pdns/ws-auth.cc

   1 /*
   2  * This file is part of PowerDNS or dnsdist.
   3  * Copyright -- PowerDNS.COM B.V. and its contributors
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * In addition, for the avoidance of any doubt, permission is granted to
  10  * link this program with OpenSSL and to (re)distribute the binaries
  11  * produced as the result of such linking.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22 #ifdef HAVE_CONFIG_H
  23 #include "config.h"
  24 #endif
  25 #include "utility.hh"
  26 #include "dynlistener.hh"
  27 #include "ws-auth.hh"
  28 #include "json.hh"
  29 #include "webserver.hh"
  30 #include "logger.hh"
  31 #include "statbag.hh"
  32 #include "misc.hh"
  33 #include "arguments.hh"
  34 #include "dns.hh"
  35 #include "comment.hh"
  36 #include "ueberbackend.hh"
  37 #include <boost/format.hpp>
  38
  39 #include "namespaces.hh"
  40 #include "ws-api.hh"
  41 #include "version.hh"
  42 #include "dnsseckeeper.hh"
  43 #include <iomanip>
  44 #include "zoneparser-tng.hh"
  45 #include "common_startup.hh"
  46 #include "auth-caches.hh"
  47
  48 using json11::Json;
  49
  50 extern StatBag S;
  51
  52 static void patchZone(HttpRequest* req, HttpResponse* resp);
  53 static void storeChangedPTRs(UeberBackend& B, vector<DNSResourceRecord>& new_ptrs);
  54 static void makePtr(const DNSResourceRecord& rr, DNSResourceRecord* ptr);
  55
  56 AuthWebServer::AuthWebServer()
  57 {
  58   d_start=time(0);
  59   d_min10=d_min5=d_min1=0;
  60   d_ws = 0;
  61   d_tid = 0;
  62   if(arg().mustDo("webserver") || arg().mustDo("api")) {
  63     d_ws = new WebServer(arg()["webserver-address"], arg().asNum("webserver-port"));
  64     d_ws->bind();
  65   }
  66 }
  67
  68 void AuthWebServer::go()
  69 {
  70   S.doRings();
  71   pthread_create(&d_tid, 0, webThreadHelper, this);
  72   pthread_create(&d_tid, 0, statThreadHelper, this);
  73 }
  74
  75 void AuthWebServer::statThread()
  76 {
  77   try {
  78     for(;;) {
  79       d_queries.submit(S.read("udp-queries"));
  80       d_cachehits.submit(S.read("packetcache-hit"));
  81       d_cachemisses.submit(S.read("packetcache-miss"));
  82       d_qcachehits.submit(S.read("query-cache-hit"));
  83       d_qcachemisses.submit(S.read("query-cache-miss"));
  84       Utility::sleep(1);
  85     }
  86   }
  87   catch(...) {
  88     L<<Logger::Error<<"Webserver statThread caught an exception, dying"<<endl;
  89     _exit(1);
  90   }
  91 }
  92
  93 void *AuthWebServer::statThreadHelper(void *p)
  94 {
  95   AuthWebServer *self=static_cast<AuthWebServer *>(p);
  96   self->statThread();
  97   return 0; // never reached
  98 }
  99
 100 void *AuthWebServer::webThreadHelper(void *p)
 101 {
 102   AuthWebServer *self=static_cast<AuthWebServer *>(p);
 103   self->webThread();
 104   return 0; // never reached
 105 }
 106
 107 static string htmlescape(const string &s) {
 108   string result;
 109   for(string::const_iterator it=s.begin(); it!=s.end(); ++it) {
 110     switch (*it) {
 111     case '&':
 112       result += "&amp;";
 113       break;
 114     case '<':
 115       result += "&lt;";
 116       break;
 117     case '>':
 118       result += "&gt;";
 119       break;
 120     case '"':
 121       result += "&quot;";
 122       break;
 123     default:
 124       result += *it;
 125     }
 126   }
 127   return result;
 128 }
 129
 130 void printtable(ostringstream &ret, const string &ringname, const string &title, int limit=10)
 131 {
 132   int tot=0;
 133   int entries=0;
 134   vector<pair <string,unsigned int> >ring=S.getRing(ringname);
 135
 136   for(vector<pair<string, unsigned int> >::const_iterator i=ring.begin(); i!=ring.end();++i) {
 137     tot+=i->second;
 138     entries++;
 139   }
 140
 141   ret<<"<div class=\"panel\">";
 142   ret<<"<span class=resetring><i></i><a href=\"?resetring="<<htmlescape(ringname)<<"\">Reset</a></span>"<<endl;
 143   ret<<"<h2>"<<title<<"</h2>"<<endl;
 144   ret<<"<div class=ringmeta>";
 145   ret<<"<a class=topXofY href=\"?ring="<<htmlescape(ringname)<<"\">Showing: Top "<<limit<<" of "<<entries<<"</a>"<<endl;
 146   ret<<"<span class=resizering>Resize: ";
 147   unsigned int sizes[]={10,100,500,1000,10000,500000,0};
 148   for(int i=0;sizes[i];++i) {
 149     if(S.getRingSize(ringname)!=sizes[i])
 150       ret<<"<a href=\"?resizering="<<htmlescape(ringname)<<"&amp;size="<<sizes[i]<<"\">"<<sizes[i]<<"</a> ";
 151     else
 152       ret<<"("<<sizes[i]<<") ";
 153   }
 154   ret<<"</span></div>";
 155
 156   ret<<"<table class=\"data\">";
 157   int printed=0;
 158   int total=max(1,tot);
 159   for(vector<pair<string,unsigned int> >::const_iterator i=ring.begin();limit && i!=ring.end();++i,--limit) {
 160     ret<<"<tr><td>"<<htmlescape(i->first)<<"</td><td>"<<i->second<<"</td><td align=right>"<< AuthWebServer::makePercentage(i->second*100.0/total)<<"</td>"<<endl;
 161     printed+=i->second;
 162   }
 163   ret<<"<tr><td colspan=3></td></tr>"<<endl;
 164   if(printed!=tot)
 165     ret<<"<tr><td><b>Rest:</b></td><td><b>"<<tot-printed<<"</b></td><td align=right><b>"<< AuthWebServer::makePercentage((tot-printed)*100.0/total)<<"</b></td>"<<endl;
 166
 167   ret<<"<tr><td><b>Total:</b></td><td><b>"<<tot<<"</b></td><td align=right><b>100%</b></td>";
 168   ret<<"</table></div>"<<endl;
 169 }
 170
 171 void AuthWebServer::printvars(ostringstream &ret)
 172 {
 173   ret<<"<div class=panel><h2>Variables</h2><table class=\"data\">"<<endl;
 174
 175   vector<string>entries=S.getEntries();
 176   for(vector<string>::const_iterator i=entries.begin();i!=entries.end();++i) {
 177     ret<<"<tr><td>"<<*i<<"</td><td>"<<S.read(*i)<<"</td><td>"<<S.getDescrip(*i)<<"</td>"<<endl;
 178   }
 179
 180   ret<<"</table></div>"<<endl;
 181 }
 182
 183 void AuthWebServer::printargs(ostringstream &ret)
 184 {
 185   ret<<"<table border=1><tr><td colspan=3 bgcolor=\"#0000ff\"><font color=\"#ffffff\">Arguments</font></td>"<<endl;
 186
 187   vector<string>entries=arg().list();
 188   for(vector<string>::const_iterator i=entries.begin();i!=entries.end();++i) {
 189     ret<<"<tr><td>"<<*i<<"</td><td>"<<arg()[*i]<<"</td><td>"<<arg().getHelp(*i)<<"</td>"<<endl;
 190   }
 191 }
 192
 193 string AuthWebServer::makePercentage(const double& val)
 194 {
 195   return (boost::format("%.01f%%") % val).str();
 196 }
 197
 198 void AuthWebServer::indexfunction(HttpRequest* req, HttpResponse* resp)
 199 {
 200   if(!req->getvars["resetring"].empty()) {
 201     if (S.ringExists(req->getvars["resetring"]))
 202       S.resetRing(req->getvars["resetring"]);
 203     resp->status = 302;
 204     resp->headers["Location"] = req->url.path;
 205     return;
 206   }
 207   if(!req->getvars["resizering"].empty()){
 208     int size=std::stoi(req->getvars["size"]);
 209     if (S.ringExists(req->getvars["resizering"]) && size > 0 && size <= 500000)
 210       S.resizeRing(req->getvars["resizering"], std::stoi(req->getvars["size"]));
 211     resp->status = 302;
 212     resp->headers["Location"] = req->url.path;
 213     return;
 214   }
 215
 216   ostringstream ret;
 217
 218   ret<<"<!DOCTYPE html>"<<endl;
 219   ret<<"<html><head>"<<endl;
 220   ret<<"<title>PowerDNS Authoritative Server Monitor</title>"<<endl;
 221   ret<<"<link rel=\"stylesheet\" href=\"style.css\"/>"<<endl;
 222   ret<<"</head><body>"<<endl;
 223
 224   ret<<"<div class=\"row\">"<<endl;
 225   ret<<"<div class=\"headl columns\">";
 226   ret<<"<a href=\"/\" id=\"appname\">PowerDNS "<<htmlescape(VERSION);
 227   if(!arg()["config-name"].empty()) {
 228     ret<<" ["<<htmlescape(arg()["config-name"])<<"]";
 229   }
 230   ret<<"</a></div>"<<endl;
 231   ret<<"<div class=\"headr columns\"></div></div>";
 232   ret<<"<div class=\"row\"><div class=\"all columns\">";
 233
 234   time_t passed=time(0)-s_starttime;
 235
 236   ret<<"<p>Uptime: "<<
 237     humanDuration(passed)<<
 238     "<br>"<<endl;
 239
 240   ret<<"Queries/second, 1, 5, 10 minute averages:  "<<std::setprecision(3)<<
 241     (int)d_queries.get1()<<", "<<
 242     (int)d_queries.get5()<<", "<<
 243     (int)d_queries.get10()<<". Max queries/second: "<<(int)d_queries.getMax()<<
 244     "<br>"<<endl;
 245
 246   if(d_cachemisses.get10()+d_cachehits.get10()>0)
 247     ret<<"Cache hitrate, 1, 5, 10 minute averages: "<<
 248       makePercentage((d_cachehits.get1()*100.0)/((d_cachehits.get1())+(d_cachemisses.get1())))<<", "<<
 249       makePercentage((d_cachehits.get5()*100.0)/((d_cachehits.get5())+(d_cachemisses.get5())))<<", "<<
 250       makePercentage((d_cachehits.get10()*100.0)/((d_cachehits.get10())+(d_cachemisses.get10())))<<
 251       "<br>"<<endl;
 252
 253   if(d_qcachemisses.get10()+d_qcachehits.get10()>0)
 254     ret<<"Backend query cache hitrate, 1, 5, 10 minute averages: "<<std::setprecision(2)<<
 255       makePercentage((d_qcachehits.get1()*100.0)/((d_qcachehits.get1())+(d_qcachemisses.get1())))<<", "<<
 256       makePercentage((d_qcachehits.get5()*100.0)/((d_qcachehits.get5())+(d_qcachemisses.get5())))<<", "<<
 257       makePercentage((d_qcachehits.get10()*100.0)/((d_qcachehits.get10())+(d_qcachemisses.get10())))<<
 258       "<br>"<<endl;
 259
 260   ret<<"Backend query load, 1, 5, 10 minute averages: "<<std::setprecision(3)<<
 261     (int)d_qcachemisses.get1()<<", "<<
 262     (int)d_qcachemisses.get5()<<", "<<
 263     (int)d_qcachemisses.get10()<<". Max queries/second: "<<(int)d_qcachemisses.getMax()<<
 264     "<br>"<<endl;
 265
 266   ret<<"Total queries: "<<S.read("udp-queries")<<". Question/answer latency: "<<S.read("latency")/1000.0<<"ms</p><br>"<<endl;
 267   if(req->getvars["ring"].empty()) {
 268     vector<string>entries=S.listRings();
 269     for(vector<string>::const_iterator i=entries.begin();i!=entries.end();++i)
 270       printtable(ret,*i,S.getRingTitle(*i));
 271
 272     printvars(ret);
 273     if(arg().mustDo("webserver-print-arguments"))
 274       printargs(ret);
 275   }
 276   else if(S.ringExists(req->getvars["ring"]))
 277     printtable(ret,req->getvars["ring"],S.getRingTitle(req->getvars["ring"]),100);
 278
 279   ret<<"</div></div>"<<endl;
 280   ret<<"<footer class=\"row\">"<<fullVersionString()<<"<br>&copy; 2013 - 2017 <a href=\"http://www.powerdns.com/\">PowerDNS.COM BV</a>.</footer>"<<endl;
 281   ret<<"</body></html>"<<endl;
 282
 283   resp->body = ret.str();
 284   resp->status = 200;
 285 }
 286
 287 /** Helper to build a record content as needed. */
 288 static inline string makeRecordContent(const QType& qtype, const string& content, bool noDot) {
 289   // noDot: for backend storage, pass true. for API users, pass false.
 290   auto drc = DNSRecordContent::makeunique(qtype.getCode(), QClass::IN, content);
 291   return drc->getZoneRepresentation(noDot);
 292 }
 293
 294 /** "Normalize" record content for API consumers. */
 295 static inline string makeApiRecordContent(const QType& qtype, const string& content) {
 296   return makeRecordContent(qtype, content, false);
 297 }
 298
 299 /** "Normalize" record content for backend storage. */
 300 static inline string makeBackendRecordContent(const QType& qtype, const string& content) {
 301   return makeRecordContent(qtype, content, true);
 302 }
 303
 304 static Json::object getZoneInfo(const DomainInfo& di, DNSSECKeeper *dk) {
 305   string zoneId = apiZoneNameToId(di.zone);
 306   return Json::object {
 307     // id is the canonical lookup key, which doesn't actually match the name (in some cases)
 308     { "id", zoneId },
 309     { "url", "/api/v1/servers/localhost/zones/" + zoneId },
 310     { "name", di.zone.toString() },
 311     { "kind", di.getKindString() },
 312     { "dnssec", dk->isSecuredZone(di.zone) },
 313     { "account", di.account },
 314     { "masters", di.masters },
 315     { "serial", (double)di.serial },
 316     { "notified_serial", (double)di.notified_serial },
 317     { "last_check", (double)di.last_check }
 318   };
 319 }
 320
 321 static bool shouldDoRRSets(HttpRequest* req) {
 322   if (req->getvars.count("rrsets") == 0 || req->getvars["rrsets"] == "true")
 323     return true;
 324   if (req->getvars["rrsets"] == "false")
 325     return false;
 326   throw ApiException("'rrsets' request parameter value '"+req->getvars["rrsets"]+"' is not supported");
 327 }
 328
 329 static void fillZone(const DNSName& zonename, HttpResponse* resp, bool doRRSets) {
 330   UeberBackend B;
 331   DomainInfo di;
 332   if(!B.getDomainInfo(zonename, di))
 333     throw ApiException("Could not find domain '"+zonename.toString()+"'");
 334
 335   DNSSECKeeper dk(&B);
 336   Json::object doc = getZoneInfo(di, &dk);
 337   // extra stuff getZoneInfo doesn't do for us (more expensive)
 338   string soa_edit_api;
 339   di.backend->getDomainMetadataOne(zonename, "SOA-EDIT-API", soa_edit_api);
 340   doc["soa_edit_api"] = soa_edit_api;
 341   string soa_edit;
 342   di.backend->getDomainMetadataOne(zonename, "SOA-EDIT", soa_edit);
 343   doc["soa_edit"] = soa_edit;
 344   string nsec3param;
 345   di.backend->getDomainMetadataOne(zonename, "NSEC3PARAM", nsec3param);
 346   doc["nsec3param"] = nsec3param;
 347   string nsec3narrow;
 348   bool nsec3narrowbool = false;
 349   di.backend->getDomainMetadataOne(zonename, "NSEC3NARROW", nsec3narrow);
 350   if (nsec3narrow == "1")
 351     nsec3narrowbool = true;
 352   doc["nsec3narrow"] = nsec3narrowbool;
 353
 354   string api_rectify;
 355   di.backend->getDomainMetadataOne(zonename, "API-RECTIFY", api_rectify);
 356   doc["api_rectify"] = (api_rectify == "1");
 357
 358   if (doRRSets) {
 359     vector<DNSResourceRecord> records;
 360     vector<Comment> comments;
 361
 362     // load all records + sort
 363     {
 364       DNSResourceRecord rr;
 365       di.backend->list(zonename, di.id, true); // incl. disabled
 366       while(di.backend->get(rr)) {
 367         if (!rr.qtype.getCode())
 368           continue; // skip empty non-terminals
 369         records.push_back(rr);
 370       }
 371       sort(records.begin(), records.end(), [](const DNSResourceRecord& a, const DNSResourceRecord& b) {
 372               if (a.qname == b.qname) {
 373                   return b.qtype < a.qtype;
 374               }
 375               return b.qname < a.qname;
 376           });
 377     }
 378
 379     // load all comments + sort
 380     {
 381       Comment comment;
 382       di.backend->listComments(di.id);
 383       while(di.backend->getComment(comment)) {
 384         comments.push_back(comment);
 385       }
 386       sort(comments.begin(), comments.end(), [](const Comment& a, const Comment& b) {
 387               if (a.qname == b.qname) {
 388                   return b.qtype < a.qtype;
 389               }
 390               return b.qname < a.qname;
 391           });
 392     }
 393
 394     Json::array rrsets;
 395     Json::object rrset;
 396     Json::array rrset_records;
 397     Json::array rrset_comments;
 398     DNSName current_qname;
 399     QType current_qtype;
 400     uint32_t ttl;
 401     auto rit = records.begin();
 402     auto cit = comments.begin();
 403
 404     while (rit != records.end() || cit != comments.end()) {
 405       if (cit == comments.end() || (rit != records.end() && (cit->qname.toString() <= rit->qname.toString() || cit->qtype < rit->qtype || cit->qtype == rit->qtype))) {
 406         current_qname = rit->qname;
 407         current_qtype = rit->qtype;
 408         ttl = rit->ttl;
 409       } else {
 410         current_qname = cit->qname;
 411         current_qtype = cit->qtype;
 412         ttl = 0;
 413       }
 414
 415       while(rit != records.end() && rit->qname == current_qname && rit->qtype == current_qtype) {
 416         ttl = min(ttl, rit->ttl);
 417         rrset_records.push_back(Json::object {
 418           { "disabled", rit->disabled },
 419           { "content", makeApiRecordContent(rit->qtype, rit->content) }
 420         });
 421         rit++;
 422       }
 423       while (cit != comments.end() && cit->qname == current_qname && cit->qtype == current_qtype) {
 424         rrset_comments.push_back(Json::object {
 425           { "modified_at", (double)cit->modified_at },
 426           { "account", cit->account },
 427           { "content", cit->content }
 428         });
 429         cit++;
 430       }
 431
 432       rrset["name"] = current_qname.toString();
 433       rrset["type"] = current_qtype.getName();
 434       rrset["records"] = rrset_records;
 435       rrset["comments"] = rrset_comments;
 436       rrset["ttl"] = (double)ttl;
 437       rrsets.push_back(rrset);
 438       rrset.clear();
 439       rrset_records.clear();
 440       rrset_comments.clear();
 441     }
 442
 443     doc["rrsets"] = rrsets;
 444   }
 445
 446   resp->setBody(doc);
 447 }
 448
 449 void productServerStatisticsFetch(map<string,string>& out)
 450 {
 451   vector<string> items = S.getEntries();
 452   for(const string& item :  items) {
 453     out[item] = std::to_string(S.read(item));
 454   }
 455
 456   // add uptime
 457   out["uptime"] = std::to_string(time(0) - s_starttime);
 458 }
 459
 460 static void gatherRecords(const Json container, const DNSName& qname, const QType qtype, const int ttl, vector<DNSResourceRecord>& new_records, vector<DNSResourceRecord>& new_ptrs) {
 461   UeberBackend B;
 462   DNSResourceRecord rr;
 463   rr.qname = qname;
 464   rr.qtype = qtype;
 465   rr.auth = 1;
 466   rr.ttl = ttl;
 467   for(auto record : container["records"].array_items()) {
 468     string content = stringFromJson(record, "content");
 469     rr.disabled = boolFromJson(record, "disabled");
 470
 471     // validate that the client sent something we can actually parse, and require that data to be dotted.
 472     try {
 473       if (rr.qtype.getCode() != QType::AAAA) {
 474         string tmp = makeApiRecordContent(rr.qtype, content);
 475         if (!pdns_iequals(tmp, content)) {
 476           throw std::runtime_error("Not in expected format (parsed as '"+tmp+"')");
 477         }
 478       } else {
 479         struct in6_addr tmpbuf;
 480         if (inet_pton(AF_INET6, content.c_str(), &tmpbuf) != 1 || content.find('.') != string::npos) {
 481           throw std::runtime_error("Invalid IPv6 address");
 482         }
 483       }
 484       rr.content = makeBackendRecordContent(rr.qtype, content);
 485     }
 486     catch(std::exception& e)
 487     {
 488       throw ApiException("Record "+rr.qname.toString()+"/"+rr.qtype.getName()+" '"+content+"': "+e.what());
 489     }
 490
 491     if ((rr.qtype.getCode() == QType::A || rr.qtype.getCode() == QType::AAAA) &&
 492         boolFromJson(record, "set-ptr", false) == true) {
 493       DNSResourceRecord ptr;
 494       makePtr(rr, &ptr);
 495
 496       // verify that there's a zone for the PTR
 497       SOAData sd;
 498       if (!B.getAuth(ptr.qname, QType(QType::PTR), &sd, false))
 499         throw ApiException("Could not find domain for PTR '"+ptr.qname.toString()+"' requested for '"+ptr.content+"'");
 500
 501       ptr.domain_id = sd.domain_id;
 502       new_ptrs.push_back(ptr);
 503     }
 504
 505     new_records.push_back(rr);
 506   }
 507 }
 508
 509 static void gatherComments(const Json container, const DNSName& qname, const QType qtype, vector<Comment>& new_comments) {
 510   Comment c;
 511   c.qname = qname;
 512   c.qtype = qtype;
 513
 514   time_t now = time(0);
 515   for (auto comment : container["comments"].array_items()) {
 516     c.modified_at = intFromJson(comment, "modified_at", now);
 517     c.content = stringFromJson(comment, "content");
 518     c.account = stringFromJson(comment, "account");
 519     new_comments.push_back(c);
 520   }
 521 }
 522
 523 static void checkDefaultDNSSECAlgos() {
 524   int k_algo = DNSSECKeeper::shorthand2algorithm(::arg()["default-ksk-algorithm"]);
 525   int z_algo = DNSSECKeeper::shorthand2algorithm(::arg()["default-zsk-algorithm"]);
 526   int k_size = arg().asNum("default-ksk-size");
 527   int z_size = arg().asNum("default-zsk-size");
 528
 529   // Sanity check DNSSEC parameters
 530   if (::arg()["default-zsk-algorithm"] != "") {
 531     if (k_algo == -1)
 532       throw ApiException("default-ksk-algorithm setting is set to unknown algorithm: " + ::arg()["default-ksk-algorithm"]);
 533     else if (k_algo <= 10 && k_size == 0)
 534       throw ApiException("default-ksk-algorithm is set to an algorithm("+::arg()["default-ksk-algorithm"]+") that requires a non-zero default-ksk-size!");
 535   }
 536
 537   if (::arg()["default-zsk-algorithm"] != "") {
 538     if (z_algo == -1)
 539       throw ApiException("default-zsk-algorithm setting is set to unknown algorithm: " + ::arg()["default-zsk-algorithm"]);
 540     else if (z_algo <= 10 && z_size == 0)
 541       throw ApiException("default-zsk-algorithm is set to an algorithm("+::arg()["default-zsk-algorithm"]+") that requires a non-zero default-zsk-size!");
 542   }
 543 }
 544
 545 static void throwUnableToSecure(const DNSName& zonename) {
 546   throw ApiException("No backend was able to secure '" + zonename.toString() + "', most likely because no DNSSEC"
 547       + "capable backends are loaded, or because the backends have DNSSEC disabled. Check your configuration.");
 548 }
 549
 550 static void updateDomainSettingsFromDocument(UeberBackend& B, const DomainInfo& di, const DNSName& zonename, const Json document) {
 551   string zonemaster;
 552   bool shouldRectify = false;
 553   for(auto value : document["masters"].array_items()) {
 554     string master = value.string_value();
 555     if (master.empty())
 556       throw ApiException("Master can not be an empty string");
 557     zonemaster += master + " ";
 558   }
 559
 560   if (zonemaster != "") {
 561     di.backend->setMaster(zonename, zonemaster);
 562   }
 563   if (document["kind"].is_string()) {
 564     di.backend->setKind(zonename, DomainInfo::stringToKind(stringFromJson(document, "kind")));
 565   }
 566   if (document["soa_edit_api"].is_string()) {
 567     di.backend->setDomainMetadataOne(zonename, "SOA-EDIT-API", document["soa_edit_api"].string_value());
 568   }
 569   if (document["soa_edit"].is_string()) {
 570     di.backend->setDomainMetadataOne(zonename, "SOA-EDIT", document["soa_edit"].string_value());
 571   }
 572   try {
 573     bool api_rectify = boolFromJson(document, "api_rectify");
 574     di.backend->setDomainMetadataOne(zonename, "API-RECTIFY", api_rectify ? "1" : "0");
 575   }
 576   catch (JsonException) {}
 577
 578   if (document["account"].is_string()) {
 579     di.backend->setAccount(zonename, document["account"].string_value());
 580   }
 581
 582   DNSSECKeeper dk(&B);
 583   bool dnssecInJSON = false;
 584   bool dnssecDocVal = false;
 585
 586   try {
 587     dnssecDocVal = boolFromJson(document, "dnssec");
 588     dnssecInJSON = true;
 589   }
 590   catch (JsonException) {}
 591
 592   bool isDNSSECZone = dk.isSecuredZone(zonename);
 593
 594   if (dnssecInJSON) {
 595     if (dnssecDocVal) {
 596       if (!isDNSSECZone) {
 597         checkDefaultDNSSECAlgos();
 598
 599         int k_algo = DNSSECKeeper::shorthand2algorithm(::arg()["default-ksk-algorithm"]);
 600         int z_algo = DNSSECKeeper::shorthand2algorithm(::arg()["default-zsk-algorithm"]);
 601         int k_size = arg().asNum("default-ksk-size");
 602         int z_size = arg().asNum("default-zsk-size");
 603
 604         if (k_algo != -1) {
 605           int64_t id;
 606           if (!dk.addKey(zonename, true, k_algo, id, k_size)) {
 607             throwUnableToSecure(zonename);
 608           }
 609         }
 610
 611         if (z_algo != -1) {
 612           int64_t id;
 613           if (!dk.addKey(zonename, false, z_algo, id, z_size)) {
 614             throwUnableToSecure(zonename);
 615           }
 616         }
 617
 618         // Used later for NSEC3PARAM
 619         isDNSSECZone = dk.isSecuredZone(zonename);
 620
 621         if (!isDNSSECZone) {
 622           throwUnableToSecure(zonename);
 623         }
 624         shouldRectify = true;
 625       }
 626     } else {
 627       // "dnssec": false in json
 628       if (isDNSSECZone) {
 629         string info, error;
 630         if (!dk.unSecureZone(zonename, error, info)) {
 631           throw ApiException("Error while un-securing zone '"+ zonename.toString()+"': " + error);
 632         }
 633         isDNSSECZone = dk.isSecuredZone(zonename);
 634         if (isDNSSECZone) {
 635           throw ApiException("Unable to un-secure zone '"+ zonename.toString()+"'");
 636         }
 637         shouldRectify = true;
 638       }
 639     }
 640   }
 641
 642   if(document["nsec3param"].string_value().length() > 0) {
 643     shouldRectify = true;
 644     NSEC3PARAMRecordContent ns3pr(document["nsec3param"].string_value());
 645     string error_msg = "";
 646     if (!isDNSSECZone) {
 647       throw ApiException("NSEC3PARAMs provided for zone '"+zonename.toString()+"', but zone is not DNSSEC secured.");
 648     }
 649     if (!dk.checkNSEC3PARAM(ns3pr, error_msg)) {
 650       throw ApiException("NSEC3PARAMs provided for zone '"+zonename.toString()+"' are invalid. " + error_msg);
 651     }
 652     if (!dk.setNSEC3PARAM(zonename, ns3pr, boolFromJson(document, "nsec3narrow", false))) {
 653       throw ApiException("NSEC3PARAMs provided for zone '" + zonename.toString() +
 654           "' passed our basic sanity checks, but cannot be used with the current backend.");
 655     }
 656   }
 657
 658   string api_rectify;
 659   di.backend->getDomainMetadataOne(zonename, "API-RECTIFY", api_rectify);
 660   if (shouldRectify && dk.isSecuredZone(zonename) && !dk.isPresigned(zonename) && api_rectify == "1") {
 661     string info;
 662     string error_msg = "";
 663     if (!dk.rectifyZone(zonename, error_msg, info, true))
 664       throw ApiException("Failed to rectify '" + zonename.toString() + "' " + error_msg);
 665   }
 666 }
 667
 668 static bool isValidMetadataKind(const string& kind, bool readonly) {
 669   static vector<string> builtinOptions {
 670     "ALLOW-AXFR-FROM",
 671     "AXFR-SOURCE",
 672     "ALLOW-DNSUPDATE-FROM",
 673     "TSIG-ALLOW-DNSUPDATE",
 674     "FORWARD-DNSUPDATE",
 675     "SOA-EDIT-DNSUPDATE",
 676     "NOTIFY-DNSUPDATE",
 677     "ALSO-NOTIFY",
 678     "AXFR-MASTER-TSIG",
 679     "GSS-ALLOW-AXFR-PRINCIPAL",
 680     "GSS-ACCEPTOR-PRINCIPAL",
 681     "IXFR",
 682     "LUA-AXFR-SCRIPT",
 683     "NSEC3NARROW",
 684     "NSEC3PARAM",
 685     "PRESIGNED",
 686     "PUBLISH-CDNSKEY",
 687     "PUBLISH-CDS",
 688     "SOA-EDIT",
 689     "TSIG-ALLOW-AXFR",
 690     "TSIG-ALLOW-DNSUPDATE"
 691   };
 692
 693   // the following options do not allow modifications via API
 694   static vector<string> protectedOptions {
 695     "API-RECTIFY",
 696     "NSEC3NARROW",
 697     "NSEC3PARAM",
 698     "PRESIGNED",
 699     "LUA-AXFR-SCRIPT"
 700   };
 701
 702   if (kind.find("X-") == 0)
 703     return true;
 704
 705   bool found = false;
 706
 707   for (const string& s : builtinOptions) {
 708     if (kind == s) {
 709       for (const string& s2 : protectedOptions) {
 710         if (!readonly && s == s2)
 711           return false;
 712       }
 713       found = true;
 714       break;
 715     }
 716   }
 717
 718   return found;
 719 }
 720
 721 static void apiZoneMetadata(HttpRequest* req, HttpResponse *resp) {
 722   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
 723
 724   UeberBackend B;
 725   DomainInfo di;
 726   if (!B.getDomainInfo(zonename, di))
 727     throw ApiException("Could not find domain '"+zonename.toString()+"'");
 728
 729   if (req->method == "GET") {
 730     map<string, vector<string> > md;
 731     Json::array document;
 732
 733     if (!B.getAllDomainMetadata(zonename, md))
 734       throw HttpNotFoundException();
 735
 736     for (const auto& i : md) {
 737       Json::array entries;
 738       for (string j : i.second)
 739         entries.push_back(j);
 740
 741       Json::object key {
 742         { "type", "Metadata" },
 743         { "kind", i.first },
 744         { "metadata", entries }
 745       };
 746
 747       document.push_back(key);
 748     }
 749
 750     resp->setBody(document);
 751   } else if (req->method == "POST" && !::arg().mustDo("api-readonly")) {
 752     auto document = req->json();
 753     string kind;
 754     vector<string> entries;
 755
 756     try {
 757       kind = stringFromJson(document, "kind");
 758     } catch (JsonException) {
 759       throw ApiException("kind is not specified or not a string");
 760     }
 761
 762     if (!isValidMetadataKind(kind, false))
 763       throw ApiException("Unsupported metadata kind '" + kind + "'");
 764
 765     vector<string> vecMetadata;
 766
 767     if (!B.getDomainMetadata(zonename, kind, vecMetadata))
 768       throw ApiException("Could not retrieve metadata entries for domain '" +
 769         zonename.toString() + "'");
 770
 771     auto& metadata = document["metadata"];
 772     if (!metadata.is_array())
 773       throw ApiException("metadata is not specified or not an array");
 774
 775     for (const auto& i : metadata.array_items()) {
 776       if (!i.is_string())
 777         throw ApiException("metadata must be strings");
 778       else if (std::find(vecMetadata.cbegin(),
 779                          vecMetadata.cend(),
 780                          i.string_value()) == vecMetadata.cend()) {
 781         vecMetadata.push_back(i.string_value());
 782       }
 783     }
 784
 785     if (!B.setDomainMetadata(zonename, kind, vecMetadata))
 786       throw ApiException("Could not update metadata entries for domain '" +
 787         zonename.toString() + "'");
 788
 789     Json::array respMetadata;
 790     for (const string& s : vecMetadata)
 791       respMetadata.push_back(s);
 792
 793     Json::object key {
 794       { "type", "Metadata" },
 795       { "kind", document["kind"] },
 796       { "metadata", respMetadata }
 797     };
 798
 799     resp->status = 201;
 800     resp->setBody(key);
 801   } else
 802     throw HttpMethodNotAllowedException();
 803 }
 804
 805 static void apiZoneMetadataKind(HttpRequest* req, HttpResponse* resp) {
 806   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
 807
 808   UeberBackend B;
 809   DomainInfo di;
 810   if (!B.getDomainInfo(zonename, di))
 811     throw ApiException("Could not find domain '"+zonename.toString()+"'");
 812
 813   string kind = req->parameters["kind"];
 814
 815   if (req->method == "GET") {
 816     vector<string> metadata;
 817     Json::object document;
 818     Json::array entries;
 819
 820     if (!B.getDomainMetadata(zonename, kind, metadata))
 821       throw HttpNotFoundException();
 822     else if (!isValidMetadataKind(kind, true))
 823       throw ApiException("Unsupported metadata kind '" + kind + "'");
 824
 825     document["type"] = "Metadata";
 826     document["kind"] = kind;
 827
 828     for (const string& i : metadata)
 829       entries.push_back(i);
 830
 831     document["metadata"] = entries;
 832     resp->setBody(document);
 833   } else if (req->method == "PUT" && !::arg().mustDo("api-readonly")) {
 834     auto document = req->json();
 835
 836     if (!isValidMetadataKind(kind, false))
 837       throw ApiException("Unsupported metadata kind '" + kind + "'");
 838
 839     vector<string> vecMetadata;
 840     auto& metadata = document["metadata"];
 841     if (!metadata.is_array())
 842       throw ApiException("metadata is not specified or not an array");
 843
 844     for (const auto& i : metadata.array_items()) {
 845       if (!i.is_string())
 846         throw ApiException("metadata must be strings");
 847       vecMetadata.push_back(i.string_value());
 848     }
 849
 850     if (!B.setDomainMetadata(zonename, kind, vecMetadata))
 851       throw ApiException("Could not update metadata entries for domain '" + zonename.toString() + "'");
 852
 853     Json::object key {
 854       { "type", "Metadata" },
 855       { "kind", kind },
 856       { "metadata", metadata }
 857     };
 858
 859     resp->setBody(key);
 860   } else if (req->method == "DELETE" && !::arg().mustDo("api-readonly")) {
 861     if (!isValidMetadataKind(kind, false))
 862       throw ApiException("Unsupported metadata kind '" + kind + "'");
 863
 864     vector<string> md;  // an empty vector will do it
 865     if (!B.setDomainMetadata(zonename, kind, md))
 866       throw ApiException("Could not delete metadata for domain '" + zonename.toString() + "' (" + kind + ")");
 867   } else
 868     throw HttpMethodNotAllowedException();
 869 }
 870
 871 static void apiZoneCryptokeysGET(DNSName zonename, int inquireKeyId, HttpResponse *resp, DNSSECKeeper *dk) {
 872   DNSSECKeeper::keyset_t keyset=dk->getKeys(zonename, false);
 873
 874   bool inquireSingleKey = inquireKeyId >= 0;
 875
 876   Json::array doc;
 877   for(const auto& value : keyset) {
 878     if (inquireSingleKey && (unsigned)inquireKeyId != value.second.id) {
 879       continue;
 880     }
 881
 882     string keyType;
 883     switch (value.second.keyType) {
 884       case DNSSECKeeper::KSK: keyType="ksk"; break;
 885       case DNSSECKeeper::ZSK: keyType="zsk"; break;
 886       case DNSSECKeeper::CSK: keyType="csk"; break;
 887     }
 888
 889     Json::object key {
 890         { "type", "Cryptokey" },
 891         { "id", (int)value.second.id },
 892         { "active", value.second.active },
 893         { "keytype", keyType },
 894         { "flags", (uint16_t)value.first.d_flags },
 895         { "dnskey", value.first.getDNSKEY().getZoneRepresentation() },
 896         { "algorithm", DNSSECKeeper::algorithm2name(value.first.d_algorithm) },
 897         { "bits", value.first.getKey()->getBits() }
 898     };
 899
 900     if (value.second.keyType == DNSSECKeeper::KSK || value.second.keyType == DNSSECKeeper::CSK) {
 901       Json::array dses;
 902       for(const uint8_t keyid : { DNSSECKeeper::SHA1, DNSSECKeeper::SHA256, DNSSECKeeper::GOST, DNSSECKeeper::SHA384 })
 903         try {
 904           dses.push_back(makeDSFromDNSKey(zonename, value.first.getDNSKEY(), keyid).getZoneRepresentation());
 905         } catch (...) {}
 906       key["ds"] = dses;
 907     }
 908
 909     if (inquireSingleKey) {
 910       key["privatekey"] = value.first.getKey()->convertToISC();
 911       resp->setBody(key);
 912       return;
 913     }
 914     doc.push_back(key);
 915   }
 916
 917   if (inquireSingleKey) {
 918     // we came here because we couldn't find the requested key.
 919     throw HttpNotFoundException();
 920   }
 921   resp->setBody(doc);
 922
 923 }
 924
 925 /*
 926  * This method handles DELETE requests for URL /api/v1/servers/:server_id/zones/:zone_name/cryptokeys/:cryptokey_id .
 927  * It deletes a key from :zone_name specified by :cryptokey_id.
 928  * Server Answers:
 929  * Case 1: the backend returns true on removal. This means the key is gone.
 930  *      The server returns 200 OK, no body.
 931  * Case 2: the backend returns false on removal. An error occurred.
 932  *      The sever returns 422 Unprocessable Entity with message "Could not DELETE :cryptokey_id".
 933  * */
 934 static void apiZoneCryptokeysDELETE(DNSName zonename, int inquireKeyId, HttpRequest *req, HttpResponse *resp, DNSSECKeeper *dk) {
 935   if (dk->removeKey(zonename, inquireKeyId)) {
 936     resp->body = "";
 937     resp->status = 200;
 938   } else {
 939     resp->setErrorResult("Could not DELETE " + req->parameters["key_id"], 422);
 940   }
 941 }
 942
 943 /*
 944  * This method adds a key to a zone by generate it or content parameter.
 945  * Parameter:
 946  *  {
 947  *  "privatekey" : "key The format used is compatible with BIND and NSD/LDNS" <string>
 948  *  "keytype" : "ksk|zsk" <string>
 949  *  "active"  : "true|false" <value>
 950  *  "algorithm" : "key generation algorithm name as default"<string> https://doc.powerdns.com/md/authoritative/dnssec/#supported-algorithms
 951  *  "bits" : number of bits <int>
 952  *  }
 953  *
 954  * Response:
 955  *  Case 1: keytype isn't ksk|zsk
 956  *    The server returns 422 Unprocessable Entity {"error" : "Invalid keytype 'keytype'"}
 957  *  Case 2: 'bits' must be a positive integer value.
 958  *    The server returns 422 Unprocessable Entity {"error" : "'bits' must be a positive integer value."}
 959  *  Case 3: The "algorithm" isn't supported
 960  *    The server returns 422 Unprocessable Entity {"error" : "Unknown algorithm: 'algo'"}
 961  *  Case 4: Algorithm <= 10 and no bits were passed
 962  *    The server returns 422 Unprocessable Entity {"error" : "Creating an algorithm algo key requires the size (in bits) to be passed"}
 963  *  Case 5: The wrong keysize was passed
 964  *    The server returns 422 Unprocessable Entity {"error" : "The algorithm does not support the given bit size."}
 965  *  Case 6: If the server cant guess the keysize
 966  *    The server returns 422 Unprocessable Entity {"error" : "Can not guess key size for algorithm"}
 967  *  Case 7: The key-creation failed
 968  *    The server returns 422 Unprocessable Entity {"error" : "Adding key failed, perhaps DNSSEC not enabled in configuration?"}
 969  *  Case 8: The key in content has the wrong format
 970  *    The server returns 422 Unprocessable Entity {"error" : "Key could not be parsed. Make sure your key format is correct."}
 971  *  Case 9: The wrong combination of fields is submitted
 972  *    The server returns 422 Unprocessable Entity {"error" : "Either you submit just the 'content' field or you leave 'content' empty and submit the other fields."}
 973  *  Case 10: No content and everything was fine
 974  *    The server returns 201 Created and all public data about the new cryptokey
 975  *  Case 11: With specified content
 976  *    The server returns 201 Created and all public data about the added cryptokey
 977  */
 978
 979 static void apiZoneCryptokeysPOST(DNSName zonename, HttpRequest *req, HttpResponse *resp, DNSSECKeeper *dk) {
 980   auto document = req->json();
 981   string privatekey_fieldname = "privatekey";
 982   auto privatekey = document["privatekey"];
 983   if (privatekey.is_null()) {
 984     // Fallback to the old "content" behaviour
 985     privatekey = document["content"];
 986     privatekey_fieldname = "content";
 987   }
 988   bool active = boolFromJson(document, "active", false);
 989   bool keyOrZone;
 990
 991   if (stringFromJson(document, "keytype") == "ksk" || stringFromJson(document, "keytype") == "csk") {
 992     keyOrZone = true;
 993   } else if (stringFromJson(document, "keytype") == "zsk") {
 994     keyOrZone = false;
 995   } else {
 996     throw ApiException("Invalid keytype " + stringFromJson(document, "keytype"));
 997   }
 998
 999   int64_t insertedId = -1;
1000
1001   if (privatekey.is_null()) {
1002     int bits = keyOrZone ? ::arg().asNum("default-ksk-size") : ::arg().asNum("default-zsk-size");
1003     auto docbits = document["bits"];
1004     if (!docbits.is_null()) {
1005       if (!docbits.is_number() || (fmod(docbits.number_value(), 1.0) != 0) || docbits.int_value() < 0) {
1006         throw ApiException("'bits' must be a positive integer value");
1007       } else {
1008         bits = docbits.int_value();
1009       }
1010     }
1011     int algorithm = DNSSECKeeper::shorthand2algorithm(keyOrZone ? ::arg()["default-ksk-algorithm"] : ::arg()["default-zsk-algorithm"]);
1012     auto providedAlgo = document["algorithm"];
1013     if (providedAlgo.is_string()) {
1014       algorithm = DNSSECKeeper::shorthand2algorithm(providedAlgo.string_value());
1015       if (algorithm == -1)
1016         throw ApiException("Unknown algorithm: " + providedAlgo.string_value());
1017     } else if (providedAlgo.is_number()) {
1018       algorithm = providedAlgo.int_value();
1019     } else if (!providedAlgo.is_null()) {
1020       throw ApiException("Unknown algorithm: " + providedAlgo.string_value());
1021     }
1022
1023     try {
1024       if (!dk->addKey(zonename, keyOrZone, algorithm, insertedId, bits, active)) {
1025         throw ApiException("Adding key failed, perhaps DNSSEC not enabled in configuration?");
1026       }
1027     } catch (std::runtime_error& error) {
1028       throw ApiException(error.what());
1029     }
1030     if (insertedId < 0)
1031       throw ApiException("Adding key failed, perhaps DNSSEC not enabled in configuration?");
1032   } else if (document["bits"].is_null() && document["algorithm"].is_null()) {
1033     auto keyData = stringFromJson(document, privatekey_fieldname);
1034     DNSKEYRecordContent dkrc;
1035     DNSSECPrivateKey dpk;
1036     try {
1037       shared_ptr<DNSCryptoKeyEngine> dke(DNSCryptoKeyEngine::makeFromISCString(dkrc, keyData));
1038       dpk.d_algorithm = dkrc.d_algorithm;
1039       // TODO remove in 4.2.0
1040       if(dpk.d_algorithm == 7)
1041         dpk.d_algorithm = 5;
1042
1043       if (keyOrZone)
1044         dpk.d_flags = 257;
1045       else
1046         dpk.d_flags = 256;
1047
1048       dpk.setKey(dke);
1049     }
1050     catch (std::runtime_error& error) {
1051       throw ApiException("Key could not be parsed. Make sure your key format is correct.");
1052     } try {
1053       if (!dk->addKey(zonename, dpk,insertedId, active)) {
1054         throw ApiException("Adding key failed, perhaps DNSSEC not enabled in configuration?");
1055       }
1056     } catch (std::runtime_error& error) {
1057       throw ApiException(error.what());
1058     }
1059     if (insertedId < 0)
1060       throw ApiException("Adding key failed, perhaps DNSSEC not enabled in configuration?");
1061   } else {
1062     throw ApiException("Either you submit just the 'privatekey' field or you leave 'privatekey' empty and submit the other fields.");
1063   }
1064   apiZoneCryptokeysGET(zonename, insertedId, resp, dk);
1065   resp->status = 201;
1066 }
1067
1068 /*
1069  * This method handles PUT (execute) requests for URL /api/v1/servers/:server_id/zones/:zone_name/cryptokeys/:cryptokey_id .
1070  * It de/activates a key from :zone_name specified by :cryptokey_id.
1071  * Server Answers:
1072  * Case 1: invalid JSON data
1073  *      The server returns 400 Bad Request
1074  * Case 2: the backend returns true on de/activation. This means the key is de/active.
1075  *      The server returns 204 No Content
1076  * Case 3: the backend returns false on de/activation. An error occurred.
1077  *      The sever returns 422 Unprocessable Entity with message "Could not de/activate Key: :cryptokey_id in Zone: :zone_name"
1078  * */
1079 static void apiZoneCryptokeysPUT(DNSName zonename, int inquireKeyId, HttpRequest *req, HttpResponse *resp, DNSSECKeeper *dk) {
1080   //throws an exception if the Body is empty
1081   auto document = req->json();
1082   //throws an exception if the key does not exist or is not a bool
1083   bool active = boolFromJson(document, "active");
1084   if (active) {
1085     if (!dk->activateKey(zonename, inquireKeyId)) {
1086       resp->setErrorResult("Could not activate Key: " + req->parameters["key_id"] + " in Zone: " + zonename.toString(), 422);
1087       return;
1088     }
1089   } else {
1090     if (!dk->deactivateKey(zonename, inquireKeyId)) {
1091       resp->setErrorResult("Could not deactivate Key: " + req->parameters["key_id"] + " in Zone: " + zonename.toString(), 422);
1092       return;
1093     }
1094   }
1095   resp->body = "";
1096   resp->status = 204;
1097   return;
1098 }
1099
1100 /*
1101  * This method chooses the right functionality for the request. It also checks for a cryptokey_id which has to be passed
1102  * by URL /api/v1/servers/:server_id/zones/:zone_name/cryptokeys/:cryptokey_id .
1103  * If the the HTTP-request-method isn't supported, the function returns a response with the 405 code (method not allowed).
1104  * */
1105 static void apiZoneCryptokeys(HttpRequest *req, HttpResponse *resp) {
1106   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
1107
1108   UeberBackend B;
1109   DNSSECKeeper dk(&B);
1110   DomainInfo di;
1111   if (!B.getDomainInfo(zonename, di))
1112     throw HttpBadRequestException();
1113
1114   int inquireKeyId = -1;
1115   if (req->parameters.count("key_id")) {
1116     inquireKeyId = std::stoi(req->parameters["key_id"]);
1117   }
1118
1119   if (req->method == "GET") {
1120     apiZoneCryptokeysGET(zonename, inquireKeyId, resp, &dk);
1121   } else if (req->method == "DELETE" && !::arg().mustDo("api-readonly")) {
1122     if (inquireKeyId == -1)
1123       throw HttpBadRequestException();
1124     apiZoneCryptokeysDELETE(zonename, inquireKeyId, req, resp, &dk);
1125   } else if (req->method == "POST" && !::arg().mustDo("api-readonly")) {
1126     apiZoneCryptokeysPOST(zonename, req, resp, &dk);
1127   } else if (req->method == "PUT" && !::arg().mustDo("api-readonly")) {
1128     if (inquireKeyId == -1)
1129       throw HttpBadRequestException();
1130     apiZoneCryptokeysPUT(zonename, inquireKeyId, req, resp, &dk);
1131   } else {
1132     throw HttpMethodNotAllowedException(); //Returns method not allowed
1133   }
1134 }
1135
1136 static void gatherRecordsFromZone(const std::string& zonestring, vector<DNSResourceRecord>& new_records, DNSName zonename) {
1137   DNSResourceRecord rr;
1138   vector<string> zonedata;
1139   stringtok(zonedata, zonestring, "\r\n");
1140
1141   ZoneParserTNG zpt(zonedata, zonename);
1142
1143   bool seenSOA=false;
1144
1145   string comment = "Imported via the API";
1146
1147   try {
1148     while(zpt.get(rr, &comment)) {
1149       if(seenSOA && rr.qtype.getCode() == QType::SOA)
1150         continue;
1151       if(rr.qtype.getCode() == QType::SOA)
1152         seenSOA=true;
1153
1154       new_records.push_back(rr);
1155     }
1156   }
1157   catch(std::exception& ae) {
1158     throw ApiException("An error occurred while parsing the zonedata: "+string(ae.what()));
1159   }
1160 }
1161
1162 /** Throws ApiException if records with duplicate name/type/content are present.
1163  *  NOTE: sorts records in-place.
1164  */
1165 static void checkDuplicateRecords(vector<DNSResourceRecord>& records) {
1166   sort(records.begin(), records.end(),
1167     [](const DNSResourceRecord& rec_a, const DNSResourceRecord& rec_b) -> bool {
1168       return rec_a.qname.toString() > rec_b.qname.toString() || \
1169         rec_a.qtype.getCode() > rec_b.qtype.getCode() || \
1170         rec_a.content < rec_b.content;
1171     }
1172   );
1173   DNSResourceRecord previous;
1174   for(const auto& rec : records) {
1175     if (previous.qtype == rec.qtype && previous.qname == rec.qname && previous.content == rec.content) {
1176       throw ApiException("Duplicate record in RRset " + rec.qname.toString() + " IN " + rec.qtype.getName() + " with content \"" + rec.content + "\"");
1177     }
1178     previous = rec;
1179   }
1180 }
1181
1182 static void apiServerZones(HttpRequest* req, HttpResponse* resp) {
1183   UeberBackend B;
1184   DNSSECKeeper dk(&B);
1185   if (req->method == "POST" && !::arg().mustDo("api-readonly")) {
1186     DomainInfo di;
1187     auto document = req->json();
1188     DNSName zonename = apiNameToDNSName(stringFromJson(document, "name"));
1189     apiCheckNameAllowedCharacters(zonename.toString());
1190     zonename.makeUsLowerCase();
1191
1192     bool exists = B.getDomainInfo(zonename, di);
1193     if(exists)
1194       throw ApiException("Domain '"+zonename.toString()+"' already exists");
1195
1196     // validate 'kind' is set
1197     DomainInfo::DomainKind zonekind = DomainInfo::stringToKind(stringFromJson(document, "kind"));
1198
1199     string zonestring = document["zone"].string_value();
1200     auto rrsets = document["rrsets"];
1201     if (rrsets.is_array() && zonestring != "")
1202       throw ApiException("You cannot give rrsets AND zone data as text");
1203
1204     auto nameservers = document["nameservers"];
1205     if (!nameservers.is_array() && zonekind != DomainInfo::Slave)
1206       throw ApiException("Nameservers list must be given (but can be empty if NS records are supplied)");
1207
1208     string soa_edit_api_kind;
1209     if (document["soa_edit_api"].is_string()) {
1210       soa_edit_api_kind = document["soa_edit_api"].string_value();
1211     }
1212     else {
1213       soa_edit_api_kind = "DEFAULT";
1214     }
1215     string soa_edit_kind = document["soa_edit"].string_value();
1216
1217     // if records/comments are given, load and check them
1218     bool have_soa = false;
1219     bool have_zone_ns = false;
1220     vector<DNSResourceRecord> new_records;
1221     vector<Comment> new_comments;
1222     vector<DNSResourceRecord> new_ptrs;
1223
1224     if (rrsets.is_array()) {
1225       for (const auto& rrset : rrsets.array_items()) {
1226         DNSName qname = apiNameToDNSName(stringFromJson(rrset, "name"));
1227         apiCheckQNameAllowedCharacters(qname.toString());
1228         QType qtype;
1229         qtype = stringFromJson(rrset, "type");
1230         if (qtype.getCode() == 0) {
1231           throw ApiException("RRset "+qname.toString()+" IN "+stringFromJson(rrset, "type")+": unknown type given");
1232         }
1233         if (rrset["records"].is_array()) {
1234           int ttl = intFromJson(rrset, "ttl");
1235           gatherRecords(rrset, qname, qtype, ttl, new_records, new_ptrs);
1236         }
1237         if (rrset["comments"].is_array()) {
1238           gatherComments(rrset, qname, qtype, new_comments);
1239         }
1240       }
1241     } else if (zonestring != "") {
1242       gatherRecordsFromZone(zonestring, new_records, zonename);
1243     }
1244
1245     for(auto& rr : new_records) {
1246       rr.qname.makeUsLowerCase();
1247       if (!rr.qname.isPartOf(zonename) && rr.qname != zonename)
1248         throw ApiException("RRset "+rr.qname.toString()+" IN "+rr.qtype.getName()+": Name is out of zone");
1249       apiCheckQNameAllowedCharacters(rr.qname.toString());
1250
1251       if (rr.qtype.getCode() == QType::SOA && rr.qname==zonename) {
1252         have_soa = true;
1253         increaseSOARecord(rr, soa_edit_api_kind, soa_edit_kind);
1254         // fixup dots after serializeSOAData/increaseSOARecord
1255         rr.content = makeBackendRecordContent(rr.qtype, rr.content);
1256       }
1257       if (rr.qtype.getCode() == QType::NS && rr.qname==zonename) {
1258         have_zone_ns = true;
1259       }
1260     }
1261
1262     // synthesize RRs as needed
1263     DNSResourceRecord autorr;
1264     autorr.qname = zonename;
1265     autorr.auth = 1;
1266     autorr.ttl = ::arg().asNum("default-ttl");
1267
1268     if (!have_soa && zonekind != DomainInfo::Slave) {
1269       // synthesize a SOA record so the zone "really" exists
1270       string soa = (boost::format("%s %s %lu")
1271         % ::arg()["default-soa-name"]
1272         % (::arg().isEmpty("default-soa-mail") ? (DNSName("hostmaster.") + zonename).toString() : ::arg()["default-soa-mail"])
1273         % document["serial"].int_value()
1274       ).str();
1275       SOAData sd;
1276       fillSOAData(soa, sd);  // fills out default values for us
1277       autorr.qtype = "SOA";
1278       autorr.content = serializeSOAData(sd);
1279       increaseSOARecord(autorr, soa_edit_api_kind, soa_edit_kind);
1280       // fixup dots after serializeSOAData/increaseSOARecord
1281       autorr.content = makeBackendRecordContent(autorr.qtype, autorr.content);
1282       new_records.push_back(autorr);
1283     }
1284
1285     // create NS records if nameservers are given
1286     for (auto value : nameservers.array_items()) {
1287       string nameserver = value.string_value();
1288       if (nameserver.empty())
1289         throw ApiException("Nameservers must be non-empty strings");
1290       if (!isCanonical(nameserver))
1291         throw ApiException("Nameserver is not canonical: '" + nameserver + "'");
1292       try {
1293         // ensure the name parses
1294         autorr.content = DNSName(nameserver).toStringRootDot();
1295       } catch (...) {
1296         throw ApiException("Unable to parse DNS Name for NS '" + nameserver + "'");
1297       }
1298       autorr.qtype = "NS";
1299       new_records.push_back(autorr);
1300       if (have_zone_ns) {
1301         throw ApiException("Nameservers list MUST NOT be mixed with zone-level NS in rrsets");
1302       }
1303     }
1304
1305     checkDuplicateRecords(new_records);
1306
1307     if (boolFromJson(document, "dnssec", false)) {
1308       checkDefaultDNSSECAlgos();
1309
1310       if(document["nsec3param"].string_value().length() > 0) {
1311         NSEC3PARAMRecordContent ns3pr(document["nsec3param"].string_value());
1312         string error_msg = "";
1313         if (!dk.checkNSEC3PARAM(ns3pr, error_msg)) {
1314           throw ApiException("NSEC3PARAMs provided for zone '"+zonename.toString()+"' are invalid. " + error_msg);
1315         }
1316       }
1317     }
1318
1319     // no going back after this
1320     if(!B.createDomain(zonename))
1321       throw ApiException("Creating domain '"+zonename.toString()+"' failed");
1322
1323     if(!B.getDomainInfo(zonename, di))
1324       throw ApiException("Creating domain '"+zonename.toString()+"' failed: lookup of domain ID failed");
1325
1326     // updateDomainSettingsFromDocument does NOT fill out the default we've established above.
1327     if (!soa_edit_api_kind.empty()) {
1328       di.backend->setDomainMetadataOne(zonename, "SOA-EDIT-API", soa_edit_api_kind);
1329     }
1330
1331     di.backend->startTransaction(zonename, di.id);
1332
1333     for(auto rr : new_records) {
1334       rr.domain_id = di.id;
1335       di.backend->feedRecord(rr, DNSName());
1336     }
1337     for(Comment& c : new_comments) {
1338       c.domain_id = di.id;
1339       di.backend->feedComment(c);
1340     }
1341
1342     updateDomainSettingsFromDocument(B, di, zonename, document);
1343
1344     di.backend->commitTransaction();
1345
1346     storeChangedPTRs(B, new_ptrs);
1347
1348     fillZone(zonename, resp, shouldDoRRSets(req));
1349     resp->status = 201;
1350     return;
1351   }
1352
1353   if(req->method != "GET")
1354     throw HttpMethodNotAllowedException();
1355
1356   vector<DomainInfo> domains;
1357   B.getAllDomains(&domains, true); // incl. disabled
1358
1359   Json::array doc;
1360   for(const DomainInfo& di : domains) {
1361     doc.push_back(getZoneInfo(di, &dk));
1362   }
1363   resp->setBody(doc);
1364 }
1365
1366 static void apiServerZoneDetail(HttpRequest* req, HttpResponse* resp) {
1367   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
1368
1369   if(req->method == "PUT" && !::arg().mustDo("api-readonly")) {
1370     // update domain settings
1371     UeberBackend B;
1372     DomainInfo di;
1373     if(!B.getDomainInfo(zonename, di))
1374       throw ApiException("Could not find domain '"+zonename.toString()+"'");
1375
1376     updateDomainSettingsFromDocument(B, di, zonename, req->json());
1377
1378     resp->body = "";
1379     resp->status = 204; // No Content, but indicate success
1380     return;
1381   }
1382   else if(req->method == "DELETE" && !::arg().mustDo("api-readonly")) {
1383     // delete domain
1384     UeberBackend B;
1385     DomainInfo di;
1386     if(!B.getDomainInfo(zonename, di))
1387       throw ApiException("Could not find domain '"+zonename.toString()+"'");
1388
1389     if(!di.backend->deleteDomain(zonename))
1390       throw ApiException("Deleting domain '"+zonename.toString()+"' failed: backend delete failed/unsupported");
1391
1392     // empty body on success
1393     resp->body = "";
1394     resp->status = 204; // No Content: declare that the zone is gone now
1395     return;
1396   } else if (req->method == "PATCH" && !::arg().mustDo("api-readonly")) {
1397     patchZone(req, resp);
1398     return;
1399   } else if (req->method == "GET") {
1400     fillZone(zonename, resp, shouldDoRRSets(req));
1401     return;
1402   }
1403
1404   throw HttpMethodNotAllowedException();
1405 }
1406
1407 static void apiServerZoneExport(HttpRequest* req, HttpResponse* resp) {
1408   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
1409
1410   if(req->method != "GET")
1411     throw HttpMethodNotAllowedException();
1412
1413   ostringstream ss;
1414
1415   UeberBackend B;
1416   DomainInfo di;
1417   if(!B.getDomainInfo(zonename, di))
1418     throw ApiException("Could not find domain '"+zonename.toString()+"'");
1419
1420   DNSResourceRecord rr;
1421   SOAData sd;
1422   di.backend->list(zonename, di.id);
1423   while(di.backend->get(rr)) {
1424     if (!rr.qtype.getCode())
1425       continue; // skip empty non-terminals
1426
1427     ss <<
1428       rr.qname.toString() << "\t" <<
1429       rr.ttl << "\t" <<
1430       rr.qtype.getName() << "\t" <<
1431       makeApiRecordContent(rr.qtype, rr.content) <<
1432       endl;
1433   }
1434
1435   if (req->accept_json) {
1436     resp->setBody(Json::object { { "zone", ss.str() } });
1437   } else {
1438     resp->headers["Content-Type"] = "text/plain; charset=us-ascii";
1439     resp->body = ss.str();
1440   }
1441 }
1442
1443 static void apiServerZoneAxfrRetrieve(HttpRequest* req, HttpResponse* resp) {
1444   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
1445
1446   if(req->method != "PUT" || ::arg().mustDo("api-readonly"))
1447     throw HttpMethodNotAllowedException();
1448
1449   UeberBackend B;
1450   DomainInfo di;
1451   if(!B.getDomainInfo(zonename, di))
1452     throw ApiException("Could not find domain '"+zonename.toString()+"'");
1453
1454   if(di.masters.empty())
1455     throw ApiException("Domain '"+zonename.toString()+"' is not a slave domain (or has no master defined)");
1456
1457   random_shuffle(di.masters.begin(), di.masters.end());
1458   Communicator.addSuckRequest(zonename, di.masters.front());
1459   resp->setSuccessResult("Added retrieval request for '"+zonename.toString()+"' from master "+di.masters.front());
1460 }
1461
1462 static void apiServerZoneNotify(HttpRequest* req, HttpResponse* resp) {
1463   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
1464
1465   if(req->method != "PUT" || ::arg().mustDo("api-readonly"))
1466     throw HttpMethodNotAllowedException();
1467
1468   UeberBackend B;
1469   DomainInfo di;
1470   if(!B.getDomainInfo(zonename, di))
1471     throw ApiException("Could not find domain '"+zonename.toString()+"'");
1472
1473   if(!Communicator.notifyDomain(zonename))
1474     throw ApiException("Failed to add to the queue - see server log");
1475
1476   resp->setSuccessResult("Notification queued");
1477 }
1478
1479 static void apiServerZoneRectify(HttpRequest* req, HttpResponse* resp) {
1480   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
1481
1482   if(req->method != "PUT")
1483     throw HttpMethodNotAllowedException();
1484
1485   UeberBackend B;
1486   DomainInfo di;
1487   if(!B.getDomainInfo(zonename, di))
1488     throw ApiException("Could not find domain '"+zonename.toString()+"'");
1489
1490   DNSSECKeeper dk(&B);
1491
1492   if (!dk.isSecuredZone(zonename))
1493     throw ApiException("Zone '" + zonename.toString() + "' is not DNSSEC signed, not rectifying.");
1494
1495   if (di.kind == DomainInfo::Slave)
1496     throw ApiException("Zone '" + zonename.toString() + "' is a slave zone, not rectifying.");
1497
1498   string error_msg = "";
1499   string info;
1500   if (!dk.rectifyZone(zonename, error_msg, info, true))
1501     throw ApiException("Failed to rectify '" + zonename.toString() + "' " + error_msg);
1502
1503   resp->setSuccessResult("Rectified");
1504 }
1505
1506 static void makePtr(const DNSResourceRecord& rr, DNSResourceRecord* ptr) {
1507   if (rr.qtype.getCode() == QType::A) {
1508     uint32_t ip;
1509     if (!IpToU32(rr.content, &ip)) {
1510       throw ApiException("PTR: Invalid IP address given");
1511     }
1512     ptr->qname = DNSName((boost::format("%u.%u.%u.%u.in-addr.arpa.")
1513                   % ((ip >> 24) & 0xff)
1514                   % ((ip >> 16) & 0xff)
1515                   % ((ip >>  8) & 0xff)
1516                   % ((ip      ) & 0xff)
1517                          ).str());
1518   } else if (rr.qtype.getCode() == QType::AAAA) {
1519     ComboAddress ca(rr.content);
1520     char buf[3];
1521     ostringstream ss;
1522     for (int octet = 0; octet < 16; ++octet) {
1523       if (snprintf(buf, sizeof(buf), "%02x", ca.sin6.sin6_addr.s6_addr[octet]) != (sizeof(buf)-1)) {
1524         // this should be impossible: no byte should give more than two digits in hex format
1525         throw PDNSException("Formatting IPv6 address failed");
1526       }
1527       ss << buf[0] << '.' << buf[1] << '.';
1528     }
1529     string tmp = ss.str();
1530     tmp.resize(tmp.size()-1); // remove last dot
1531     // reverse and append arpa domain
1532     ptr->qname = DNSName(string(tmp.rbegin(), tmp.rend())) + DNSName("ip6.arpa.");
1533   } else {
1534     throw ApiException("Unsupported PTR source '" + rr.qname.toString() + "' type '" + rr.qtype.getName() + "'");
1535   }
1536
1537   ptr->qtype = "PTR";
1538   ptr->ttl = rr.ttl;
1539   ptr->disabled = rr.disabled;
1540   ptr->content = rr.qname.toStringRootDot();
1541 }
1542
1543 static void storeChangedPTRs(UeberBackend& B, vector<DNSResourceRecord>& new_ptrs) {
1544   for(const DNSResourceRecord& rr :  new_ptrs) {
1545     SOAData sd;
1546     if (!B.getAuth(rr.qname, QType(QType::PTR), &sd, false))
1547       throw ApiException("Could not find domain for PTR '"+rr.qname.toString()+"' requested for '"+rr.content+"' (while saving)");
1548
1549     string soa_edit_api_kind;
1550     string soa_edit_kind;
1551     bool soa_changed = false;
1552     DNSResourceRecord soarr;
1553     sd.db->getDomainMetadataOne(sd.qname, "SOA-EDIT-API", soa_edit_api_kind);
1554     sd.db->getDomainMetadataOne(sd.qname, "SOA-EDIT", soa_edit_kind);
1555     if (!soa_edit_api_kind.empty()) {
1556       soarr.qname = sd.qname;
1557       soarr.content = serializeSOAData(sd);
1558       soarr.qtype = "SOA";
1559       soarr.domain_id = sd.domain_id;
1560       soarr.auth = 1;
1561       soarr.ttl = sd.ttl;
1562       increaseSOARecord(soarr, soa_edit_api_kind, soa_edit_kind);
1563       // fixup dots after serializeSOAData/increaseSOARecord
1564       soarr.content = makeBackendRecordContent(soarr.qtype, soarr.content);
1565       soa_changed = true;
1566     }
1567
1568     sd.db->startTransaction(sd.qname);
1569     if (!sd.db->replaceRRSet(sd.domain_id, rr.qname, rr.qtype, vector<DNSResourceRecord>(1, rr))) {
1570       sd.db->abortTransaction();
1571       throw ApiException("PTR-Hosting backend for "+rr.qname.toString()+"/"+rr.qtype.getName()+" does not support editing records.");
1572     }
1573
1574     if (soa_changed) {
1575       sd.db->replaceRRSet(sd.domain_id, soarr.qname, soarr.qtype, vector<DNSResourceRecord>(1, soarr));
1576     }
1577
1578     sd.db->commitTransaction();
1579     purgeAuthCachesExact(rr.qname);
1580   }
1581 }
1582
1583 static void patchZone(HttpRequest* req, HttpResponse* resp) {
1584   UeberBackend B;
1585   DomainInfo di;
1586   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
1587   if (!B.getDomainInfo(zonename, di))
1588     throw ApiException("Could not find domain '"+zonename.toString()+"'");
1589
1590   vector<DNSResourceRecord> new_records;
1591   vector<Comment> new_comments;
1592   vector<DNSResourceRecord> new_ptrs;
1593
1594   Json document = req->json();
1595
1596   auto rrsets = document["rrsets"];
1597   if (!rrsets.is_array())
1598     throw ApiException("No rrsets given in update request");
1599
1600   di.backend->startTransaction(zonename);
1601
1602   try {
1603     string soa_edit_api_kind;
1604     string soa_edit_kind;
1605     di.backend->getDomainMetadataOne(zonename, "SOA-EDIT-API", soa_edit_api_kind);
1606     di.backend->getDomainMetadataOne(zonename, "SOA-EDIT", soa_edit_kind);
1607     bool soa_edit_done = false;
1608
1609     for (const auto& rrset : rrsets.array_items()) {
1610       string changetype = toUpper(stringFromJson(rrset, "changetype"));
1611       DNSName qname = apiNameToDNSName(stringFromJson(rrset, "name"));
1612       apiCheckQNameAllowedCharacters(qname.toString());
1613       QType qtype;
1614       qtype = stringFromJson(rrset, "type");
1615       if (qtype.getCode() == 0) {
1616         throw ApiException("RRset "+qname.toString()+" IN "+stringFromJson(rrset, "type")+": unknown type given");
1617       }
1618
1619       if (changetype == "DELETE") {
1620         // delete all matching qname/qtype RRs (and, implicitly comments).
1621         if (!di.backend->replaceRRSet(di.id, qname, qtype, vector<DNSResourceRecord>())) {
1622           throw ApiException("Hosting backend does not support editing records.");
1623         }
1624       }
1625       else if (changetype == "REPLACE") {
1626         // we only validate for REPLACE, as DELETE can be used to "fix" out of zone records.
1627         if (!qname.isPartOf(zonename) && qname != zonename)
1628           throw ApiException("RRset "+qname.toString()+" IN "+qtype.getName()+": Name is out of zone");
1629
1630         bool replace_records = rrset["records"].is_array();
1631         bool replace_comments = rrset["comments"].is_array();
1632
1633         if (!replace_records && !replace_comments) {
1634           throw ApiException("No change for RRset " + qname.toString() + " IN " + qtype.getName());
1635         }
1636
1637         new_records.clear();
1638         new_comments.clear();
1639
1640         if (replace_records) {
1641           // ttl shouldn't be part of DELETE, and it shouldn't be required if we don't get new records.
1642           int ttl = intFromJson(rrset, "ttl");
1643           // new_ptrs is merged.
1644           gatherRecords(rrset, qname, qtype, ttl, new_records, new_ptrs);
1645
1646           for(DNSResourceRecord& rr : new_records) {
1647             rr.domain_id = di.id;
1648             if (rr.qtype.getCode() == QType::SOA && rr.qname==zonename) {
1649               soa_edit_done = increaseSOARecord(rr, soa_edit_api_kind, soa_edit_kind);
1650               rr.content = makeBackendRecordContent(rr.qtype, rr.content);
1651             }
1652           }
1653           checkDuplicateRecords(new_records);
1654         }
1655
1656         if (replace_comments) {
1657           gatherComments(rrset, qname, qtype, new_comments);
1658
1659           for(Comment& c : new_comments) {
1660             c.domain_id = di.id;
1661           }
1662         }
1663
1664         if (replace_records) {
1665           di.backend->lookup(QType(QType::ANY), qname);
1666           DNSResourceRecord rr;
1667           while (di.backend->get(rr)) {
1668             if (qtype.getCode() == QType::CNAME && rr.qtype.getCode() != QType::CNAME) {
1669               throw ApiException("RRset "+qname.toString()+" IN "+qtype.getName()+": Conflicts with pre-existing non-CNAME RRset");
1670             } else if (qtype.getCode() != QType::CNAME && rr.qtype.getCode() == QType::CNAME) {
1671               throw ApiException("RRset "+qname.toString()+" IN "+qtype.getName()+": Conflicts with pre-existing CNAME RRset");
1672             }
1673           }
1674
1675           if (!di.backend->replaceRRSet(di.id, qname, qtype, new_records)) {
1676             throw ApiException("Hosting backend does not support editing records.");
1677           }
1678         }
1679         if (replace_comments) {
1680           if (!di.backend->replaceComments(di.id, qname, qtype, new_comments)) {
1681             throw ApiException("Hosting backend does not support editing comments.");
1682           }
1683         }
1684       }
1685       else
1686         throw ApiException("Changetype not understood");
1687     }
1688
1689     // edit SOA (if needed)
1690     if (!soa_edit_api_kind.empty() && !soa_edit_done) {
1691       SOAData sd;
1692       if (!B.getSOA(zonename, sd))
1693         throw ApiException("No SOA found for domain '"+zonename.toString()+"'");
1694
1695       DNSResourceRecord rr;
1696       rr.qname = zonename;
1697       rr.content = serializeSOAData(sd);
1698       rr.qtype = "SOA";
1699       rr.domain_id = di.id;
1700       rr.auth = 1;
1701       rr.ttl = sd.ttl;
1702       increaseSOARecord(rr, soa_edit_api_kind, soa_edit_kind);
1703       // fixup dots after serializeSOAData/increaseSOARecord
1704       rr.content = makeBackendRecordContent(rr.qtype, rr.content);
1705
1706       if (!di.backend->replaceRRSet(di.id, rr.qname, rr.qtype, vector<DNSResourceRecord>(1, rr))) {
1707         throw ApiException("Hosting backend does not support editing records.");
1708       }
1709
1710       // return old and new serials in headers
1711       resp->headers["X-PDNS-Old-Serial"] = std::to_string(sd.serial);
1712       fillSOAData(rr.content, sd);
1713       resp->headers["X-PDNS-New-Serial"] = std::to_string(sd.serial);
1714     }
1715
1716   } catch(...) {
1717     di.backend->abortTransaction();
1718     throw;
1719   }
1720
1721   DNSSECKeeper dk(&B);
1722   string api_rectify;
1723   di.backend->getDomainMetadataOne(zonename, "API-RECTIFY", api_rectify);
1724   if (dk.isSecuredZone(zonename) && !dk.isPresigned(zonename) && api_rectify == "1") {
1725     string error_msg = "";
1726     string info;
1727     if (!dk.rectifyZone(zonename, error_msg, info, false))
1728       throw ApiException("Failed to rectify '" + zonename.toString() + "' " + error_msg);
1729   }
1730
1731   di.backend->commitTransaction();
1732
1733   purgeAuthCachesExact(zonename);
1734
1735   // now the PTRs
1736   storeChangedPTRs(B, new_ptrs);
1737
1738   resp->body = "";
1739   resp->status = 204; // No Content, but indicate success
1740   return;
1741 }
1742
1743 static void apiServerSearchData(HttpRequest* req, HttpResponse* resp) {
1744   if(req->method != "GET")
1745     throw HttpMethodNotAllowedException();
1746
1747   string q = req->getvars["q"];
1748   string sMax = req->getvars["max"];
1749   int maxEnts = 100;
1750   int ents = 0;
1751
1752   if (q.empty())
1753     throw ApiException("Query q can't be blank");
1754   if (!sMax.empty())
1755     maxEnts = std::stoi(sMax);
1756   if (maxEnts < 1)
1757     throw ApiException("Maximum entries must be larger than 0");
1758
1759   SimpleMatch sm(q,true);
1760   UeberBackend B;
1761   vector<DomainInfo> domains;
1762   vector<DNSResourceRecord> result_rr;
1763   vector<Comment> result_c;
1764   map<int,DomainInfo> zoneIdZone;
1765   map<int,DomainInfo>::iterator val;
1766   Json::array doc;
1767
1768   B.getAllDomains(&domains, true);
1769
1770   for(const DomainInfo di: domains)
1771   {
1772     if (ents < maxEnts && sm.match(di.zone)) {
1773       doc.push_back(Json::object {
1774         { "object_type", "zone" },
1775         { "zone_id", apiZoneNameToId(di.zone) },
1776         { "name", di.zone.toString() }
1777       });
1778       ents++;
1779     }
1780     zoneIdZone[di.id] = di; // populate cache
1781   }
1782
1783   if (B.searchRecords(q, maxEnts, result_rr))
1784   {
1785     for(const DNSResourceRecord& rr: result_rr)
1786     {
1787       if (!rr.qtype.getCode())
1788         continue; // skip empty non-terminals
1789
1790       auto object = Json::object {
1791         { "object_type", "record" },
1792         { "name", rr.qname.toString() },
1793         { "type", rr.qtype.getName() },
1794         { "ttl", (double)rr.ttl },
1795         { "disabled", rr.disabled },
1796         { "content", makeApiRecordContent(rr.qtype, rr.content) }
1797       };
1798       if ((val = zoneIdZone.find(rr.domain_id)) != zoneIdZone.end()) {
1799         object["zone_id"] = apiZoneNameToId(val->second.zone);
1800         object["zone"] = val->second.zone.toString();
1801       }
1802       doc.push_back(object);
1803     }
1804   }
1805
1806   if (B.searchComments(q, maxEnts, result_c))
1807   {
1808     for(const Comment &c: result_c)
1809     {
1810       auto object = Json::object {
1811         { "object_type", "comment" },
1812         { "name", c.qname.toString() },
1813         { "content", c.content }
1814       };
1815       if ((val = zoneIdZone.find(c.domain_id)) != zoneIdZone.end()) {
1816         object["zone_id"] = apiZoneNameToId(val->second.zone);
1817         object["zone"] = val->second.zone.toString();
1818       }
1819       doc.push_back(object);
1820     }
1821   }
1822
1823   resp->setBody(doc);
1824 }
1825
1826 void apiServerCacheFlush(HttpRequest* req, HttpResponse* resp) {
1827   if(req->method != "PUT" || ::arg().mustDo("api-readonly"))
1828     throw HttpMethodNotAllowedException();
1829
1830   DNSName canon = apiNameToDNSName(req->getvars["domain"]);
1831
1832   uint64_t count = purgeAuthCachesExact(canon);
1833   resp->setBody(Json::object {
1834       { "count", (int) count },
1835       { "result", "Flushed cache." }
1836   });
1837 }
1838
1839 void AuthWebServer::cssfunction(HttpRequest* req, HttpResponse* resp)
1840 {
1841   resp->headers["Cache-Control"] = "max-age=86400";
1842   resp->headers["Content-Type"] = "text/css";
1843
1844   ostringstream ret;
1845   ret<<"* { box-sizing: border-box; margin: 0; padding: 0; }"<<endl;
1846   ret<<"body { color: black; background: white; margin-top: 1em; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 10pt; position: relative; }"<<endl;
1847   ret<<"a { color: #0959c2; }"<<endl;
1848   ret<<"a:hover { color: #3B8EC8; }"<<endl;
1849   ret<<".row { width: 940px; max-width: 100%; min-width: 768px; margin: 0 auto; }"<<endl;
1850   ret<<".row:before, .row:after { display: table; content:\" \"; }"<<endl;
1851   ret<<".row:after { clear: both; }"<<endl;
1852   ret<<".columns { position: relative; min-height: 1px; float: left; }"<<endl;
1853   ret<<".all { width: 100%; }"<<endl;
1854   ret<<".headl { width: 60%; }"<<endl;
1855   ret<<".headr { width: 39.5%; float: right; background-repeat: no-repeat; margin-top: 7px; ";
1856   ret<<"background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAJoAAAAUCAYAAAB1RSS/AAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAACtgAAArYBAHIqtQAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAABBTSURBVGiBtVp7cFRVmv9u3763b7/f9It00iFACBohgCEyQYgKI49CLV3cWaoEZBcfo2shu7KOtZbjrqOuVQtVWFuOrPqPRU3NgOIDlkgyJEYJwUAqjzEJedFJupN0p9/v+9o/mtve7r790HF+VbeSPue7555zz+98z4ucOXNmgWVZBH4AK5PJGIPBQBqNxpTNZkthGMZCCUxMTBCDg4PyiYkJWTQaRc1mc7Kuri7a1NQU4ssxDAOffPKJAQCynvnII494ESTddO3aNaXT6SS4TplMRj/44IM+7ndXV5dqfn5ewh9306ZNQZqmobu7W11qri0tLX6tVkv19vYqpqampPw+BEFYtVpNGQwG0mKxpJYsWUIKjTE6OiodGBhQ8NcgkUgYjUZDORyOhM1mSxV6fjAYFF+6dEnLb9NoNOR9990X4H53dHSovV4vzpfZvn27T6FQ0Py2sbExorOzU+N2uwmWZUGv15N33nlnuLGxMZy7byyVQEJ//nd9Yuz/lJR/HBdrHSlJ9baIuuV1L4LJ8/Y49pc/KcJX39WRC4MEgskY3Lourmn5rQdbckfe2ijfOBZo+40xNXtNysR9KLZkdVK+9oBf0fBkCABA3NraamTZwjxSKpXUAw884G1paQkUIty5c+f0Fy5cWMIfx+l0Snt6ejTt7e26AwcOuKxWawoAQCQSQW9vr3pxcTHrJTY3Nwe5Tb18+bJ2bGxMzvWhKMpu27bNj6IoCwDQ1tamd7lcRM79genpaaK1tdVQcDG3sXbt2rBWq6X6+/sV3d3d2mKyy5cvj+7cudO7atWqGL99bGxMWuxZOp0utX37du+9994b5A4Qh2AwiObei6Ioe/fdd4eVSiUNAHD16lX1+Pi4nC+zadOmIJ9oZ8+eNeTu3/T0tLSvr0/V3d0dPXr0qJNrZ+KL6MKpjZWUbyxzQMmFIYJcGCISw5+qjE9+M4UqLJmx/RdeWBK+elKfGTjuR+OhWSxx86JS/9D/zsrufDzMdSXGv5J5/vBYBZuKiLi25HS3LDndLUuMX1IYHjvtynQUQjgcFp89e9b8zjvv2BmGyepjWRbeffdd2/nz55cUIqvT6ZSeOHHC7vf7xVyb3W6P58rNzc1liOfxeLJISNM04na7Me63z+fD+P1SqZQupHn+Wty8eVN+4sSJyv7+fnlp6R/g8/nw06dPW0+ePLmUJEmklDxN08iVK1dU5Y7f0dGhvnjxYkElQVFU1jP9Xz5j4pMsSzYwifvPPWnhfsdHPpdnkYwHlk4ivi9/baFDM2IAACYZEi1++qSVTzI+YkN/VEe++726JNE4TE1Nyc6cOWPkt3322Wf6/v7+ki8nEAhgH3zwQWYhDoejINGSyaQoFAphuf2zs7MSAIBIJIImEgmU32ez2RLlruOngGVZ+Oijj6w+n09cWjobg4ODyg8//NBSWhLgu+++K4toJEkin376qancObBkFIl/f7bo2ImxC0om5kUBACK9pzTFZJlEAI0O/kEJABAf+UJOh115+8VH5MZHGkGimc3mRK66BwBoa2szBAIBMUB6w1tbW415QgUwOjqqGB4elgIA1NTU5BGN02IulwsXOqUul0sCADA/P5+3qIqKip+NaARBMBiGMbnt0Wg0z68qF729vepr164pS8k5nU7ZwsJC0U0DAOjp6VHGYjE0t10kEgmqt5TrOwIYqqRWTbmuSQAASM9fiFKy5Fx/Wnaur7Ss53tC8IQ+/fTTM/F4HH3rrbcc/E1nWRYmJyeJtWvXRr7++mt1rnoGANi6devipk2bgsePH7dHIpGs8Ts7O7W1tbXxqqqqJIZhLN+keDweDADA7XbjuWPebpcAACwsLOT1V1VVFSSayWRKvvLKK5P8tmLBTVNTk//hhx/2vv/++5aBgYEsLeB0OqWF7gMAsFqtiYqKivj169c1ueaytbVVv2HDhnChewHS7/fKlSuqPXv2LBaTyw1gAABqa2sjhw4dck1PT0vOnz9v4O+NWFNdlluBqispAABUYSEp/6TgPmRkVba0rGppybFRpZksaDodDkeioqIiT/M4nU4JAMDIyEiez1JTUxN9/PHHFyoqKpJbtmzx5faPj4/LANKOr9VqzRqbi7D4vhof8/PzOMAPhMyZa948OSAIAjiOs/xLSFvzIZFImO3bt+fNn9OqhaDRaMiDBw/Obd26NY8oTqdTWmhtfPT29paMmkOhUJ6CkEgkjFKppOvq6mIvvviis76+PkNqVF1BiQ21yWJjoiobiRlWpQAACMeWaKk5EMu2RQEAiOr7YyBCi2YliMrN0aI+Wjwez+vn/KOZmZk8lbl69eoI97+QeQwEAhgXFFRVVWX1+/1+nGVZyE1bcPB6vRKWZSE35JdKpbTJZCp4qiiKQmZmZnDuEiKqEITWTtN0SfMDALBjx45FiUSSZ35HRkaKakQAgPn5ecnU1FRRQuv1+rz0Qn9/v+ry5ctqgPTh2rFjR9ZB0e78Hzcgedb2NhDQ7vq9C24fQNXm3/gww8qCxJTX/4OfcGyJAwBgS+pSqo3/XFADo0oLqdn2lkeQaAzDIB0dHWqPx5O3YK1WSzIMA7lmEQDAaDSSQv/zEQwGUQCA6urqLKJRFIV4PB6MH3GqVCqS3z83N4cvLi5mEaVUIOD1evHXX399GXedOnXKWkweIJ3r++abb/IcYqPRWDA3xodUKmWEyMCZ/1IolQvMfXcAabN7+vRp68cff2wS8nElVVvihl99cQtV27PmhapspOHvzzmJ5Tsy6RtELGGX7G+7JV2xIysHiqAYq/rFv3h0e96f57drHnjTo2n57TwiJrIOl6SyOWo6cPmWiNAwgj7am2++6Ugmk4IkrK2tjUWjUVRoMXK5PJOHkclkdJ4AAESjURQAYPny5YKRJ59odXV1EX6ea2ZmRpKbf/s5AwEAgO+//17+8ssv1/j9/jzNt3HjxmC542g0GjI318etXQgoirKcxrx+/brKYDAUJPW6desiFy5ciM/MzORpyM7OTl04HEYPHz7synURiJpfxizPj4+T8/0S0jOEiw2rUrh5TRJE+TRAFWba+KvPZung9Hxy9iohwpUMvnRjQkSo8zQ1ICJQbX7Zp2h8LpCa7ZEwUY8Yt21IiHXLMopCkEyFSFZZWRmz2+0FVSqXUL39v6AM5yTr9XpKrVZnab2RkRFZKpXKPHvlypUxvuM+PT0tCQaDWW+lWCDwUzA3N0cIkay2tjbS0tLiL3ccoYNWzPRWVVXFcBxnAACCwSAmRCIOCILA/v373QqFghLqv3Hjhrq9vb1gioIFBNLFoLI8gbKBILdHRNi8ocvOC6nVavLw4cOzAAAKhYJGEARytRo/5A6Hw4JMk8lkmRNht9vjAwMDmU0dGhril3TAbDanDAZD0u12EwAAw8PDCoZhspZQLBD4KRBa17Zt27wPPfSQVyQqO+0IQumHQloeIB0Jr169Onzjxg01QOHDzqGioiJ55MiRW8ePH68UCg6+/PJLY0tLS4Cv1RJjF2W+z5+2UEFnxiqgKhup2/muW7pyV1YAQEfmUN9n/2SOj57PRN4IirHKphe86q2vLSIozktHMBDq+p0u3PkfRpZKZOYtqWyOavd86BZrlxWOOjMTQVH2jjvuCL/wwgtOvV5PAaQ3QyqV5r20SCSSebmhUEiQaCqVKnNfLkk4QnEwmUyk2WzOaNDp6emsU14qEABIO87Hjh2b5K79+/e7i8kLVS0UCgXF19blINfEAwCoVCpBDcShsbExVKw/FzabLXXs2LFJIT81Go2K+YFPYqpDuvDx7ko+yQAA6NAs5jn9sD1+84KMa2OpJLLw0X2VfJIBALA0iYS6/svoO/ePWcni4KWXjKH2V0x8kgEAJG99Lfd8uLmSSfiFj+j999/v3bt3r/vgwYMzb7zxxthzzz03w9UqOVit1rzFjY6OZiY7NDSUl/4gCIIxmUyZcZYtW1ZQG0mlUloul9Nmszkjn1sCK6cigGEY63A4EtxlsViKOvQOhyOm0WiyyNve3q4vN+IESKeAhKJnISeej/r6+ijfzy2Evr4+Oad19Xo9dejQoVkhbev1ejNE83/xjAXYfPcqDRZ8nz9lhdtjhjr/U0d6RwoGLtH+j7WJyctSAADSM4SHu/9bsFwFAECHXVjwq381ChKtubk50NLSEmhsbAxrNBrBU7hixYq8XMvg4KByamqKmJubw7799ts8H6GqqirGV+XV1dWJQppCq9WSAABWq7WgT/hzBwIAaW3d0NCQpVkCgQDW1dVVVnnI5XLhp06dsuW24zjO1NTUFJ0viqJsfX19Sa3W09Ojfu+996xcCkapVNIoiuaxyGAwkAAAdHBaXIw4AGnNRnqHcQCAxOTlknXdxHirHAAgOXFJBkzxQ5ic6pD/6Nodh9uRT1YxPRaLoW+//XaVWCxmhXyMe+65J8D/jeM4a7FYEkKOL5ceWLp0aUGiVVZWliSax+PBX3rppRp+27PPPjtdLKhpamoKtre3Z53Sr776yrB58+a8LzH4GB4eVr722muCpaaGhoYgQRCFVEoGGzduDF65cqVkqevGjRvqgYEBld1uj8/NzUlIMtsNwnGc4VJMlH+yrNwhFbglxoyrUnTEXVKeDs2K039nSstG5rDyvdscLF26NNnQ0JAX7tM0jQiRzGQyJdevXx/Jba+srBQ0J3q9ngRIBwRisVhQ65UTCNA0jQQCAYx/CZXO+LDb7UmLxZJFYo/Hg1+9erVovTLXtHMgCILevXt30bISh5UrV8ZzTXchUBSFTExMyIQCj7q6ugh3KHDbugSIhN8hHxLb+iQAAGasK+2SmOvTsuY1pWWNqxI/mWgAAI8++uiCTqcrmcTEMIzZt2+fW8hMFvJbuNMoEokEM+FSqZQ2m81/k0+DAADWr1+fZ8IuXrxY8lu3XKAoyu7bt8/NmbFSEDLdPxYSiYTZu3dvJqmKYHJWturhomNKa34ZFskMNACAYt2hQDFZEaGh5XfsDQMAECt2R1Glreja5GsOBP4qoul0Ouro0aO3TCZTQTOkUqnII0eO3FqxYoUgoYRKVQAA/ISl0Ph/60+Dmpqa8syky+Ui+vr6yv4uTavVks8///ytUsV0oWf/GHk+pFIp/cQTT8zqdLos31q36+S8WFcjuE9iTVVK99CpTDQuXbk7qmz8taAGRlAJq9t50o2qllIAACKJitHu+cCF4ApBdS5d/XdB+fqnguLq6upobm4Kx/GyQ3m9Xk+9+uqrk21tbZquri6t1+vFWZYFi8WSdDgcsV27di1qtdqCYb3ZbCZra2sjueaW/yl0XV1dNBwOZ/mT/KIxB6VSSTkcjlhuey44X8lkMqVy5TmC6/V6qrGx0Z8bPY6OjsrWrFkT1el0ec9CUZRVqVSUWq2mqqur4xs2bAgL+XQSiYTJvZcf9Njt9uRdd90Vys2PcQnd5ubmAMMwcPPmTXk0GhUDpCsRVVVVsccee2yBS0PxIZLqacszfZPBP7+qj4+1Kilf+lNuYtkDEU3La3mfcmsfPL4gqfxFrJxPuYll22Kmp/omgpf+zZia7ZEyCT+KGVcn5WsP+uUNh0IAAP8PaQRnE4MgdzkAAAAASUVORK5CYII=);";
1857   ret<<" width: 154px; height: 20px; }"<<endl;
1858   ret<<"a#appname { margin: 0; font-size: 27px; color: #666; text-decoration: none; font-weight: bold; display: block; }"<<endl;
1859   ret<<"footer { border-top:  1px solid #ddd; padding-top: 4px; font-size: 12px; }"<<endl;
1860   ret<<"footer.row { margin-top: 1em; margin-bottom: 1em; }"<<endl;
1861   ret<<".panel { background: #f2f2f2; border: 1px solid #e6e6e6; margin: 0 0 22px 0; padding: 20px; }"<<endl;
1862   ret<<"table.data { width: 100%; border-spacing: 0; border-top: 1px solid #333; }"<<endl;
1863   ret<<"table.data td { border-bottom: 1px solid #333; padding: 2px; }"<<endl;
1864   ret<<"table.data tr:nth-child(2n) { background: #e2e2e2; }"<<endl;
1865   ret<<"table.data tr:hover { background: white; }"<<endl;
1866   ret<<".ringmeta { margin-bottom: 5px; }"<<endl;
1867   ret<<".resetring {float: right; }"<<endl;
1868   ret<<".resetring i { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAA/klEQVQY01XPP04UUBgE8N/33vd2XZUWEuzYuMZEG4KFCQn2NhA4AIewAOMBPIG2xhNYeAcKGqkNCdmYlVBZGBIT4FHsbuE0U8xk/kAbqm9TOfI/nicfhmwgDNhvylUT58kxCp4l31L8SfH9IetJ2ev6PwyIwyZWsdb11/gbTK55Co+r8rmJaRPTFJcpZil+pTit7C5awMpA+Zpi1sRFE9MqflYOloYCjY2uP8EdYiGU4CVGUBubxKfOOLjrtOBmzvEilbVb/aQWvhRl0unBZVXe4XdnK+bprwqnhoyTsyZ+JG8Wk0apfExxlcp7PFruXH8gdxamWB4cyW2sIO4BG3czIp78jUIAAAAASUVORK5CYII=); width: 10px; height: 10px; margin-right: 2px; display: inline-block; background-repeat: no-repeat; }"<<endl;
1869   ret<<".resetring:hover i { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAA2ElEQVQY013PMUoDcRDF4c+kEzxCsNNCrBQvIGhnlcYm11EkBxAraw8gglgIoiJpAoKIYlBcgrgopsma3c3fwt1k9cHA480M8xvQp/nMjorOWY5ov7IAYlpjQk7aYxcuWBpwFQgJnUcaYk7GhEDIGL5w+MVpKLIRyR2b4JOjvGhUKzHTv2W7iuSN479Dvu9plf1awbQ6y3x1sU5tjpVJcMbakF6Ycoas8Dl5xEHJ160wRdfqzXfa6XQ4PLDlicWUjxHxZfndL/N+RhiwNzl/Q6PDhn/qsl76H7prcApk2B1aAAAAAElFTkSuQmCC);}"<<endl;
1870   ret<<".resizering {float: right;}"<<endl;
1871   resp->body = ret.str();
1872   resp->status = 200;
1873 }
1874
1875 void AuthWebServer::webThread()
1876 {
1877   try {
1878     if(::arg().mustDo("api")) {
1879       d_ws->registerApiHandler("/api/v1/servers/localhost/cache/flush", &apiServerCacheFlush);
1880       d_ws->registerApiHandler("/api/v1/servers/localhost/config", &apiServerConfig);
1881       d_ws->registerApiHandler("/api/v1/servers/localhost/search-log", &apiServerSearchLog);
1882       d_ws->registerApiHandler("/api/v1/servers/localhost/search-data", &apiServerSearchData);
1883       d_ws->registerApiHandler("/api/v1/servers/localhost/statistics", &apiServerStatistics);
1884       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/axfr-retrieve", &apiServerZoneAxfrRetrieve);
1885       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/cryptokeys/<key_id>", &apiZoneCryptokeys);
1886       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/cryptokeys", &apiZoneCryptokeys);
1887       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/export", &apiServerZoneExport);
1888       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/metadata/<kind>", &apiZoneMetadataKind);
1889       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/metadata", &apiZoneMetadata);
1890       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/notify", &apiServerZoneNotify);
1891       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>/rectify", &apiServerZoneRectify);
1892       d_ws->registerApiHandler("/api/v1/servers/localhost/zones/<id>", &apiServerZoneDetail);
1893       d_ws->registerApiHandler("/api/v1/servers/localhost/zones", &apiServerZones);
1894       d_ws->registerApiHandler("/api/v1/servers/localhost", &apiServerDetail);
1895       d_ws->registerApiHandler("/api/v1/servers", &apiServer);
1896       d_ws->registerApiHandler("/api", &apiDiscovery);
1897     }
1898     if (::arg().mustDo("webserver")) {
1899       d_ws->registerWebHandler("/style.css", boost::bind(&AuthWebServer::cssfunction, this, _1, _2));
1900       d_ws->registerWebHandler("/", boost::bind(&AuthWebServer::indexfunction, this, _1, _2));
1901     }
1902     d_ws->go();
1903   }
1904   catch(...) {
1905     L<<Logger::Error<<"AuthWebServer thread caught an exception, dying"<<endl;
1906     _exit(1);
1907   }
1908 }