Check for filename clashes /w dnssec-policy zones

Just like with dynamic and/or inline-signing zones, check if no two
or more zone configurations set the same filename. In these cases,
the zone files are not read-only and named-checkconf should catch
a configuration where multiple zone statements write to the same file.

Add some bad configuration tests where KASP zones reference the same
zone file.

Update the good-kasp test to allow for two zones configure the same
file name, dnssec-policy none.

(cherry picked from commit 0b5fc0afcfd1a0bb7c1f16b63872b7ee26fb2777)

diff --git a/bin/tests/system/checkconf/bad-kasp10.conf b/bin/tests/system/checkconf/bad-kasp10.conf
new file mode 100644 (file)
index 0000000..026fb52
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp10.conf
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// One zone with dnssec-policy 'none', one zone with dnssec-policy 'insecure',
+// both using the same zone file.
+
+zone "example1.net" {
+       type master;
+       file "example.db";
+       dnssec-policy "none";
+};
+
+zone "example2.net" {
+       type master;
+       file "example.db";
+       dnssec-policy "insecure";
+};
+

diff --git a/bin/tests/system/checkconf/bad-kasp11.conf b/bin/tests/system/checkconf/bad-kasp11.conf
new file mode 100644 (file)
index 0000000..6d5f518
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp11.conf
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// One zone with a dnssec-policy, the other with allow-update,
+// with the same zone file.
+
+zone "example1.net" {
+       type master;
+       file "example.db";
+       dnssec-policy "default";
+};
+
+zone "example2.net" {
+       type master;
+       file "example.db";
+       allow-update { any; };
+};
+

diff --git a/bin/tests/system/checkconf/bad-kasp12.conf b/bin/tests/system/checkconf/bad-kasp12.conf
new file mode 100644 (file)
index 0000000..3251f61
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp12.conf
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// One zone with a dnssec-policy, the other with update-policy,
+// with the same zone file.
+
+zone "example1.net" {
+       type master;
+       file "example.db";
+       dnssec-policy "default";
+};
+
+zone "example2.net" {
+       type master;
+       file "example.db";
+       update-policy {
+               grant * self * TXT;
+       };
+};
+

diff --git a/bin/tests/system/checkconf/bad-kasp13.conf b/bin/tests/system/checkconf/bad-kasp13.conf
new file mode 100644 (file)
index 0000000..503859b
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp13.conf
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// One zone transitioning to insecure, the other with allow-update,
+// with the same zone file.
+
+zone "example1.net" {
+       type master;
+       file "example.db";
+       dnssec-policy "insecure";
+};
+
+zone "example2.net" {
+       type master;
+       file "example.db";
+       allow-update { any; };
+};
+

diff --git a/bin/tests/system/checkconf/bad-kasp6.conf b/bin/tests/system/checkconf/bad-kasp6.conf
new file mode 100644 (file)
index 0000000..672f4df
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp6.conf
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// Two zones with dnssec-policy with the same zone file.
+
+zone "example1.net" {
+       type master;
+       file "example.db";
+       dnssec-policy "default";
+};
+
+zone "example2.net" {
+       type master;
+       file "example.db";
+       dnssec-policy "default";
+};
+

diff --git a/bin/tests/system/checkconf/bad-kasp7.conf b/bin/tests/system/checkconf/bad-kasp7.conf
new file mode 100644 (file)
index 0000000..b7ba4a9
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp7.conf
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// Two zones with dnssec-policy 'insecure' (transitioning to insecure)
+// with the same zone file.
+
+zone "example1.net" {
+       type master;
+       file "example.db";
+       dnssec-policy "insecure";
+};
+
+zone "example2.net" {
+       type master;
+       file "example.db";
+       dnssec-policy "insecure";
+};
+

diff --git a/bin/tests/system/checkconf/bad-kasp8.conf b/bin/tests/system/checkconf/bad-kasp8.conf
new file mode 100644 (file)
index 0000000..af4f1a3
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp8.conf
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// One zone with dnssec-policy, the other zone has 'dnssec-policy none',
+// both with the same zone file.
+
+zone "example1.net" {
+       type master;
+       file "example.db";
+       dnssec-policy "default";
+};
+
+zone "example2.net" {
+       type master;
+       file "example.db";
+       dnssec-policy "none";
+};
+

diff --git a/bin/tests/system/checkconf/bad-kasp9.conf b/bin/tests/system/checkconf/bad-kasp9.conf
new file mode 100644 (file)
index 0000000..7fc5370
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-kasp9.conf
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// One zone with dnssec-policy, the other zone has 'dnssec-policy insecure'
+// (transitioning to inseure), both with the same zone file.
+
+zone "example1.net" {
+       type master;
+       file "example.db";
+       dnssec-policy "default";
+};
+
+zone "example2.net" {
+       type master;
+       file "example.db";
+       dnssec-policy "insecure";
+};
+

diff --git a/bin/tests/system/checkconf/good-kasp.conf b/bin/tests/system/checkconf/good-kasp.conf
index 87fdc9db581dfa67ece49412476c74d07b43d2b4..2aa3091a8a04d3705a1e5b4b8c638323d4e3060c 100644 (file)
--- a/bin/tests/system/checkconf/good-kasp.conf
+++ b/bin/tests/system/checkconf/good-kasp.conf
@@ -49,8 +49,13 @@ zone "example3" {
        file "example3.db";
        dnssec-policy "default";
 };
-zone "example4" {
+zone "dnssec-policy-none-shared-zonefile1" {
        type master;
-       file "example4.db";
+       file "shared.db";
+       dnssec-policy "none";
+};
+zone "dnssec-policy-none-shared-zonefile2" {
+       type master;
+       file "shared.db";
        dnssec-policy "none";
 };

diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index ab61371d60ca20c4bd9c150ccc7a2c4a2ff0218c..c0c9d02c0e7f98c45845d6e3de2d81ea953de715 100644 (file)
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -1052,9 +1052,7 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
                        if (result == ISC_R_SUCCESS) {
                                result = ISC_R_FAILURE;
                        }
-               }
-
-               if (bad_name) {
+               } else if (bad_name) {
                        cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
                                    "dnssec-policy name may not be 'insecure', "
                                    "'none', or 'default' (which are built-in "
@@ -1062,9 +1060,9 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
                        if (result == ISC_R_SUCCESS) {
                                result = ISC_R_FAILURE;
                        }
+               } else {
+                       has_dnssecpolicy = true;
                }
-
-               has_dnssecpolicy = true;
        }
 
        obj = NULL;
@@ -3045,10 +3043,9 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
        }
 
        /*
-        * If the zone type is rbt/rbt64 then master/hint zones
-        * require file clauses.
-        * If inline signing is used, then slave zones require a
-        * file clause as well
+        * If the zone type is rbt/rbt64 then master/hint zones require file
+        * clauses. If inline-signing is used, then slave zones require a
+        * file clause as well.
         */
        obj = NULL;
        dlz = false;
@@ -3086,7 +3083,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
                        result = tresult;
                } else if (tresult == ISC_R_SUCCESS &&
                           (ztype == CFG_ZONE_SLAVE ||
-                           ztype == CFG_ZONE_MIRROR || ddns))
+                           ztype == CFG_ZONE_MIRROR || ddns ||
+                           has_dnssecpolicy))
                {
                        tresult = fileexist(fileobj, files, true, logctx);
                        if (tresult != ISC_R_SUCCESS) {