From: Michał Kępień Date: Tue, 9 Oct 2018 08:54:51 +0000 (+0200) Subject: Clean up handling of NOTIFY settings for mirror zones X-Git-Tag: v9.13.4~99^2~5 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1d49b01cc6ddd51647227730531fa5668c135201;p=thirdparty%2Fbind9.git Clean up handling of NOTIFY settings for mirror zones Previous way of handling NOTIFY settings for mirror zones was a bit tricky: any value of the "notify" option was accepted, but it was subsequently overridden with dns_notifytype_explicit. Given the way zone configuration is performed, this resulted in the following behavior: - if "notify yes;" was set explicitly at any configuration level or inherited from default configuration, it was silently changed and so only hosts specified in "also-notify", if any, were notified, - if "notify no;" was set at any configuration level, it was effectively honored since even though zone->notifytype was silently set to dns_notifytype_explicit, the "also-notify" option was never processed due to "notify no;" being set. Effectively, this only allowed the hosts specified in "also-notify" to be notified, when either "notify yes;" or "notify explicit;" was explicitly set or inherited from default configuration. Clean up handling of NOTIFY settings for mirror zones by: - reporting a configuration error when anything else than "notify no;" or "notify explicit;" is set for a mirror zone at the zone level, - overriding inherited "notify yes;" setting with "notify explicit;" for mirror zones, - informing the user when the "notify" setting is overridden, unless the setting in question was inherited from default configuration. --- diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c index 36a29ece17d..a1f2c5340ed 100644 --- a/bin/named/zoneconf.c +++ b/bin/named/zoneconf.c @@ -833,6 +833,37 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, return (view == myview); } +/*% + * For mirror zones, change "notify yes;" to "notify explicit;", informing the + * user only if "notify" was explicitly configured rather than inherited from + * default configuration. + */ +static dns_notifytype_t +process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype, + const char *zname, const cfg_obj_t **maps) +{ + const cfg_obj_t *obj = NULL; + + /* + * Return the original setting if this is not a mirror zone or if the + * zone is configured with something else than "notify yes;". + */ + if (ztype != dns_zone_mirror || ntype != dns_notifytype_yes) { + return (ntype); + } + + /* + * Only log a message if "notify" was set in the configuration + * hierarchy supplied in 'maps'. + */ + if (named_config_get(maps, "notify", &obj) == ISC_R_SUCCESS) { + cfg_obj_log(obj, named_g_lctx, ISC_LOG_INFO, + "'notify explicit;' will be used for mirror zone " + "'%s'", zname); + } + + return (dns_notifytype_explicit); +} isc_result_t named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, @@ -1187,6 +1218,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, else INSIST(0); } + notifytype = process_notifytype(notifytype, ztype, zname, + nodefault); if (raw != NULL) dns_zone_setnotifytype(raw, dns_notifytype_no); dns_zone_setnotifytype(zone, notifytype); @@ -1713,11 +1746,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, dns_zone_setxfracl(zone, none); dns_acl_detach(&none); } - /* - * Only allow "also-notify". - */ - notifytype = dns_notifytype_explicit; - dns_zone_setnotifytype(zone, notifytype); /* FALLTHROUGH */ case dns_zone_slave: case dns_zone_stub: diff --git a/bin/tests/system/checkconf/bad-mirror-explicit-notify-yes.conf b/bin/tests/system/checkconf/bad-mirror-explicit-notify-yes.conf new file mode 100644 index 00000000000..e0fabdff38c --- /dev/null +++ b/bin/tests/system/checkconf/bad-mirror-explicit-notify-yes.conf @@ -0,0 +1,16 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +zone "." { + type mirror; + masters { 127.0.0.1; }; + notify yes; +}; diff --git a/bin/tests/system/checkconf/good-mirror-inherited-notify-yes.conf b/bin/tests/system/checkconf/good-mirror-inherited-notify-yes.conf new file mode 100644 index 00000000000..14a29bf7b55 --- /dev/null +++ b/bin/tests/system/checkconf/good-mirror-inherited-notify-yes.conf @@ -0,0 +1,19 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + notify yes; +}; + +zone "." { + type mirror; + masters { 127.0.0.1; }; +}; diff --git a/lib/bind9/check.c b/lib/bind9/check.c index bfb89170018..2a54fdf0d0d 100644 --- a/lib/bind9/check.c +++ b/lib/bind9/check.c @@ -1915,6 +1915,52 @@ check_nonzero(const cfg_obj_t *options, isc_log_t *logctx) { return (result); } +/*% + * Check whether NOTIFY configuration at the zone level is acceptable for a + * mirror zone. Return true if it is; return false otherwise. + */ +static bool +check_mirror_zone_notify(const cfg_obj_t *zoptions, const char *znamestr, + isc_log_t *logctx) +{ + bool notify_configuration_ok = true; + const cfg_obj_t *obj = NULL; + + (void)cfg_map_get(zoptions, "notify", &obj); + if (obj == NULL) { + /* + * "notify" not set at zone level. This is fine. + */ + return (true); + } + + if (cfg_obj_isboolean(obj)) { + if (cfg_obj_asboolean(obj)) { + /* + * "notify yes;" set at zone level. This is an error. + */ + notify_configuration_ok = false; + } + } else { + const char *notifystr = cfg_obj_asstring(obj); + if (strcasecmp(notifystr, "explicit") != 0) { + /* + * Something else than "notify explicit;" set at zone + * level. This is an error. + */ + notify_configuration_ok = false; + } + } + + if (!notify_configuration_ok) { + cfg_obj_log(zoptions, logctx, ISC_LOG_ERROR, + "zone '%s': mirror zones can only be used with " + "'notify no;' or 'notify explicit;'", znamestr); + } + + return (notify_configuration_ok); +} + static isc_result_t check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, const cfg_obj_t *config, isc_symtab_t *symtab, @@ -2186,6 +2232,16 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, } } + /* + * Only a limited subset of all possible "notify" settings can be used + * at the zone level for mirror zones. + */ + if (ztype == CFG_ZONE_MIRROR && + !check_mirror_zone_notify(zoptions, znamestr, logctx)) + { + result = ISC_R_FAILURE; + } + /* * Master, slave, and mirror zones may have an "also-notify" field, but * shouldn't if notify is disabled. diff --git a/util/copyrights b/util/copyrights index b7fb76b0136..4bc39004350 100644 --- a/util/copyrights +++ b/util/copyrights @@ -597,6 +597,7 @@ ./bin/tests/system/checkconf/bad-maxcachettl.conf CONF-C 2018 ./bin/tests/system/checkconf/bad-maxncachettl.conf CONF-C 2018 ./bin/tests/system/checkconf/bad-maxttlmap.conf CONF-C 2014,2016,2018 +./bin/tests/system/checkconf/bad-mirror-explicit-notify-yes.conf CONF-C 2018 ./bin/tests/system/checkconf/bad-noddns.conf CONF-C 2014,2016,2018 ./bin/tests/system/checkconf/bad-options-also-notify.conf CONF-C 2016,2018 ./bin/tests/system/checkconf/bad-printtime.conf CONF-C 2016,2018 @@ -668,6 +669,7 @@ ./bin/tests/system/checkconf/good-lmdb-mapsize-smallest.conf CONF-C 2017,2018 ./bin/tests/system/checkconf/good-maxcachettl.conf CONF-C 2018 ./bin/tests/system/checkconf/good-maxncachettl.conf CONF-C 2018 +./bin/tests/system/checkconf/good-mirror-inherited-notify-yes.conf CONF-C 2018 ./bin/tests/system/checkconf/good-nested.conf CONF-C 2015,2016,2018 ./bin/tests/system/checkconf/good-options-also-notify.conf CONF-C 2016,2018 ./bin/tests/system/checkconf/good-printtime.conf CONF-C 2016,2018