From: Mark Karpilovskij <mark.karpilovskij@nic.cz>
Date: Fri, 6 Apr 2018 14:57:09 +0000 (+0200)
Subject: conf: warn if whole zonefile-load + automatic DNSSEC signing + ACL transfer
X-Git-Tag: v2.7.0~100
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4fbcaf753558edc88eca4e511ff39d6a9802d7e4;p=thirdparty%2Fknot-dns.git

conf: warn if whole zonefile-load + automatic DNSSEC signing + ACL transfer

Relates to #572
---

diff --git a/src/knot/conf/tools.c b/src/knot/conf/tools.c
index d570ac7cfb..a0fa537a25 100644
--- a/src/knot/conf/tools.c
+++ b/src/knot/conf/tools.c
@@ -31,6 +31,7 @@
 #include "knot/conf/module.h"
 #include "knot/conf/schema.h"
 #include "knot/common/log.h"
+#include "knot/updates/acl.h"
 #include "libknot/errcode.h"
 #include "libknot/yparser/yptrafo.h"
 #include "contrib/string.h"
@@ -423,6 +424,39 @@ int check_template(
 int check_zone(
 	knotd_conf_check_args_t *args)
 {
+	const knot_dname_t *zone = args->id;
+
+	// Check for dnssec_signing + zonefile_load whole + acl transfer.
+	conf_val_t dnssec = conf_zone_get_txn(args->extra->conf, args->extra->txn,
+	                                      C_DNSSEC_SIGNING, zone);
+	conf_val_t zf_load = conf_zone_get_txn(args->extra->conf, args->extra->txn,
+		                               C_ZONEFILE_LOAD, zone);
+	if (conf_bool(&dnssec) && conf_opt(&zf_load) == ZONEFILE_LOAD_WHOLE) {
+		conf_val_t acl = conf_zone_get_txn(args->extra->conf, args->extra->txn,
+		                                   C_ACL, zone);
+		bool stop = false;
+		while (acl.code == KNOT_EOK && !stop) {
+			conf_val_t action = conf_id_get_txn(args->extra->conf,
+			                                    args->extra->txn,
+			                                    C_ACL, C_ACTION, &acl);
+			while (action.code == KNOT_EOK) {
+				if (conf_opt(&action) != ACL_ACTION_TRANSFER) {
+					conf_val_next(&action);
+					continue;
+				}
+
+				CONF_LOG_ZONE(LOG_NOTICE, zone,
+				         "zone file change with DNSSEC signing can "
+				         "result in malformed outgoing IXFR, consider "
+				         "zone.zonefile-load setting");
+				stop = true;
+				break;
+			}
+
+			conf_val_next(&acl);
+		}
+	}
+
 	return KNOT_EOK;
 }
 
diff --git a/tests/knot/test_confio.c b/tests/knot/test_confio.c
index 28b7ce7e84..2f1ed065c6 100644
--- a/tests/knot/test_confio.c
+++ b/tests/knot/test_confio.c
@@ -938,10 +938,15 @@ static const yp_item_t desc_remote[] = {
 	{ NULL }
 };
 
+static const knot_lookup_t zonefile_load[] = {
+	{ 0, NULL }
+};
+
 #define ZONE_ITEMS \
 	{ C_FILE,           YP_TSTR,  YP_VNONE }, \
 	{ C_MASTER,         YP_TREF,  YP_VREF = { C_RMT }, YP_FMULTI, { check_ref } }, \
 	{ C_DNSSEC_SIGNING, YP_TBOOL, YP_VNONE }, \
+	{ C_ZONEFILE_LOAD,  YP_TOPT,  YP_VOPT = { zonefile_load, ZONEFILE_LOAD_WHOLE } }, \
 	{ C_COMMENT,        YP_TSTR,  YP_VNONE },
 
 static const yp_item_t desc_template[] = {