Add check-svcb to named

check-svcb signals whether to perform additional contraint tests
when loading / update primary zone files.

diff --git a/bin/check/check-tool.c b/bin/check/check-tool.c
index 1fb6e7c7c10ce713c9b0b83fc5419970935ef97b..20e901c5d29607f26f87e4b99b0d17cb0201d0ca 100644 (file)
--- a/bin/check/check-tool.c
+++ b/bin/check/check-tool.c
@@ -94,7 +94,7 @@ dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
 #if CHECK_SIBLING
                             DNS_ZONEOPT_CHECKSIBLING |
 #endif /* if CHECK_SIBLING */
-                            DNS_ZONEOPT_CHECKWILDCARD |
+                            DNS_ZONEOPT_CHECKSVCB | DNS_ZONEOPT_CHECKWILDCARD |
                             DNS_ZONEOPT_WARNMXCNAME | DNS_ZONEOPT_WARNSRVCNAME;
 
 /*

diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
index ceba9adce3c087ae9afd77c0fd64b67506060a76..a95bddbea7a0907708721bbd8c5b4005c3cc101e 100644 (file)
--- a/bin/check/named-checkconf.c
+++ b/bin/check/named-checkconf.c
@@ -401,6 +401,17 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
                zone_options |= DNS_ZONEOPT_CHECKSPF;
        }
 
+       obj = NULL;
+       if (get_maps(maps, "check-svcb", &obj)) {
+               if (cfg_obj_asboolean(obj)) {
+                       zone_options |= DNS_ZONEOPT_CHECKSVCB;
+               } else {
+                       zone_options &= ~DNS_ZONEOPT_CHECKSVCB;
+               }
+       } else {
+               zone_options |= DNS_ZONEOPT_CHECKSVCB;
+       }
+
        obj = NULL;
        if (get_checknames(maps, &obj)) {
                if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {

diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c
index 165639d31b36d0a3ed4cfa175ff54511d6618dda..1e874f32d93c6d08d47a6528a01086e856a4595b 100644 (file)
--- a/bin/check/named-checkzone.c
+++ b/bin/check/named-checkzone.c
@@ -165,8 +165,8 @@ main(int argc, char **argv) {
        isc_commandline_errprint = false;
 
        while ((c = isc_commandline_parse(argc, argv,
-                                         "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:DF:"
-                                         "M:S:T:W:")) != EOF)
+                                         "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:C:"
+                                         "DF:M:S:T:W:")) != EOF)
        {
                switch (c) {
                case 'c':
@@ -361,6 +361,18 @@ main(int argc, char **argv) {
                        workdir = isc_commandline_argument;
                        break;
 
+               case 'C':
+                       if (ARGCMP("check-svcb:fail")) {
+                               zone_options |= DNS_ZONEOPT_CHECKSVCB;
+                       } else if (ARGCMP("check-svcb:ignore")) {
+                               zone_options &= ~DNS_ZONEOPT_CHECKSVCB;
+                       } else {
+                               fprintf(stderr, "invalid argument to -C: %s\n",
+                                       isc_commandline_argument);
+                               exit(1);
+                       }
+                       break;
+
                case 'D':
                        dumpzone++;
                        break;

diff --git a/bin/check/named-checkzone.rst b/bin/check/named-checkzone.rst
index 563752f476e3f9bdd7314697aef9a433e3b63424..e6ad56f73c1266d131e5053f1760f3820bd00c99 100644 (file)
--- a/bin/check/named-checkzone.rst
+++ b/bin/check/named-checkzone.rst
@@ -23,7 +23,7 @@ named-checkzone - zone file validation tool
 Synopsis
 ~~~~~~~~
 
-:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
+:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
 
 Description
 ~~~~~~~~~~~
@@ -68,6 +68,15 @@ Options
 
    This option specifies the class of the zone. If not specified, ``IN`` is assumed.
 
+.. option:: -C mode
+
+   This option controls check mode on zone files when loading.
+   Possible modes are ``check-svcb:fail`` and ``check-svcb:ignore``.
+
+   ``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
+   records and ``check-svcb:ignore`` disables these checks.  The
+   default is ``check-svcb:fail``.
+
 .. option:: -i mode
 
    This option performs post-load zone integrity checks. Possible modes are

diff --git a/bin/check/named-compilezone.rst b/bin/check/named-compilezone.rst
index fa47f154c2870654154df1678b1c017e56aaadce..5c629f3ae9761f80db5f6d65c5ac25505aff7a05 100644 (file)
--- a/bin/check/named-compilezone.rst
+++ b/bin/check/named-compilezone.rst
@@ -23,7 +23,7 @@ named-compilezone - zone file converting tool
 Synopsis
 ~~~~~~~~
 
-:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
+:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
 
 Description
 ~~~~~~~~~~~
@@ -70,6 +70,15 @@ Options
 
    This option specifies the class of the zone. If not specified, ``IN`` is assumed.
 
+.. option:: -C mode
+
+   This option controls check mode on zone files when loading.
+   Possible modes are ``check-svcb:fail`` and ``check-svcb:ignore``.
+
+   ``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
+   records and ``check-svcb:ignore`` disables these checks.  The
+   default is ``check-svcb:fail``.
+
 .. option:: -i mode
 
    This option performs post-load zone integrity checks. Possible modes are

diff --git a/bin/named/config.c b/bin/named/config.c
index 347b07849823726e1a3aac36def64d1ac5698f0f..2524263c99999829511f03c0522e20a6c7eb1ff7 100644 (file)
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -152,6 +152,7 @@ options {\n\
        check-names response ignore;\n\
        check-names secondary warn;\n\
        check-spf warn;\n\
+       check-svcb yes;\n\
        clients-per-query 10;\n\
        dnssec-accept-expired no;\n\
        dnssec-validation " VALIDATION_DEFAULT "; \n"

diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index 67a00fd7e5ea8b1a155d5bc3072eeaaa04802e13..33d9098c7f6717197b3631631fd51ae24c3004a2 100644 (file)
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -1472,6 +1472,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
                }
                dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSPF, check);
 
+               obj = NULL;
+               result = named_config_get(maps, "check-svcb", &obj);
+               INSIST(result == ISC_R_SUCCESS && obj != NULL);
+               dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSVCB,
+                                  cfg_obj_asboolean(obj));
+
                obj = NULL;
                result = named_config_get(maps, "zero-no-soa-ttl", &obj);
                INSIST(result == ISC_R_SUCCESS && obj != NULL);

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 7fbb2d4e5a57497d71f2320e8159da6409c810e6..712d284ed90fe7d4d2c60a96518f9d3f49d851d2 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -2772,6 +2772,16 @@ Boolean Options
    Policy Framework record present (starts with "v=spf1") if there is an
    SPF record present. The default is ``warn``.
 
+.. namedconf:statement:: check-svcb
+   :tags: zone
+   :short: Specifies whether to perform additional checks on SVCB records.
+
+   If ``yes``, checks that SVCB records that start with a ``_dns``
+   label prefixed by an optional ``_<port>`` label (e.g.
+   ``_443._dns.ns1.example``), have an ``alpn`` parameter and that
+   the ``dohpath`` parameter exists when the ``alpn`` indicates
+   that it should be present.  The default is ``yes``.
+
 .. namedconf:statement:: zero-no-soa-ttl
    :tags: zone, query, server
    :short: Specifies whether to set the time to live (TTL) of the SOA record to zero, when returning authoritative negative responses to SOA queries.

diff --git a/doc/man/named-checkzone.1in b/doc/man/named-checkzone.1in
index 822295ff51a6bac0800a6a60f350ed31681e1a27..699dca4aee386cc898f26530cb6c79f275be9a9b 100644 (file)
--- a/doc/man/named-checkzone.1in
+++ b/doc/man/named-checkzone.1in
@@ -32,7 +32,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 named-checkzone \- zone file validity checking or converting tool
 .SH SYNOPSIS
 .sp
-\fBnamed\-checkzone\fP [\fB\-d\fP] [\fB\-h\fP] [\fB\-j\fP] [\fB\-q\fP] [\fB\-v\fP] [\fB\-c\fP class] [\fB\-f\fP format] [\fB\-F\fP format] [\fB\-J\fP filename] [\fB\-i\fP mode] [\fB\-k\fP mode] [\fB\-m\fP mode] [\fB\-M\fP mode] [\fB\-n\fP mode] [\fB\-l\fP ttl] [\fB\-L\fP serial] [\fB\-o\fP filename] [\fB\-r\fP mode] [\fB\-s\fP style] [\fB\-S\fP mode] [\fB\-t\fP directory] [\fB\-T\fP mode] [\fB\-w\fP directory] [\fB\-D\fP] [\fB\-W\fP mode] {zonename} {filename}
+\fBnamed\-checkzone\fP [\fB\-d\fP] [\fB\-h\fP] [\fB\-j\fP] [\fB\-q\fP] [\fB\-v\fP] [\fB\-c\fP class] [\fB\-C\fP mode] [\fB\-f\fP format] [\fB\-F\fP format] [\fB\-J\fP filename] [\fB\-i\fP mode] [\fB\-k\fP mode] [\fB\-m\fP mode] [\fB\-M\fP mode] [\fB\-n\fP mode] [\fB\-l\fP ttl] [\fB\-L\fP serial] [\fB\-o\fP filename] [\fB\-r\fP mode] [\fB\-s\fP style] [\fB\-S\fP mode] [\fB\-t\fP directory] [\fB\-T\fP mode] [\fB\-w\fP directory] [\fB\-D\fP] [\fB\-W\fP mode] {zonename} {filename}
 .SH DESCRIPTION
 .sp
 \fBnamed\-checkzone\fP checks the syntax and integrity of a zone file. It
@@ -81,6 +81,16 @@ This option specifies the class of the zone. If not specified, \fBIN\fP is assum
 .UNINDENT
 .INDENT 0.0
 .TP
+.B \-C mode
+This option controls check mode on zone files when loading.
+Possible modes are \fBcheck\-svcb:fail\fP and \fBcheck\-svcb:ignore\fP\&.
+.sp
+\fBcheck\-svcb:fail\fP turns on additional checks on \fB_dns\fP SVCB
+records and \fBcheck\-svcb:ignore\fP disables these checks.  The
+default is \fBcheck\-svcb:fail\fP\&.
+.UNINDENT
+.INDENT 0.0
+.TP
 .B \-i mode
 This option performs post\-load zone integrity checks. Possible modes are
 \fBfull\fP (the default), \fBfull\-sibling\fP, \fBlocal\fP,

diff --git a/doc/man/named-compilezone.1in b/doc/man/named-compilezone.1in
index b4897f2ae24ac567b0ccca442ad5bb18319c85bf..388b57dc4608bfa3cd22e136463d1d779f6ec767 100644 (file)
--- a/doc/man/named-compilezone.1in
+++ b/doc/man/named-compilezone.1in
@@ -32,7 +32,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 named-compilezone \- zone file validity checking or converting tool
 .SH SYNOPSIS
 .sp
-\fBnamed\-compilezone\fP [\fB\-d\fP] [\fB\-h\fP] [\fB\-j\fP] [\fB\-q\fP] [\fB\-v\fP] [\fB\-c\fP class] [\fB\-f\fP format] [\fB\-F\fP format] [\fB\-J\fP filename] [\fB\-i\fP mode] [\fB\-k\fP mode] [\fB\-m\fP mode] [\fB\-M\fP mode] [\fB\-n\fP mode] [\fB\-l\fP ttl] [\fB\-L\fP serial] [\fB\-r\fP mode] [\fB\-s\fP style] [\fB\-S\fP mode] [\fB\-t\fP directory] [\fB\-T\fP mode] [\fB\-w\fP directory] [\fB\-D\fP] [\fB\-W\fP mode] {\fB\-o\fP filename} {zonename} {filename}
+\fBnamed\-compilezone\fP [\fB\-d\fP] [\fB\-h\fP] [\fB\-j\fP] [\fB\-q\fP] [\fB\-v\fP] [\fB\-c\fP class] [\fB\-C\fP mode] [\fB\-f\fP format] [\fB\-F\fP format] [\fB\-J\fP filename] [\fB\-i\fP mode] [\fB\-k\fP mode] [\fB\-m\fP mode] [\fB\-M\fP mode] [\fB\-n\fP mode] [\fB\-l\fP ttl] [\fB\-L\fP serial] [\fB\-r\fP mode] [\fB\-s\fP style] [\fB\-S\fP mode] [\fB\-t\fP directory] [\fB\-T\fP mode] [\fB\-w\fP directory] [\fB\-D\fP] [\fB\-W\fP mode] {\fB\-o\fP filename} {zonename} {filename}
 .SH DESCRIPTION
 .sp
 \fBnamed\-compilezone\fP checks the syntax and integrity of a zone file,
@@ -83,6 +83,16 @@ This option specifies the class of the zone. If not specified, \fBIN\fP is assum
 .UNINDENT
 .INDENT 0.0
 .TP
+.B \-C mode
+This option controls check mode on zone files when loading.
+Possible modes are \fBcheck\-svcb:fail\fP and \fBcheck\-svcb:ignore\fP\&.
+.sp
+\fBcheck\-svcb:fail\fP turns on additional checks on \fB_dns\fP SVCB
+records and \fBcheck\-svcb:ignore\fP disables these checks.  The
+default is \fBcheck\-svcb:fail\fP\&.
+.UNINDENT
+.INDENT 0.0
+.TP
 .B \-i mode
 This option performs post\-load zone integrity checks. Possible modes are
 \fBfull\fP (the default), \fBfull\-sibling\fP, \fBlocal\fP,

diff --git a/doc/man/named.conf.5in b/doc/man/named.conf.5in
index bfc32254c1c13751a5fff1702766d8a35f1ccade..5ba10558a6897a64c9ce65691d3397c62a38c313 100644 (file)
--- a/doc/man/named.conf.5in
+++ b/doc/man/named.conf.5in
@@ -147,6 +147,7 @@ options {
        check\-sibling <boolean>;
        check\-spf ( warn | ignore );
        check\-srv\-cname ( fail | warn | ignore );
+       check\-svcb <boolean>;
        check\-wildcard <boolean>;
        clients\-per\-query <integer>;
        cookie\-algorithm ( aes | siphash24 );
@@ -455,6 +456,7 @@ view <string> [ <class> ] {
        check\-sibling <boolean>;
        check\-spf ( warn | ignore );
        check\-srv\-cname ( fail | warn | ignore );
+       check\-svcb <boolean>;
        check\-wildcard <boolean>;
        clients\-per\-query <integer>;
        deny\-answer\-addresses { <address_match_element>; ... } [ except\-from { <string>; ... } ];
@@ -680,6 +682,7 @@ zone <string> [ <class> ] {
        check\-sibling <boolean>;
        check\-spf ( warn | ignore );
        check\-srv\-cname ( fail | warn | ignore );
+       check\-svcb <boolean>;
        check\-wildcard <boolean>;
        database <string>;
        dialup ( notify | notify\-passive | passive | refresh | <boolean> );

diff --git a/doc/misc/options b/doc/misc/options
index b11fe07b464cdac770d4f580b966d26e5523b988..8857e4f674991fe48a357e9f4da4edb260f26973 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -90,6 +90,7 @@ options {
        check-sibling <boolean>;
        check-spf ( warn | ignore );
        check-srv-cname ( fail | warn | ignore );
+       check-svcb <boolean>;
        check-wildcard <boolean>;
        clients-per-query <integer>;
        cookie-algorithm ( aes | siphash24 );
@@ -398,6 +399,7 @@ view <string> [ <class> ] {
        check-sibling <boolean>;
        check-spf ( warn | ignore );
        check-srv-cname ( fail | warn | ignore );
+       check-svcb <boolean>;
        check-wildcard <boolean>;
        clients-per-query <integer>;
        deny-answer-addresses { <address_match_element>; ... } [ except-from { <string>; ... } ];

diff --git a/doc/misc/primary.zoneopt b/doc/misc/primary.zoneopt
index 5501962f4ce0300670bb237e0ed52fa77d8b09d4..2cb8a7e5d4b8df9f630434c5ff1ef57dfe8314e6 100644 (file)
--- a/doc/misc/primary.zoneopt
+++ b/doc/misc/primary.zoneopt
@@ -16,6 +16,7 @@ zone <string> [ <class> ] {
        check-sibling <boolean>;
        check-spf ( warn | ignore );
        check-srv-cname ( fail | warn | ignore );
+       check-svcb <boolean>;
        check-wildcard <boolean>;
        database <string>;
        dialup ( notify | notify-passive | passive | refresh | <boolean> );

diff --git a/lib/dns/include/dns/master.h b/lib/dns/include/dns/master.h
index 26e67a05660d999e6d45abb032748f0d0a046ba7..2edb12a308654fbf7f0b1541496f734910601679 100644 (file)
--- a/lib/dns/include/dns/master.h
+++ b/lib/dns/include/dns/master.h
@@ -55,10 +55,11 @@
 #define DNS_MASTER_CHECKMX     0x00000800
 #define DNS_MASTER_CHECKMXFAIL 0x00001000
 
-#define DNS_MASTER_RESIGN   0x00002000
-#define DNS_MASTER_KEY     0x00004000 /*%< Loading a key zone master file. */
-#define DNS_MASTER_NOTTL    0x00008000 /*%< Don't require ttl. */
-#define DNS_MASTER_CHECKTTL 0x00010000 /*%< Check max-zone-ttl */
+#define DNS_MASTER_RESIGN    0x00002000
+#define DNS_MASTER_KEY      0x00004000 /*%< Loading a key zone master file. */
+#define DNS_MASTER_NOTTL     0x00008000 /*%< Don't require ttl. */
+#define DNS_MASTER_CHECKTTL  0x00010000 /*%< Check max-zone-ttl */
+#define DNS_MASTER_CHECKSVCB 0x00020000 /*%< Check SVBC records */
 
 ISC_LANG_BEGINDECLS
 

diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
index 616bf4dd115c999b44bc0939e0d2cdc1213f2793..845afe8c09d151e38a6d5167ed0a5af923d48328 100644 (file)
--- a/lib/dns/include/dns/zone.h
+++ b/lib/dns/include/dns/zone.h
@@ -99,6 +99,7 @@ typedef enum {
        DNS_ZONEOPT_CHECKSPF = 1 << 27,         /*%< check SPF records */
        DNS_ZONEOPT_CHECKTTL = 1 << 28,         /*%< check max-zone-ttl */
        DNS_ZONEOPT_AUTOEMPTY = 1 << 29,        /*%< automatic empty zone */
+       DNS_ZONEOPT_CHECKSVCB = 1 << 30,        /*%< check SVBC records */
        DNS_ZONEOPT___MAX = UINT64_MAX, /* trick to make the ENUM 64-bit wide */
 } dns_zoneopt_t;
 

diff --git a/lib/dns/master.c b/lib/dns/master.c
index 8821d3724818a210fe721a022d66a0126f47e735..8ff0de68a3be36309e4b88b78c35baf34d5397be 100644 (file)
--- a/lib/dns/master.c
+++ b/lib/dns/master.c
@@ -1895,6 +1895,28 @@ load_text(dns_loadctx_t *lctx) {
                        }
                }
 
+               if (type == dns_rdatatype_svcb &&
+                   (lctx->options & DNS_MASTER_ZONE) != 0 &&
+                   (lctx->options & DNS_MASTER_CHECKSVCB) != 0)
+               {
+                       result = dns_rdata_checksvcb(ictx->current,
+                                                    &rdata[rdcount]);
+                       if (result != ISC_R_SUCCESS) {
+                               (*callbacks->error)(callbacks,
+                                                   "%s:%lu: SVCB "
+                                                   "record not valid: %s",
+                                                   source, line,
+                                                   isc_result_totext(result));
+                               if (MANYERRS(lctx, result)) {
+                                       SETRESULT(lctx, result);
+                                       target = target_ft;
+                                       continue;
+                               } else if (result != ISC_R_SUCCESS) {
+                                       goto insist_and_cleanup;
+                               }
+                       }
+               }
+
                if (dns_rdatatype_atparent(type) &&
                    dns_master_isprimary(lctx) &&
                    dns_name_equal(ictx->current, lctx->top))

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 83f5aac850f7c0991aa6e1bd96813540067ab9a0..1970f0ac1f3f82c80f1f615cf51ff7cedd2e9b21 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -2562,6 +2562,9 @@ get_primary_options(dns_zone_t *zone) {
        if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKTTL)) {
                options |= DNS_MASTER_CHECKTTL;
        }
+       if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKSVCB)) {
+               options |= DNS_MASTER_CHECKSVCB;
+       }
 
        return (options);
 }

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index d359d37bad6a05e02fcf3e6f74210023a9286493..aabe02a2887c2885d6cbe2ea8fc1402b3c78bdae 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -2253,6 +2253,7 @@ static cfg_clausedef_t zone_clauses[] = {
        { "check-sibling", &cfg_type_boolean, CFG_ZONE_PRIMARY },
        { "check-spf", &cfg_type_warn, CFG_ZONE_PRIMARY },
        { "check-srv-cname", &cfg_type_checkmode, CFG_ZONE_PRIMARY },
+       { "check-svcb", &cfg_type_boolean, CFG_ZONE_PRIMARY },
        { "check-wildcard", &cfg_type_boolean, CFG_ZONE_PRIMARY },
        { "dialup", &cfg_type_dialuptype,
          CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_STUB },

diff --git a/lib/ns/update.c b/lib/ns/update.c
index 51cedf60e3284f915cea1c966b66d4377840fca9..cf4a469e106dbb80285e8d9b8674eab97cb2072c 100644 (file)
--- a/lib/ns/update.c
+++ b/lib/ns/update.c
@@ -2813,6 +2813,8 @@ update_action(isc_task_t *task, isc_event_t *event) {
                                     ISC_MEM_ZERO);
        }
 
+       options = dns_zone_getoptions(zone);
+
        for (rule = 0,
            result = dns_message_firstname(request, DNS_SECTION_UPDATE);
             result == ISC_R_SUCCESS;
@@ -2844,6 +2846,16 @@ update_action(isc_task_t *task, isc_event_t *event) {
                        if (result != ISC_R_SUCCESS) {
                                FAIL(DNS_R_REFUSED);
                        }
+                       if ((options & DNS_ZONEOPT_CHECKSVCB) != 0 &&
+                           rdata.type == dns_rdatatype_svcb) {
+                               result = dns_rdata_checksvcb(name, &rdata);
+                               if (result != ISC_R_SUCCESS) {
+                                       const char *reason =
+                                               isc_result_totext(result);
+                                       FAILNT(DNS_R_REFUSED, name, rdata.type,
+                                              reason);
+                               }
+                       }
                } else if (update_class == dns_rdataclass_any) {
                        if (ttl != 0 || rdata.length != 0 ||
                            (dns_rdatatype_ismeta(rdata.type) &&
@@ -2982,7 +2994,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
         * Process the Update Section.
         */
 
-       options = dns_zone_getoptions(zone);
        for (rule = 0,
            result = dns_message_firstname(request, DNS_SECTION_UPDATE);
             result == ISC_R_SUCCESS;