Extend ACL syntax handling code with 'port' and 'transport' options

This commit extends ACL syntax handling code with 'port' and
'transport' options. Currently, the extended syntax is available only
for allow-transfer options.

diff --git a/bin/named/named.conf.rst b/bin/named/named.conf.rst
index 28a39c45e0178aa669da8c117a47de531f728308..644c70430aa98e30490a79ad70a373e00d77efdd 100644 (file)
--- a/bin/named/named.conf.rst
+++ b/bin/named/named.conf.rst
@@ -166,7 +166,8 @@ OPTIONS
        allow-query-on { address_match_element; ... };
        allow-recursion { address_match_element; ... };
        allow-recursion-on { address_match_element; ... };
-       allow-transfer { address_match_element; ... };
+       allow-transfer [ port integer ] [ transport string ] {
+           address_match_element; ... };
        allow-update { address_match_element; ... };
        allow-update-forwarding { address_match_element; ... };
        also-notify [ port integer ] [ dscp integer ] { (
@@ -605,7 +606,8 @@ VIEW
        allow-query-on { address_match_element; ... };
        allow-recursion { address_match_element; ... };
        allow-recursion-on { address_match_element; ... };
-       allow-transfer { address_match_element; ... };
+       allow-transfer [ port integer ] [ transport string ] {
+           address_match_element; ... };
        allow-update { address_match_element; ... };
        allow-update-forwarding { address_match_element; ... };
        also-notify [ port integer ] [ dscp integer ] { (
@@ -889,7 +891,8 @@ VIEW
                allow-notify { address_match_element; ... };
                allow-query { address_match_element; ... };
                allow-query-on { address_match_element; ... };
-               allow-transfer { address_match_element; ... };
+               allow-transfer [ port integer ] [ transport string ] {
+                   address_match_element; ... };
                allow-update { address_match_element; ... };
                allow-update-forwarding { address_match_element; ... };
                also-notify [ port integer ] [ dscp integer ] { (
@@ -1009,7 +1012,8 @@ ZONE
        allow-notify { address_match_element; ... };
        allow-query { address_match_element; ... };
        allow-query-on { address_match_element; ... };
-       allow-transfer { address_match_element; ... };
+       allow-transfer [ port integer ] [ transport string ] {
+           address_match_element; ... };
        allow-update { address_match_element; ... };
        allow-update-forwarding { address_match_element; ... };
        also-notify [ port integer ] [ dscp integer ] { (

diff --git a/doc/man/named.conf.5in b/doc/man/named.conf.5in
index de092a77df4f67aea2f8ee79983d4ed597351661..1e285a2d0e86c274e6c65ae4965d67acb465babd 100644 (file)
--- a/doc/man/named.conf.5in
+++ b/doc/man/named.conf.5in
@@ -233,7 +233,8 @@ options {
       allow\-query\-on { address_match_element; ... };
       allow\-recursion { address_match_element; ... };
       allow\-recursion\-on { address_match_element; ... };
-      allow\-transfer { address_match_element; ... };
+      allow\-transfer [ port integer ] [ transport string ] {
+          address_match_element; ... };
       allow\-update { address_match_element; ... };
       allow\-update\-forwarding { address_match_element; ... };
       also\-notify [ port integer ] [ dscp integer ] { (
@@ -708,7 +709,8 @@ view string [ class ] {
       allow\-query\-on { address_match_element; ... };
       allow\-recursion { address_match_element; ... };
       allow\-recursion\-on { address_match_element; ... };
-      allow\-transfer { address_match_element; ... };
+      allow\-transfer [ port integer ] [ transport string ] {
+          address_match_element; ... };
       allow\-update { address_match_element; ... };
       allow\-update\-forwarding { address_match_element; ... };
       also\-notify [ port integer ] [ dscp integer ] { (
@@ -992,7 +994,8 @@ view string [ class ] {
               allow\-notify { address_match_element; ... };
               allow\-query { address_match_element; ... };
               allow\-query\-on { address_match_element; ... };
-              allow\-transfer { address_match_element; ... };
+              allow\-transfer [ port integer ] [ transport string ] {
+                  address_match_element; ... };
               allow\-update { address_match_element; ... };
               allow\-update\-forwarding { address_match_element; ... };
               also\-notify [ port integer ] [ dscp integer ] { (
@@ -1116,7 +1119,8 @@ zone string [ class ] {
       allow\-notify { address_match_element; ... };
       allow\-query { address_match_element; ... };
       allow\-query\-on { address_match_element; ... };
-      allow\-transfer { address_match_element; ... };
+      allow\-transfer [ port integer ] [ transport string ] {
+          address_match_element; ... };
       allow\-update { address_match_element; ... };
       allow\-update\-forwarding { address_match_element; ... };
       also\-notify [ port integer ] [ dscp integer ] { (

diff --git a/doc/misc/master.zoneopt b/doc/misc/master.zoneopt
index e51eee9bcc9bce256e075c960574ffcee15657ef..69134fd1f4ddfcf21162db6f4bdfe099b33e2362 100644 (file)
--- a/doc/misc/master.zoneopt
+++ b/doc/misc/master.zoneopt
@@ -2,7 +2,7 @@ zone <string> [ <class> ] {
        type ( master | primary );
        allow-query { <address_match_element>; ... };
        allow-query-on { <address_match_element>; ... };
-       allow-transfer { <address_match_element>; ... };
+       allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
        allow-update { <address_match_element>; ... };
        also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];

diff --git a/doc/misc/master.zoneopt.rst b/doc/misc/master.zoneopt.rst
index 985e2b404ffeca1ead9b13b96d94692f5bfc873d..597a8dbdd9091e80b229b3c2c9bdbac9fa2f9f0a 100644 (file)
--- a/doc/misc/master.zoneopt.rst
+++ b/doc/misc/master.zoneopt.rst
@@ -4,7 +4,7 @@
        type ( master | primary );
        allow-query { <address_match_element>; ... };
        allow-query-on { <address_match_element>; ... };
-       allow-transfer { <address_match_element>; ... };
+       allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
        allow-update { <address_match_element>; ... };
        also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];

diff --git a/doc/misc/mirror.zoneopt b/doc/misc/mirror.zoneopt
index 50556fc9ec086a5417d06834ec29dba73c3a0cc2..a21182789d7427655f466d4685a1fdc9321ca4b9 100644 (file)
--- a/doc/misc/mirror.zoneopt
+++ b/doc/misc/mirror.zoneopt
@@ -3,7 +3,7 @@ zone <string> [ <class> ] {
        allow-notify { <address_match_element>; ... };
        allow-query { <address_match_element>; ... };
        allow-query-on { <address_match_element>; ... };
-       allow-transfer { <address_match_element>; ... };
+       allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
        allow-update-forwarding { <address_match_element>; ... };
        also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];

diff --git a/doc/misc/mirror.zoneopt.rst b/doc/misc/mirror.zoneopt.rst
index d481248fb094f5f1e898af48be5b2be01abe9e0a..668207601c440da0f80b69679b87d9c7e7e2d211 100644 (file)
--- a/doc/misc/mirror.zoneopt.rst
+++ b/doc/misc/mirror.zoneopt.rst
@@ -5,7 +5,7 @@
        allow-notify { <address_match_element>; ... };
        allow-query { <address_match_element>; ... };
        allow-query-on { <address_match_element>; ... };
-       allow-transfer { <address_match_element>; ... };
+       allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
        allow-update-forwarding { <address_match_element>; ... };
        also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];

diff --git a/doc/misc/options b/doc/misc/options
index 86967657ae468889021d2fa61d13fdaa02fed1e0..b62967ef0c60f5f72a55aadb9ce4ad691373997e 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -90,7 +90,8 @@ options {
         allow-query-on { <address_match_element>; ... };
         allow-recursion { <address_match_element>; ... };
         allow-recursion-on { <address_match_element>; ... };
-        allow-transfer { <address_match_element>; ... };
+        allow-transfer [ port <integer> ] [ transport <string> ] {
+            <address_match_element>; ... };
         allow-update { <address_match_element>; ... };
         allow-update-forwarding { <address_match_element>; ... };
         also-notify [ port <integer> ] [ dscp <integer> ] { (
@@ -484,7 +485,8 @@ view <string> [ <class> ] {
         allow-query-on { <address_match_element>; ... };
         allow-recursion { <address_match_element>; ... };
         allow-recursion-on { <address_match_element>; ... };
-        allow-transfer { <address_match_element>; ... };
+        allow-transfer [ port <integer> ] [ transport <string> ] {
+            <address_match_element>; ... };
         allow-update { <address_match_element>; ... };
         allow-update-forwarding { <address_match_element>; ... };
         also-notify [ port <integer> ] [ dscp <integer> ] { (
@@ -770,7 +772,8 @@ view <string> [ <class> ] {
                 allow-notify { <address_match_element>; ... };
                 allow-query { <address_match_element>; ... };
                 allow-query-on { <address_match_element>; ... };
-                allow-transfer { <address_match_element>; ... };
+                allow-transfer [ port <integer> ] [ transport <string> ] {
+                    <address_match_element>; ... };
                 allow-update { <address_match_element>; ... };
                 allow-update-forwarding { <address_match_element>; ... };
                 also-notify [ port <integer> ] [ dscp <integer> ] { (
@@ -886,7 +889,8 @@ zone <string> [ <class> ] {
         allow-notify { <address_match_element>; ... };
         allow-query { <address_match_element>; ... };
         allow-query-on { <address_match_element>; ... };
-        allow-transfer { <address_match_element>; ... };
+        allow-transfer [ port <integer> ] [ transport <string> ] {
+            <address_match_element>; ... };
         allow-update { <address_match_element>; ... };
         allow-update-forwarding { <address_match_element>; ... };
         also-notify [ port <integer> ] [ dscp <integer> ] { (

diff --git a/doc/misc/options.active b/doc/misc/options.active
index bd4ceb26ae87678182f276ca33e23e2ea1c3446d..a3e2fbe3f0e7232e7b56a88bd3cbb880425d4335 100644 (file)
--- a/doc/misc/options.active
+++ b/doc/misc/options.active
@@ -89,7 +89,8 @@ options {
         allow-query-on { <address_match_element>; ... };
         allow-recursion { <address_match_element>; ... };
         allow-recursion-on { <address_match_element>; ... };
-        allow-transfer { <address_match_element>; ... };
+        allow-transfer [ port <integer> ] [ transport <string> ] {
+            <address_match_element>; ... };
         allow-update { <address_match_element>; ... };
         allow-update-forwarding { <address_match_element>; ... };
         also-notify [ port <integer> ] [ dscp <integer> ] { (
@@ -481,7 +482,8 @@ view <string> [ <class> ] {
         allow-query-on { <address_match_element>; ... };
         allow-recursion { <address_match_element>; ... };
         allow-recursion-on { <address_match_element>; ... };
-        allow-transfer { <address_match_element>; ... };
+        allow-transfer [ port <integer> ] [ transport <string> ] {
+            <address_match_element>; ... };
         allow-update { <address_match_element>; ... };
         allow-update-forwarding { <address_match_element>; ... };
         also-notify [ port <integer> ] [ dscp <integer> ] { (
@@ -765,7 +767,8 @@ view <string> [ <class> ] {
                 allow-notify { <address_match_element>; ... };
                 allow-query { <address_match_element>; ... };
                 allow-query-on { <address_match_element>; ... };
-                allow-transfer { <address_match_element>; ... };
+                allow-transfer [ port <integer> ] [ transport <string> ] {
+                    <address_match_element>; ... };
                 allow-update { <address_match_element>; ... };
                 allow-update-forwarding { <address_match_element>; ... };
                 also-notify [ port <integer> ] [ dscp <integer> ] { (
@@ -880,7 +883,8 @@ zone <string> [ <class> ] {
         allow-notify { <address_match_element>; ... };
         allow-query { <address_match_element>; ... };
         allow-query-on { <address_match_element>; ... };
-        allow-transfer { <address_match_element>; ... };
+        allow-transfer [ port <integer> ] [ transport <string> ] {
+            <address_match_element>; ... };
         allow-update { <address_match_element>; ... };
         allow-update-forwarding { <address_match_element>; ... };
         also-notify [ port <integer> ] [ dscp <integer> ] { (

diff --git a/doc/misc/options.grammar.rst b/doc/misc/options.grammar.rst
index 2c440420f1ba247684a3bff57918dbdd23670553..8e69a096864aa0eeb792ecdd8be77bf4fe74db10 100644 (file)
--- a/doc/misc/options.grammar.rst
+++ b/doc/misc/options.grammar.rst
@@ -9,7 +9,8 @@
        allow-query-on { <address_match_element>; ... };
        allow-recursion { <address_match_element>; ... };
        allow-recursion-on { <address_match_element>; ... };
-       allow-transfer { <address_match_element>; ... };
+       allow-transfer [ port <integer> ] [ transport <string> ] {
+           <address_match_element>; ... };
        allow-update { <address_match_element>; ... };
        allow-update-forwarding { <address_match_element>; ... };
        also-notify [ port <integer> ] [ dscp <integer> ] { (

diff --git a/doc/misc/slave.zoneopt b/doc/misc/slave.zoneopt
index be63c04e10373b3362e0ab3cf69bd62c92db0117..5fbbc065bce4998ea0602eb9e501b11d8f545485 100644 (file)
--- a/doc/misc/slave.zoneopt
+++ b/doc/misc/slave.zoneopt
@@ -3,7 +3,7 @@ zone <string> [ <class> ] {
        allow-notify { <address_match_element>; ... };
        allow-query { <address_match_element>; ... };
        allow-query-on { <address_match_element>; ... };
-       allow-transfer { <address_match_element>; ... };
+       allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
        allow-update-forwarding { <address_match_element>; ... };
        also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];

diff --git a/doc/misc/slave.zoneopt.rst b/doc/misc/slave.zoneopt.rst
index 93996f47d87b6039e260b51e505503d1ef8b57a6..3a603a044ca0cf17805529d2eaece37b69a5b721 100644 (file)
--- a/doc/misc/slave.zoneopt.rst
+++ b/doc/misc/slave.zoneopt.rst
@@ -5,7 +5,7 @@
        allow-notify { <address_match_element>; ... };
        allow-query { <address_match_element>; ... };
        allow-query-on { <address_match_element>; ... };
-       allow-transfer { <address_match_element>; ... };
+       allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
        allow-update-forwarding { <address_match_element>; ... };
        also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];

diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index d127b6efa594d142a0a7e93f7877d0234ee0b495..1130983732ca4710ab447906b8c29a8c80662369 100644 (file)
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -475,6 +475,47 @@ checkacl(const char *aclname, cfg_aclconfctx_t *actx, const cfg_obj_t *zconfig,
        if (acl != NULL) {
                dns_acl_detach(&acl);
        }
+
+       if (strcasecmp(aclname, "allow-transfer") == 0 &&
+           cfg_obj_istuple(aclobj)) {
+               const cfg_obj_t *obj_port = cfg_tuple_get(
+                       cfg_tuple_get(aclobj, "port-transport"), "port");
+               const cfg_obj_t *obj_proto = cfg_tuple_get(
+                       cfg_tuple_get(aclobj, "port-transport"), "transport");
+
+               if (cfg_obj_isuint32(obj_port) &&
+                   cfg_obj_asuint32(obj_port) >= UINT16_MAX) {
+                       cfg_obj_log(obj_port, logctx, ISC_LOG_ERROR,
+                                   "port value '%u' is out of range",
+
+                                   cfg_obj_asuint32(obj_port));
+                       if (result == ISC_R_SUCCESS) {
+                               result = ISC_R_RANGE;
+                       }
+               }
+
+               if (cfg_obj_isstring(obj_proto)) {
+                       const char *allowed[] = { "tcp", "tls" };
+                       const char *transport = cfg_obj_asstring(obj_proto);
+                       bool found = false;
+                       for (size_t i = 0; i < ARRAY_SIZE(allowed); i++) {
+                               if (strcasecmp(transport, allowed[i]) == 0) {
+                                       found = true;
+                               }
+                       }
+
+                       if (!found) {
+                               cfg_obj_log(obj_proto, logctx, ISC_LOG_ERROR,
+                                           "'%s' is not a valid transport "
+                                           "protocol for "
+                                           "zone "
+                                           "transfers. Please specify either "
+                                           "'tcp' or 'tls'",
+                                           transport);
+                               result = ISC_R_FAILURE;
+                       }
+               }
+       }
        return (result);
 }
 

diff --git a/lib/isccfg/aclconf.c b/lib/isccfg/aclconf.c
index f748199b7444ff6c92427ad217ee184fa9fcde04..9f2fea573bab23c727fbcb4db4bbae8799f713fe 100644 (file)
--- a/lib/isccfg/aclconf.c
+++ b/lib/isccfg/aclconf.c
@@ -627,7 +627,7 @@ cfg_acl_fromconfig(const cfg_obj_t *caml, const cfg_obj_t *cctx,
 }
 
 isc_result_t
-cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
+cfg_acl_fromconfig2(const cfg_obj_t *acl_data, const cfg_obj_t *cctx,
                    isc_log_t *lctx, cfg_aclconfctx_t *ctx, isc_mem_t *mctx,
                    unsigned int nest_level, uint16_t family,
                    dns_acl_t **target) {
@@ -638,6 +638,9 @@ cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
        dns_iptable_t *iptab;
        int new_nest_level = 0;
        bool setpos;
+       const cfg_obj_t *caml = NULL;
+       const cfg_obj_t *obj_acl_tuple = NULL;
+       const cfg_obj_t *obj_port = NULL, *obj_proto = NULL;
 
        if (nest_level != 0) {
                new_nest_level = nest_level - 1;
@@ -647,6 +650,19 @@ cfg_acl_fromconfig2(const cfg_obj_t *caml, const cfg_obj_t *cctx,
        REQUIRE(target != NULL);
        REQUIRE(*target == NULL || DNS_ACL_VALID(*target));
 
+       REQUIRE(acl_data != NULL);
+       if (cfg_obj_islist(acl_data)) {
+               caml = acl_data;
+       } else {
+               INSIST(cfg_obj_istuple(acl_data));
+               caml = cfg_tuple_get(acl_data, "acl");
+               INSIST(caml != NULL);
+               obj_acl_tuple = cfg_tuple_get(acl_data, "port-transport");
+               INSIST(obj_acl_tuple != NULL);
+               obj_port = cfg_tuple_get(obj_acl_tuple, "port");
+               obj_proto = cfg_tuple_get(obj_acl_tuple, "protocol");
+       }
+
        if (*target != NULL) {
                /*
                 * If target already points to an ACL, then we're being

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 4ba4b0a17ce9c8df9706349b93d6eb8f53329c13..86d1bf16d935e78924c385c9a98836f622def3f6 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -185,6 +185,39 @@ static cfg_type_t cfg_type_listenon = { "listenon",         cfg_parse_tuple,
 
 /*% acl */
 
+/*
+ * Encrypted transfer related definitions
+ */
+
+static cfg_tuplefielddef_t cfg_transport_acl_tuple_fields[] = {
+       { "port", &cfg_type_optional_port, 0 },
+       { "transport", &cfg_type_astring, 0 },
+       { NULL, NULL, 0 }
+};
+static cfg_type_t cfg_transport_acl_tuple = {
+       "transport-acl tuple", cfg_parse_kv_tuple,
+       cfg_print_kv_tuple,    cfg_doc_kv_tuple,
+       &cfg_rep_tuple,        cfg_transport_acl_tuple_fields
+};
+
+static cfg_tuplefielddef_t cfg_transport_acl_fields[] = {
+       { "port-transport", &cfg_transport_acl_tuple, 0 },
+       { "aml", &cfg_type_bracketed_aml, 0 },
+       { NULL, NULL, 0 }
+};
+
+static cfg_type_t cfg_type_transport_acl = {
+       "transport-acl", cfg_parse_tuple, cfg_print_tuple,
+       cfg_doc_tuple,   &cfg_rep_tuple,  cfg_transport_acl_fields
+};
+
+/*
+ * NOTE: To enable syntax which allows specifying port and protocol,
+ * replace 'cfg_type_bracketed_aml' with
+ * 'cfg_type_transport_acl'.
+ *
+ * Example: acl port 853 protocol tls { ... };
+ */
 static cfg_tuplefielddef_t acl_fields[] = { { "name", &cfg_type_astring, 0 },
                                            { "value", &cfg_type_bracketed_aml,
                                              0 },
@@ -2174,6 +2207,13 @@ static cfg_clausedef_t dnssecpolicy_clauses[] = {
  * Note: CFG_ZONE_* options indicate in which zone types this clause is
  * legal.
  */
+/*
+ * NOTE: To enable syntax which allows specifying port and protocol
+ * within 'allow-*' clauses, replace 'cfg_type_bracketed_aml' with
+ * 'cfg_type_transport_acl'.
+ *
+ * Example: allow-transfer port 853 protocol tls { ... };
+ */
 static cfg_clausedef_t zone_clauses[] = {
        { "allow-notify", &cfg_type_bracketed_aml,
          CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
@@ -2183,7 +2223,7 @@ static cfg_clausedef_t zone_clauses[] = {
        { "allow-query-on", &cfg_type_bracketed_aml,
          CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
                  CFG_ZONE_STUB | CFG_ZONE_REDIRECT | CFG_ZONE_STATICSTUB },
-       { "allow-transfer", &cfg_type_bracketed_aml,
+       { "allow-transfer", &cfg_type_transport_acl,
          CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
        { "allow-update", &cfg_type_bracketed_aml, CFG_ZONE_PRIMARY },
        { "allow-update-forwarding", &cfg_type_bracketed_aml,