Add parental-agents configuration

Introduce a way to configure parental agents that can be used to
query DS records to be used in automatic key rollovers.

diff --git a/bin/named/named.conf.rst b/bin/named/named.conf.rst
index cc3aad616c3f2a3fb5d0d08a8ce5b2000f8cf956..b4a91cd4c908a2cf9c535fa5c883850fd0af3c75 100644 (file)
--- a/bin/named/named.conf.rst
+++ b/bin/named/named.conf.rst
@@ -465,6 +465,17 @@ OPTIONS
        zone-statistics ( full | terse | none | boolean );
   };
 
+PARENTAL-AGENTS
+^^^^^^^^^^^^^^^
+
+::
+
+  parental-agents string [ port integer ] [
+      dscp integer ] { ( remote-servers |
+      ipv4_address [ port integer ] |
+      ipv6_address [ port integer ] ) [ key
+      string ] [ tls string ]; ... };
+
 PLUGIN
 ^^^^^^
 
@@ -930,6 +941,10 @@ VIEW
                notify-source-v6 ( ipv6_address | * ) [ port ( integer
                    | * ) ] [ dscp integer ];
                notify-to-soa boolean;
+               parental-agents [ port integer ] [ dscp integer ] { (
+                   remote-servers | ipv4_address [ port integer ] |
+                   ipv6_address [ port integer ] ) [ key string ] [
+                   tls string ]; ... };
                primaries [ port integer ] [ dscp integer ] { (
                    remote-servers | ipv4_address [ port integer ] |
                    ipv6_address [ port integer ] ) [ key string ] [
@@ -1038,6 +1053,10 @@ ZONE
        notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
            [ dscp integer ];
        notify-to-soa boolean;
+       parental-agents [ port integer ] [ dscp integer ] { (
+           remote-servers | ipv4_address [ port integer ] |
+           ipv6_address [ port integer ] ) [ key string ] [ tls
+           string ]; ... };
        primaries [ port integer ] [ dscp integer ] { (
            remote-servers | ipv4_address [ port integer ] |
            ipv6_address [ port integer ] ) [ key string ] [ tls

diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
index d3f00397669ad084105d3d4a1c508ec4a1572a87..bd6a9b083d724e839b885e865ac16dbadd78bd67 100644 (file)
--- a/bin/tests/system/checkconf/good.conf
+++ b/bin/tests/system/checkconf/good.conf
@@ -86,6 +86,10 @@ options {
        transfer-source 0.0.0.0 dscp 63;
        zone-statistics none;
 };
+parental-agents "parents" {
+       10.10.10.11;
+       10.10.10.12;
+};
 view "first" {
        match-clients {
                "none";
@@ -176,11 +180,18 @@ view "fourth" {
        zone "dnssec-test" {
                type master;
                file "dnssec-test.db";
+               parental-agents {
+                       1.2.3.4;
+                       1.2.3.5;
+               };
                dnssec-policy "test";
        };
        zone "dnssec-default" {
                type master;
                file "dnssec-default.db";
+               parental-agents {
+                       "parents";
+               };
                dnssec-policy "default";
        };
        zone "dnssec-inherit" {

diff --git a/doc/arm/Makefile.am b/doc/arm/Makefile.am
index 31a06ebd297e147c15e69b7c67c4ad13b270bfa0..5a1311095647c096f5d6e472c30a5e3f152bf9d8 100644 (file)
--- a/doc/arm/Makefile.am
+++ b/doc/arm/Makefile.am
@@ -37,6 +37,7 @@ EXTRA_DIST =                                  \
        ../misc/master.zoneopt.rst              \
        ../misc/mirror.zoneopt.rst              \
        ../misc/options.grammar.rst             \
+       ../misc/parentals.grammar.rst           \
        ../misc/primaries.grammar.rst           \
        ../misc/redirect.zoneopt.rst            \
        ../misc/server.grammar.rst              \

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 4f563d4ed28a1cdf8c39d2f6bee0c6f286413246..d6a45551ebea7bac0d408fab95f8f5916ff9c946 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -280,6 +280,9 @@ The following statements are supported:
     ``options``
         Controls global server configuration options and sets defaults for other statements.
 
+    ``parental-agents``
+        Defines a named list of servers for inclusion in primary and secondary zones' ``parental-agents`` lists.
+
     ``primaries``
         Defines a named list of servers for inclusion in stub and secondary zones' ``primaries`` or ``also-notify`` lists. (Note: this is a synonym for the original keyword ``masters``, which can still be used, but is no longer the preferred terminology.)
 
@@ -844,6 +847,21 @@ At ``debug`` level 4 or higher, the detailed context information logged at
 ``debug`` level 2 is logged for errors other than SERVFAIL and for negative
 responses such as NXDOMAIN.
 
+.. _parentals_grammar:
+
+``parental-agents`` Statement Grammar
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+.. include:: ../misc/parentals.grammar.rst
+
+.. _parentals_statement:
+
+``parental-agents`` Statement Definition and Usage
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+``parental-agents`` lists allow for a common set of parental agents to be easily
+used by multiple primary and secondary zones in their ``parental-agents`` lists.
+
 .. _primaries_grammar:
 
 ``primaries`` Statement Grammar

diff --git a/doc/man/named.conf.5in b/doc/man/named.conf.5in
index ac1a1555f907838050657315fc5a4722563ad6d7..4beb6c4604480ef242247316124b146fc482acac 100644 (file)
--- a/doc/man/named.conf.5in
+++ b/doc/man/named.conf.5in
@@ -535,6 +535,21 @@ options {
 .fi
 .UNINDENT
 .UNINDENT
+.SS PARENTAL\-AGENTS
+.INDENT 0.0
+.INDENT 3.5
+.sp
+.nf
+.ft C
+parental\-agents string [ port integer ] [
+    dscp integer ] { ( remote\-servers |
+    ipv4_address [ port integer ] |
+    ipv6_address [ port integer ] ) [ key
+    string ] [ tls string ]; ... };
+.ft P
+.fi
+.UNINDENT
+.UNINDENT
 .SS PLUGIN
 .INDENT 0.0
 .INDENT 3.5
@@ -1029,6 +1044,10 @@ view string [ class ] {
               notify\-source\-v6 ( ipv6_address | * ) [ port ( integer
                   | * ) ] [ dscp integer ];
               notify\-to\-soa boolean;
+              parental\-agents [ port integer ] [ dscp integer ] { (
+                  remote\-servers | ipv4_address [ port integer ] |
+                  ipv6_address [ port integer ] ) [ key string ] [
+                  tls string ]; ... };
               primaries [ port integer ] [ dscp integer ] { (
                   remote\-servers | ipv4_address [ port integer ] |
                   ipv6_address [ port integer ] ) [ key string ] [
@@ -1141,6 +1160,10 @@ zone string [ class ] {
       notify\-source\-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
           [ dscp integer ];
       notify\-to\-soa boolean;
+      parental\-agents [ port integer ] [ dscp integer ] { (
+          remote\-servers | ipv4_address [ port integer ] |
+          ipv6_address [ port integer ] ) [ key string ] [ tls
+          string ]; ... };
       primaries [ port integer ] [ dscp integer ] { (
           remote\-servers | ipv4_address [ port integer ] |
           ipv6_address [ port integer ] ) [ key string ] [ tls

diff --git a/doc/misc/master.zoneopt b/doc/misc/master.zoneopt
index 45b905c545404864c563107a8b99c0ada4da403c..6740613e8c3082dd2e7e9166d5bc01924256a93f 100644 (file)
--- a/doc/misc/master.zoneopt
+++ b/doc/misc/master.zoneopt
@@ -46,6 +46,7 @@ zone <string> [ <class> ] {
        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
        notify-to-soa <boolean>;
+       parental-agents [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
        serial-update-method ( date | increment | unixtime );
        sig-signing-nodes <integer>;
        sig-signing-signatures <integer>;

diff --git a/doc/misc/master.zoneopt.rst b/doc/misc/master.zoneopt.rst
index 968e4b24b1186c92b63bee050e78d1f630eb6ec4..05243c40bcf836eafb4ebbb2388a2183407f294a 100644 (file)
--- a/doc/misc/master.zoneopt.rst
+++ b/doc/misc/master.zoneopt.rst
@@ -48,6 +48,7 @@
        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
        notify-to-soa <boolean>;
+       parental-agents [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
        serial-update-method ( date | increment | unixtime );
        sig-signing-nodes <integer>;
        sig-signing-signatures <integer>;

diff --git a/doc/misc/options b/doc/misc/options
index e33917a6dc2dc8bec5cad9f08a9f59f2a3e3f47e..87aa9e2f4762af28d7273ba7f1ad63efae71ab47 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -391,6 +391,12 @@ options {
         zone-statistics ( full | terse | none | <boolean> );
 };
 
+parental-agents <string> [ port <integer> ] [
+    dscp <integer> ] { ( <remote-servers> |
+    <ipv4_address> [ port <integer> ] |
+    <ipv6_address> [ port <integer> ] ) [ key
+    <string> ] [ tls <string> ]; ... }; // may occur multiple times
+
 plugin ( query ) <string> [ { <unspecified-text>
     } ]; // may occur multiple times
 
@@ -817,6 +823,10 @@ view <string> [ <class> ] {
                     | * ) ] [ dscp <integer> ];
                 notify-to-soa <boolean>;
                 nsec3-test-zone <boolean>; // test only
+                parental-agents [ port <integer> ] [ dscp <integer> ] { (
+                    <remote-servers> | <ipv4_address> [ port <integer> ] |
+                    <ipv6_address> [ port <integer> ] ) [ key <string> ] [
+                    tls <string> ]; ... };
                 primaries [ port <integer> ] [ dscp <integer> ] { (
                     <remote-servers> | <ipv4_address> [ port <integer> ] |
                     <ipv6_address> [ port <integer> ] ) [ key <string> ] [
@@ -921,6 +931,10 @@ zone <string> [ <class> ] {
             [ dscp <integer> ];
         notify-to-soa <boolean>;
         nsec3-test-zone <boolean>; // test only
+        parental-agents [ port <integer> ] [ dscp <integer> ] { (
+            <remote-servers> | <ipv4_address> [ port <integer> ] |
+            <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls
+            <string> ]; ... };
         primaries [ port <integer> ] [ dscp <integer> ] { (
             <remote-servers> | <ipv4_address> [ port <integer> ] |
             <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls

diff --git a/doc/misc/options.active b/doc/misc/options.active
index 49fd35e230ef2b97f03379497a9e66b052f8dc44..d8bb60f930187472b93113abe626e8c1442bd936 100644 (file)
--- a/doc/misc/options.active
+++ b/doc/misc/options.active
@@ -388,6 +388,12 @@ options {
         zone-statistics ( full | terse | none | <boolean> );
 };
 
+parental-agents <string> [ port <integer> ] [
+    dscp <integer> ] { ( <remote-servers> |
+    <ipv4_address> [ port <integer> ] |
+    <ipv6_address> [ port <integer> ] ) [ key
+    <string> ] [ tls <string> ]; ... }; // may occur multiple times
+
 plugin ( query ) <string> [ { <unspecified-text>
     } ]; // may occur multiple times
 
@@ -811,6 +817,10 @@ view <string> [ <class> ] {
                 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer>
                     | * ) ] [ dscp <integer> ];
                 notify-to-soa <boolean>;
+                parental-agents [ port <integer> ] [ dscp <integer> ] { (
+                    <remote-servers> | <ipv4_address> [ port <integer> ] |
+                    <ipv6_address> [ port <integer> ] ) [ key <string> ] [
+                    tls <string> ]; ... };
                 primaries [ port <integer> ] [ dscp <integer> ] { (
                     <remote-servers> | <ipv4_address> [ port <integer> ] |
                     <ipv6_address> [ port <integer> ] ) [ key <string> ] [
@@ -914,6 +924,10 @@ zone <string> [ <class> ] {
         notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ]
             [ dscp <integer> ];
         notify-to-soa <boolean>;
+        parental-agents [ port <integer> ] [ dscp <integer> ] { (
+            <remote-servers> | <ipv4_address> [ port <integer> ] |
+            <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls
+            <string> ]; ... };
         primaries [ port <integer> ] [ dscp <integer> ] { (
             <remote-servers> | <ipv4_address> [ port <integer> ] |
             <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls

diff --git a/doc/misc/parentals.grammar.rst b/doc/misc/parentals.grammar.rst
new file mode 100644 (file)
index 0000000..32cef5a
--- /dev/null
+++ b/doc/misc/parentals.grammar.rst
@@ -0,0 +1,7 @@
+::
+
+  parental-agents <string> [ port <integer> ] [ dscp
+      <integer> ] { ( <remote-servers> |
+      <ipv4_address> [ port <integer> ] |
+      <ipv6_address> [ port <integer> ] ) [ key
+      <string> ] [ tls <string> ]; ... };

diff --git a/doc/misc/slave.zoneopt b/doc/misc/slave.zoneopt
index 490bb4637e19639fb78cae7c15c6ee4e3dce1513..a7e7c713e39194b349818ffd2da0627848e931ee 100644 (file)
--- a/doc/misc/slave.zoneopt
+++ b/doc/misc/slave.zoneopt
@@ -45,6 +45,7 @@ zone <string> [ <class> ] {
        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
        notify-to-soa <boolean>;
+       parental-agents [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
        primaries [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
        request-expire <boolean>;
        request-ixfr <boolean>;

diff --git a/doc/misc/slave.zoneopt.rst b/doc/misc/slave.zoneopt.rst
index d15501b7b57879649953f31ceee4eeff611af1a8..48f9454c62bbfbe19aeab987afe3dc47a61df22f 100644 (file)
--- a/doc/misc/slave.zoneopt.rst
+++ b/doc/misc/slave.zoneopt.rst
@@ -47,6 +47,7 @@
        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
        notify-to-soa <boolean>;
+       parental-agents [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
        primaries [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
        request-expire <boolean>;
        request-ixfr <boolean>;

diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
index c417c25a8f5d2fff14ad14f7d105724786054228..a981f0dd231f58909bbb9f37547d15e8b303dc03 100644 (file)
--- a/lib/dns/include/dns/zone.h
+++ b/lib/dns/include/dns/zone.h
@@ -655,6 +655,27 @@ dns_zone_setprimaries(dns_zone_t *zone, const isc_sockaddr_t *primaries,
  *\li      Any result dns_name_dup() can return, if keynames!=NULL
  */
 
+isc_result_t
+dns_zone_setparentals(dns_zone_t *zone, const isc_sockaddr_t *parentals,
+                     dns_name_t **keynames, dns_name_t **tlsnames,
+                     uint32_t count);
+/*%<
+ *     Set the list of parental agents for the zone.
+ *
+ * Require:
+ *\li  'zone' to be a valid zone.
+ *\li  'parentals' array of isc_sockaddr_t with port set or NULL.
+ *\li  'count' the number of parentals.
+ *\li  'keynames' array of dns_name_t's for tsig keys or NULL.
+ *
+ *\li  If 'parentals' is NULL then 'count' must be zero.
+ *
+ * Returns:
+ *\li  #ISC_R_SUCCESS
+ *\li  #ISC_R_NOMEMORY
+ *\li      Any result dns_name_dup() can return, if keynames!=NULL
+ */
+
 isc_result_t
 dns_zone_setalsonotify(dns_zone_t *zone, const isc_sockaddr_t *notify,
                       const isc_dscp_t *dscps, dns_name_t **keynames,

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index a512e9a2cc92b6ec2cf6d39888aaa487d55971ca..f45bfe0194678cc092c701d0d9346f55318348cf 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -1114,6 +1114,7 @@ static cfg_clausedef_t namedconf_clauses[] = {
        { "lwres", NULL, CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_ANCIENT },
        { "masters", &cfg_type_remoteservers, CFG_CLAUSEFLAG_MULTI },
        { "options", &cfg_type_options, 0 },
+       { "parental-agents", &cfg_type_remoteservers, CFG_CLAUSEFLAG_MULTI },
        { "primaries", &cfg_type_remoteservers, CFG_CLAUSEFLAG_MULTI },
        { "statistics-channels", &cfg_type_statschannels,
          CFG_CLAUSEFLAG_MULTI },
@@ -2318,6 +2319,8 @@ static cfg_clausedef_t zone_only_clauses[] = {
        { "masters", &cfg_type_namesockaddrkeylist,
          CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
                  CFG_ZONE_REDIRECT },
+       { "parental-agents", &cfg_type_namesockaddrkeylist,
+         CFG_ZONE_MASTER | CFG_ZONE_SLAVE },
        { "primaries", &cfg_type_namesockaddrkeylist,
          CFG_ZONE_SLAVE | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
                  CFG_ZONE_REDIRECT },