From: Kees Monshouwer <mind04@monshouwer.org>
Date: Sun, 15 Jun 2014 22:23:00 +0000 (+0200)
Subject: reinstate, optional, bindbackend hybrid mode operation
X-Git-Tag: auth-3.4.0-rc1~113^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=aebddbd23ba64803b3f664ea25e06b481762eb87;p=thirdparty%2Fpdns.git

reinstate, optional, bindbackend hybrid mode operation
---

diff --git a/modules/bindbackend/bindbackend2.cc b/modules/bindbackend/bindbackend2.cc
index f174d7ed96..20556208f5 100644
--- a/modules/bindbackend/bindbackend2.cc
+++ b/modules/bindbackend/bindbackend2.cc
@@ -421,7 +421,12 @@ void Bind2Backend::alsoNotifies(const string &domain, set<string> *ips)
 void Bind2Backend::parseZoneFile(BB2DomainInfo *bbd) 
 {
   NSEC3PARAMRecordContent ns3pr;
-  bool nsec3zone=getNSEC3PARAM(bbd->d_name, &ns3pr);
+  bool nsec3zone;
+  if (d_hybrid) {
+    DNSSECKeeper dk;
+    nsec3zone=dk.getNSEC3PARAM(bbd->d_name, &ns3pr);
+  } else
+    nsec3zone=getNSEC3PARAM(bbd->d_name, &ns3pr);
 
   bbd->d_records = shared_ptr<recordstorage_t>(new recordstorage_t());
         
@@ -588,8 +593,12 @@ Bind2Backend::Bind2Backend(const string &suffix, bool loadZones)
 {
   setArgPrefix("bind"+suffix);
   d_logprefix="[bind"+suffix+"backend]";
+  d_hybrid=mustDo("hybrid");
   s_ignore_broken_records=mustDo("ignore-broken-records");
 
+  if (!loadZones && d_hybrid)
+    return;
+
   Lock l(&s_startup_lock);
   
   d_transaction_id=0;
@@ -914,7 +923,14 @@ bool Bind2Backend::getBeforeAndAfterNamesAbsolute(uint32_t id, const std::string
   NSEC3PARAMRecordContent ns3pr;
   string auth=bbd.d_name;
     
-  if(!getNSEC3PARAM(auth, &ns3pr)) {
+  bool nsec3zone;
+  if (d_hybrid) {
+    DNSSECKeeper dk;
+    nsec3zone=dk.getNSEC3PARAM(auth, &ns3pr);
+  } else
+    nsec3zone=getNSEC3PARAM(auth, &ns3pr);
+
+  if(!nsec3zone) {
     //cerr<<"in bind2backend::getBeforeAndAfterAbsolute: no nsec3 for "<<auth<<endl;
     return findBeforeAndAfterUnhashed(bbd, qname, unhashed, before, after);
   
@@ -1304,6 +1320,7 @@ class Bind2Factory : public BackendFactory
          declare(suffix,"supermasters","List of IP-addresses of supermasters","");
          declare(suffix,"supermaster-destdir","Destination directory for newly added slave zones",::arg()["config-dir"]);
          declare(suffix,"dnssec-db","Filename to store & access our DNSSEC metadatabase, empty for none", "");         
+         declare(suffix,"hybrid","Store DNSSEC metadata in other backend","no");
       }
 
       DNSBackend *make(const string &suffix="")
diff --git a/modules/bindbackend/bindbackend2.hh b/modules/bindbackend/bindbackend2.hh
index aa6511e97f..8666a702a4 100644
--- a/modules/bindbackend/bindbackend2.hh
+++ b/modules/bindbackend/bindbackend2.hh
@@ -244,6 +244,7 @@ private:
   static bool safeRemoveBBDomainInfo(const std::string& name);
   bool GetBBDomainInfo(int id, BB2DomainInfo** bbd);
   shared_ptr<SSQLite3> d_dnssecdb;
+  bool d_hybrid;
   bool getNSEC3PARAM(const std::string& zname, NSEC3PARAMRecordContent* ns3p);
   class handle
   {
diff --git a/modules/bindbackend/binddnssec.cc b/modules/bindbackend/binddnssec.cc
index bc50a3283f..ecbd59d32d 100644
--- a/modules/bindbackend/binddnssec.cc
+++ b/modules/bindbackend/binddnssec.cc
@@ -34,7 +34,7 @@ void Bind2Backend::setupDNSSEC()
 }
 
 bool Bind2Backend::doesDNSSEC()
-{ return false; }
+{ return d_hybrid; }
 
 bool Bind2Backend::getNSEC3PARAM(const std::string& zname, NSEC3PARAMRecordContent* ns3p)
 { return false; }
@@ -55,7 +55,7 @@ bool Bind2Backend::removeDomainKey(const string& name, unsigned int id)
 { return false; }
 
 int Bind2Backend::addDomainKey(const string& name, const KeyData& key)
-{ return false; }
+{ return -1; }
 
 bool Bind2Backend::activateDomainKey(const string& name, unsigned int id)
 { return false; }
@@ -80,7 +80,7 @@ bool Bind2Backend::getTSIGKeys(std::vector< struct TSIGKey > &keys)
 void Bind2Backend::setupDNSSEC()
 {
   // cerr<<"Settting up dnssec db.. "<<getArg("dnssec-db") <<endl;
-  if(getArg("dnssec-db").empty())
+  if(getArg("dnssec-db").empty() || d_hybrid)
     return;
   try {
     d_dnssecdb = shared_ptr<SSQLite3>(new SSQLite3(getArg("dnssec-db")));
@@ -95,11 +95,14 @@ void Bind2Backend::setupDNSSEC()
 
 bool Bind2Backend::doesDNSSEC()
 {
-  return true;
+  return d_dnssecdb || d_hybrid;
 }
 
 bool Bind2Backend::getNSEC3PARAM(const std::string& zname, NSEC3PARAMRecordContent* ns3p)
 {
+  if(!d_dnssecdb || d_hybrid)
+    return false;
+
   string value;
   vector<string> meta;
   getDomainMetadata(zname, "NSEC3PARAM", meta);
@@ -120,7 +123,7 @@ bool Bind2Backend::getNSEC3PARAM(const std::string& zname, NSEC3PARAMRecordConte
 
 bool Bind2Backend::getAllDomainMetadata(const string& name, std::map<std::string, std::vector<std::string> >& meta)
 {
-  if(!d_dnssecdb)
+  if(!d_dnssecdb || d_hybrid)
     return false;
 
   // cerr<<"Asked to get metadata for zone '"<<name<<"'|"<<kind<<"\n";
@@ -142,7 +145,7 @@ bool Bind2Backend::getAllDomainMetadata(const string& name, std::map<std::string
 
 bool Bind2Backend::getDomainMetadata(const string& name, const std::string& kind, std::vector<std::string>& meta)
 {
-  if(!d_dnssecdb)
+  if(!d_dnssecdb || d_hybrid)
     return false;
     
   // cerr<<"Asked to get metadata for zone '"<<name<<"'|"<<kind<<"\n";
@@ -164,7 +167,7 @@ bool Bind2Backend::getDomainMetadata(const string& name, const std::string& kind
 
 bool Bind2Backend::setDomainMetadata(const string& name, const std::string& kind, const std::vector<std::string>& meta)
 {
-  if(!d_dnssecdb)
+  if(!d_dnssecdb || d_hybrid)
     return false;
   
   boost::format fmt("delete from domainmetadata where domain='%s' and kind='%s'");
@@ -184,7 +187,7 @@ bool Bind2Backend::setDomainMetadata(const string& name, const std::string& kind
 bool Bind2Backend::getDomainKeys(const string& name, unsigned int kind, std::vector<KeyData>& keys)
 {
   // cerr<<"Asked to get keys for zone '"<<name<<"'\n";
-  if(!d_dnssecdb)
+  if(!d_dnssecdb || d_hybrid)
     return false;
   boost::format fmt("select id,flags, active, content from cryptokeys where domain='%s'");
   try {
@@ -208,7 +211,7 @@ bool Bind2Backend::getDomainKeys(const string& name, unsigned int kind, std::vec
 
 bool Bind2Backend::removeDomainKey(const string& name, unsigned int id)
 {
-  if(!d_dnssecdb)
+  if(!d_dnssecdb || d_hybrid)
     return false;
 
   // cerr<<"Asked to remove key "<<id<<" in zone '"<<name<<"'\n";
@@ -226,8 +229,8 @@ bool Bind2Backend::removeDomainKey(const string& name, unsigned int id)
 
 int Bind2Backend::addDomainKey(const string& name, const KeyData& key)
 {
-  if(!d_dnssecdb)
-    return false;
+  if(!d_dnssecdb || d_hybrid)
+    return -1;
   
   //cerr<<"Asked to add a key to zone '"<<name<<"'\n";
   
@@ -245,7 +248,7 @@ int Bind2Backend::addDomainKey(const string& name, const KeyData& key)
 bool Bind2Backend::activateDomainKey(const string& name, unsigned int id)
 {
   // cerr<<"Asked to activate key "<<id<<" inzone '"<<name<<"'\n";
-  if(!d_dnssecdb)
+  if(!d_dnssecdb || d_hybrid)
     return false;
   
   boost::format fmt("update cryptokeys set active=1 where domain='%s' and id=%d");
@@ -262,7 +265,7 @@ bool Bind2Backend::activateDomainKey(const string& name, unsigned int id)
 bool Bind2Backend::deactivateDomainKey(const string& name, unsigned int id)
 {
   // cerr<<"Asked to deactivate key "<<id<<" inzone '"<<name<<"'\n";
-  if(!d_dnssecdb)
+  if(!d_dnssecdb || d_hybrid)
     return false;
     
   boost::format fmt("update cryptokeys set active=0 where domain='%s' and id=%d");
@@ -278,7 +281,7 @@ bool Bind2Backend::deactivateDomainKey(const string& name, unsigned int id)
 
 bool Bind2Backend::getTSIGKey(const string& name, string* algorithm, string* content)
 {
-  if(!d_dnssecdb)
+  if(!d_dnssecdb || d_hybrid)
     return false;
   boost::format fmt("select algorithm, secret from tsigkeys where name='%s'");
   
@@ -303,7 +306,7 @@ bool Bind2Backend::getTSIGKey(const string& name, string* algorithm, string* con
 
 bool Bind2Backend::setTSIGKey(const string& name, const string& algorithm, const string& content)
 {
-  if(!d_dnssecdb)
+  if(!d_dnssecdb || d_hybrid)
     return false;
   boost::format fmt("replace into tsigkeys (name,algorithm,secret) values('%s', '%s', '%s')");
   try {
@@ -318,7 +321,7 @@ bool Bind2Backend::setTSIGKey(const string& name, const string& algorithm, const
 
 bool Bind2Backend::deleteTSIGKey(const string& name) 
 {
-  if(!d_dnssecdb)
+  if(!d_dnssecdb || d_hybrid)
     return false;
   boost::format fmt("delete from tsigkeys where name='%s'");
 
@@ -334,7 +337,7 @@ bool Bind2Backend::deleteTSIGKey(const string& name)
 
 bool Bind2Backend::getTSIGKeys(std::vector< struct TSIGKey > &keys)
 {
-  if(!d_dnssecdb)
+  if(!d_dnssecdb || d_hybrid)
     return false;
 
   try {
diff --git a/pdns/docs/pdns.xml b/pdns/docs/pdns.xml
index 53d1ba6f49..e9b65f1bb8 100644
--- a/pdns/docs/pdns.xml
+++ b/pdns/docs/pdns.xml
@@ -13464,8 +13464,9 @@ $ pdnssec rectify-zone powerdnssec.org
   	<section id="dnssec-bind-hybrid"><title>PowerDNSSEC hybrid BIND-mode operation</title>
     <warning>
     <para>
-      This mode is only supported in 3.0 and 3.0.1! In 3.1 and up, the bindbackend
-      always does its own key storage.
+      This mode is only supported in 3.0, 3.0.1 and 3.4 and up! In 3.1 to 3.3.1, the bindbackend
+      always did its own key storage.
+      In 3.4 and up hybrid bind mode operation is optional and enabled with the bindbackend <command>hybrid</command> config option.
     </para>
     </warning>
     <para>
@@ -19898,10 +19899,10 @@ VALUES (:zoneid, :ip)
 	      <row><entry>Slave</entry><entry>Yes</entry></row>
 	      <row><entry>Superslave</entry><entry>Experimental</entry></row>
 	      <row><entry>Autoserial</entry><entry>No</entry></row>
-	      <row><entry>DNSSEC</entry><entry>Yes, but no key storage</entry></row>
+	      <row><entry>DNSSEC</entry><entry>Yes</entry></row>
 	      <row><entry>Disabled data</entry><entry>No</entry></row>
 	      <row><entry>Comments</entry><entry>No</entry></row>
-	      <row><entry>Module name</entry><entry>none (built in)</entry></row>
+	      <row><entry>Module name</entry><entry>bind</entry></row>
 	      <row><entry>Launch</entry><entry>bind</entry></row>
 	    </tbody>
 	  </tgroup>
@@ -19950,6 +19951,22 @@ VALUES (:zoneid, :ip)
 	      </para>
 	    </listitem>
 	  </varlistentry>
+	  <varlistentry>
+	    <term>bind-dnssec-db=</term>
+	    <listitem>
+	      <para>
+		Filename to store and access our DNSSEC metadatabase, empty for none.
+	      </para>
+	    </listitem>
+	  </varlistentry>
+	  <varlistentry>
+	    <term>bind-hybrid=</term>
+	    <listitem>
+	      <para>
+		Store DNSSEC keys and metadata storage in an other backend.
+	      </para>
+	    </listitem>
+	  </varlistentry>
 	</variablelist>
       </para>
       <sect2>