

				newsize = newlen * sizeof(*stack);
				oldsize = stackcount * sizeof(*stack);
				new = isc_mem_get(mctx, newsize);
				if (new == NULL)
					goto cleanup;
				if (stackcount != 0) {
					memcpy(new, stack, oldsize);
					isc_mem_put(mctx, stack, oldsize);
				}
				stack = new;
				stackcount = newlen;
			}
			/*
			 * We want to resume processing this list on the
			 * next element.
			 */
			stack[pushed].element = cfg_list_next(element);
			stack[pushed].port = port;
			pushed++;
			goto newlist;
		}

		if (i == addrcount) {
			void * new;
			isc_uint32_t newlen = addrcount + 16;
			size_t newsize, oldsize;

			newsize = newlen * sizeof(isc_sockaddr_t);
			oldsize = addrcount * sizeof(isc_sockaddr_t);
			new = isc_mem_get(mctx, newsize);
			if (new == NULL)
				goto cleanup;
			if (addrcount != 0) {
				memcpy(new, addrs, oldsize);
				isc_mem_put(mctx, addrs, oldsize);
			}
			addrs = new;
			addrcount = newlen;

			newsize = newlen * sizeof(dns_name_t *);
			oldsize = keycount * sizeof(dns_name_t *);
			new = isc_mem_get(mctx, newsize);
			if (new == NULL)
				goto cleanup;
			if (keycount != 0) {
625
626
				memcpy(new, keys, oldsize);
				isc_mem_put(mctx, keys, oldsize);
627
628
629
630
631
			}
			keys = new;
			keycount = newlen;
		}

632
633
634
635
		addrs[i] = *cfg_obj_assockaddr(addr);
		if (isc_sockaddr_getport(&addrs[i]) == 0)
			isc_sockaddr_setport(&addrs[i], port);
		keys[i] = NULL;
636
637
		if (!cfg_obj_isstring(key)) {
			i++;
638
			continue;
639
		}
640
641
642
643
		keys[i] = isc_mem_get(mctx, sizeof(dns_name_t));
		if (keys[i] == NULL)
			goto cleanup;
		dns_name_init(keys[i], NULL);
Automatic Updater's avatar
Automatic Updater committed
644

645
646
647
648
649
		keystr = cfg_obj_asstring(key);
		isc_buffer_init(&b, keystr, strlen(keystr));
		isc_buffer_add(&b, strlen(keystr));
		dns_fixedname_init(&fname);
		result = dns_name_fromtext(dns_fixedname_name(&fname), &b,
650
					   dns_rootname, 0, NULL);
651
652
653
654
655
656
		if (result != ISC_R_SUCCESS)
			goto cleanup;
		result = dns_name_dup(dns_fixedname_name(&fname), mctx,
				      keys[i]);
		if (result != ISC_R_SUCCESS)
			goto cleanup;
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
		i++;
	}
	if (pushed != 0) {
		pushed--;
		element = stack[pushed].element;
		port = stack[pushed].port;
		goto resume;
	}
	if (i < addrcount) {
		void * new;
		size_t newsize, oldsize;

		newsize = i * sizeof(isc_sockaddr_t);
		oldsize = addrcount * sizeof(isc_sockaddr_t);
		if (i != 0) {
			new = isc_mem_get(mctx, newsize);
			if (new == NULL)
				goto cleanup;
			memcpy(new, addrs, newsize);
		} else
			new = NULL;
678
		isc_mem_put(mctx, addrs, oldsize);
679
680
681
682
683
684
685
686
687
688
689
690
		addrs = new;
		addrcount = i;

		newsize = i * sizeof(dns_name_t *);
		oldsize = keycount * sizeof(dns_name_t *);
		if (i != 0) {
			new = isc_mem_get(mctx, newsize);
			if (new == NULL)
				goto cleanup;
			memcpy(new, keys,  newsize);
		} else
			new = NULL;
691
		isc_mem_put(mctx, keys, oldsize);
692
693
		keys = new;
		keycount = i;
694
	}
695
696
697
698
699

	if (lists != NULL)
		isc_mem_put(mctx, lists, listcount * sizeof(*lists));
	if (stack != NULL)
		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
Automatic Updater's avatar
Automatic Updater committed
700

701
	INSIST(keycount == addrcount);
702
703
704

	*addrsp = addrs;
	*keysp = keys;
705
	*countp = addrcount;
706
707
708
709
710

	return (ISC_R_SUCCESS);

 cleanup:
	if (addrs != NULL)
711
		isc_mem_put(mctx, addrs, addrcount * sizeof(isc_sockaddr_t));
712
	if (keys != NULL) {
713
		for (j = 0; j <= i; j++) {
714
715
716
717
718
719
			if (keys[j] == NULL)
				continue;
			if (dns_name_dynamic(keys[j]))
				dns_name_free(keys[j], mctx);
			isc_mem_put(mctx, keys[j], sizeof(dns_name_t));
		}
720
		isc_mem_put(mctx, keys, keycount * sizeof(dns_name_t *));
721
	}
722
723
724
725
	if (lists != NULL)
		isc_mem_put(mctx, lists, listcount * sizeof(*lists));
	if (stack != NULL)
		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
	return (result);
}

void
ns_config_putipandkeylist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
			  dns_name_t ***keysp, isc_uint32_t count)
{
	unsigned int i;
	dns_name_t **keys = *keysp;

	INSIST(addrsp != NULL && *addrsp != NULL);

	isc_mem_put(mctx, *addrsp, count * sizeof(isc_sockaddr_t));
	for (i = 0; i < count; i++) {
		if (keys[i] == NULL)
			continue;
		if (dns_name_dynamic(keys[i]))
			dns_name_free(keys[i], mctx);
		isc_mem_put(mctx, keys[i], sizeof(dns_name_t));
	}
	isc_mem_put(mctx, *keysp, count * sizeof(dns_name_t *));
	*addrsp = NULL;
	*keysp = NULL;
}

isc_result_t
752
753
754
755
ns_config_getport(const cfg_obj_t *config, in_port_t *portp) {
	const cfg_obj_t *maps[3];
	const cfg_obj_t *options = NULL;
	const cfg_obj_t *portobj = NULL;
756
757
758
	isc_result_t result;
	int i;

759
	(void)cfg_map_get(config, "options", &options);
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
	i = 0;
	if (options != NULL)
		maps[i++] = options;
	maps[i++] = ns_g_defaults;
	maps[i] = NULL;

	result = ns_config_get(maps, "port", &portobj);
	INSIST(result == ISC_R_SUCCESS);
	if (cfg_obj_asuint32(portobj) >= ISC_UINT16_MAX) {
		cfg_obj_log(portobj, ns_g_lctx, ISC_LOG_ERROR,
			    "port '%u' out of range",
			    cfg_obj_asuint32(portobj));
		return (ISC_R_RANGE);
	}
	*portp = (in_port_t)cfg_obj_asuint32(portobj);
	return (ISC_R_SUCCESS);
}
Brian Wellington's avatar
Brian Wellington committed
777

778
779
780
781
struct keyalgorithms {
	const char *str;
	enum { hmacnone, hmacmd5, hmacsha1, hmacsha224,
	       hmacsha256, hmacsha384, hmacsha512 } hmac;
782
	unsigned int type;
783
784
	isc_uint16_t size;
} algorithms[] = {
785
786
787
788
789
790
791
792
793
	{ "hmac-md5", hmacmd5, DST_ALG_HMACMD5, 128 },
	{ "hmac-md5.sig-alg.reg.int", hmacmd5, DST_ALG_HMACMD5, 0 },
	{ "hmac-md5.sig-alg.reg.int.", hmacmd5, DST_ALG_HMACMD5, 0 },
	{ "hmac-sha1", hmacsha1, DST_ALG_HMACSHA1, 160 },
	{ "hmac-sha224", hmacsha224, DST_ALG_HMACSHA224, 224 },
	{ "hmac-sha256", hmacsha256, DST_ALG_HMACSHA256, 256 },
	{ "hmac-sha384", hmacsha384, DST_ALG_HMACSHA384, 384 },
	{ "hmac-sha512", hmacsha512, DST_ALG_HMACSHA512, 512 },
	{  NULL, hmacnone, DST_ALG_UNKNOWN, 0 }
794
795
};

Brian Wellington's avatar
Brian Wellington committed
796
isc_result_t
797
798
ns_config_getkeyalgorithm(const char *str, dns_name_t **name,
			  isc_uint16_t *digestbits)
799
800
801
802
803
804
805
{
	return (ns_config_getkeyalgorithm2(str, name, NULL, digestbits));
}

isc_result_t
ns_config_getkeyalgorithm2(const char *str, dns_name_t **name,
			   unsigned int *typep, isc_uint16_t *digestbits)
Brian Wellington's avatar
Brian Wellington committed
806
{
807
808
809
810
811
812
813
814
815
816
817
	int i;
	size_t len = 0;
	isc_uint16_t bits;
	isc_result_t result;

	for (i = 0; algorithms[i].str != NULL; i++) {
		len = strlen(algorithms[i].str);
		if (strncasecmp(algorithms[i].str, str, len) == 0 &&
		    (str[len] == '\0' ||
		     (algorithms[i].size != 0 && str[len] == '-')))
			break;
Brian Wellington's avatar
Brian Wellington committed
818
	}
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
	if (algorithms[i].str == NULL)
		return (ISC_R_NOTFOUND);
	if (str[len] == '-') {
		result = isc_parse_uint16(&bits, str + len + 1, 10);
		if (result != ISC_R_SUCCESS)
			return (result);
		if (bits > algorithms[i].size)
			return (ISC_R_RANGE);
	} else if (algorithms[i].size == 0)
		bits = 128;
	else
		bits = algorithms[i].size;

	if (name != NULL) {
		switch (algorithms[i].hmac) {
		case hmacmd5: *name = dns_tsig_hmacmd5_name; break;
		case hmacsha1: *name = dns_tsig_hmacsha1_name; break;
		case hmacsha224: *name = dns_tsig_hmacsha224_name; break;
		case hmacsha256: *name = dns_tsig_hmacsha256_name; break;
		case hmacsha384: *name = dns_tsig_hmacsha384_name; break;
		case hmacsha512: *name = dns_tsig_hmacsha512_name; break;
		default:
			INSIST(0);
		}
	}
844
845
	if (typep != NULL)
		*typep = algorithms[i].type;
846
847
848
	if (digestbits != NULL)
		*digestbits = bits;
	return (ISC_R_SUCCESS);
Brian Wellington's avatar
Brian Wellington committed
849
}