conf: warn if whole zonefile-load + automatic DNSSEC signing + ACL transfer

Relates to #572

diff --git a/src/knot/conf/tools.c b/src/knot/conf/tools.c
index d570ac7cfbdc064e3ee6887b248ef6c8fb6249f3..a0fa537a25c94d0c898c2026eb93511f0985bd0f 100644 (file)
--- a/src/knot/conf/tools.c
+++ b/src/knot/conf/tools.c
@@ -31,6 +31,7 @@
 #include "knot/conf/module.h"
 #include "knot/conf/schema.h"
 #include "knot/common/log.h"
+#include "knot/updates/acl.h"
 #include "libknot/errcode.h"
 #include "libknot/yparser/yptrafo.h"
 #include "contrib/string.h"
@@ -423,6 +424,39 @@ int check_template(
 int check_zone(
        knotd_conf_check_args_t *args)
 {
+       const knot_dname_t *zone = args->id;
+
+       // Check for dnssec_signing + zonefile_load whole + acl transfer.
+       conf_val_t dnssec = conf_zone_get_txn(args->extra->conf, args->extra->txn,
+                                             C_DNSSEC_SIGNING, zone);
+       conf_val_t zf_load = conf_zone_get_txn(args->extra->conf, args->extra->txn,
+                                              C_ZONEFILE_LOAD, zone);
+       if (conf_bool(&dnssec) && conf_opt(&zf_load) == ZONEFILE_LOAD_WHOLE) {
+               conf_val_t acl = conf_zone_get_txn(args->extra->conf, args->extra->txn,
+                                                  C_ACL, zone);
+               bool stop = false;
+               while (acl.code == KNOT_EOK && !stop) {
+                       conf_val_t action = conf_id_get_txn(args->extra->conf,
+                                                           args->extra->txn,
+                                                           C_ACL, C_ACTION, &acl);
+                       while (action.code == KNOT_EOK) {
+                               if (conf_opt(&action) != ACL_ACTION_TRANSFER) {
+                                       conf_val_next(&action);
+                                       continue;
+                               }
+
+                               CONF_LOG_ZONE(LOG_NOTICE, zone,
+                                        "zone file change with DNSSEC signing can "
+                                        "result in malformed outgoing IXFR, consider "
+                                        "zone.zonefile-load setting");
+                               stop = true;
+                               break;
+                       }
+
+                       conf_val_next(&acl);
+               }
+       }
+
        return KNOT_EOK;
 }
 

diff --git a/tests/knot/test_confio.c b/tests/knot/test_confio.c
index 28b7ce7e846a924fda3970fe0dcf2dd4307b79b6..2f1ed065c6ef82c101d2a68e3fe6d6643eb1e856 100644 (file)
--- a/tests/knot/test_confio.c
+++ b/tests/knot/test_confio.c
@@ -938,10 +938,15 @@ static const yp_item_t desc_remote[] = {
        { NULL }
 };
 
+static const knot_lookup_t zonefile_load[] = {
+       { 0, NULL }
+};
+
 #define ZONE_ITEMS \
        { C_FILE,           YP_TSTR,  YP_VNONE }, \
        { C_MASTER,         YP_TREF,  YP_VREF = { C_RMT }, YP_FMULTI, { check_ref } }, \
        { C_DNSSEC_SIGNING, YP_TBOOL, YP_VNONE }, \
+       { C_ZONEFILE_LOAD,  YP_TOPT,  YP_VOPT = { zonefile_load, ZONEFILE_LOAD_WHOLE } }, \
        { C_COMMENT,        YP_TSTR,  YP_VNONE },
 
 static const yp_item_t desc_template[] = {