pdns/ws-auth.cc

   1 /*
   2  * This file is part of PowerDNS or dnsdist.
   3  * Copyright -- PowerDNS.COM B.V. and its contributors
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * In addition, for the avoidance of any doubt, permission is granted to
  10  * link this program with OpenSSL and to (re)distribute the binaries
  11  * produced as the result of such linking.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22 #ifdef HAVE_CONFIG_H
  23 #include "config.h"
  24 #endif
  25 #include "utility.hh"
  26 #include "dynlistener.hh"
  27 #include "ws-auth.hh"
  28 #include "json.hh"
  29 #include "webserver.hh"
  30 #include "logger.hh"
  31 #include "statbag.hh"
  32 #include "misc.hh"
  33 #include "arguments.hh"
  34 #include "dns.hh"
  35 #include "comment.hh"
  36 #include "ueberbackend.hh"
  37 #include <boost/format.hpp>
  38
  39 #include "namespaces.hh"
  40 #include "ws-api.hh"
  41 #include "version.hh"
  42 #include "dnsseckeeper.hh"
  43 #include <iomanip>
  44 #include "zoneparser-tng.hh"
  45 #include "common_startup.hh"
  46 #include "auth-caches.hh"
  47
  48 using json11::Json;
  49
  50 extern StatBag S;
  51
  52 static void patchZone(HttpRequest* req, HttpResponse* resp);
  53 static void storeChangedPTRs(UeberBackend& B, vector<DNSResourceRecord>& new_ptrs);
  54 static void makePtr(const DNSResourceRecord& rr, DNSResourceRecord* ptr);
  55
  56 AuthWebServer::AuthWebServer()
  57 {
  58   d_start=time(0);
  59   d_min10=d_min5=d_min1=0;
  60   d_ws = 0;
  61   d_tid = 0;
  62   if(arg().mustDo("webserver") || arg().mustDo("api")) {
  63     d_ws = new WebServer(arg()["webserver-address"], arg().asNum("webserver-port"));
  64     d_ws->bind();
  65   }
  66 }
  67
  68 void AuthWebServer::go()
  69 {
  70   S.doRings();
  71   pthread_create(&d_tid, 0, webThreadHelper, this);
  72   pthread_create(&d_tid, 0, statThreadHelper, this);
  73 }
  74
  75 void AuthWebServer::statThread()
  76 {
  77   try {
  78     for(;;) {
  79       d_queries.submit(S.read("udp-queries"));
  80       d_cachehits.submit(S.read("packetcache-hit"));
  81       d_cachemisses.submit(S.read("packetcache-miss"));
  82       d_qcachehits.submit(S.read("query-cache-hit"));
  83       d_qcachemisses.submit(S.read("query-cache-miss"));
  84       Utility::sleep(1);
  85     }
  86   }
  87   catch(...) {
  88     g_log<<Logger::Error<<"Webserver statThread caught an exception, dying"<<endl;
  89     _exit(1);
  90   }
  91 }
  92
  93 void *AuthWebServer::statThreadHelper(void *p)
  94 {
  95   AuthWebServer *self=static_cast<AuthWebServer *>(p);
  96   self->statThread();
  97   return 0; // never reached
  98 }
  99
 100 void *AuthWebServer::webThreadHelper(void *p)
 101 {
 102   AuthWebServer *self=static_cast<AuthWebServer *>(p);
 103   self->webThread();
 104   return 0; // never reached
 105 }
 106
 107 static string htmlescape(const string &s) {
 108   string result;
 109   for(string::const_iterator it=s.begin(); it!=s.end(); ++it) {
 110     switch (*it) {
 111     case '&':
 112       result += "&amp;";
 113       break;
 114     case '<':
 115       result += "&lt;";
 116       break;
 117     case '>':
 118       result += "&gt;";
 119       break;
 120     case '"':
 121       result += "&quot;";
 122       break;
 123     default:
 124       result += *it;
 125     }
 126   }
 127   return result;
 128 }
 129
 130 void printtable(ostringstream &ret, const string &ringname, const string &title, int limit=10)
 131 {
 132   int tot=0;
 133   int entries=0;
 134   vector<pair <string,unsigned int> >ring=S.getRing(ringname);
 135
 136   for(vector<pair<string, unsigned int> >::const_iterator i=ring.begin(); i!=ring.end();++i) {
 137     tot+=i->second;
 138     entries++;
 139   }
 140
 141   ret<<"<div class=\"panel\">";
 142   ret<<"<span class=resetring><i></i><a href=\"?resetring="<<htmlescape(ringname)<<"\">Reset</a></span>"<<endl;
 143   ret<<"<h2>"<<title<<"</h2>"<<endl;
 144   ret<<"<div class=ringmeta>";
 145   ret<<"<a class=topXofY href=\"?ring="<<htmlescape(ringname)<<"\">Showing: Top "<<limit<<" of "<<entries<<"</a>"<<endl;
 146   ret<<"<span class=resizering>Resize: ";
 147   unsigned int sizes[]={10,100,500,1000,10000,500000,0};
 148   for(int i=0;sizes[i];++i) {
 149     if(S.getRingSize(ringname)!=sizes[i])
 150       ret<<"<a href=\"?resizering="<<htmlescape(ringname)<<"&amp;size="<<sizes[i]<<"\">"<<sizes[i]<<"</a> ";
 151     else
 152       ret<<"("<<sizes[i]<<") ";
 153   }
 154   ret<<"</span></div>";
 155
 156   ret<<"<table class=\"data\">";
 157   int printed=0;
 158   int total=max(1,tot);
 159   for(vector<pair<string,unsigned int> >::const_iterator i=ring.begin();limit && i!=ring.end();++i,--limit) {
 160     ret<<"<tr><td>"<<htmlescape(i->first)<<"</td><td>"<<i->second<<"</td><td align=right>"<< AuthWebServer::makePercentage(i->second*100.0/total)<<"</td>"<<endl;
 161     printed+=i->second;
 162   }
 163   ret<<"<tr><td colspan=3></td></tr>"<<endl;
 164   if(printed!=tot)
 165     ret<<"<tr><td><b>Rest:</b></td><td><b>"<<tot-printed<<"</b></td><td align=right><b>"<< AuthWebServer::makePercentage((tot-printed)*100.0/total)<<"</b></td>"<<endl;
 166
 167   ret<<"<tr><td><b>Total:</b></td><td><b>"<<tot<<"</b></td><td align=right><b>100%</b></td>";
 168   ret<<"</table></div>"<<endl;
 169 }
 170
 171 void AuthWebServer::printvars(ostringstream &ret)
 172 {
 173   ret<<"<div class=panel><h2>Variables</h2><table class=\"data\">"<<endl;
 174
 175   vector<string>entries=S.getEntries();
 176   for(vector<string>::const_iterator i=entries.begin();i!=entries.end();++i) {
 177     ret<<"<tr><td>"<<*i<<"</td><td>"<<S.read(*i)<<"</td><td>"<<S.getDescrip(*i)<<"</td>"<<endl;
 178   }
 179
 180   ret<<"</table></div>"<<endl;
 181 }
 182
 183 void AuthWebServer::printargs(ostringstream &ret)
 184 {
 185   ret<<"<table border=1><tr><td colspan=3 bgcolor=\"#0000ff\"><font color=\"#ffffff\">Arguments</font></td>"<<endl;
 186
 187   vector<string>entries=arg().list();
 188   for(vector<string>::const_iterator i=entries.begin();i!=entries.end();++i) {
 189     ret<<"<tr><td>"<<*i<<"</td><td>"<<arg()[*i]<<"</td><td>"<<arg().getHelp(*i)<<"</td>"<<endl;
 190   }
 191 }
 192
 193 string AuthWebServer::makePercentage(const double& val)
 194 {
 195   return (boost::format("%.01f%%") % val).str();
 196 }
 197
 198 void AuthWebServer::indexfunction(HttpRequest* req, HttpResponse* resp)
 199 {
 200   if(!req->getvars["resetring"].empty()) {
 201     if (S.ringExists(req->getvars["resetring"]))
 202       S.resetRing(req->getvars["resetring"]);
 203     resp->status = 302;
 204     resp->headers["Location"] = req->url.path;
 205     return;
 206   }
 207   if(!req->getvars["resizering"].empty()){
 208     int size=std::stoi(req->getvars["size"]);
 209     if (S.ringExists(req->getvars["resizering"]) && size > 0 && size <= 500000)
 210       S.resizeRing(req->getvars["resizering"], std::stoi(req->getvars["size"]));
 211     resp->status = 302;
 212     resp->headers["Location"] = req->url.path;
 213     return;
 214   }
 215
 216   ostringstream ret;
 217
 218   ret<<"<!DOCTYPE html>"<<endl;
 219   ret<<"<html><head>"<<endl;
 220   ret<<"<title>PowerDNS Authoritative Server Monitor</title>"<<endl;
 221   ret<<"<link rel=\"stylesheet\" href=\"style.css\"/>"<<endl;
 222   ret<<"</head><body>"<<endl;
 223
 224   ret<<"<div class=\"row\">"<<endl;
 225   ret<<"<div class=\"headl columns\">";
 226   ret<<"<a href=\"/\" id=\"appname\">PowerDNS "<<htmlescape(VERSION);
 227   if(!arg()["config-name"].empty()) {
 228     ret<<" ["<<htmlescape(arg()["config-name"])<<"]";
 229   }
 230   ret<<"</a></div>"<<endl;
 231   ret<<"<div class=\"headr columns\"></div></div>";
 232   ret<<"<div class=\"row\"><div class=\"all columns\">";
 233
 234   time_t passed=time(0)-s_starttime;
 235
 236   ret<<"<p>Uptime: "<<
 237     humanDuration(passed)<<
 238     "<br>"<<endl;
 239
 240   ret<<"Queries/second, 1, 5, 10 minute averages:  "<<std::setprecision(3)<<
 241     (int)d_queries.get1()<<", "<<
 242     (int)d_queries.get5()<<", "<<
 243     (int)d_queries.get10()<<". Max queries/second: "<<(int)d_queries.getMax()<<
 244     "<br>"<<endl;
 245
 246   if(d_cachemisses.get10()+d_cachehits.get10()>0)
 247     ret<<"Cache hitrate, 1, 5, 10 minute averages: "<<
 248       makePercentage((d_cachehits.get1()*100.0)/((d_cachehits.get1())+(d_cachemisses.get1())))<<", "<<
 249       makePercentage((d_cachehits.get5()*100.0)/((d_cachehits.get5())+(d_cachemisses.get5())))<<", "<<
 250       makePercentage((d_cachehits.get10()*100.0)/((d_cachehits.get10())+(d_cachemisses.get10())))<<
 251       "<br>"<<endl;
 252
 253   if(d_qcachemisses.get10()+d_qcachehits.get10()>0)
 254     ret<<"Backend query cache hitrate, 1, 5, 10 minute averages: "<<std::setprecision(2)<<
 255       makePercentage((d_qcachehits.get1()*100.0)/((d_qcachehits.get1())+(d_qcachemisses.get1())))<<", "<<
 256       makePercentage((d_qcachehits.get5()*100.0)/((d_qcachehits.get5())+(d_qcachemisses.get5())))<<", "<<
 257       makePercentage((d_qcachehits.get10()*100.0)/((d_qcachehits.get10())+(d_qcachemisses.get10())))<<
 258       "<br>"<<endl;
 259
 260   ret<<"Backend query load, 1, 5, 10 minute averages: "<<std::setprecision(3)<<
 261     (int)d_qcachemisses.get1()<<", "<<
 262     (int)d_qcachemisses.get5()<<", "<<
 263     (int)d_qcachemisses.get10()<<". Max queries/second: "<<(int)d_qcachemisses.getMax()<<
 264     "<br>"<<endl;
 265
 266   ret<<"Total queries: "<<S.read("udp-queries")<<". Question/answer latency: "<<S.read("latency")/1000.0<<"ms</p><br>"<<endl;
 267   if(req->getvars["ring"].empty()) {
 268     vector<string>entries=S.listRings();
 269     for(vector<string>::const_iterator i=entries.begin();i!=entries.end();++i)
 270       printtable(ret,*i,S.getRingTitle(*i));
 271
 272     printvars(ret);
 273     if(arg().mustDo("webserver-print-arguments"))
 274       printargs(ret);
 275   }
 276   else if(S.ringExists(req->getvars["ring"]))
 277     printtable(ret,req->getvars["ring"],S.getRingTitle(req->getvars["ring"]),100);
 278
 279   ret<<"</div></div>"<<endl;
 280   ret<<"<footer class=\"row\">"<<fullVersionString()<<"<br>&copy; 2013 - 2018 <a href=\"http://www.powerdns.com/\">PowerDNS.COM BV</a>.</footer>"<<endl;
 281   ret<<"</body></html>"<<endl;
 282
 283   resp->body = ret.str();
 284   resp->status = 200;
 285 }
 286
 287 /** Helper to build a record content as needed. */
 288 static inline string makeRecordContent(const QType& qtype, const string& content, bool noDot) {
 289   // noDot: for backend storage, pass true. for API users, pass false.
 290   auto drc = DNSRecordContent::makeunique(qtype.getCode(), QClass::IN, content);
 291   return drc->getZoneRepresentation(noDot);
 292 }
 293
 294 /** "Normalize" record content for API consumers. */
 295 static inline string makeApiRecordContent(const QType& qtype, const string& content) {
 296   return makeRecordContent(qtype, content, false);
 297 }
 298
 299 /** "Normalize" record content for backend storage. */
 300 static inline string makeBackendRecordContent(const QType& qtype, const string& content) {
 301   return makeRecordContent(qtype, content, true);
 302 }
 303
 304 static Json::object getZoneInfo(const DomainInfo& di, DNSSECKeeper *dk) {
 305   string zoneId = apiZoneNameToId(di.zone);
 306   vector<string> masters;
 307   for(const auto& m : di.masters)
 308     masters.push_back(m.toStringWithPortExcept(53));
 309
 310   return Json::object {
 311     // id is the canonical lookup key, which doesn't actually match the name (in some cases)
 312     { "id", zoneId },
 313     { "url", "/api/v1/servers/localhost/zones/" + zoneId },
 314     { "name", di.zone.toString() },
 315     { "kind", di.getKindString() },
 316     { "dnssec", dk->isSecuredZone(di.zone) },
 317     { "account", di.account },
 318     { "masters", masters },
 319     { "serial", (double)di.serial },
 320     { "notified_serial", (double)di.notified_serial },
 321     { "last_check", (double)di.last_check }
 322   };
 323 }
 324
 325 static bool shouldDoRRSets(HttpRequest* req) {
 326   if (req->getvars.count("rrsets") == 0 || req->getvars["rrsets"] == "true")
 327     return true;
 328   if (req->getvars["rrsets"] == "false")
 329     return false;
 330   throw ApiException("'rrsets' request parameter value '"+req->getvars["rrsets"]+"' is not supported");
 331 }
 332
 333 static void fillZone(const DNSName& zonename, HttpResponse* resp, bool doRRSets) {
 334   UeberBackend B;
 335   DomainInfo di;
 336   if(!B.getDomainInfo(zonename, di)) {
 337     throw HttpNotFoundException();
 338   }
 339
 340   DNSSECKeeper dk(&B);
 341   Json::object doc = getZoneInfo(di, &dk);
 342   // extra stuff getZoneInfo doesn't do for us (more expensive)
 343   string soa_edit_api;
 344   di.backend->getDomainMetadataOne(zonename, "SOA-EDIT-API", soa_edit_api);
 345   doc["soa_edit_api"] = soa_edit_api;
 346   string soa_edit;
 347   di.backend->getDomainMetadataOne(zonename, "SOA-EDIT", soa_edit);
 348   doc["soa_edit"] = soa_edit;
 349   string nsec3param;
 350   di.backend->getDomainMetadataOne(zonename, "NSEC3PARAM", nsec3param);
 351   doc["nsec3param"] = nsec3param;
 352   string nsec3narrow;
 353   bool nsec3narrowbool = false;
 354   di.backend->getDomainMetadataOne(zonename, "NSEC3NARROW", nsec3narrow);
 355   if (nsec3narrow == "1")
 356     nsec3narrowbool = true;
 357   doc["nsec3narrow"] = nsec3narrowbool;
 358
 359   string api_rectify;
 360   di.backend->getDomainMetadataOne(zonename, "API-RECTIFY", api_rectify);
 361   doc["api_rectify"] = (api_rectify == "1");
 362
 363   if (doRRSets) {
 364     vector<DNSResourceRecord> records;
 365     vector<Comment> comments;
 366
 367     // load all records + sort
 368     {
 369       DNSResourceRecord rr;
 370       di.backend->list(zonename, di.id, true); // incl. disabled
 371       while(di.backend->get(rr)) {
 372         if (!rr.qtype.getCode())
 373           continue; // skip empty non-terminals
 374         records.push_back(rr);
 375       }
 376       sort(records.begin(), records.end(), [](const DNSResourceRecord& a, const DNSResourceRecord& b) {
 377               if (a.qname == b.qname) {
 378                   return b.qtype < a.qtype;
 379               }
 380               return b.qname < a.qname;
 381           });
 382     }
 383
 384     // load all comments + sort
 385     {
 386       Comment comment;
 387       di.backend->listComments(di.id);
 388       while(di.backend->getComment(comment)) {
 389         comments.push_back(comment);
 390       }
 391       sort(comments.begin(), comments.end(), [](const Comment& a, const Comment& b) {
 392               if (a.qname == b.qname) {
 393                   return b.qtype < a.qtype;
 394               }
 395               return b.qname < a.qname;
 396           });
 397     }
 398
 399     Json::array rrsets;
 400     Json::object rrset;
 401     Json::array rrset_records;
 402     Json::array rrset_comments;
 403     DNSName current_qname;
 404     QType current_qtype;
 405     uint32_t ttl;
 406     auto rit = records.begin();
 407     auto cit = comments.begin();
 408
 409     while (rit != records.end() || cit != comments.end()) {
 410       if (cit == comments.end() || (rit != records.end() && (cit->qname.toString() <= rit->qname.toString() || cit->qtype < rit->qtype || cit->qtype == rit->qtype))) {
 411         current_qname = rit->qname;
 412         current_qtype = rit->qtype;
 413         ttl = rit->ttl;
 414       } else {
 415         current_qname = cit->qname;
 416         current_qtype = cit->qtype;
 417         ttl = 0;
 418       }
 419
 420       while(rit != records.end() && rit->qname == current_qname && rit->qtype == current_qtype) {
 421         ttl = min(ttl, rit->ttl);
 422         rrset_records.push_back(Json::object {
 423           { "disabled", rit->disabled },
 424           { "content", makeApiRecordContent(rit->qtype, rit->content) }
 425         });
 426         rit++;
 427       }
 428       while (cit != comments.end() && cit->qname == current_qname && cit->qtype == current_qtype) {
 429         rrset_comments.push_back(Json::object {
 430           { "modified_at", (double)cit->modified_at },
 431           { "account", cit->account },
 432           { "content", cit->content }
 433         });
 434         cit++;
 435       }
 436
 437       rrset["name"] = current_qname.toString();
 438       rrset["type"] = current_qtype.getName();
 439       rrset["records"] = rrset_records;
 440       rrset["comments"] = rrset_comments;
 441       rrset["ttl"] = (double)ttl;
 442       rrsets.push_back(rrset);
 443       rrset.clear();
 444       rrset_records.clear();
 445       rrset_comments.clear();
 446     }
 447
 448     doc["rrsets"] = rrsets;
 449   }
 450
 451   resp->setBody(doc);
 452 }
 453
 454 void productServerStatisticsFetch(map<string,string>& out)
 455 {
 456   vector<string> items = S.getEntries();
 457   for(const string& item :  items) {
 458     out[item] = std::to_string(S.read(item));
 459   }
 460
 461   // add uptime
 462   out["uptime"] = std::to_string(time(0) - s_starttime);
 463 }
 464
 465 static void gatherRecords(const Json container, const DNSName& qname, const QType qtype, const int ttl, vector<DNSResourceRecord>& new_records, vector<DNSResourceRecord>& new_ptrs) {
 466   UeberBackend B;
 467   DNSResourceRecord rr;
 468   rr.qname = qname;
 469   rr.qtype = qtype;
 470   rr.auth = 1;
 471   rr.ttl = ttl;
 472   for(auto record : container["records"].array_items()) {
 473     string content = stringFromJson(record, "content");
 474     rr.disabled = boolFromJson(record, "disabled");
 475
 476     // validate that the client sent something we can actually parse, and require that data to be dotted.
 477     try {
 478       if (rr.qtype.getCode() != QType::AAAA) {
 479         string tmp = makeApiRecordContent(rr.qtype, content);
 480         if (!pdns_iequals(tmp, content)) {
 481           throw std::runtime_error("Not in expected format (parsed as '"+tmp+"')");
 482         }
 483       } else {
 484         struct in6_addr tmpbuf;
 485         if (inet_pton(AF_INET6, content.c_str(), &tmpbuf) != 1 || content.find('.') != string::npos) {
 486           throw std::runtime_error("Invalid IPv6 address");
 487         }
 488       }
 489       rr.content = makeBackendRecordContent(rr.qtype, content);
 490     }
 491     catch(std::exception& e)
 492     {
 493       throw ApiException("Record "+rr.qname.toString()+"/"+rr.qtype.getName()+" '"+content+"': "+e.what());
 494     }
 495
 496     if ((rr.qtype.getCode() == QType::A || rr.qtype.getCode() == QType::AAAA) &&
 497         boolFromJson(record, "set-ptr", false) == true) {
 498       DNSResourceRecord ptr;
 499       makePtr(rr, &ptr);
 500
 501       // verify that there's a zone for the PTR
 502       SOAData sd;
 503       if (!B.getAuth(ptr.qname, QType(QType::PTR), &sd, false))
 504         throw ApiException("Could not find domain for PTR '"+ptr.qname.toString()+"' requested for '"+ptr.content+"'");
 505
 506       ptr.domain_id = sd.domain_id;
 507       new_ptrs.push_back(ptr);
 508     }
 509
 510     new_records.push_back(rr);
 511   }
 512 }
 513
 514 static void gatherComments(const Json container, const DNSName& qname, const QType qtype, vector<Comment>& new_comments) {
 515   Comment c;
 516   c.qname = qname;
 517   c.qtype = qtype;
 518
 519   time_t now = time(0);
 520   for (auto comment : container["comments"].array_items()) {
 521     c.modified_at = intFromJson(comment, "modified_at", now);
 522     c.content = stringFromJson(comment, "content");
 523     c.account = stringFromJson(comment, "account");
 524     new_comments.push_back(c);
 525   }
 526 }
 527
 528 static void checkDefaultDNSSECAlgos() {
 529   int k_algo = DNSSECKeeper::shorthand2algorithm(::arg()["default-ksk-algorithm"]);
 530   int z_algo = DNSSECKeeper::shorthand2algorithm(::arg()["default-zsk-algorithm"]);
 531   int k_size = arg().asNum("default-ksk-size");
 532   int z_size = arg().asNum("default-zsk-size");
 533
 534   // Sanity check DNSSEC parameters
 535   if (::arg()["default-zsk-algorithm"] != "") {
 536     if (k_algo == -1)
 537       throw ApiException("default-ksk-algorithm setting is set to unknown algorithm: " + ::arg()["default-ksk-algorithm"]);
 538     else if (k_algo <= 10 && k_size == 0)
 539       throw ApiException("default-ksk-algorithm is set to an algorithm("+::arg()["default-ksk-algorithm"]+") that requires a non-zero default-ksk-size!");
 540   }
 541
 542   if (::arg()["default-zsk-algorithm"] != "") {
 543     if (z_algo == -1)
 544       throw ApiException("default-zsk-algorithm setting is set to unknown algorithm: " + ::arg()["default-zsk-algorithm"]);
 545     else if (z_algo <= 10 && z_size == 0)
 546       throw ApiException("default-zsk-algorithm is set to an algorithm("+::arg()["default-zsk-algorithm"]+") that requires a non-zero default-zsk-size!");
 547   }
 548 }
 549
 550 static void throwUnableToSecure(const DNSName& zonename) {
 551   throw ApiException("No backend was able to secure '" + zonename.toString() + "', most likely because no DNSSEC"
 552       + "capable backends are loaded, or because the backends have DNSSEC disabled. Check your configuration.");
 553 }
 554
 555 static void updateDomainSettingsFromDocument(UeberBackend& B, const DomainInfo& di, const DNSName& zonename, const Json document) {
 556   string zonemaster;
 557   bool shouldRectify = false;
 558   for(auto value : document["masters"].array_items()) {
 559     string master = value.string_value();
 560     if (master.empty())
 561       throw ApiException("Master can not be an empty string");
 562     zonemaster += master + " ";
 563   }
 564
 565   if (zonemaster != "") {
 566     di.backend->setMaster(zonename, zonemaster);
 567   }
 568   if (document["kind"].is_string()) {
 569     di.backend->setKind(zonename, DomainInfo::stringToKind(stringFromJson(document, "kind")));
 570   }
 571   if (document["soa_edit_api"].is_string()) {
 572     di.backend->setDomainMetadataOne(zonename, "SOA-EDIT-API", document["soa_edit_api"].string_value());
 573   }
 574   if (document["soa_edit"].is_string()) {
 575     di.backend->setDomainMetadataOne(zonename, "SOA-EDIT", document["soa_edit"].string_value());
 576   }
 577   try {
 578     bool api_rectify = boolFromJson(document, "api_rectify");
 579     di.backend->setDomainMetadataOne(zonename, "API-RECTIFY", api_rectify ? "1" : "0");
 580   }
 581   catch (JsonException) {}
 582
 583   if (document["account"].is_string()) {
 584     di.backend->setAccount(zonename, document["account"].string_value());
 585   }
 586
 587   DNSSECKeeper dk(&B);
 588   bool dnssecInJSON = false;
 589   bool dnssecDocVal = false;
 590
 591   try {
 592     dnssecDocVal = boolFromJson(document, "dnssec");
 593     dnssecInJSON = true;
 594   }
 595   catch (JsonException) {}
 596
 597   bool isDNSSECZone = dk.isSecuredZone(zonename);
 598
 599   if (dnssecInJSON) {
 600     if (dnssecDocVal) {
 601       if (!isDNSSECZone) {
 602         checkDefaultDNSSECAlgos();
 603
 604         int k_algo = DNSSECKeeper::shorthand2algorithm(::arg()["default-ksk-algorithm"]);
 605         int z_algo = DNSSECKeeper::shorthand2algorithm(::arg()["default-zsk-algorithm"]);
 606         int k_size = arg().asNum("default-ksk-size");
 607         int z_size = arg().asNum("default-zsk-size");
 608
 609         if (k_algo != -1) {
 610           int64_t id;
 611           if (!dk.addKey(zonename, true, k_algo, id, k_size)) {
 612             throwUnableToSecure(zonename);
 613           }
 614         }
 615
 616         if (z_algo != -1) {
 617           int64_t id;
 618           if (!dk.addKey(zonename, false, z_algo, id, z_size)) {
 619             throwUnableToSecure(zonename);
 620           }
 621         }
 622
 623         // Used later for NSEC3PARAM
 624         isDNSSECZone = dk.isSecuredZone(zonename);
 625
 626         if (!isDNSSECZone) {
 627           throwUnableToSecure(zonename);
 628         }
 629         shouldRectify = true;
 630       }
 631     } else {
 632       // "dnssec": false in json
 633       if (isDNSSECZone) {
 634         string info, error;
 635         if (!dk.unSecureZone(zonename, error, info)) {
 636           throw ApiException("Error while un-securing zone '"+ zonename.toString()+"': " + error);
 637         }
 638         isDNSSECZone = dk.isSecuredZone(zonename);
 639         if (isDNSSECZone) {
 640           throw ApiException("Unable to un-secure zone '"+ zonename.toString()+"'");
 641         }
 642         shouldRectify = true;
 643       }
 644     }
 645   }
 646
 647   if(document["nsec3param"].string_value().length() > 0) {
 648     shouldRectify = true;
 649     NSEC3PARAMRecordContent ns3pr(document["nsec3param"].string_value());
 650     string error_msg = "";
 651     if (!isDNSSECZone) {
 652       throw ApiException("NSEC3PARAMs provided for zone '"+zonename.toString()+"', but zone is not DNSSEC secured.");
 653     }
 654     if (!dk.checkNSEC3PARAM(ns3pr, error_msg)) {
 655       throw ApiException("NSEC3PARAMs provided for zone '"+zonename.toString()+"' are invalid. " + error_msg);
 656     }
 657     if (!dk.setNSEC3PARAM(zonename, ns3pr, boolFromJson(document, "nsec3narrow", false))) {
 658       throw ApiException("NSEC3PARAMs provided for zone '" + zonename.toString() +
 659           "' passed our basic sanity checks, but cannot be used with the current backend.");
 660     }
 661   }
 662
 663   string api_rectify;
 664   di.backend->getDomainMetadataOne(zonename, "API-RECTIFY", api_rectify);
 665   if (shouldRectify && dk.isSecuredZone(zonename) && !dk.isPresigned(zonename) && api_rectify == "1") {
 666     string info;
 667     string error_msg = "";
 668     if (!dk.rectifyZone(zonename, error_msg, info, true))
 669       throw ApiException("Failed to rectify '" + zonename.toString() + "' " + error_msg);
 670   }
 671 }
 672
 673 static bool isValidMetadataKind(const string& kind, bool readonly) {
 674   static vector<string> builtinOptions {
 675     "ALLOW-AXFR-FROM",
 676     "AXFR-SOURCE",
 677     "ALLOW-DNSUPDATE-FROM",
 678     "TSIG-ALLOW-DNSUPDATE",
 679     "FORWARD-DNSUPDATE",
 680     "SOA-EDIT-DNSUPDATE",
 681     "NOTIFY-DNSUPDATE",
 682     "ALSO-NOTIFY",
 683     "AXFR-MASTER-TSIG",
 684     "GSS-ALLOW-AXFR-PRINCIPAL",
 685     "GSS-ACCEPTOR-PRINCIPAL",
 686     "IXFR",
 687     "LUA-AXFR-SCRIPT",
 688     "NSEC3NARROW",
 689     "NSEC3PARAM",
 690     "PRESIGNED",
 691     "PUBLISH-CDNSKEY",
 692     "PUBLISH-CDS",
 693     "SOA-EDIT",
 694     "TSIG-ALLOW-AXFR",
 695     "TSIG-ALLOW-DNSUPDATE"
 696   };
 697
 698   // the following options do not allow modifications via API
 699   static vector<string> protectedOptions {
 700     "API-RECTIFY",
 701     "NSEC3NARROW",
 702     "NSEC3PARAM",
 703     "PRESIGNED",
 704     "LUA-AXFR-SCRIPT"
 705   };
 706
 707   if (kind.find("X-") == 0)
 708     return true;
 709
 710   bool found = false;
 711
 712   for (const string& s : builtinOptions) {
 713     if (kind == s) {
 714       for (const string& s2 : protectedOptions) {
 715         if (!readonly && s == s2)
 716           return false;
 717       }
 718       found = true;
 719       break;
 720     }
 721   }
 722
 723   return found;
 724 }
 725
 726 static void apiZoneMetadata(HttpRequest* req, HttpResponse *resp) {
 727   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
 728
 729   UeberBackend B;
 730   DomainInfo di;
 731   if (!B.getDomainInfo(zonename, di)) {
 732     throw HttpNotFoundException();
 733   }
 734
 735   if (req->method == "GET") {
 736     map<string, vector<string> > md;
 737     Json::array document;
 738
 739     if (!B.getAllDomainMetadata(zonename, md))
 740       throw HttpNotFoundException();
 741
 742     for (const auto& i : md) {
 743       Json::array entries;
 744       for (string j : i.second)
 745         entries.push_back(j);
 746
 747       Json::object key {
 748         { "type", "Metadata" },
 749         { "kind", i.first },
 750         { "metadata", entries }
 751       };
 752
 753       document.push_back(key);
 754     }
 755
 756     resp->setBody(document);
 757   } else if (req->method == "POST" && !::arg().mustDo("api-readonly")) {
 758     auto document = req->json();
 759     string kind;
 760     vector<string> entries;
 761
 762     try {
 763       kind = stringFromJson(document, "kind");
 764     } catch (JsonException) {
 765       throw ApiException("kind is not specified or not a string");
 766     }
 767
 768     if (!isValidMetadataKind(kind, false))
 769       throw ApiException("Unsupported metadata kind '" + kind + "'");
 770
 771     vector<string> vecMetadata;
 772
 773     if (!B.getDomainMetadata(zonename, kind, vecMetadata))
 774       throw ApiException("Could not retrieve metadata entries for domain '" +
 775         zonename.toString() + "'");
 776
 777     auto& metadata = document["metadata"];
 778     if (!metadata.is_array())
 779       throw ApiException("metadata is not specified or not an array");
 780
 781     for (const auto& i : metadata.array_items()) {
 782       if (!i.is_string())
 783         throw ApiException("metadata must be strings");
 784       else if (std::find(vecMetadata.cbegin(),
 785                          vecMetadata.cend(),
 786                          i.string_value()) == vecMetadata.cend()) {
 787         vecMetadata.push_back(i.string_value());
 788       }
 789     }
 790
 791     if (!B.setDomainMetadata(zonename, kind, vecMetadata))
 792       throw ApiException("Could not update metadata entries for domain '" +
 793         zonename.toString() + "'");
 794
 795     Json::array respMetadata;
 796     for (const string& s : vecMetadata)
 797       respMetadata.push_back(s);
 798
 799     Json::object key {
 800       { "type", "Metadata" },
 801       { "kind", document["kind"] },
 802       { "metadata", respMetadata }
 803     };
 804
 805     resp->status = 201;
 806     resp->setBody(key);
 807   } else
 808     throw HttpMethodNotAllowedException();
 809 }
 810
 811 static void apiZoneMetadataKind(HttpRequest* req, HttpResponse* resp) {
 812   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
 813
 814   UeberBackend B;
 815   DomainInfo di;
 816   if (!B.getDomainInfo(zonename, di)) {
 817     throw HttpNotFoundException();
 818   }
 819
 820   string kind = req->parameters["kind"];
 821
 822   if (req->method == "GET") {
 823     vector<string> metadata;
 824     Json::object document;
 825     Json::array entries;
 826
 827     if (!B.getDomainMetadata(zonename, kind, metadata))
 828       throw HttpNotFoundException();
 829     else if (!isValidMetadataKind(kind, true))
 830       throw ApiException("Unsupported metadata kind '" + kind + "'");
 831
 832     document["type"] = "Metadata";
 833     document["kind"] = kind;
 834
 835     for (const string& i : metadata)
 836       entries.push_back(i);
 837
 838     document["metadata"] = entries;
 839     resp->setBody(document);
 840   } else if (req->method == "PUT" && !::arg().mustDo("api-readonly")) {
 841     auto document = req->json();
 842
 843     if (!isValidMetadataKind(kind, false))
 844       throw ApiException("Unsupported metadata kind '" + kind + "'");
 845
 846     vector<string> vecMetadata;
 847     auto& metadata = document["metadata"];
 848     if (!metadata.is_array())
 849       throw ApiException("metadata is not specified or not an array");
 850
 851     for (const auto& i : metadata.array_items()) {
 852       if (!i.is_string())
 853         throw ApiException("metadata must be strings");
 854       vecMetadata.push_back(i.string_value());
 855     }
 856
 857     if (!B.setDomainMetadata(zonename, kind, vecMetadata))
 858       throw ApiException("Could not update metadata entries for domain '" + zonename.toString() + "'");
 859
 860     Json::object key {
 861       { "type", "Metadata" },
 862       { "kind", kind },
 863       { "metadata", metadata }
 864     };
 865
 866     resp->setBody(key);
 867   } else if (req->method == "DELETE" && !::arg().mustDo("api-readonly")) {
 868     if (!isValidMetadataKind(kind, false))
 869       throw ApiException("Unsupported metadata kind '" + kind + "'");
 870
 871     vector<string> md;  // an empty vector will do it
 872     if (!B.setDomainMetadata(zonename, kind, md))
 873       throw ApiException("Could not delete metadata for domain '" + zonename.toString() + "' (" + kind + ")");
 874   } else
 875     throw HttpMethodNotAllowedException();
 876 }
 877
 878 static void apiZoneCryptokeysGET(DNSName zonename, int inquireKeyId, HttpResponse *resp, DNSSECKeeper *dk) {
 879   DNSSECKeeper::keyset_t keyset=dk->getKeys(zonename, false);
 880
 881   bool inquireSingleKey = inquireKeyId >= 0;
 882
 883   Json::array doc;
 884   for(const auto& value : keyset) {
 885     if (inquireSingleKey && (unsigned)inquireKeyId != value.second.id) {
 886       continue;
 887     }
 888
 889     string keyType;
 890     switch (value.second.keyType) {
 891       case DNSSECKeeper::KSK: keyType="ksk"; break;
 892       case DNSSECKeeper::ZSK: keyType="zsk"; break;
 893       case DNSSECKeeper::CSK: keyType="csk"; break;
 894     }
 895
 896     Json::object key {
 897         { "type", "Cryptokey" },
 898         { "id", (int)value.second.id },
 899         { "active", value.second.active },
 900         { "keytype", keyType },
 901         { "flags", (uint16_t)value.first.d_flags },
 902         { "dnskey", value.first.getDNSKEY().getZoneRepresentation() },
 903         { "algorithm", DNSSECKeeper::algorithm2name(value.first.d_algorithm) },
 904         { "bits", value.first.getKey()->getBits() }
 905     };
 906
 907     if (value.second.keyType == DNSSECKeeper::KSK || value.second.keyType == DNSSECKeeper::CSK) {
 908       Json::array dses;
 909       for(const uint8_t keyid : { DNSSECKeeper::SHA1, DNSSECKeeper::SHA256, DNSSECKeeper::GOST, DNSSECKeeper::SHA384 })
 910         try {
 911           dses.push_back(makeDSFromDNSKey(zonename, value.first.getDNSKEY(), keyid).getZoneRepresentation());
 912         } catch (...) {}
 913       key["ds"] = dses;
 914     }
 915
 916     if (inquireSingleKey) {
 917       key["privatekey"] = value.first.getKey()->convertToISC();
 918       resp->setBody(key);
 919       return;
 920     }
 921     doc.push_back(key);
 922   }
 923
 924   if (inquireSingleKey) {
 925     // we came here because we couldn't find the requested key.
 926     throw HttpNotFoundException();
 927   }
 928   resp->setBody(doc);
 929
 930 }
 931
 932 /*
 933  * This method handles DELETE requests for URL /api/v1/servers/:server_id/zones/:zone_name/cryptokeys/:cryptokey_id .
 934  * It deletes a key from :zone_name specified by :cryptokey_id.
 935  * Server Answers:
 936  * Case 1: the backend returns true on removal. This means the key is gone.
 937  *      The server returns 200 OK, no body.
 938  * Case 2: the backend returns false on removal. An error occurred.
 939  *      The sever returns 422 Unprocessable Entity with message "Could not DELETE :cryptokey_id".
 940  * */
 941 static void apiZoneCryptokeysDELETE(DNSName zonename, int inquireKeyId, HttpRequest *req, HttpResponse *resp, DNSSECKeeper *dk) {
 942   if (dk->removeKey(zonename, inquireKeyId)) {
 943     resp->body = "";
 944     resp->status = 200;
 945   } else {
 946     resp->setErrorResult("Could not DELETE " + req->parameters["key_id"], 422);
 947   }
 948 }
 949
 950 /*
 951  * This method adds a key to a zone by generate it or content parameter.
 952  * Parameter:
 953  *  {
 954  *  "privatekey" : "key The format used is compatible with BIND and NSD/LDNS" <string>
 955  *  "keytype" : "ksk|zsk" <string>
 956  *  "active"  : "true|false" <value>
 957  *  "algorithm" : "key generation algorithm name as default"<string> https://doc.powerdns.com/md/authoritative/dnssec/#supported-algorithms
 958  *  "bits" : number of bits <int>
 959  *  }
 960  *
 961  * Response:
 962  *  Case 1: keytype isn't ksk|zsk
 963  *    The server returns 422 Unprocessable Entity {"error" : "Invalid keytype 'keytype'"}
 964  *  Case 2: 'bits' must be a positive integer value.
 965  *    The server returns 422 Unprocessable Entity {"error" : "'bits' must be a positive integer value."}
 966  *  Case 3: The "algorithm" isn't supported
 967  *    The server returns 422 Unprocessable Entity {"error" : "Unknown algorithm: 'algo'"}
 968  *  Case 4: Algorithm <= 10 and no bits were passed
 969  *    The server returns 422 Unprocessable Entity {"error" : "Creating an algorithm algo key requires the size (in bits) to be passed"}
 970  *  Case 5: The wrong keysize was passed
 971  *    The server returns 422 Unprocessable Entity {"error" : "The algorithm does not support the given bit size."}
 972  *  Case 6: If the server cant guess the keysize
 973  *    The server returns 422 Unprocessable Entity {"error" : "Can not guess key size for algorithm"}
 974  *  Case 7: The key-creation failed
 975  *    The server returns 422 Unprocessable Entity {"error" : "Adding key failed, perhaps DNSSEC not enabled in configuration?"}
 976  *  Case 8: The key in content has the wrong format
 977  *    The server returns 422 Unprocessable Entity {"error" : "Key could not be parsed. Make sure your key format is correct."}
 978  *  Case 9: The wrong combination of fields is submitted
 979  *    The server returns 422 Unprocessable Entity {"error" : "Either you submit just the 'content' field or you leave 'content' empty and submit the other fields."}
 980  *  Case 10: No content and everything was fine
 981  *    The server returns 201 Created and all public data about the new cryptokey
 982  *  Case 11: With specified content
 983  *    The server returns 201 Created and all public data about the added cryptokey
 984  */
 985
 986 static void apiZoneCryptokeysPOST(DNSName zonename, HttpRequest *req, HttpResponse *resp, DNSSECKeeper *dk) {
 987   auto document = req->json();
 988   string privatekey_fieldname = "privatekey";
 989   auto privatekey = document["privatekey"];
 990   if (privatekey.is_null()) {
 991     // Fallback to the old "content" behaviour
 992     privatekey = document["content"];
 993     privatekey_fieldname = "content";
 994   }
 995   bool active = boolFromJson(document, "active", false);
 996   bool keyOrZone;
 997
 998   if (stringFromJson(document, "keytype") == "ksk" || stringFromJson(document, "keytype") == "csk") {
 999     keyOrZone = true;
1000   } else if (stringFromJson(document, "keytype") == "zsk") {
1001     keyOrZone = false;
1002   } else {
1003     throw ApiException("Invalid keytype " + stringFromJson(document, "keytype"));
1004   }
1005
1006   int64_t insertedId = -1;
1007
1008   if (privatekey.is_null()) {
1009     int bits = keyOrZone ? ::arg().asNum("default-ksk-size") : ::arg().asNum("default-zsk-size");
1010     auto docbits = document["bits"];
1011     if (!docbits.is_null()) {
1012       if (!docbits.is_number() || (fmod(docbits.number_value(), 1.0) != 0) || docbits.int_value() < 0) {
1013         throw ApiException("'bits' must be a positive integer value");
1014       } else {
1015         bits = docbits.int_value();
1016       }
1017     }
1018     int algorithm = DNSSECKeeper::shorthand2algorithm(keyOrZone ? ::arg()["default-ksk-algorithm"] : ::arg()["default-zsk-algorithm"]);
1019     auto providedAlgo = document["algorithm"];
1020     if (providedAlgo.is_string()) {
1021       algorithm = DNSSECKeeper::shorthand2algorithm(providedAlgo.string_value());
1022       if (algorithm == -1)
1023         throw ApiException("Unknown algorithm: " + providedAlgo.string_value());
1024     } else if (providedAlgo.is_number()) {
1025       algorithm = providedAlgo.int_value();
1026     } else if (!providedAlgo.is_null()) {
1027       throw ApiException("Unknown algorithm: " + providedAlgo.string_value());
1028     }
1029
1030     try {
1031       if (!dk->addKey(zonename, keyOrZone, algorithm, insertedId, bits, active)) {
1032         throw ApiException("Adding key failed, perhaps DNSSEC not enabled in configuration?");
1033       }
1034     } catch (std::runtime_error& error) {
1035       throw ApiException(error.what());
1036     }
1037     if (insertedId < 0)
1038       throw ApiException("Adding key failed, perhaps DNSSEC not enabled in configuration?");
1039   } else if (document["bits"].is_null() && document["algorithm"].is_null()) {
1040     auto keyData = stringFromJson(document, privatekey_fieldname);
1041     DNSKEYRecordContent dkrc;
1042     DNSSECPrivateKey dpk;
1043     try {
1044       shared_ptr<DNSCryptoKeyEngine> dke(DNSCryptoKeyEngine::makeFromISCString(dkrc, keyData));
1045       dpk.d_algorithm = dkrc.d_algorithm;
1046       // TODO remove in 4.2.0
1047       if(dpk.d_algorithm == DNSSECKeeper::RSASHA1NSEC3SHA1)
1048         dpk.d_algorithm = DNSSECKeeper::RSASHA1;
1049
1050       if (keyOrZone)
1051         dpk.d_flags = 257;
1052       else
1053         dpk.d_flags = 256;
1054
1055       dpk.setKey(dke);
1056     }
1057     catch (std::runtime_error& error) {
1058       throw ApiException("Key could not be parsed. Make sure your key format is correct.");
1059     } try {
1060       if (!dk->addKey(zonename, dpk,insertedId, active)) {
1061         throw ApiException("Adding key failed, perhaps DNSSEC not enabled in configuration?");
1062       }
1063     } catch (std::runtime_error& error) {
1064       throw ApiException(error.what());
1065     }
1066     if (insertedId < 0)
1067       throw ApiException("Adding key failed, perhaps DNSSEC not enabled in configuration?");
1068   } else {
1069     throw ApiException("Either you submit just the 'privatekey' field or you leave 'privatekey' empty and submit the other fields.");
1070   }
1071   apiZoneCryptokeysGET(zonename, insertedId, resp, dk);
1072   resp->status = 201;
1073 }
1074
1075 /*
1076  * This method handles PUT (execute) requests for URL /api/v1/servers/:server_id/zones/:zone_name/cryptokeys/:cryptokey_id .
1077  * It de/activates a key from :zone_name specified by :cryptokey_id.
1078  * Server Answers:
1079  * Case 1: invalid JSON data
1080  *      The server returns 400 Bad Request
1081  * Case 2: the backend returns true on de/activation. This means the key is de/active.
1082  *      The server returns 204 No Content
1083  * Case 3: the backend returns false on de/activation. An error occurred.
1084  *      The sever returns 422 Unprocessable Entity with message "Could not de/activate Key: :cryptokey_id in Zone: :zone_name"
1085  * */
1086 static void apiZoneCryptokeysPUT(DNSName zonename, int inquireKeyId, HttpRequest *req, HttpResponse *resp, DNSSECKeeper *dk) {
1087   //throws an exception if the Body is empty
1088   auto document = req->json();
1089   //throws an exception if the key does not exist or is not a bool
1090   bool active = boolFromJson(document, "active");
1091   if (active) {
1092     if (!dk->activateKey(zonename, inquireKeyId)) {
1093       resp->setErrorResult("Could not activate Key: " + req->parameters["key_id"] + " in Zone: " + zonename.toString(), 422);
1094       return;
1095     }
1096   } else {
1097     if (!dk->deactivateKey(zonename, inquireKeyId)) {
1098       resp->setErrorResult("Could not deactivate Key: " + req->parameters["key_id"] + " in Zone: " + zonename.toString(), 422);
1099       return;
1100     }
1101   }
1102   resp->body = "";
1103   resp->status = 204;
1104   return;
1105 }
1106
1107 /*
1108  * This method chooses the right functionality for the request. It also checks for a cryptokey_id which has to be passed
1109  * by URL /api/v1/servers/:server_id/zones/:zone_name/cryptokeys/:cryptokey_id .
1110  * If the the HTTP-request-method isn't supported, the function returns a response with the 405 code (method not allowed).
1111  * */
1112 static void apiZoneCryptokeys(HttpRequest *req, HttpResponse *resp) {
1113   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
1114
1115   UeberBackend B;
1116   DNSSECKeeper dk(&B);
1117   DomainInfo di;
1118   if (!B.getDomainInfo(zonename, di)) {
1119     throw HttpNotFoundException();
1120   }
1121
1122   int inquireKeyId = -1;
1123   if (req->parameters.count("key_id")) {
1124     inquireKeyId = std::stoi(req->parameters["key_id"]);
1125   }
1126
1127   if (req->method == "GET") {
1128     apiZoneCryptokeysGET(zonename, inquireKeyId, resp, &dk);
1129   } else if (req->method == "DELETE" && !::arg().mustDo("api-readonly")) {
1130     if (inquireKeyId == -1)
1131       throw HttpBadRequestException();
1132     apiZoneCryptokeysDELETE(zonename, inquireKeyId, req, resp, &dk);
1133   } else if (req->method == "POST" && !::arg().mustDo("api-readonly")) {
1134     apiZoneCryptokeysPOST(zonename, req, resp, &dk);
1135   } else if (req->method == "PUT" && !::arg().mustDo("api-readonly")) {
1136     if (inquireKeyId == -1)
1137       throw HttpBadRequestException();
1138     apiZoneCryptokeysPUT(zonename, inquireKeyId, req, resp, &dk);
1139   } else {
1140     throw HttpMethodNotAllowedException(); //Returns method not allowed
1141   }
1142 }
1143
1144 static void gatherRecordsFromZone(const std::string& zonestring, vector<DNSResourceRecord>& new_records, DNSName zonename) {
1145   DNSResourceRecord rr;
1146   vector<string> zonedata;
1147   stringtok(zonedata, zonestring, "\r\n");
1148
1149   ZoneParserTNG zpt(zonedata, zonename);
1150
1151   bool seenSOA=false;
1152
1153   string comment = "Imported via the API";
1154
1155   try {
1156     while(zpt.get(rr, &comment)) {
1157       if(seenSOA && rr.qtype.getCode() == QType::SOA)
1158         continue;
1159       if(rr.qtype.getCode() == QType::SOA)
1160         seenSOA=true;
1161
1162       new_records.push_back(rr);
1163     }
1164   }
1165   catch(std::exception& ae) {
1166     throw ApiException("An error occurred while parsing the zonedata: "+string(ae.what()));
1167   }
1168 }
1169
1170 /** Throws ApiException if records with duplicate name/type/content are present.
1171  *  NOTE: sorts records in-place.
1172  */
1173 static void checkDuplicateRecords(vector<DNSResourceRecord>& records) {
1174   sort(records.begin(), records.end(),
1175     [](const DNSResourceRecord& rec_a, const DNSResourceRecord& rec_b) -> bool {
1176       return rec_a.qname.toString() > rec_b.qname.toString() || \
1177         rec_a.qtype.getCode() > rec_b.qtype.getCode() || \
1178         rec_a.content < rec_b.content;
1179     }
1180   );
1181   DNSResourceRecord previous;
1182   for(const auto& rec : records) {
1183     if (previous.qtype == rec.qtype && previous.qname == rec.qname && previous.content == rec.content) {
1184       throw ApiException("Duplicate record in RRset " + rec.qname.toString() + " IN " + rec.qtype.getName() + " with content \"" + rec.content + "\"");
1185     }
1186     previous = rec;
1187   }
1188 }
1189
1190 static void apiServerZones(HttpRequest* req, HttpResponse* resp) {
1191   UeberBackend B;
1192   DNSSECKeeper dk(&B);
1193   if (req->method == "POST" && !::arg().mustDo("api-readonly")) {
1194     DomainInfo di;
1195     auto document = req->json();
1196     DNSName zonename = apiNameToDNSName(stringFromJson(document, "name"));
1197     apiCheckNameAllowedCharacters(zonename.toString());
1198     zonename.makeUsLowerCase();
1199
1200     bool exists = B.getDomainInfo(zonename, di);
1201     if(exists)
1202       throw HttpConflictException();
1203
1204     // validate 'kind' is set
1205     DomainInfo::DomainKind zonekind = DomainInfo::stringToKind(stringFromJson(document, "kind"));
1206
1207     string zonestring = document["zone"].string_value();
1208     auto rrsets = document["rrsets"];
1209     if (rrsets.is_array() && zonestring != "")
1210       throw ApiException("You cannot give rrsets AND zone data as text");
1211
1212     auto nameservers = document["nameservers"];
1213     if (!nameservers.is_array() && zonekind != DomainInfo::Slave)
1214       throw ApiException("Nameservers list must be given (but can be empty if NS records are supplied)");
1215
1216     string soa_edit_api_kind;
1217     if (document["soa_edit_api"].is_string()) {
1218       soa_edit_api_kind = document["soa_edit_api"].string_value();
1219     }
1220     else {
1221       soa_edit_api_kind = "DEFAULT";
1222     }
1223     string soa_edit_kind = document["soa_edit"].string_value();
1224
1225     // if records/comments are given, load and check them
1226     bool have_soa = false;
1227     bool have_zone_ns = false;
1228     vector<DNSResourceRecord> new_records;
1229     vector<Comment> new_comments;
1230     vector<DNSResourceRecord> new_ptrs;
1231
1232     if (rrsets.is_array()) {
1233       for (const auto& rrset : rrsets.array_items()) {
1234         DNSName qname = apiNameToDNSName(stringFromJson(rrset, "name"));
1235         apiCheckQNameAllowedCharacters(qname.toString());
1236         QType qtype;
1237         qtype = stringFromJson(rrset, "type");
1238         if (qtype.getCode() == 0) {
1239           throw ApiException("RRset "+qname.toString()+" IN "+stringFromJson(rrset, "type")+": unknown type given");
1240         }
1241         if (rrset["records"].is_array()) {
1242           int ttl = intFromJson(rrset, "ttl");
1243           gatherRecords(rrset, qname, qtype, ttl, new_records, new_ptrs);
1244         }
1245         if (rrset["comments"].is_array()) {
1246           gatherComments(rrset, qname, qtype, new_comments);
1247         }
1248       }
1249     } else if (zonestring != "") {
1250       gatherRecordsFromZone(zonestring, new_records, zonename);
1251     }
1252
1253     for(auto& rr : new_records) {
1254       rr.qname.makeUsLowerCase();
1255       if (!rr.qname.isPartOf(zonename) && rr.qname != zonename)
1256         throw ApiException("RRset "+rr.qname.toString()+" IN "+rr.qtype.getName()+": Name is out of zone");
1257       apiCheckQNameAllowedCharacters(rr.qname.toString());
1258
1259       if (rr.qtype.getCode() == QType::SOA && rr.qname==zonename) {
1260         have_soa = true;
1261         increaseSOARecord(rr, soa_edit_api_kind, soa_edit_kind);
1262       }
1263       if (rr.qtype.getCode() == QType::NS && rr.qname==zonename) {
1264         have_zone_ns = true;
1265       }
1266     }
1267
1268     // synthesize RRs as needed
1269     DNSResourceRecord autorr;
1270     autorr.qname = zonename;
1271     autorr.auth = 1;
1272     autorr.ttl = ::arg().asNum("default-ttl");
1273
1274     if (!have_soa && zonekind != DomainInfo::Slave) {
1275       // synthesize a SOA record so the zone "really" exists
1276       string soa = (boost::format("%s %s %ul")
1277         % ::arg()["default-soa-name"]
1278         % (::arg().isEmpty("default-soa-mail") ? (DNSName("hostmaster.") + zonename).toString() : ::arg()["default-soa-mail"])
1279         % document["serial"].int_value()
1280       ).str();
1281       SOAData sd;
1282       fillSOAData(soa, sd);  // fills out default values for us
1283       autorr.qtype = QType::SOA;
1284       autorr.content = makeSOAContent(sd)->getZoneRepresentation(true);
1285       increaseSOARecord(autorr, soa_edit_api_kind, soa_edit_kind);
1286       new_records.push_back(autorr);
1287     }
1288
1289     // create NS records if nameservers are given
1290     for (auto value : nameservers.array_items()) {
1291       string nameserver = value.string_value();
1292       if (nameserver.empty())
1293         throw ApiException("Nameservers must be non-empty strings");
1294       if (!isCanonical(nameserver))
1295         throw ApiException("Nameserver is not canonical: '" + nameserver + "'");
1296       try {
1297         // ensure the name parses
1298         autorr.content = DNSName(nameserver).toStringRootDot();
1299       } catch (...) {
1300         throw ApiException("Unable to parse DNS Name for NS '" + nameserver + "'");
1301       }
1302       autorr.qtype = QType::NS;
1303       new_records.push_back(autorr);
1304       if (have_zone_ns) {
1305         throw ApiException("Nameservers list MUST NOT be mixed with zone-level NS in rrsets");
1306       }
1307     }
1308
1309     checkDuplicateRecords(new_records);
1310
1311     if (boolFromJson(document, "dnssec", false)) {
1312       checkDefaultDNSSECAlgos();
1313
1314       if(document["nsec3param"].string_value().length() > 0) {
1315         NSEC3PARAMRecordContent ns3pr(document["nsec3param"].string_value());
1316         string error_msg = "";
1317         if (!dk.checkNSEC3PARAM(ns3pr, error_msg)) {
1318           throw ApiException("NSEC3PARAMs provided for zone '"+zonename.toString()+"' are invalid. " + error_msg);
1319         }
1320       }
1321     }
1322
1323     // no going back after this
1324     if(!B.createDomain(zonename))
1325       throw ApiException("Creating domain '"+zonename.toString()+"' failed");
1326
1327     if(!B.getDomainInfo(zonename, di))
1328       throw ApiException("Creating domain '"+zonename.toString()+"' failed: lookup of domain ID failed");
1329
1330     // updateDomainSettingsFromDocument does NOT fill out the default we've established above.
1331     if (!soa_edit_api_kind.empty()) {
1332       di.backend->setDomainMetadataOne(zonename, "SOA-EDIT-API", soa_edit_api_kind);
1333     }
1334
1335     di.backend->startTransaction(zonename, di.id);
1336
1337     for(auto rr : new_records) {
1338       rr.domain_id = di.id;
1339       di.backend->feedRecord(rr, DNSName());
1340     }
1341     for(Comment& c : new_comments) {
1342       c.domain_id = di.id;
1343       di.backend->feedComment(c);
1344     }
1345
1346     updateDomainSettingsFromDocument(B, di, zonename, document);
1347
1348     di.backend->commitTransaction();
1349
1350     storeChangedPTRs(B, new_ptrs);
1351
1352     fillZone(zonename, resp, shouldDoRRSets(req));
1353     resp->status = 201;
1354     return;
1355   }
1356
1357   if(req->method != "GET")
1358     throw HttpMethodNotAllowedException();
1359
1360   vector<DomainInfo> domains;
1361   B.getAllDomains(&domains, true); // incl. disabled
1362
1363   Json::array doc;
1364   for(const DomainInfo& di : domains) {
1365     doc.push_back(getZoneInfo(di, &dk));
1366   }
1367   resp->setBody(doc);
1368 }
1369
1370 static void apiServerZoneDetail(HttpRequest* req, HttpResponse* resp) {
1371   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
1372
1373   UeberBackend B;
1374   DomainInfo di;
1375   if (!B.getDomainInfo(zonename, di)) {
1376     throw HttpNotFoundException();
1377   }
1378
1379   if(req->method == "PUT" && !::arg().mustDo("api-readonly")) {
1380     // update domain settings
1381
1382     updateDomainSettingsFromDocument(B, di, zonename, req->json());
1383
1384     resp->body = "";
1385     resp->status = 204; // No Content, but indicate success
1386     return;
1387   }
1388   else if(req->method == "DELETE" && !::arg().mustDo("api-readonly")) {
1389     // delete domain
1390     if(!di.backend->deleteDomain(zonename))
1391       throw ApiException("Deleting domain '"+zonename.toString()+"' failed: backend delete failed/unsupported");
1392
1393     // empty body on success
1394     resp->body = "";
1395     resp->status = 204; // No Content: declare that the zone is gone now
1396     return;
1397   } else if (req->method == "PATCH" && !::arg().mustDo("api-readonly")) {
1398     patchZone(req, resp);
1399     return;
1400   } else if (req->method == "GET") {
1401     fillZone(zonename, resp, shouldDoRRSets(req));
1402     return;
1403   }
1404   throw HttpMethodNotAllowedException();
1405 }
1406
1407 static void apiServerZoneExport(HttpRequest* req, HttpResponse* resp) {
1408   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
1409
1410   if(req->method != "GET")
1411     throw HttpMethodNotAllowedException();
1412
1413   ostringstream ss;
1414
1415   UeberBackend B;
1416   DomainInfo di;
1417   if (!B.getDomainInfo(zonename, di)) {
1418     throw HttpNotFoundException();
1419   }
1420
1421   DNSResourceRecord rr;
1422   SOAData sd;
1423   di.backend->list(zonename, di.id);
1424   while(di.backend->get(rr)) {
1425     if (!rr.qtype.getCode())
1426       continue; // skip empty non-terminals
1427
1428     ss <<
1429       rr.qname.toString() << "\t" <<
1430       rr.ttl << "\t" <<
1431       rr.qtype.getName() << "\t" <<
1432       makeApiRecordContent(rr.qtype, rr.content) <<
1433       endl;
1434   }
1435
1436   if (req->accept_json) {
1437     resp->setBody(Json::object { { "zone", ss.str() } });
1438   } else {
1439     resp->headers["Content-Type"] = "text/plain; charset=us-ascii";
1440     resp->body = ss.str();
1441   }
1442 }
1443
1444 static void apiServerZoneAxfrRetrieve(HttpRequest* req, HttpResponse* resp) {
1445   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
1446
1447   if(req->method != "PUT" || ::arg().mustDo("api-readonly"))
1448     throw HttpMethodNotAllowedException();
1449
1450   UeberBackend B;
1451   DomainInfo di;
1452   if (!B.getDomainInfo(zonename, di)) {
1453     throw HttpNotFoundException();
1454   }
1455
1456   if(di.masters.empty())
1457     throw ApiException("Domain '"+zonename.toString()+"' is not a slave domain (or has no master defined)");
1458
1459   random_shuffle(di.masters.begin(), di.masters.end());
1460   Communicator.addSuckRequest(zonename, di.masters.front());
1461   resp->setSuccessResult("Added retrieval request for '"+zonename.toString()+"' from master "+di.masters.front().toLogString());
1462 }
1463
1464 static void apiServerZoneNotify(HttpRequest* req, HttpResponse* resp) {
1465   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
1466
1467   if(req->method != "PUT" || ::arg().mustDo("api-readonly"))
1468     throw HttpMethodNotAllowedException();
1469
1470   UeberBackend B;
1471   DomainInfo di;
1472   if (!B.getDomainInfo(zonename, di)) {
1473     throw HttpNotFoundException();
1474   }
1475
1476   if(!Communicator.notifyDomain(zonename))
1477     throw ApiException("Failed to add to the queue - see server log");
1478
1479   resp->setSuccessResult("Notification queued");
1480 }
1481
1482 static void apiServerZoneRectify(HttpRequest* req, HttpResponse* resp) {
1483   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
1484
1485   if(req->method != "PUT")
1486     throw HttpMethodNotAllowedException();
1487
1488   UeberBackend B;
1489   DomainInfo di;
1490   if (!B.getDomainInfo(zonename, di)) {
1491     throw HttpNotFoundException();
1492   }
1493
1494   DNSSECKeeper dk(&B);
1495
1496   if (!dk.isSecuredZone(zonename))
1497     throw ApiException("Zone '" + zonename.toString() + "' is not DNSSEC signed, not rectifying.");
1498
1499   if (di.kind == DomainInfo::Slave)
1500     throw ApiException("Zone '" + zonename.toString() + "' is a slave zone, not rectifying.");
1501
1502   string error_msg = "";
1503   string info;
1504   if (!dk.rectifyZone(zonename, error_msg, info, true))
1505     throw ApiException("Failed to rectify '" + zonename.toString() + "' " + error_msg);
1506
1507   resp->setSuccessResult("Rectified");
1508 }
1509
1510 static void makePtr(const DNSResourceRecord& rr, DNSResourceRecord* ptr) {
1511   if (rr.qtype.getCode() == QType::A) {
1512     uint32_t ip;
1513     if (!IpToU32(rr.content, &ip)) {
1514       throw ApiException("PTR: Invalid IP address given");
1515     }
1516     ptr->qname = DNSName((boost::format("%u.%u.%u.%u.in-addr.arpa.")
1517                   % ((ip >> 24) & 0xff)
1518                   % ((ip >> 16) & 0xff)
1519                   % ((ip >>  8) & 0xff)
1520                   % ((ip      ) & 0xff)
1521                          ).str());
1522   } else if (rr.qtype.getCode() == QType::AAAA) {
1523     ComboAddress ca(rr.content);
1524     char buf[3];
1525     ostringstream ss;
1526     for (int octet = 0; octet < 16; ++octet) {
1527       if (snprintf(buf, sizeof(buf), "%02x", ca.sin6.sin6_addr.s6_addr[octet]) != (sizeof(buf)-1)) {
1528         // this should be impossible: no byte should give more than two digits in hex format
1529         throw PDNSException("Formatting IPv6 address failed");
1530       }
1531       ss << buf[0] << '.' << buf[1] << '.';
1532     }
1533     string tmp = ss.str();
1534     tmp.resize(tmp.size()-1); // remove last dot
1535     // reverse and append arpa domain
1536     ptr->qname = DNSName(string(tmp.rbegin(), tmp.rend())) + DNSName("ip6.arpa.");
1537   } else {
1538     throw ApiException("Unsupported PTR source '" + rr.qname.toString() + "' type '" + rr.qtype.getName() + "'");
1539   }
1540
1541   ptr->qtype = "PTR";
1542   ptr->ttl = rr.ttl;
1543   ptr->disabled = rr.disabled;
1544   ptr->content = rr.qname.toStringRootDot();
1545 }
1546
1547 static void storeChangedPTRs(UeberBackend& B, vector<DNSResourceRecord>& new_ptrs) {
1548   for(const DNSResourceRecord& rr :  new_ptrs) {
1549     SOAData sd;
1550     if (!B.getAuth(rr.qname, QType(QType::PTR), &sd, false))
1551       throw ApiException("Could not find domain for PTR '"+rr.qname.toString()+"' requested for '"+rr.content+"' (while saving)");
1552
1553     string soa_edit_api_kind;
1554     string soa_edit_kind;
1555     bool soa_changed = false;
1556     DNSResourceRecord soarr;
1557     sd.db->getDomainMetadataOne(sd.qname, "SOA-EDIT-API", soa_edit_api_kind);
1558     sd.db->getDomainMetadataOne(sd.qname, "SOA-EDIT", soa_edit_kind);
1559     if (!soa_edit_api_kind.empty()) {
1560       soa_changed = makeIncreasedSOARecord(sd, soa_edit_api_kind, soa_edit_kind, soarr);
1561     }
1562
1563     sd.db->startTransaction(sd.qname);
1564     if (!sd.db->replaceRRSet(sd.domain_id, rr.qname, rr.qtype, vector<DNSResourceRecord>(1, rr))) {
1565       sd.db->abortTransaction();
1566       throw ApiException("PTR-Hosting backend for "+rr.qname.toString()+"/"+rr.qtype.getName()+" does not support editing records.");
1567     }
1568
1569     if (soa_changed) {
1570       sd.db->replaceRRSet(sd.domain_id, soarr.qname, soarr.qtype, vector<DNSResourceRecord>(1, soarr));
1571     }
1572
1573     sd.db->commitTransaction();
1574     purgeAuthCachesExact(rr.qname);
1575   }
1576 }
1577
1578 static void patchZone(HttpRequest* req, HttpResponse* resp) {
1579   UeberBackend B;
1580   DomainInfo di;
1581   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
1582   if (!B.getDomainInfo(zonename, di)) {
1583     throw HttpNotFoundException();
1584   }
1585
1586   vector<DNSResourceRecord> new_records;
1587   vector<Comment> new_comments;
1588   vector<DNSResourceRecord> new_ptrs;
1589
1590   Json document = req->json();
1591
1592   auto rrsets = document["rrsets"];
1593   if (!rrsets.is_array())
1594     throw ApiException("No rrsets given in update request");
1595
1596   di.backend->startTransaction(zonename);
1597
1598   try {
1599     string soa_edit_api_kind;
1600     string soa_edit_kind;
1601     di.backend->getDomainMetadataOne(zonename, "SOA-EDIT-API", soa_edit_api_kind);
1602     di.backend->getDomainMetadataOne(zonename, "SOA-EDIT", soa_edit_kind);
1603     bool soa_edit_done = false;
1604
1605     for (const auto& rrset : rrsets.array_items()) {
1606       string changetype = toUpper(stringFromJson(rrset, "changetype"));
1607       DNSName qname = apiNameToDNSName(stringFromJson(rrset, "name"));
1608       apiCheckQNameAllowedCharacters(qname.toString());
1609       QType qtype;
1610       qtype = stringFromJson(rrset, "type");
1611       if (qtype.getCode() == 0) {
1612         throw ApiException("RRset "+qname.toString()+" IN "+stringFromJson(rrset, "type")+": unknown type given");
1613       }
1614
1615       if (changetype == "DELETE") {
1616         // delete all matching qname/qtype RRs (and, implicitly comments).
1617         if (!di.backend->replaceRRSet(di.id, qname, qtype, vector<DNSResourceRecord>())) {
1618           throw ApiException("Hosting backend does not support editing records.");
1619         }
1620       }
1621       else if (changetype == "REPLACE") {
1622         // we only validate for REPLACE, as DELETE can be used to "fix" out of zone records.
1623         if (!qname.isPartOf(zonename) && qname != zonename)
1624           throw ApiException("RRset "+qname.toString()+" IN "+qtype.getName()+": Name is out of zone");
1625
1626         bool replace_records = rrset["records"].is_array();
1627         bool replace_comments = rrset["comments"].is_array();
1628
1629         if (!replace_records && !replace_comments) {
1630           throw ApiException("No change for RRset " + qname.toString() + " IN " + qtype.getName());
1631         }
1632
1633         new_records.clear();
1634         new_comments.clear();
1635
1636         if (replace_records) {
1637           // ttl shouldn't be part of DELETE, and it shouldn't be required if we don't get new records.
1638           int ttl = intFromJson(rrset, "ttl");
1639           // new_ptrs is merged.
1640           gatherRecords(rrset, qname, qtype, ttl, new_records, new_ptrs);
1641
1642           for(DNSResourceRecord& rr : new_records) {
1643             rr.domain_id = di.id;
1644             if (rr.qtype.getCode() == QType::SOA && rr.qname==zonename) {
1645               soa_edit_done = increaseSOARecord(rr, soa_edit_api_kind, soa_edit_kind);
1646             }
1647           }
1648           checkDuplicateRecords(new_records);
1649         }
1650
1651         if (replace_comments) {
1652           gatherComments(rrset, qname, qtype, new_comments);
1653
1654           for(Comment& c : new_comments) {
1655             c.domain_id = di.id;
1656           }
1657         }
1658
1659         if (replace_records) {
1660           di.backend->lookup(QType(QType::ANY), qname);
1661           DNSResourceRecord rr;
1662           while (di.backend->get(rr)) {
1663             if (qtype.getCode() == QType::CNAME && rr.qtype.getCode() != QType::CNAME) {
1664               throw ApiException("RRset "+qname.toString()+" IN "+qtype.getName()+": Conflicts with pre-existing non-CNAME RRset");
1665             } else if (qtype.getCode() != QType::CNAME && rr.qtype.getCode() == QType::CNAME) {
1666               throw ApiException("RRset "+qname.toString()+" IN "+qtype.getName()+": Conflicts with pre-existing CNAME RRset");
1667             }
1668           }
1669
1670           if (!di.backend->replaceRRSet(di.id, qname, qtype, new_records)) {
1671             throw ApiException("Hosting backend does not support editing records.");
1672           }
1673         }
1674         if (replace_comments) {
1675           if (!di.backend->replaceComments(di.id, qname, qtype, new_comments)) {
1676             throw ApiException("Hosting backend does not support editing comments.");
1677           }
1678         }
1679       }
1680       else
1681         throw ApiException("Changetype not understood");
1682     }
1683
1684     // edit SOA (if needed)
1685     if (!soa_edit_api_kind.empty() && !soa_edit_done) {
1686       SOAData sd;
1687       if (!B.getSOAUncached(zonename, sd, true))
1688         throw ApiException("No SOA found for domain '"+zonename.toString()+"'");
1689
1690       DNSResourceRecord rr;
1691       if (makeIncreasedSOARecord(sd, soa_edit_api_kind, soa_edit_kind, rr)) {
1692         if (!di.backend->replaceRRSet(di.id, rr.qname, rr.qtype, vector<DNSResourceRecord>(1, rr))) {
1693           throw ApiException("Hosting backend does not support editing records.");
1694         }
1695       }
1696
1697       // return old and new serials in headers
1698       resp->headers["X-PDNS-Old-Serial"] = std::to_string(sd.serial);
1699       fillSOAData(rr.content, sd);
1700       resp->headers["X-PDNS-New-Serial"] = std::to_string(sd.serial);
1701     }
1702
1703   } catch(...) {
1704     di.backend->abortTransaction();
1705     throw;
1706   }
1707
1708   DNSSECKeeper dk(&B);
1709   string api_rectify;
1710   di.backend->getDomainMetadataOne(zonename, "API-RECTIFY", api_rectify);
1711   if (dk.isSecuredZone(zonename) && !dk.isPresigned(zonename) && api_rectify == "1") {
1712     string error_msg = "";
1713     string info;
1714     if (!dk.rectifyZone(zonename, error_msg, info, false))
1715       throw ApiException("Failed to rectify '" + zonename.toString() + "' " + error_msg);
1716   }
1717
1718   di.backend->commitTransaction();
1719
1720   purgeAuthCachesExact(zonename);
1721
1722   // now the PTRs
1723   storeChangedPTRs(B, new_ptrs);
1724
1725   resp->body = "";
1726   resp->status = 204; // No Content, but indicate success
1727   return;
1728 }
1729
1730 static void apiServerSearchData(HttpRequest* req, HttpResponse* resp) {
1731   if(req->method != "GET")
1732     throw HttpMethodNotAllowedException();
1733
1734   string q = req->getvars["q"];
1735   string sMax = req->getvars["max"];
1736   int maxEnts = 100;
1737   int ents = 0;
1738
1739   if (q.empty())
1740     throw ApiException("Query q can't be blank");
1741   if (!sMax.empty())
1742     maxEnts = std::stoi(sMax);
1743   if (maxEnts < 1)
1744     throw ApiException("Maximum entries must be larger than 0");
1745
1746   SimpleMatch sm(q,true);
1747   UeberBackend B;
1748   vector<DomainInfo> domains;
1749   vector<DNSResourceRecord> result_rr;
1750   vector<Comment> result_c;
1751   map<int,DomainInfo> zoneIdZone;
1752   map<int,DomainInfo>::iterator val;
1753   Json::array doc;
1754
1755   B.getAllDomains(&domains, true);
1756
1757   for(const DomainInfo di: domains)
1758   {
1759     if (ents < maxEnts && sm.match(di.zone)) {
1760       doc.push_back(Json::object {
1761         { "object_type", "zone" },
1762         { "zone_id", apiZoneNameToId(di.zone) },
1763         { "name", di.zone.toString() }
1764       });
1765       ents++;
1766     }
1767     zoneIdZone[di.id] = di; // populate cache
1768   }
1769
1770   if (B.searchRecords(q, maxEnts, result_rr))
1771   {
1772     for(const DNSResourceRecord& rr: result_rr)
1773     {
1774       if (!rr.qtype.getCode())
1775         continue; // skip empty non-terminals
1776
1777       auto object = Json::object {
1778         { "object_type", "record" },
1779         { "name", rr.qname.toString() },
1780         { "type", rr.qtype.getName() },
1781         { "ttl", (double)rr.ttl },
1782         { "disabled", rr.disabled },
1783         { "content", makeApiRecordContent(rr.qtype, rr.content) }
1784       };
1785       if ((val = zoneIdZone.find(rr.domain_id)) != zoneIdZone.end()) {
1786         object["zone_id"] = apiZoneNameToId(val->second.zone);
1787         object["zone"] = val->second.zone.toString();
1788       }
1789       doc.push_back(object);
1790     }
1791   }
1792
1793   if (B.searchComments(q, maxEnts, result_c))
1794   {
1795     for(const Comment &c: result_c)
1796     {
1797       auto object = Json::object {
1798         { "object_type", "comment" },
1799         { "name", c.qname.toString() },
1800         { "content", c.content }
1801       };
1802       if ((val = zoneIdZone.find(c.domain_id)) != zoneIdZone.end()) {
1803         object["zone_id"] = apiZoneNameToId(val->second.zone);
1804         object["zone"] = val->second.zone.toString();
1805       }
1806       doc.push_back(object);
1807     }
1808   }
1809
1810   resp->setBody(doc);
1811 }
1812
1813 void apiServerCacheFlush(HttpRequest* req, HttpResponse* resp) {
1814   if(req->method != "PUT" || ::arg().mustDo("api-readonly"))
1815     throw HttpMethodNotAllowedException();
1816
1817   DNSName canon = apiNameToDNSName(req->getvars["domain"]);
1818
1819   uint64_t count = purgeAuthCachesExact(canon);
1820   resp->setBody(Json::object {
1821       { "count", (int) count },
1822       { "result", "Flushed cache." }
1823   });
1824 }
1825
1826 void AuthWebServer::cssfunction(HttpRequest* req, HttpResponse* resp)
1827 {
1828   resp->headers["Cache-Control"] = "max-age=86400";
1829   resp->headers["Content-Type"] = "text/css";
1830
1831   ostringstream ret;
1832   ret<<"* { box-sizing: border-box; margin: 0; padding: 0; }"<<endl;
1833   ret<<"body { color: black; background: white; margin-top: 1em; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 10pt; position: relative; }"<<endl;
1834   ret<<"a { color: #0959c2; }"<<endl;
1835   ret<<"a:hover { color: #3B8EC8; }"<<endl;
1836   ret<<".row { width: 940px; max-width: 100%; min-width: 768px; margin: 0 auto; }"<<endl;
1837   ret<<".row:before, .row:after { display: table; content:\" \"; }"<<endl;
1838   ret<<".row:after { clear: both; }"<<endl;
1839   ret<<".columns { position: relative; min-height: 1px; float: left; }"<<endl;
1840   ret<<".all { width: 100%; }"<<endl;
1841   ret<<".headl { width: 60%; }"<<endl;
1842   ret<<".headr { width: 39.5%; float: right; background-repeat: no-repeat; margin-top: 7px; ";
1843   ret<<"background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAJoAAAAUCAYAAAB1RSS/AAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAACtgAAArYBAHIqtQAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAABBTSURBVGiBtVp7cFRVmv9u3763b7/f9It00iFACBohgCEyQYgKI49CLV3cWaoEZBcfo2shu7KOtZbjrqOuVQtVWFuOrPqPRU3NgOIDlkgyJEYJwUAqjzEJedFJupN0p9/v+9o/mtve7r790HF+VbeSPue7555zz+98z4ucOXNmgWVZBH4AK5PJGIPBQBqNxpTNZkthGMZCCUxMTBCDg4PyiYkJWTQaRc1mc7Kuri7a1NQU4ssxDAOffPKJAQCynvnII494ESTddO3aNaXT6SS4TplMRj/44IM+7ndXV5dqfn5ewh9306ZNQZqmobu7W11qri0tLX6tVkv19vYqpqampPw+BEFYtVpNGQwG0mKxpJYsWUIKjTE6OiodGBhQ8NcgkUgYjUZDORyOhM1mSxV6fjAYFF+6dEnLb9NoNOR9990X4H53dHSovV4vzpfZvn27T6FQ0Py2sbExorOzU+N2uwmWZUGv15N33nlnuLGxMZy7byyVQEJ//nd9Yuz/lJR/HBdrHSlJ9baIuuV1L4LJ8/Y49pc/KcJX39WRC4MEgskY3Lourmn5rQdbckfe2ijfOBZo+40xNXtNysR9KLZkdVK+9oBf0fBkCABA3NraamTZwjxSKpXUAw884G1paQkUIty5c+f0Fy5cWMIfx+l0Snt6ejTt7e26AwcOuKxWawoAQCQSQW9vr3pxcTHrJTY3Nwe5Tb18+bJ2bGxMzvWhKMpu27bNj6IoCwDQ1tamd7lcRM79genpaaK1tdVQcDG3sXbt2rBWq6X6+/sV3d3d2mKyy5cvj+7cudO7atWqGL99bGxMWuxZOp0utX37du+9994b5A4Qh2AwiObei6Ioe/fdd4eVSiUNAHD16lX1+Pi4nC+zadOmIJ9oZ8+eNeTu3/T0tLSvr0/V3d0dPXr0qJNrZ+KL6MKpjZWUbyxzQMmFIYJcGCISw5+qjE9+M4UqLJmx/RdeWBK+elKfGTjuR+OhWSxx86JS/9D/zsrufDzMdSXGv5J5/vBYBZuKiLi25HS3LDndLUuMX1IYHjvtynQUQjgcFp89e9b8zjvv2BmGyepjWRbeffdd2/nz55cUIqvT6ZSeOHHC7vf7xVyb3W6P58rNzc1liOfxeLJISNM04na7Me63z+fD+P1SqZQupHn+Wty8eVN+4sSJyv7+fnlp6R/g8/nw06dPW0+ePLmUJEmklDxN08iVK1dU5Y7f0dGhvnjxYkElQVFU1jP9Xz5j4pMsSzYwifvPPWnhfsdHPpdnkYwHlk4ivi9/baFDM2IAACYZEi1++qSVTzI+YkN/VEe++726JNE4TE1Nyc6cOWPkt3322Wf6/v7+ki8nEAhgH3zwQWYhDoejINGSyaQoFAphuf2zs7MSAIBIJIImEgmU32ez2RLlruOngGVZ+Oijj6w+n09cWjobg4ODyg8//NBSWhLgu+++K4toJEkin376qancObBkFIl/f7bo2ImxC0om5kUBACK9pzTFZJlEAI0O/kEJABAf+UJOh115+8VH5MZHGkGimc3mRK66BwBoa2szBAIBMUB6w1tbW415QgUwOjqqGB4elgIA1NTU5BGN02IulwsXOqUul0sCADA/P5+3qIqKip+NaARBMBiGMbnt0Wg0z68qF729vepr164pS8k5nU7ZwsJC0U0DAOjp6VHGYjE0t10kEgmqt5TrOwIYqqRWTbmuSQAASM9fiFKy5Fx/Wnaur7Ss53tC8IQ+/fTTM/F4HH3rrbcc/E1nWRYmJyeJtWvXRr7++mt1rnoGANi6devipk2bgsePH7dHIpGs8Ts7O7W1tbXxqqqqJIZhLN+keDweDADA7XbjuWPebpcAACwsLOT1V1VVFSSayWRKvvLKK5P8tmLBTVNTk//hhx/2vv/++5aBgYEsLeB0OqWF7gMAsFqtiYqKivj169c1ueaytbVVv2HDhnChewHS7/fKlSuqPXv2LBaTyw1gAABqa2sjhw4dck1PT0vOnz9v4O+NWFNdlluBqispAABUYSEp/6TgPmRkVba0rGppybFRpZksaDodDkeioqIiT/M4nU4JAMDIyEiez1JTUxN9/PHHFyoqKpJbtmzx5faPj4/LANKOr9VqzRqbi7D4vhof8/PzOMAPhMyZa948OSAIAjiOs/xLSFvzIZFImO3bt+fNn9OqhaDRaMiDBw/Obd26NY8oTqdTWmhtfPT29paMmkOhUJ6CkEgkjFKppOvq6mIvvviis76+PkNqVF1BiQ21yWJjoiobiRlWpQAACMeWaKk5EMu2RQEAiOr7YyBCi2YliMrN0aI+Wjwez+vn/KOZmZk8lbl69eoI97+QeQwEAhgXFFRVVWX1+/1+nGVZyE1bcPB6vRKWZSE35JdKpbTJZCp4qiiKQmZmZnDuEiKqEITWTtN0SfMDALBjx45FiUSSZ35HRkaKakQAgPn5ecnU1FRRQuv1+rz0Qn9/v+ry5ctqgPTh2rFjR9ZB0e78Hzcgedb2NhDQ7vq9C24fQNXm3/gww8qCxJTX/4OfcGyJAwBgS+pSqo3/XFADo0oLqdn2lkeQaAzDIB0dHWqPx5O3YK1WSzIMA7lmEQDAaDSSQv/zEQwGUQCA6urqLKJRFIV4PB6MH3GqVCqS3z83N4cvLi5mEaVUIOD1evHXX399GXedOnXKWkweIJ3r++abb/IcYqPRWDA3xodUKmWEyMCZ/1IolQvMfXcAabN7+vRp68cff2wS8nElVVvihl99cQtV27PmhapspOHvzzmJ5Tsy6RtELGGX7G+7JV2xIysHiqAYq/rFv3h0e96f57drHnjTo2n57TwiJrIOl6SyOWo6cPmWiNAwgj7am2++6Ugmk4IkrK2tjUWjUVRoMXK5PJOHkclkdJ4AAESjURQAYPny5YKRJ59odXV1EX6ea2ZmRpKbf/s5AwEAgO+//17+8ssv1/j9/jzNt3HjxmC542g0GjI318etXQgoirKcxrx+/brKYDAUJPW6desiFy5ciM/MzORpyM7OTl04HEYPHz7synURiJpfxizPj4+T8/0S0jOEiw2rUrh5TRJE+TRAFWba+KvPZung9Hxy9iohwpUMvnRjQkSo8zQ1ICJQbX7Zp2h8LpCa7ZEwUY8Yt21IiHXLMopCkEyFSFZZWRmz2+0FVSqXUL39v6AM5yTr9XpKrVZnab2RkRFZKpXKPHvlypUxvuM+PT0tCQaDWW+lWCDwUzA3N0cIkay2tjbS0tLiL3ccoYNWzPRWVVXFcBxnAACCwSAmRCIOCILA/v373QqFghLqv3Hjhrq9vb1gioIFBNLFoLI8gbKBILdHRNi8ocvOC6nVavLw4cOzAAAKhYJGEARytRo/5A6Hw4JMk8lkmRNht9vjAwMDmU0dGhril3TAbDanDAZD0u12EwAAw8PDCoZhspZQLBD4KRBa17Zt27wPPfSQVyQqO+0IQumHQloeIB0Jr169Onzjxg01QOHDzqGioiJ55MiRW8ePH68UCg6+/PJLY0tLS4Cv1RJjF2W+z5+2UEFnxiqgKhup2/muW7pyV1YAQEfmUN9n/2SOj57PRN4IirHKphe86q2vLSIozktHMBDq+p0u3PkfRpZKZOYtqWyOavd86BZrlxWOOjMTQVH2jjvuCL/wwgtOvV5PAaQ3QyqV5r20SCSSebmhUEiQaCqVKnNfLkk4QnEwmUyk2WzOaNDp6emsU14qEABIO87Hjh2b5K79+/e7i8kLVS0UCgXF19blINfEAwCoVCpBDcShsbExVKw/FzabLXXs2LFJIT81Go2K+YFPYqpDuvDx7ko+yQAA6NAs5jn9sD1+84KMa2OpJLLw0X2VfJIBALA0iYS6/svoO/ePWcni4KWXjKH2V0x8kgEAJG99Lfd8uLmSSfiFj+j999/v3bt3r/vgwYMzb7zxxthzzz03w9UqOVit1rzFjY6OZiY7NDSUl/4gCIIxmUyZcZYtW1ZQG0mlUloul9Nmszkjn1sCK6cigGEY63A4EtxlsViKOvQOhyOm0WiyyNve3q4vN+IESKeAhKJnISeej/r6+ijfzy2Evr4+Oad19Xo9dejQoVkhbev1ejNE83/xjAXYfPcqDRZ8nz9lhdtjhjr/U0d6RwoGLtH+j7WJyctSAADSM4SHu/9bsFwFAECHXVjwq381ChKtubk50NLSEmhsbAxrNBrBU7hixYq8XMvg4KByamqKmJubw7799ts8H6GqqirGV+XV1dWJQppCq9WSAABWq7WgT/hzBwIAaW3d0NCQpVkCgQDW1dVVVnnI5XLhp06dsuW24zjO1NTUFJ0viqJsfX19Sa3W09Ojfu+996xcCkapVNIoiuaxyGAwkAAAdHBaXIw4AGnNRnqHcQCAxOTlknXdxHirHAAgOXFJBkzxQ5ic6pD/6Nodh9uRT1YxPRaLoW+//XaVWCxmhXyMe+65J8D/jeM4a7FYEkKOL5ceWLp0aUGiVVZWliSax+PBX3rppRp+27PPPjtdLKhpamoKtre3Z53Sr776yrB58+a8LzH4GB4eVr722muCpaaGhoYgQRCFVEoGGzduDF65cqVkqevGjRvqgYEBld1uj8/NzUlIMtsNwnGc4VJMlH+yrNwhFbglxoyrUnTEXVKeDs2K039nSstG5rDyvdscLF26NNnQ0JAX7tM0jQiRzGQyJdevXx/Jba+srBQ0J3q9ngRIBwRisVhQ65UTCNA0jQQCAYx/CZXO+LDb7UmLxZJFYo/Hg1+9erVovTLXtHMgCILevXt30bISh5UrV8ZzTXchUBSFTExMyIQCj7q6ugh3KHDbugSIhN8hHxLb+iQAAGasK+2SmOvTsuY1pWWNqxI/mWgAAI8++uiCTqcrmcTEMIzZt2+fW8hMFvJbuNMoEokEM+FSqZQ2m81/k0+DAADWr1+fZ8IuXrxY8lu3XKAoyu7bt8/NmbFSEDLdPxYSiYTZu3dvJqmKYHJWturhomNKa34ZFskMNACAYt2hQDFZEaGh5XfsDQMAECt2R1Glreja5GsOBP4qoul0Ouro0aO3TCZTQTOkUqnII0eO3FqxYoUgoYRKVQAA/ISl0Ph/60+Dmpqa8syky+Ui+vr6yv4uTavVks8///ytUsV0oWf/GHk+pFIp/cQTT8zqdLos31q36+S8WFcjuE9iTVVK99CpTDQuXbk7qmz8taAGRlAJq9t50o2qllIAACKJitHu+cCF4ApBdS5d/XdB+fqnguLq6upobm4Kx/GyQ3m9Xk+9+uqrk21tbZquri6t1+vFWZYFi8WSdDgcsV27di1qtdqCYb3ZbCZra2sjueaW/yl0XV1dNBwOZ/mT/KIxB6VSSTkcjlhuey44X8lkMqVy5TmC6/V6qrGx0Z8bPY6OjsrWrFkT1el0ec9CUZRVqVSUWq2mqqur4xs2bAgL+XQSiYTJvZcf9Njt9uRdd90Vys2PcQnd5ubmAMMwcPPmTXk0GhUDpCsRVVVVsccee2yBS0PxIZLqacszfZPBP7+qj4+1Kilf+lNuYtkDEU3La3mfcmsfPL4gqfxFrJxPuYll22Kmp/omgpf+zZia7ZEyCT+KGVcn5WsP+uUNh0IAAP8PaQRnE4MgdzkAAAAASUVORK5CYII=);";
1844   ret<<" width: 154px; height: 20px; }"<<endl;
1845   ret<<"a#appname { margin: 0; font-size: 27px; color: #666; text-decoration: none; font-weight: bold; display: block; }"<<endl;
1846   ret<<"footer { border-top:  1px solid #ddd; padding-top: 4px; font-size: 12px; }"<<endl;
1847   ret<<"footer.row { margin-top: 1em; margin-bottom: 1em; }"<<endl;
1848   ret<<".panel { background: #f2f2f2; border: 1px solid #e6e6e6; margin: 0 0 22px 0; padding: 20px; }"<<endl;
1849   ret<<"table.data { width: 100%; border-spacing: 0; border-top: 1px solid #333; }"<<endl;
1850   ret<<"table.data td { border-bottom: 1px solid #333; padding: 2px; }"<<endl;
1851   ret<<"table.data tr:nth-child(2n) { background: #e2e2e2; }"<<endl;
1852   ret<<"table.data tr:hover { background: white; }"<<endl;
1853   ret<<".ringmeta { margin-bottom: 5px; }"<<endl;
1854   ret<<".resetring {float: right; }"<<endl;
1855   ret<<".resetring i { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAA/klEQVQY01XPP04UUBgE8N/33vd2XZUWEuzYuMZEG4KFCQn2NhA4AIewAOMBPIG2xhNYeAcKGqkNCdmYlVBZGBIT4FHsbuE0U8xk/kAbqm9TOfI/nicfhmwgDNhvylUT58kxCp4l31L8SfH9IetJ2ev6PwyIwyZWsdb11/gbTK55Co+r8rmJaRPTFJcpZil+pTit7C5awMpA+Zpi1sRFE9MqflYOloYCjY2uP8EdYiGU4CVGUBubxKfOOLjrtOBmzvEilbVb/aQWvhRl0unBZVXe4XdnK+bprwqnhoyTsyZ+JG8Wk0apfExxlcp7PFruXH8gdxamWB4cyW2sIO4BG3czIp78jUIAAAAASUVORK5CYII=); width: 10px; height: 10px; margin-right: 2px; display: inline-block; background-repeat: no-repeat; }"<<endl;
1856   ret<<".resetring:hover i { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAA2ElEQVQY013PMUoDcRDF4c+kEzxCsNNCrBQvIGhnlcYm11EkBxAraw8gglgIoiJpAoKIYlBcgrgopsma3c3fwt1k9cHA480M8xvQp/nMjorOWY5ov7IAYlpjQk7aYxcuWBpwFQgJnUcaYk7GhEDIGL5w+MVpKLIRyR2b4JOjvGhUKzHTv2W7iuSN479Dvu9plf1awbQ6y3x1sU5tjpVJcMbakF6Ycoas8Dl5xEHJ160wRdfqzXfa6XQ4PLDlicWUjxHxZfndL/N+RhiwNzl/Q6PDhn/qsl76H7prcApk2B1aAAAAAElFTkSuQmCC);}"<<endl;
1857   ret<<".resizering {float: right;}"<<endl;
1858   resp->body = ret.str();
1859   resp->status = 200;
1860 }
1861
1862 void AuthWebServer::webThread()
1863 {
1864   try {
1865     if(::arg().mustDo("api")) {
1866       d_ws->registerApiHandler("/api/v1/servers/localhost/cache/flush", &apiServerCacheFlush);
1867       d_ws->registerApiHandler("/api/v1/servers/localhost/config", &apiServerConfig);
1868       d_ws->registerApiHandler("/api/v1/servers/localhost/search-log", &apiServerSearchLog);
1869       d_ws->registerApiHandler("/api/v1/servers/localhost/search-data", &apiServerSearchData);
1870       d_ws->registerApiHandler("/api/v1/servers/localhost/statistics", &apiServerStatistics);
1871       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/axfr-retrieve", &apiServerZoneAxfrRetrieve);
1872       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/cryptokeys/<key_id>", &apiZoneCryptokeys);
1873       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/cryptokeys", &apiZoneCryptokeys);
1874       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/export", &apiServerZoneExport);
1875       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/metadata/<kind>", &apiZoneMetadataKind);
1876       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/metadata", &apiZoneMetadata);
1877       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/notify", &apiServerZoneNotify);
1878       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/rectify", &apiServerZoneRectify);
1879       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>", &apiServerZoneDetail);
1880       d_ws->registerApiHandler("/api/v1/servers/localhost/zones", &apiServerZones);
1881       d_ws->registerApiHandler("/api/v1/servers/localhost", &apiServerDetail);
1882       d_ws->registerApiHandler("/api/v1/servers", &apiServer);
1883       d_ws->registerApiHandler("/api", &apiDiscovery);
1884     }
1885     if (::arg().mustDo("webserver")) {
1886       d_ws->registerWebHandler("/style.css", boost::bind(&AuthWebServer::cssfunction, this, _1, _2));
1887       d_ws->registerWebHandler("/", boost::bind(&AuthWebServer::indexfunction, this, _1, _2));
1888     }
1889     d_ws->go();
1890   }
1891   catch(...) {
1892     g_log<<Logger::Error<<"AuthWebServer thread caught an exception, dying"<<endl;
1893     _exit(1);
1894   }
1895 }