From: Evan Hunt Date: Tue, 14 Jul 2009 22:54:57 +0000 (+0000) Subject: 2630. [func] Improved syntax for DDNS autoconfiguration: use X-Git-Tag: v9.7.0a2~62 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=08f860f800d32007a0c9bf456f6c35fbb2ecbc81;p=thirdparty%2Fbind9.git 2630. [func] Improved syntax for DDNS autoconfiguration: use "update-policy local;" to switch on local DDNS in a zone. [RT #19875] --- diff --git a/CHANGES b/CHANGES index f7eb5b2266f..5371341d7b0 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ +2630. [func] Improved syntax for DDNS autoconfiguration: use + "update-policy local;" to switch on local DDNS in a + zone. [RT #19875] + 2629. [port] Check for seteuid()/setegid(), use setresuid()/ setresgid() if not present. [RT #19932] diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in index 08b55166b50..b67ccdd04e3 100644 --- a/bin/confgen/Makefile.in +++ b/bin/confgen/Makefile.in @@ -12,7 +12,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.3 2009/06/11 23:47:55 tbox Exp $ +# $Id: Makefile.in,v 1.4 2009/07/14 22:54:56 each Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -68,9 +68,7 @@ rndc-confgen.@O@: rndc-confgen.c -c ${srcdir}/rndc-confgen.c ddns-confgen.@O@: ddns-confgen.c - ${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \ - -DDDNS_KEYFILE=\"${localstatedir}/run/named/ddns.key\" \ - -c ${srcdir}/ddns-confgen.c + ${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -c ${srcdir}/ddns-confgen.c rndc-confgen@EXEEXT@: rndc-confgen.@O@ util.@O@ keygen.@O@ ${UOBJS} ${CONFDEPLIBS} ${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ rndc-confgen.@O@ util.@O@ keygen.@O@ \ diff --git a/bin/named/config.c b/bin/named/config.c index 9834c199356..8d89c89cf49 100644 --- a/bin/named/config.c +++ b/bin/named/config.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: config.c,v 1.98 2009/06/30 02:52:32 each Exp $ */ +/* $Id: config.c,v 1.99 2009/07/14 22:54:56 each Exp $ */ /*! \file */ @@ -59,9 +59,9 @@ options {\n\ files unlimited;\n\ stacksize default;\n" #endif -"# ddns-keyfile \"" NS_LOCALSTATEDIR "/run/named/ddns.key\";\n\ - ddns-keyname local-ddns;\n\ - ddns-keyalg hmac-sha256;\n\ +"# session-keyfile \"" NS_LOCALSTATEDIR "/run/named/session.key\";\n\ + session-keyname local-ddns;\n\ + session-keyalg hmac-sha256;\n\ deallocate-on-exit true;\n\ # directory \n\ dump-file \"named_dump.db\";\n\ @@ -168,7 +168,6 @@ options {\n\ notify-delay 5;\n\ notify-to-soa no;\n\ dialup no;\n\ - ddns-autoconf no;\n\ # forward \n\ # forwarders \n\ maintain-ixfr-base no;\n\ diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h index 7c3dfeb6bd1..3ddab2ab680 100644 --- a/bin/named/include/named/globals.h +++ b/bin/named/include/named/globals.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: globals.h,v 1.83 2009/06/10 00:27:21 each Exp $ */ +/* $Id: globals.h,v 1.84 2009/07/14 22:54:56 each Exp $ */ #ifndef NAMED_GLOBALS_H #define NAMED_GLOBALS_H 1 @@ -92,8 +92,8 @@ EXTERN cfg_obj_t * ns_g_bindkeys INIT(NULL); EXTERN const char * ns_g_keyfile INIT(NS_SYSCONFDIR "/rndc.key"); -EXTERN dns_tsigkey_t * ns_g_ddnskey INIT(NULL); -EXTERN dns_name_t ns_g_ddnskeyname; +EXTERN dns_tsigkey_t * ns_g_sessionkey INIT(NULL); +EXTERN dns_name_t ns_g_sessionkeyname; EXTERN const char * lwresd_g_conffile INIT(NS_SYSCONFDIR "/lwresd.conf"); @@ -119,9 +119,9 @@ EXTERN const char * ns_g_chrootdir INIT(NULL); EXTERN isc_boolean_t ns_g_foreground INIT(ISC_FALSE); EXTERN isc_boolean_t ns_g_logstderr INIT(ISC_FALSE); -EXTERN const char * ns_g_defaultddnskeyfile INIT(NS_LOCALSTATEDIR - "/run/named/" - "ddns.key"); +EXTERN const char * ns_g_defaultsessionkeyfile + INIT(NS_LOCALSTATEDIR "/run/named/" + "session.key"); #if NS_RUN_PID_DIR EXTERN const char * ns_g_defaultpidfile INIT(NS_LOCALSTATEDIR diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h index 4ade41a0085..cb1ba284999 100644 --- a/bin/named/include/named/server.h +++ b/bin/named/include/named/server.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: server.h,v 1.100 2009/07/02 07:39:02 marka Exp $ */ +/* $Id: server.h,v 1.101 2009/07/14 22:54:56 each Exp $ */ #ifndef NAMED_SERVER_H #define NAMED_SERVER_H 1 @@ -110,11 +110,11 @@ struct ns_server { ns_statschannellist_t statschannels; - dns_tsigkey_t *ddnskey; - char *ddns_keyfile; - dns_name_t *ddns_keyname; - unsigned int ddns_keyalg; - isc_uint16_t ddns_keybits; + dns_tsigkey_t *sessionkey; + char *session_keyfile; + dns_name_t *session_keyname; + unsigned int session_keyalg; + isc_uint16_t session_keybits; }; #define NS_SERVER_MAGIC ISC_MAGIC('S','V','E','R') diff --git a/bin/named/server.c b/bin/named/server.c index f14337c6f7e..f700b42feab 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: server.c,v 1.537 2009/07/02 07:39:02 marka Exp $ */ +/* $Id: server.c,v 1.538 2009/07/14 22:54:56 each Exp $ */ /*! \file */ @@ -1786,9 +1786,9 @@ configure_view(dns_view_t *view, const cfg_obj_t *config, * Configure the view's TSIG keys. */ CHECK(ns_tsigkeyring_fromconfig(config, vconfig, view->mctx, &ring)); - if (ns_g_server->ddnskey != NULL) { - CHECK(dns_tsigkeyring_add(ring, ns_g_server->ddns_keyname, - ns_g_server->ddnskey)); + if (ns_g_server->sessionkey != NULL) { + CHECK(dns_tsigkeyring_add(ring, ns_g_server->session_keyname, + ns_g_server->sessionkey)); } dns_view_setkeyring(view, ring); ring = NULL; /* ownership transferred */ @@ -3327,24 +3327,24 @@ removed(dns_zone_t *zone, void *uap) { static void cleanup_session_key(ns_server_t *server, isc_mem_t *mctx) { - if (server->ddns_keyfile != NULL) { - isc_file_remove(server->ddns_keyfile); - isc_mem_free(mctx, server->ddns_keyfile); - server->ddns_keyfile = NULL; + if (server->session_keyfile != NULL) { + isc_file_remove(server->session_keyfile); + isc_mem_free(mctx, server->session_keyfile); + server->session_keyfile = NULL; } - if (server->ddns_keyname != NULL) { - if (dns_name_dynamic(server->ddns_keyname)) - dns_name_free(server->ddns_keyname, mctx); - isc_mem_put(mctx, server->ddns_keyname, sizeof(dns_name_t)); - server->ddns_keyname = NULL; + if (server->session_keyname != NULL) { + if (dns_name_dynamic(server->session_keyname)) + dns_name_free(server->session_keyname, mctx); + isc_mem_put(mctx, server->session_keyname, sizeof(dns_name_t)); + server->session_keyname = NULL; } - if (server->ddnskey != NULL) - dns_tsigkey_detach(&server->ddnskey); + if (server->sessionkey != NULL) + dns_tsigkey_detach(&server->sessionkey); - server->ddns_keyalg = DST_ALG_UNKNOWN; - server->ddns_keybits = 0; + server->session_keyalg = DST_ALG_UNKNOWN; + server->session_keybits = 0; } static isc_result_t @@ -3395,7 +3395,13 @@ generate_session_key(const char *filename, const char *keynamestr, key = NULL; /* ownership of key has been transferred */ /* Dump the key to the key file. */ - CHECK(isc_file_safecreate(filename, &fp)); + result = isc_file_safecreate(filename, &fp); + if (result != ISC_R_SUCCESS) { + isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, + NS_LOGMODULE_SERVER, ISC_LOG_ERROR, + "could not create %s", filename); + goto cleanup; + } fprintf(fp, "key \"%s\" {\n" "\talgorithm %s;\n" @@ -3439,17 +3445,17 @@ configure_session_key(const cfg_obj_t **maps, ns_server_t *server, isc_result_t result; obj = NULL; - result = ns_config_get(maps, "ddns-keyfile", &obj); + result = ns_config_get(maps, "session-keyfile", &obj); if (result == ISC_R_SUCCESS) { if (cfg_obj_isvoid(obj)) keyfile = NULL; /* disable it */ else keyfile = cfg_obj_asstring(obj); } else - keyfile = ns_g_defaultddnskeyfile; + keyfile = ns_g_defaultsessionkeyfile; obj = NULL; - result = ns_config_get(maps, "ddns-keyname", &obj); + result = ns_config_get(maps, "session-keyname", &obj); INSIST(result == ISC_R_SUCCESS); keynamestr = cfg_obj_asstring(obj); dns_fixedname_init(&fname); @@ -3462,7 +3468,7 @@ configure_session_key(const cfg_obj_t **maps, ns_server_t *server, return (result); obj = NULL; - result = ns_config_get(maps, "ddns-keyalg", &obj); + result = ns_config_get(maps, "session-keyalg", &obj); INSIST(result == ISC_R_SUCCESS); algstr = cfg_obj_asstring(obj); algname = NULL; @@ -3470,58 +3476,58 @@ configure_session_key(const cfg_obj_t **maps, ns_server_t *server, if (result != ISC_R_SUCCESS) { const char *s = " (keeping current key)"; - cfg_obj_log(obj, ns_g_lctx, ISC_LOG_ERROR, "ddns-keyalg: " + cfg_obj_log(obj, ns_g_lctx, ISC_LOG_ERROR, "session-keyalg: " "unsupported or unknown algorithm '%s'%s", algstr, - server->ddns_keyfile != NULL ? s : ""); + server->session_keyfile != NULL ? s : ""); return (result); } /* See if we need to (re)generate a new key. */ if (keyfile == NULL) { - if (server->ddns_keyfile != NULL) + if (server->session_keyfile != NULL) need_deleteold = ISC_TRUE; - } else if (server->ddns_keyfile == NULL) + } else if (server->session_keyfile == NULL) need_createnew = ISC_TRUE; - else if (strcmp(keyfile, server->ddns_keyfile) != 0 || - !dns_name_equal(server->ddns_keyname, keyname) || - server->ddns_keyalg != algtype || - server->ddns_keybits != bits) { + else if (strcmp(keyfile, server->session_keyfile) != 0 || + !dns_name_equal(server->session_keyname, keyname) || + server->session_keyalg != algtype || + server->session_keybits != bits) { need_deleteold = ISC_TRUE; need_createnew = ISC_TRUE; } if (need_deleteold) { - INSIST(server->ddns_keyfile != NULL); - INSIST(server->ddns_keyname != NULL); - INSIST(server->ddnskey != NULL); + INSIST(server->session_keyfile != NULL); + INSIST(server->session_keyname != NULL); + INSIST(server->sessionkey != NULL); cleanup_session_key(server, mctx); } if (need_createnew) { - INSIST(server->ddnskey == NULL); - INSIST(server->ddns_keyfile == NULL); - INSIST(server->ddns_keyname == NULL); - INSIST(server->ddns_keyalg == DST_ALG_UNKNOWN); - INSIST(server->ddns_keybits == 0); - - server->ddns_keyname = isc_mem_get(mctx, sizeof(dns_name_t)); - if (server->ddns_keyname == NULL) + INSIST(server->sessionkey == NULL); + INSIST(server->session_keyfile == NULL); + INSIST(server->session_keyname == NULL); + INSIST(server->session_keyalg == DST_ALG_UNKNOWN); + INSIST(server->session_keybits == 0); + + server->session_keyname = isc_mem_get(mctx, sizeof(dns_name_t)); + if (server->session_keyname == NULL) goto cleanup; - dns_name_init(server->ddns_keyname, NULL); - CHECK(dns_name_dup(keyname, mctx, server->ddns_keyname)); + dns_name_init(server->session_keyname, NULL); + CHECK(dns_name_dup(keyname, mctx, server->session_keyname)); - server->ddns_keyfile = isc_mem_strdup(mctx, keyfile); - if (server->ddns_keyfile == NULL) + server->session_keyfile = isc_mem_strdup(mctx, keyfile); + if (server->session_keyfile == NULL) goto cleanup; - server->ddns_keyalg = algtype; - server->ddns_keybits = bits; + server->session_keyalg = algtype; + server->session_keybits = bits; CHECK(generate_session_key(keyfile, keynamestr, keyname, algstr, algname, algtype, bits, mctx, - &server->ddnskey)); + &server->sessionkey)); } return (result); @@ -3962,9 +3968,25 @@ load_configuration(const char *filename, ns_server_t *server, CHECK(isc_timer_reset(server->pps_timer, isc_timertype_ticker, NULL, &interval, ISC_FALSE)); + /* + * Write the PID file. + */ + obj = NULL; + if (ns_config_get(maps, "pid-file", &obj) == ISC_R_SUCCESS) + if (cfg_obj_isvoid(obj)) + ns_os_writepidfile(NULL, first_time); + else + ns_os_writepidfile(cfg_obj_asstring(obj), first_time); + else if (ns_g_lwresdonly) + ns_os_writepidfile(lwresd_g_defaultpidfile, first_time); + else + ns_os_writepidfile(ns_g_defaultpidfile, first_time); + /* * Configure the server-wide session key. This must be done before - * configure views because zone configuration may require ddns-keyname. + * configure views because zone configuration may need to know + * session-keyname. + * * Failure of session key generation isn't fatal at this time; if it * turns out that a session key is really needed but doesn't exist, * we'll treat it as a fatal error then. @@ -4128,17 +4150,6 @@ load_configuration(const char *filename, ns_server_t *server, } } - obj = NULL; - if (ns_config_get(maps, "pid-file", &obj) == ISC_R_SUCCESS) - if (cfg_obj_isvoid(obj)) - ns_os_writepidfile(NULL, first_time); - else - ns_os_writepidfile(cfg_obj_asstring(obj), first_time); - else if (ns_g_lwresdonly) - ns_os_writepidfile(lwresd_g_defaultpidfile, first_time); - else - ns_os_writepidfile(ns_g_defaultpidfile, first_time); - /* * Relinquish root privileges. */ @@ -4557,9 +4568,9 @@ shutdown_server(isc_task_t *task, isc_event_t *event) { dns_zonemgr_shutdown(server->zonemgr); - if (ns_g_ddnskey != NULL) { - dns_tsigkey_detach(&ns_g_ddnskey); - dns_name_free(&ns_g_ddnskeyname, server->mctx); + if (ns_g_sessionkey != NULL) { + dns_tsigkey_detach(&ns_g_sessionkey); + dns_name_free(&ns_g_sessionkeyname, server->mctx); } if (server->blackholeacl != NULL) @@ -4719,11 +4730,11 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) { ISC_LIST_INIT(server->cachelist); - server->ddnskey = NULL; - server->ddns_keyfile = NULL; - server->ddns_keyname = NULL; - server->ddns_keyalg = DST_ALG_UNKNOWN; - server->ddns_keybits = 0; + server->sessionkey = NULL; + server->session_keyfile = NULL; + server->session_keyname = NULL; + server->session_keyalg = DST_ALG_UNKNOWN; + server->session_keybits = 0; server->magic = NS_SERVER_MAGIC; *serverp = server; diff --git a/bin/named/win32/os.c b/bin/named/win32/os.c index 73b65e0de02..4ba467e1090 100644 --- a/bin/named/win32/os.c +++ b/bin/named/win32/os.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: os.c,v 1.34 2009/06/12 02:33:21 each Exp $ */ +/* $Id: os.c,v 1.35 2009/07/14 22:54:56 each Exp $ */ #include #include @@ -66,7 +66,7 @@ ns_paths_init() { ns_g_defaultpidfile = isc_ntpaths_get(NAMED_PID_PATH); lwresd_g_defaultpidfile = isc_ntpaths_get(LWRESD_PID_PATH); ns_g_keyfile = isc_ntpaths_get(RNDC_KEY_PATH); - ns_g_defaultddnskeyfile = isc_ntpaths_get(DDNS_KEY_PATH); + ns_g_defaultsessionkeyfile = isc_ntpaths_get(SESSION_KEY_PATH); Initialized = TRUE; } diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c index 8a2edd4d040..1a1cebea29d 100644 --- a/bin/named/zoneconf.c +++ b/bin/named/zoneconf.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: zoneconf.c,v 1.151 2009/06/10 23:47:47 tbox Exp $ */ +/* $Id: zoneconf.c,v 1.152 2009/07/14 22:54:56 each Exp $ */ /*% */ @@ -172,21 +172,27 @@ parse_acl: */ static isc_result_t configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone, - const char *zname, isc_boolean_t autoddns) -{ + const char *zname) { const cfg_obj_t *updatepolicy = NULL; const cfg_listelt_t *element, *element2; dns_ssutable_t *table = NULL; isc_mem_t *mctx = dns_zone_getmctx(zone); + isc_boolean_t autoddns = ISC_FALSE; isc_result_t result; (void)cfg_map_get(zconfig, "update-policy", &updatepolicy); - if (updatepolicy == NULL && !autoddns) { + if (updatepolicy == NULL) { dns_zone_setssutable(zone, NULL); return (ISC_R_SUCCESS); } + if (cfg_obj_isstring(updatepolicy) && + strcmp("local", cfg_obj_asstring(updatepolicy)) == 0) { + autoddns = ISC_TRUE; + updatepolicy = NULL; + } + result = dns_ssutable_create(mctx, &table); if (result != ISC_R_SUCCESS) return (result); @@ -336,14 +342,14 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone, } /* - * If this is a "ddns-autoconf" zone and a DDNS session key exists, - * then use the default policy, equivalent to: - * update-policy { grant zonesub any; }; + * If "update-policy local;" and a session key exists, + * then use the default policy, which is equivalent to: + * update-policy { grant zonesub any; }; */ if (autoddns) { dns_rdatatype_t any = dns_rdatatype_any; - if (ns_g_server->ddns_keyname == NULL) { + if (ns_g_server->session_keyname == NULL) { isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER, ISC_LOG_ERROR, "failed to enable auto DDNS policy " @@ -354,7 +360,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone, } result = dns_ssutable_addrule(table, ISC_TRUE, - ns_g_server->ddns_keyname, + ns_g_server->session_keyname, DNS_SSUMATCHTYPE_SUBDOMAIN, dns_zone_getorigin(zone), 1, &any); @@ -480,7 +486,6 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, isc_boolean_t check = ISC_FALSE, fail = ISC_FALSE; isc_boolean_t warn = ISC_FALSE, ignore = ISC_FALSE; isc_boolean_t ixfrdiff; - isc_boolean_t autoddns; dns_masterformat_t masterformat; isc_stats_t *zoneqrystats; isc_boolean_t zonestats_on; @@ -795,13 +800,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, "address, which is insecure", zname); - obj = NULL; - result = ns_config_get(maps, "ddns-autoconf", &obj); - INSIST(result == ISC_R_SUCCESS); - autoddns = cfg_obj_asboolean(obj); - - RETERR(configure_zone_ssutable(zoptions, zone, zname, - autoddns)); + RETERR(configure_zone_ssutable(zoptions, zone, zname)); obj = NULL; result = ns_config_get(maps, "sig-validity-interval", &obj); diff --git a/bin/nsupdate/Makefile.in b/bin/nsupdate/Makefile.in index 150bfcf578c..b479eb7e933 100644 --- a/bin/nsupdate/Makefile.in +++ b/bin/nsupdate/Makefile.in @@ -13,7 +13,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: Makefile.in,v 1.31 2009/06/11 23:47:55 tbox Exp $ +# $Id: Makefile.in,v 1.32 2009/07/14 22:54:56 each Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -65,7 +65,7 @@ MANOBJS = ${MANPAGES} ${HTMLPAGES} nsupdate.@O@: nsupdate.c ${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \ - -DDDNS_KEYFILE=\"${localstatedir}/run/named/ddns.key\" \ + -DSESSION_KEYFILE=\"${localstatedir}/run/named/session.key\" \ -c ${srcdir}/nsupdate.c nsupdate@EXEEXT@: nsupdate.@O@ ${UOBJS} ${DEPLIBS} diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c index 7963e7bf7bd..ca0bff10ceb 100644 --- a/bin/nsupdate/nsupdate.c +++ b/bin/nsupdate/nsupdate.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: nsupdate.c,v 1.168 2009/06/10 01:44:53 each Exp $ */ +/* $Id: nsupdate.c,v 1.169 2009/07/14 22:54:56 each Exp $ */ /*! \file */ @@ -562,9 +562,9 @@ setup_keystr(void) { * Get a key from a named.conf format keyfile */ static isc_result_t -read_ddnskey(isc_mem_t *mctx, isc_log_t *lctx) { +read_sessionkey(isc_mem_t *mctx, isc_log_t *lctx) { cfg_parser_t *pctx = NULL; - cfg_obj_t *ddnskey = NULL; + cfg_obj_t *sessionkey = NULL; const cfg_obj_t *key = NULL; const cfg_obj_t *secretobj = NULL; const cfg_obj_t *algorithmobj = NULL; @@ -581,11 +581,12 @@ read_ddnskey(isc_mem_t *mctx, isc_log_t *lctx) { if (result != ISC_R_SUCCESS) goto cleanup; - result = cfg_parse_file(pctx, keyfile, &cfg_type_ddnskey, &ddnskey); + result = cfg_parse_file(pctx, keyfile, &cfg_type_sessionkey, + &sessionkey); if (result != ISC_R_SUCCESS) goto cleanup; - result = cfg_map_get(ddnskey, "key", &key); + result = cfg_map_get(sessionkey, "key", &key); if (result != ISC_R_SUCCESS) goto cleanup; @@ -605,8 +606,8 @@ read_ddnskey(isc_mem_t *mctx, isc_log_t *lctx) { cleanup: if (pctx != NULL) { - if (ddnskey != NULL) - cfg_obj_destroy(pctx, &ddnskey); + if (sessionkey != NULL) + cfg_obj_destroy(pctx, &sessionkey); cfg_parser_destroy(&pctx); } @@ -629,9 +630,9 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) { DST_TYPE_PRIVATE | DST_TYPE_KEY, mctx, &dstkey); - /* If that didn't work, try reading it as a ddns.key keyfile */ + /* If that didn't work, try reading it as a session.key keyfile */ if (result != ISC_R_SUCCESS) { - result = read_ddnskey(mctx, lctx); + result = read_sessionkey(mctx, lctx); if (result == ISC_R_SUCCESS) return; } @@ -884,7 +885,7 @@ setup_system(void) { if (keystr != NULL) setup_keystr(); else if (local_only) - read_ddnskey(mctx, lctx); + read_sessionkey(mctx, lctx); else if (keyfile != NULL) setup_keyfile(mctx, lctx); } @@ -1043,7 +1044,7 @@ parse_args(int argc, char **argv, isc_mem_t *mctx, isc_entropy_t **ectx) { struct in_addr localhost; if (keyfile == NULL) - keyfile = DDNS_KEYFILE; + keyfile = SESSION_KEYFILE; if (userserver == NULL) { userserver = isc_mem_get(mctx, sizeof(isc_sockaddr_t)); diff --git a/bin/nsupdate/nsupdate.docbook b/bin/nsupdate/nsupdate.docbook index 1b5150708ac..242118b0a65 100644 --- a/bin/nsupdate/nsupdate.docbook +++ b/bin/nsupdate/nsupdate.docbook @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + Jun 30, 2000 @@ -179,9 +179,9 @@ address cannot be overridden). Connections to the local server will use a TSIG key found in /var/run/named/ddns.key, which is automatically generated by named if any - local master zone has the dynamic zone option set - to yes. The location of this key file can be overridden with - the option. + local master zone has set update-policy to + local. The location of this key file can be + overridden with the option. By default, nsupdate diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 0a621309bc8..716914140b1 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + BIND 9 Administrator Reference Manual @@ -1651,16 +1651,16 @@ controls { Dynamic update is enabled by including an - allow-update, update-policy - clause in the zone statement, or by setting the - ddns-autconf option to yes. + allow-update or an update-policy + clause in the zone statement. - If the zone's ddns-autoconf option is set to - yes, then updates to the zone - will be permitted for the key ddns.key, + If the zone's update-policy is set to + local, updates to the zone + will be permitted for the key local-ddns, which will be generated by named at startup. + See for more details. @@ -2217,9 +2217,8 @@ allow-update { key host1-host2. ;}; - You may want to read about the more powerful - update-policy statement in - . + See for a discussion of + the more flexible update-policy statement. @@ -5288,6 +5287,58 @@ badresp:1,adberr:0,findfail:0,valfail:0] + + session-keyfile + + + The pathname of the file into which to write a TSIG + session key generated by named for use by + nsupdate -l. If not specified, the + default is /var/run/named/session.key. + (See , and in + particular the discussion of the + update-policy statement's + local option for more + information about this feature.) + + + + + + session-keyname + + + The key name to use for the TSIG session key. + If not specified, the default is "local-ddns". + + + + + + session-keyalg + + + The algorithm to use for the TSIG session key. + Valid values are hmac-sha1, hmac-sha224, hmac-sha256, + hmac-sha384, hmac-sha512 and hmac-md5. If not + specified, the default is hmac-sha256. + + + + + + session-keyfile + + + The pathname of the file into which to write a session TSIG + key for use by nsupdate -l. (See the + discussion of the update-policy + statement's local option for more + details on this feature.) + + + + port @@ -9123,7 +9174,7 @@ view "external" { allow-query-on { address_match_list }; allow-transfer { address_match_list }; allow-update { address_match_list }; - update-policy { update_policy_rule ... }; + update-policy local | { update_policy_rule ... }; also-notify { ip_addr port ip_port ; ip_addr port ip_port ; ... }; check-names (warn|fail|ignore) ; @@ -9746,19 +9797,6 @@ zone zone_name class - - ddns-autoconf - - - If this flag is set to yes in - a master zone, the zone will be set to allow dynamic - updates using a TSIG session key generated by - named and stored in a file for use - by nsupdate -l on the local system, - - - - forward @@ -10115,15 +10153,14 @@ zone zone_name class - The update-policy clause is new - in BIND 9 and allows more fine-grained - control over what updates are allowed. A set of rules - is specified, where each rule either grants or denies - permissions for one or more names to be updated by - one or more identities. If the dynamic update request - message is signed (that is, it includes either a TSIG - or SIG(0) record), the identity of the signer can be - determined. + The update-policy clause + allows more fine-grained control over what updates are + allowed. A set of rules is specified, where each rule + either grants or denies permissions for one or more + names to be updated by one or more identities. If + the dynamic update request message is signed (that is, + it includes either a TSIG or SIG(0) record), the + identity of the signer can be determined. Rules are specified in the update-policy @@ -10135,9 +10172,39 @@ zone zone_name class + + There is a pre-defined update-policy + rule which can be switched on with the command + update-policy local;. + Switching on this rule in a zone causes + named to generate a TSIG session + key and place it in a file, and to allow that key + to update the zone. (By default, the file is + /var/run/named/session.key, the key + name is "local-ddns" and the key algorithm is HMAC-SHA256, + but these values are configurable with the + session-keyfile, + session-keyname and + session-keyalg options, respectively). + + + A client running on the local system, and with appropriate + permissions, may read that file and use the key to sign update + requests. The zone's update policy will be set to allow that + key to change any record within the zone. Assuming the + key name is "local-ddns", this policy is equivalent to: + + + update-policy { grant local-ddns zonesub any; }; + + + + The command nsupdate -l sends update + requests to localhost, and signs them using the session key. + - This is how a rule definition looks: + Other rule definitions look like this: @@ -10147,12 +10214,11 @@ zone zone_name class Each rule grants or denies privileges. Once a message has successfully matched a rule, the operation is immediately - granted - or denied and no further rules are examined. A rule is matched - when the signer matches the identity field, the name matches the - name field in accordance with the nametype field, and the type - matches - the types specified in the type field. + granted or denied and no further rules are examined. A rule + is matched when the signer matches the identity field, the + name matches the name field in accordance with the nametype + field, and the type matches the types specified in the type + field. No signer is required for tcp-self diff --git a/lib/bind9/check.c b/lib/bind9/check.c index 66dd12fc082..76b0daaaf2e 100644 --- a/lib/bind9/check.c +++ b/lib/bind9/check.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: check.c,v 1.103 2009/06/10 23:47:47 tbox Exp $ */ +/* $Id: check.c,v 1.104 2009/07/14 22:54:57 each Exp $ */ /*! \file */ @@ -969,6 +969,12 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) { const char *str; isc_buffer_t b; + /* Check for "update-policy local;" */ + if (cfg_obj_isstring(policy) && + strcmp("local", cfg_obj_asstring(policy)) == 0) + return (ISC_R_SUCCESS); + + /* Now check the grant policy */ for (element = cfg_list_first(policy); element != NULL; element = cfg_list_next(element)) diff --git a/lib/isc/win32/include/isc/ntpaths.h b/lib/isc/win32/include/isc/ntpaths.h index ffcf48b2681..39bcb6276f6 100644 --- a/lib/isc/win32/include/isc/ntpaths.h +++ b/lib/isc/win32/include/isc/ntpaths.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: ntpaths.h,v 1.19 2009/06/12 02:33:21 each Exp $ */ +/* $Id: ntpaths.h,v 1.20 2009/07/14 22:54:57 each Exp $ */ /* * Windows-specific path definitions @@ -41,7 +41,7 @@ enum NtPaths { LOCAL_STATE_DIR, SYS_CONF_DIR, RNDC_KEY_PATH, - DDNS_KEY_PATH + SESSION_KEY_PATH }; /* @@ -50,7 +50,7 @@ enum NtPaths { #define NAMED_CONFFILE isc_ntpaths_get(NAMED_CONF_PATH) #define RNDC_CONFFILE isc_ntpaths_get(RNDC_CONF_PATH) #define RNDC_KEYFILE isc_ntpaths_get(RNDC_KEY_PATH) -#define DDNS_KEYFILE isc_ntpaths_get(DDNS_KEY_PATH) +#define SESSION_KEYFILE isc_ntpaths_get(SESSION_KEY_PATH) #define RESOLV_CONF isc_ntpaths_get(RESOLV_CONF_PATH) /* diff --git a/lib/isc/win32/ntpaths.c b/lib/isc/win32/ntpaths.c index f52aeb97465..1ff8c5a9b5c 100644 --- a/lib/isc/win32/ntpaths.c +++ b/lib/isc/win32/ntpaths.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: ntpaths.c,v 1.14 2009/06/12 02:33:21 each Exp $ */ +/* $Id: ntpaths.c,v 1.15 2009/07/14 22:54:57 each Exp $ */ /* * This module fetches the required path information that is specific @@ -44,7 +44,7 @@ static char lwresd_defaultpidfile[MAX_PATH]; static char local_state_dir[MAX_PATH]; static char sys_conf_dir[MAX_PATH]; static char rndc_keyFile[MAX_PATH]; -static char ddns_keyFile[MAX_PATH]; +static char session_keyFile[MAX_PATH]; static DWORD baseLen = MAX_PATH; static BOOL Initialized = FALSE; @@ -85,8 +85,8 @@ isc_ntpaths_init() { strcpy(rndc_keyFile, namedBase); strcat(rndc_keyFile, "\\etc\\rndc.key"); - strcpy(ddns_keyFile, namedBase); - strcat(ddns_keyFile, "\\etc\\ddns.key"); + strcpy(session_keyFile, namedBase); + strcat(session_keyFile, "\\etc\\session.key"); strcpy(rndc_confFile, namedBase); strcat(rndc_confFile, "\\etc\\rndc.conf"); @@ -138,8 +138,8 @@ isc_ntpaths_get(int ind) { case RNDC_KEY_PATH: return (rndc_keyFile); break; - case DDNS_KEY_PATH: - return (ddns_keyFile); + case SESSION_KEY_PATH: + return (session_keyFile); break; default: return (NULL); diff --git a/lib/isccfg/include/isccfg/namedconf.h b/lib/isccfg/include/isccfg/namedconf.h index 819da4d9ff2..80860964739 100644 --- a/lib/isccfg/include/isccfg/namedconf.h +++ b/lib/isccfg/include/isccfg/namedconf.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: namedconf.h,v 1.13 2009/06/25 05:28:34 marka Exp $ */ +/* $Id: namedconf.h,v 1.14 2009/07/14 22:54:57 each Exp $ */ #ifndef ISCCFG_NAMEDCONF_H #define ISCCFG_NAMEDCONF_H 1 @@ -42,7 +42,7 @@ LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_rndcconf; LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_rndckey; /*%< A complete rndc.key file. */ -LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_ddnskey; +LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_sessionkey; /*%< A complete ddns.key file. */ LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_keyref; diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c index 05035530a04..519e62a30ad 100644 --- a/lib/isccfg/namedconf.c +++ b/lib/isccfg/namedconf.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: namedconf.c,v 1.101 2009/07/10 23:47:58 tbox Exp $ */ +/* $Id: namedconf.c,v 1.102 2009/07/14 22:54:57 each Exp $ */ /*! \file */ @@ -24,6 +24,7 @@ #include #include +#include #include #include #include @@ -35,9 +36,9 @@ #define TOKEN_STRING(pctx) (pctx->token.value.as_textregion.base) /*% Check a return value. */ -#define CHECK(op) \ - do { result = (op); \ - if (result != ISC_R_SUCCESS) goto cleanup; \ +#define CHECK(op) \ + do { result = (op); \ + if (result != ISC_R_SUCCESS) goto cleanup; \ } while (0) /*% Clean up a configuration object if non-NULL. */ @@ -57,7 +58,15 @@ static isc_result_t parse_keyvalue(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret); static isc_result_t -parse_optional_keyvalue(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret); +parse_optional_keyvalue(cfg_parser_t *pctx, const cfg_type_t *type, + cfg_obj_t **ret); + +static isc_result_t +parse_updatepolicy(cfg_parser_t *pctx, const cfg_type_t *type, + cfg_obj_t **ret); + +static void +doc_updatepolicy(cfg_printer_t *pctx, const cfg_type_t *type); static void print_keyvalue(cfg_printer_t *pctx, const cfg_obj_t *obj); @@ -330,10 +339,51 @@ static cfg_type_t cfg_type_grant = { }; static cfg_type_t cfg_type_updatepolicy = { - "update_policy", cfg_parse_bracketed_list, cfg_print_bracketed_list, - cfg_doc_bracketed_list, &cfg_rep_list, &cfg_type_grant + "update_policy", parse_updatepolicy, NULL, doc_updatepolicy, + &cfg_rep_list, &cfg_type_grant }; +static isc_result_t +parse_updatepolicy(cfg_parser_t *pctx, const cfg_type_t *type, + cfg_obj_t **ret) { + isc_result_t result; + CHECK(cfg_gettoken(pctx, 0)); + if (pctx->token.type == isc_tokentype_special && + pctx->token.value.as_char == '{') { + return (cfg_parse_bracketed_list(pctx, type, ret)); + } + + if (pctx->token.type == isc_tokentype_string && + strcasecmp(TOKEN_STRING(pctx), "local") == 0) { + cfg_obj_t *obj = NULL; + CHECK(cfg_create_obj(pctx, &cfg_type_ustring, &obj)); + obj->value.string.length = strlen("local"); + obj->value.string.base = isc_mem_get(pctx->mctx, + obj->value.string.length + 1); + if (obj->value.string.base == NULL) { + isc_mem_put(pctx->mctx, obj, sizeof(*obj)); + return (ISC_R_NOMEMORY); + } + memcpy(obj->value.string.base, "local", 5); + obj->value.string.base[5] = '\0'; + *ret = obj; + return (ISC_R_SUCCESS); + } + + cfg_ungettoken(pctx); + return (ISC_R_UNEXPECTEDTOKEN); + + cleanup: + return (result); +} + +static void +doc_updatepolicy(cfg_printer_t *pctx, const cfg_type_t *type) { + cfg_print_chars(pctx, "( local | { ", 12); + cfg_doc_obj(pctx, type->of); + cfg_print_chars(pctx, "; ... }", 7); +} + /*% * A view statement. */ @@ -534,6 +584,7 @@ parse_qstringornone(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) { isc_result_t result; + CHECK(cfg_gettoken(pctx, CFG_LEXOPT_QSTRING)); if (pctx->token.type == isc_tokentype_string && strcasecmp(TOKEN_STRING(pctx), "none") == 0) @@ -551,7 +602,9 @@ doc_qstringornone(cfg_printer_t *pctx, const cfg_type_t *type) { } static cfg_type_t cfg_type_qstringornone = { - "qstringornone", parse_qstringornone, NULL, doc_qstringornone, NULL, NULL }; + "qstringornone", parse_qstringornone, NULL, doc_qstringornone, + NULL, NULL +}; /*% * keyword hostname @@ -735,9 +788,9 @@ options_clauses[] = { { "blackhole", &cfg_type_bracketed_aml, 0 }, { "coresize", &cfg_type_size, 0 }, { "datasize", &cfg_type_size, 0 }, - { "ddns-keyfile", &cfg_type_qstringornone, 0 }, - { "ddns-keyname", &cfg_type_astring, 0 }, - { "ddns-keyalg", &cfg_type_astring, 0 }, + { "session-keyfile", &cfg_type_qstringornone, 0 }, + { "session-keyname", &cfg_type_astring, 0 }, + { "session-keyalg", &cfg_type_astring, 0 }, { "deallocate-on-exit", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE }, { "directory", &cfg_type_qstring, CFG_CLAUSEFLAG_CALLBACK }, { "dump-file", &cfg_type_qstring, 0 }, @@ -1027,7 +1080,6 @@ zone_clauses[] = { { "check-sibling", &cfg_type_boolean, 0 }, { "check-srv-cname", &cfg_type_checkmode, 0 }, { "check-wildcard", &cfg_type_boolean, 0 }, - { "ddns-autoconf", &cfg_type_boolean, 0 }, { "dialup", &cfg_type_dialuptype, 0 }, { "forward", &cfg_type_forwardtype, 0 }, { "forwarders", &cfg_type_portiplist, 0 }, @@ -1079,6 +1131,7 @@ zone_only_clauses[] = { { "masters", &cfg_type_namesockaddrkeylist, 0 }, { "pubkey", &cfg_type_pubkey, CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_OBSOLETE }, + { "ddns-autoconf", &cfg_type_boolean, 0 }, { "update-policy", &cfg_type_updatepolicy, 0 }, { "database", &cfg_type_astring, 0 }, { "delegation-only", &cfg_type_boolean, 0 }, @@ -2195,11 +2248,11 @@ LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_rndckey = { }; /* - * ddns.key has exactly the same syntax as rndc.key, but it's defined + * session.key has exactly the same syntax as rndc.key, but it's defined * separately for clarity (and so we can extend it someday, if needed). */ -LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_ddnskey = { - "ddnskey", cfg_parse_mapbody, cfg_print_mapbody, cfg_doc_mapbody, +LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_sessionkey = { + "sessionkey", cfg_parse_mapbody, cfg_print_mapbody, cfg_doc_mapbody, &cfg_rep_map, rndckey_clausesets };