1 /* $NetBSD: config.c,v 1.11 2015/07/08 17:28:55 christos Exp $ */
4 * Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
5 * Copyright (C) 2001-2003 Internet Software Consortium.
7 * Permission to use, copy, modify, and/or distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
11 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
12 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
13 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
14 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
15 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
16 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
17 * PERFORMANCE OF THIS SOFTWARE.
26 #include <isc/buffer.h>
29 #include <isc/parseint.h>
30 #include <isc/region.h>
31 #include <isc/result.h>
32 #include <isc/sockaddr.h>
33 #include <isc/string.h>
36 #include <isccfg/namedconf.h>
38 #include <dns/fixedname.h>
40 #include <dns/rdataclass.h>
41 #include <dns/rdatatype.h>
47 #include <named/config.h>
48 #include <named/globals.h>
50 #include <bind.keys.h>
52 /*% default configuration */
53 static char defaultconf
[] = "\
55 automatic-interface-scan yes;\n\
56 # blackhole {none;};\n"
58 " coresize default;\n\
63 "# session-keyfile \"" NS_LOCALSTATEDIR
"/run/named/session.key\";\n\
64 session-keyname local-ddns;\n\
65 session-keyalg hmac-sha256;\n\
66 deallocate-on-exit true;\n\
68 dump-file \"named_dump.db\";\n\
70 has-old-clients false;\n\
71 heartbeat-interval 60;\n\
72 host-statistics no;\n\
73 interface-interval 60;\n\
75 listen-on-v6 {any;};\n\
76 match-mapped-addresses no;\n\
77 max-rsa-exponent-size 0; /* no limit */\n\
78 memstatistics-file \"named.memstats\";\n\
79 multiple-cnames no;\n\
80 # named-xfer <obsolete>;\n\
81 # pid-file \"" NS_LOCALSTATEDIR
"/run/named/named.pid\"; /* or /lwresd.pid */\n\
82 bindkeys-file \"" NS_SYSCONFDIR
"/bind.keys\";\n\
85 recursing-file \"named.recursing\";\n\
86 secroots-file \"named.secroots\";\n\
90 random-device \"" PATH_RANDOMDEV
"\";\n\
94 recursive-clients 1000;\n\
95 resolver-query-timeout 10;\n\
96 rrset-order { order random; };\n\
98 serial-query-rate 20;\n\
100 statistics-file \"named.stats\";\n\
101 statistics-interval 60;\n\
103 tcp-listen-queue 10;\n\
104 # tkey-dhkey <none>\n\
105 # tkey-gssapi-credential <none>\n\
106 # tkey-domain <none>\n\
107 transfers-per-ns 2;\n\
110 treat-cr-as-space true;\n\
113 edns-udp-size 4096;\n\
114 max-udp-size 4096;\n\
116 #ifdef ISC_PLATFORM_USESIT
118 nosit-udp-size 4096;\n\
123 request-nsid false;\n\
124 reserved-sockets 512;\n\
127 dnssec-lookaside . trust-anchor dlv.isc.org;\n\
130 allow-notify {none;};\n\
131 allow-update-forwarding {none;};\n\
132 allow-query-cache { localnets; localhost; };\n\
133 allow-query-cache-on { any; };\n\
134 allow-recursion { localnets; localhost; };\n\
135 allow-recursion-on { any; };\n\
136 # allow-v6-synthesis <obsolete>;\n\
139 auth-nxdomain false;\n\
140 minimal-responses false;\n\
142 provide-ixfr true;\n\
143 request-ixfr true;\n\
146 additional-from-auth true;\n\
147 additional-from-cache true;\n\
148 query-source address *;\n\
149 query-source-v6 address *;\n\
151 notify-source-v6 *;\n\
152 cleaning-interval 0; /* now meaningless */\n\
155 max-ncache-ttl 10800; /* 3 hours */\n\
156 max-cache-ttl 604800; /* 1 week */\n\
157 transfer-format many-answers;\n\
159 check-names master fail;\n\
160 check-names slave warn;\n\
161 check-names response ignore;\n\
162 check-dup-records warn;\n\
166 acache-cleaning-interval 60;\n\
167 max-acache-size 16M;\n\
168 dnssec-enable yes;\n\
169 dnssec-validation yes; \n\
170 dnssec-accept-expired no;\n\
171 clients-per-query 10;\n\
172 max-clients-per-query 100;\n\
173 max-recursion-depth 7;\n\
174 max-recursion-queries 75;\n\
175 zero-no-soa-ttl-cache no;\n\
176 nsec3-test-zone no;\n\
177 allow-new-zones no;\n\
179 #ifdef ALLOW_FILTER_AAAA
180 " filter-aaaa-on-v4 no;\n\
181 filter-aaaa-on-v6 no;\n\
182 filter-aaaa { any; };\n\
187 allow-query {any;};\n\
188 allow-query-on {any;};\n\
189 allow-transfer {any;};\n\
191 # also-notify <none>\n\
196 # forwarders <none>\n\
197 maintain-ixfr-base no;\n\
198 # max-ixfr-log-size <obsolete>\n\
199 transfer-source *;\n\
200 transfer-source-v6 *;\n\
201 alt-transfer-source *;\n\
202 alt-transfer-source-v6 *;\n\
203 max-transfer-time-in 120;\n\
204 max-transfer-time-out 120;\n\
205 max-transfer-idle-in 60;\n\
206 max-transfer-idle-out 60;\n\
207 max-retry-time 1209600; /* 2 weeks */\n\
208 min-retry-time 500;\n\
209 max-refresh-time 2419200; /* 4 weeks */\n\
210 min-refresh-time 300;\n\
212 dnssec-secure-to-insecure no;\n\
213 sig-validity-interval 30; /* days */\n\
214 sig-signing-nodes 100;\n\
215 sig-signing-signatures 10;\n\
216 sig-signing-type 65534;\n\
217 inline-signing no;\n\
218 zone-statistics terse;\n\
219 max-journal-size unlimited;\n\
220 ixfr-from-differences false;\n\
221 check-wildcard yes;\n\
222 check-sibling yes;\n\
223 check-integrity yes;\n\
224 check-mx-cname warn;\n\
225 check-srv-cname warn;\n\
226 zero-no-soa-ttl yes;\n\
227 update-check-ksk yes;\n\
228 serial-update-method increment;\n\
229 dnssec-update-mode maintain;\n\
230 dnssec-dnskey-kskonly no;\n\
231 dnssec-loadkeys-interval 60;\n\
232 try-tcp-refresh yes; /* BIND 8 compat */\n\
237 # Zones in the \"_bind\" view are NOT counted in the count of zones.\n\
239 view \"_bind\" chaos {\n\
242 allow-new-zones no;\n\
244 # Prevent use of this zone in DNS amplified reflection DoS attacks\n\
246 responses-per-second 3;\n\
248 min-table-size 10;\n\
251 zone \"version.bind\" chaos {\n\
253 database \"_builtin version\";\n\
256 zone \"hostname.bind\" chaos {\n\
258 database \"_builtin hostname\";\n\
261 zone \"authors.bind\" chaos {\n\
263 database \"_builtin authors\";\n\
266 zone \"id.server\" chaos {\n\
268 database \"_builtin id\";\n\
273 # Default trusted key(s) for builtin DLV support\n\
274 # (used if \"dnssec-lookaside auto;\" is set and\n\
275 # sysconfdir/bind.keys doesn't exist).\n\
277 # BEGIN MANAGED KEYS\n"
279 /* Imported from bind.keys.h: */
282 "# END MANAGED KEYS\n\
286 ns_config_parsedefaults(cfg_parser_t
*parser
, cfg_obj_t
**conf
) {
289 isc_buffer_init(&b
, defaultconf
, sizeof(defaultconf
) - 1);
290 isc_buffer_add(&b
, sizeof(defaultconf
) - 1);
291 return (cfg_parse_buffer(parser
, &b
, &cfg_type_namedconf
, conf
));
295 ns_config_get(cfg_obj_t
const * const *maps
, const char *name
,
296 const cfg_obj_t
**obj
)
302 return (ISC_R_NOTFOUND
);
303 if (cfg_map_get(maps
[i
], name
, obj
) == ISC_R_SUCCESS
)
304 return (ISC_R_SUCCESS
);
309 ns_checknames_get(const cfg_obj_t
**maps
, const char *which
,
310 const cfg_obj_t
**obj
)
312 const cfg_listelt_t
*element
;
313 const cfg_obj_t
*checknames
;
314 const cfg_obj_t
*type
;
315 const cfg_obj_t
*value
;
320 return (ISC_R_NOTFOUND
);
322 if (cfg_map_get(maps
[i
], "check-names",
323 &checknames
) == ISC_R_SUCCESS
) {
325 * Zone map entry is not a list.
327 if (checknames
!= NULL
&& !cfg_obj_islist(checknames
)) {
329 return (ISC_R_SUCCESS
);
331 for (element
= cfg_list_first(checknames
);
333 element
= cfg_list_next(element
)) {
334 value
= cfg_listelt_value(element
);
335 type
= cfg_tuple_get(value
, "type");
336 if (strcasecmp(cfg_obj_asstring(type
),
338 *obj
= cfg_tuple_get(value
, "mode");
339 return (ISC_R_SUCCESS
);
348 ns_config_listcount(const cfg_obj_t
*list
) {
349 const cfg_listelt_t
*e
;
352 for (e
= cfg_list_first(list
); e
!= NULL
; e
= cfg_list_next(e
))
359 ns_config_getclass(const cfg_obj_t
*classobj
, dns_rdataclass_t defclass
,
360 dns_rdataclass_t
*classp
) {
364 if (!cfg_obj_isstring(classobj
)) {
366 return (ISC_R_SUCCESS
);
368 DE_CONST(cfg_obj_asstring(classobj
), r
.base
);
369 r
.length
= strlen(r
.base
);
370 result
= dns_rdataclass_fromtext(classp
, &r
);
371 if (result
!= ISC_R_SUCCESS
)
372 cfg_obj_log(classobj
, ns_g_lctx
, ISC_LOG_ERROR
,
373 "unknown class '%s'", r
.base
);
378 ns_config_gettype(const cfg_obj_t
*typeobj
, dns_rdatatype_t deftype
,
379 dns_rdatatype_t
*typep
) {
383 if (!cfg_obj_isstring(typeobj
)) {
385 return (ISC_R_SUCCESS
);
387 DE_CONST(cfg_obj_asstring(typeobj
), r
.base
);
388 r
.length
= strlen(r
.base
);
389 result
= dns_rdatatype_fromtext(typep
, &r
);
390 if (result
!= ISC_R_SUCCESS
)
391 cfg_obj_log(typeobj
, ns_g_lctx
, ISC_LOG_ERROR
,
392 "unknown type '%s'", r
.base
);
397 ns_config_getzonetype(const cfg_obj_t
*zonetypeobj
) {
398 dns_zonetype_t ztype
= dns_zone_none
;
401 str
= cfg_obj_asstring(zonetypeobj
);
402 if (strcasecmp(str
, "master") == 0)
403 ztype
= dns_zone_master
;
404 else if (strcasecmp(str
, "slave") == 0)
405 ztype
= dns_zone_slave
;
406 else if (strcasecmp(str
, "stub") == 0)
407 ztype
= dns_zone_stub
;
408 else if (strcasecmp(str
, "static-stub") == 0)
409 ztype
= dns_zone_staticstub
;
410 else if (strcasecmp(str
, "redirect") == 0)
411 ztype
= dns_zone_redirect
;
418 ns_config_getiplist(const cfg_obj_t
*config
, const cfg_obj_t
*list
,
419 in_port_t defport
, isc_mem_t
*mctx
,
420 isc_sockaddr_t
**addrsp
, isc_dscp_t
**dscpsp
,
421 isc_uint32_t
*countp
)
424 const cfg_obj_t
*addrlist
;
425 const cfg_obj_t
*portobj
, *dscpobj
;
426 const cfg_listelt_t
*element
;
427 isc_sockaddr_t
*addrs
;
429 isc_dscp_t dscp
= -1, *dscps
= NULL
;
432 INSIST(addrsp
!= NULL
&& *addrsp
== NULL
);
433 INSIST(dscpsp
== NULL
|| *dscpsp
== NULL
);
434 INSIST(countp
!= NULL
);
436 addrlist
= cfg_tuple_get(list
, "addresses");
437 count
= ns_config_listcount(addrlist
);
439 portobj
= cfg_tuple_get(list
, "port");
440 if (cfg_obj_isuint32(portobj
)) {
441 isc_uint32_t val
= cfg_obj_asuint32(portobj
);
442 if (val
> ISC_UINT16_MAX
) {
443 cfg_obj_log(portobj
, ns_g_lctx
, ISC_LOG_ERROR
,
444 "port '%u' out of range", val
);
445 return (ISC_R_RANGE
);
447 port
= (in_port_t
) val
;
448 } else if (defport
!= 0)
451 result
= ns_config_getport(config
, &port
);
452 if (result
!= ISC_R_SUCCESS
)
456 if (dscpsp
!= NULL
) {
457 dscps
= isc_mem_get(mctx
, count
* sizeof(isc_dscp_t
));
459 return (ISC_R_NOMEMORY
);
461 dscpobj
= cfg_tuple_get(list
, "dscp");
462 if (dscpobj
!= NULL
&& cfg_obj_isuint32(dscpobj
)) {
463 if (cfg_obj_asuint32(dscpobj
) > 63) {
464 cfg_obj_log(dscpobj
, ns_g_lctx
, ISC_LOG_ERROR
,
465 "dscp value '%u' is out of range",
466 cfg_obj_asuint32(dscpobj
));
467 return (ISC_R_RANGE
);
469 dscp
= (isc_dscp_t
)cfg_obj_asuint32(dscpobj
);
473 addrs
= isc_mem_get(mctx
, count
* sizeof(isc_sockaddr_t
));
475 return (ISC_R_NOMEMORY
);
477 for (element
= cfg_list_first(addrlist
);
479 element
= cfg_list_next(element
), i
++)
481 const cfg_obj_t
*addr
;
483 addr
= cfg_listelt_value(element
);
484 addrs
[i
] = *cfg_obj_assockaddr(addr
);
485 if (dscpsp
!= NULL
) {
486 isc_dscp_t innerdscp
;
487 innerdscp
= cfg_obj_getdscp(addr
);
490 dscps
[i
] = innerdscp
;
492 if (isc_sockaddr_getport(&addrs
[i
]) == 0)
493 isc_sockaddr_setport(&addrs
[i
], port
);
503 return (ISC_R_SUCCESS
);
507 ns_config_putiplist(isc_mem_t
*mctx
, isc_sockaddr_t
**addrsp
,
508 isc_dscp_t
**dscpsp
, isc_uint32_t count
)
510 INSIST(addrsp
!= NULL
&& *addrsp
!= NULL
);
511 INSIST(dscpsp
== NULL
|| *dscpsp
!= NULL
);
513 isc_mem_put(mctx
, *addrsp
, count
* sizeof(isc_sockaddr_t
));
516 if (dscpsp
!= NULL
) {
517 isc_mem_put(mctx
, *dscpsp
, count
* sizeof(isc_dscp_t
));
523 get_masters_def(const cfg_obj_t
*cctx
, const char *name
,
524 const cfg_obj_t
**ret
)
527 const cfg_obj_t
*masters
= NULL
;
528 const cfg_listelt_t
*elt
;
530 result
= cfg_map_get(cctx
, "masters", &masters
);
531 if (result
!= ISC_R_SUCCESS
)
533 for (elt
= cfg_list_first(masters
);
535 elt
= cfg_list_next(elt
)) {
536 const cfg_obj_t
*list
;
537 const char *listname
;
539 list
= cfg_listelt_value(elt
);
540 listname
= cfg_obj_asstring(cfg_tuple_get(list
, "name"));
542 if (strcasecmp(listname
, name
) == 0) {
544 return (ISC_R_SUCCESS
);
547 return (ISC_R_NOTFOUND
);
551 ns_config_getipandkeylist(const cfg_obj_t
*config
, const cfg_obj_t
*list
,
552 isc_mem_t
*mctx
, isc_sockaddr_t
**addrsp
,
553 isc_dscp_t
**dscpsp
, dns_name_t
***keysp
,
554 isc_uint32_t
*countp
)
556 isc_uint32_t addrcount
= 0, dscpcount
= 0, keycount
= 0, i
= 0;
557 isc_uint32_t listcount
= 0, l
= 0, j
;
558 isc_uint32_t stackcount
= 0, pushed
= 0;
560 const cfg_listelt_t
*element
;
561 const cfg_obj_t
*addrlist
;
562 const cfg_obj_t
*portobj
;
563 const cfg_obj_t
*dscpobj
;
566 dns_fixedname_t fname
;
567 isc_sockaddr_t
*addrs
= NULL
;
568 isc_dscp_t
*dscps
= NULL
;
569 dns_name_t
**keys
= NULL
;
570 struct { const char *name
; } *lists
= NULL
;
572 const cfg_listelt_t
*element
;
577 REQUIRE(addrsp
!= NULL
&& *addrsp
== NULL
);
578 REQUIRE(dscpsp
!= NULL
&& *dscpsp
== NULL
);
579 REQUIRE(keysp
!= NULL
&& *keysp
== NULL
);
580 REQUIRE(countp
!= NULL
);
583 * Get system defaults.
585 result
= ns_config_getport(config
, &port
);
586 if (result
!= ISC_R_SUCCESS
)
589 result
= ns_config_getdscp(config
, &dscp
);
590 if (result
!= ISC_R_SUCCESS
)
594 addrlist
= cfg_tuple_get(list
, "addresses");
595 portobj
= cfg_tuple_get(list
, "port");
596 dscpobj
= cfg_tuple_get(list
, "dscp");
598 if (cfg_obj_isuint32(portobj
)) {
599 isc_uint32_t val
= cfg_obj_asuint32(portobj
);
600 if (val
> ISC_UINT16_MAX
) {
601 cfg_obj_log(portobj
, ns_g_lctx
, ISC_LOG_ERROR
,
602 "port '%u' out of range", val
);
603 result
= ISC_R_RANGE
;
606 port
= (in_port_t
) val
;
609 if (dscpobj
!= NULL
&& cfg_obj_isuint32(dscpobj
)) {
610 if (cfg_obj_asuint32(dscpobj
) > 63) {
611 cfg_obj_log(dscpobj
, ns_g_lctx
, ISC_LOG_ERROR
,
612 "dscp value '%u' is out of range",
613 cfg_obj_asuint32(dscpobj
));
614 return (ISC_R_RANGE
);
616 dscp
= (isc_dscp_t
)cfg_obj_asuint32(dscpobj
);
619 result
= ISC_R_NOMEMORY
;
621 element
= cfg_list_first(addrlist
);
625 element
= cfg_list_next(element
))
627 const cfg_obj_t
*addr
;
628 const cfg_obj_t
*key
;
632 addr
= cfg_tuple_get(cfg_listelt_value(element
),
634 key
= cfg_tuple_get(cfg_listelt_value(element
), "key");
636 if (!cfg_obj_issockaddr(addr
)) {
637 const char *listname
= cfg_obj_asstring(addr
);
638 isc_result_t tresult
;
641 if (listcount
== l
) {
643 isc_uint32_t newlen
= listcount
+ 16;
644 size_t newsize
, oldsize
;
646 newsize
= newlen
* sizeof(*lists
);
647 oldsize
= listcount
* sizeof(*lists
);
648 new = isc_mem_get(mctx
, newsize
);
651 if (listcount
!= 0) {
652 memmove(new, lists
, oldsize
);
653 isc_mem_put(mctx
, lists
, oldsize
);
659 for (j
= 0; j
< l
; j
++)
660 if (strcasecmp(lists
[j
].name
, listname
) == 0)
664 tresult
= get_masters_def(config
, listname
, &list
);
665 if (tresult
== ISC_R_NOTFOUND
) {
666 cfg_obj_log(addr
, ns_g_lctx
, ISC_LOG_ERROR
,
667 "masters \"%s\" not found", listname
);
672 if (tresult
!= ISC_R_SUCCESS
)
674 lists
[l
++].name
= listname
;
676 if (stackcount
== pushed
) {
678 isc_uint32_t newlen
= stackcount
+ 16;
679 size_t newsize
, oldsize
;
681 newsize
= newlen
* sizeof(*stack
);
682 oldsize
= stackcount
* sizeof(*stack
);
683 new = isc_mem_get(mctx
, newsize
);
686 if (stackcount
!= 0) {
687 memmove(new, stack
, oldsize
);
688 isc_mem_put(mctx
, stack
, oldsize
);
694 * We want to resume processing this list on the
697 stack
[pushed
].element
= cfg_list_next(element
);
698 stack
[pushed
].port
= port
;
699 stack
[pushed
].dscp
= dscp
;
704 if (i
== addrcount
) {
706 isc_uint32_t newlen
= addrcount
+ 16;
707 size_t newsize
, oldsize
;
709 newsize
= newlen
* sizeof(isc_sockaddr_t
);
710 oldsize
= addrcount
* sizeof(isc_sockaddr_t
);
711 new = isc_mem_get(mctx
, newsize
);
714 if (addrcount
!= 0) {
715 memmove(new, addrs
, oldsize
);
716 isc_mem_put(mctx
, addrs
, oldsize
);
721 newsize
= newlen
* sizeof(isc_dscp_t
);
722 oldsize
= dscpcount
* sizeof(isc_dscp_t
);
723 new = isc_mem_get(mctx
, newsize
);
726 if (dscpcount
!= 0) {
727 memmove(new, dscps
, oldsize
);
728 isc_mem_put(mctx
, dscps
, oldsize
);
733 newsize
= newlen
* sizeof(dns_name_t
*);
734 oldsize
= keycount
* sizeof(dns_name_t
*);
735 new = isc_mem_get(mctx
, newsize
);
739 memmove(new, keys
, oldsize
);
740 isc_mem_put(mctx
, keys
, oldsize
);
746 addrs
[i
] = *cfg_obj_assockaddr(addr
);
747 if (isc_sockaddr_getport(&addrs
[i
]) == 0)
748 isc_sockaddr_setport(&addrs
[i
], port
);
749 dscps
[i
] = cfg_obj_getdscp(addr
);
753 i
++; /* Increment here so that cleanup on error works. */
754 if (!cfg_obj_isstring(key
))
756 keys
[i
- 1] = isc_mem_get(mctx
, sizeof(dns_name_t
));
757 if (keys
[i
- 1] == NULL
)
759 dns_name_init(keys
[i
- 1], NULL
);
761 keystr
= cfg_obj_asstring(key
);
762 isc_buffer_constinit(&b
, keystr
, strlen(keystr
));
763 isc_buffer_add(&b
, strlen(keystr
));
764 dns_fixedname_init(&fname
);
765 result
= dns_name_fromtext(dns_fixedname_name(&fname
), &b
,
766 dns_rootname
, 0, NULL
);
767 if (result
!= ISC_R_SUCCESS
)
769 result
= dns_name_dup(dns_fixedname_name(&fname
), mctx
,
771 if (result
!= ISC_R_SUCCESS
)
776 element
= stack
[pushed
].element
;
777 port
= stack
[pushed
].port
;
778 dscp
= stack
[pushed
].dscp
;
783 size_t newsize
, oldsize
;
785 newsize
= i
* sizeof(isc_sockaddr_t
);
786 oldsize
= addrcount
* sizeof(isc_sockaddr_t
);
788 new = isc_mem_get(mctx
, newsize
);
791 memmove(new, addrs
, newsize
);
794 isc_mem_put(mctx
, addrs
, oldsize
);
798 newsize
= i
* sizeof(isc_dscp_t
);
799 oldsize
= dscpcount
* sizeof(isc_dscp_t
);
801 new = isc_mem_get(mctx
, newsize
);
804 memmove(new, dscps
, newsize
);
807 isc_mem_put(mctx
, dscps
, oldsize
);
811 newsize
= i
* sizeof(dns_name_t
*);
812 oldsize
= keycount
* sizeof(dns_name_t
*);
814 new = isc_mem_get(mctx
, newsize
);
817 memmove(new, keys
, newsize
);
820 isc_mem_put(mctx
, keys
, oldsize
);
826 isc_mem_put(mctx
, lists
, listcount
* sizeof(*lists
));
828 isc_mem_put(mctx
, stack
, stackcount
* sizeof(*stack
));
830 INSIST(keycount
== addrcount
);
837 return (ISC_R_SUCCESS
);
841 isc_mem_put(mctx
, addrs
, addrcount
* sizeof(isc_sockaddr_t
));
843 isc_mem_put(mctx
, dscps
, dscpcount
* sizeof(isc_dscp_t
));
845 for (j
= 0; j
< i
; j
++) {
848 if (dns_name_dynamic(keys
[j
]))
849 dns_name_free(keys
[j
], mctx
);
850 isc_mem_put(mctx
, keys
[j
], sizeof(dns_name_t
));
852 isc_mem_put(mctx
, keys
, keycount
* sizeof(dns_name_t
*));
855 isc_mem_put(mctx
, lists
, listcount
* sizeof(*lists
));
857 isc_mem_put(mctx
, stack
, stackcount
* sizeof(*stack
));
862 ns_config_putipandkeylist(isc_mem_t
*mctx
, isc_sockaddr_t
**addrsp
,
863 isc_dscp_t
**dscpsp
, dns_name_t
***keysp
,
869 REQUIRE(addrsp
!= NULL
&& *addrsp
!= NULL
);
870 REQUIRE(dscpsp
== NULL
|| *dscpsp
!= NULL
);
871 REQUIRE(keysp
!= NULL
&& *keysp
!= NULL
);
875 isc_mem_put(mctx
, *addrsp
, count
* sizeof(isc_sockaddr_t
));
877 isc_mem_put(mctx
, *dscpsp
, count
* sizeof(isc_dscp_t
));
878 for (i
= 0; i
< count
; i
++) {
881 if (dns_name_dynamic(keys
[i
]))
882 dns_name_free(keys
[i
], mctx
);
883 isc_mem_put(mctx
, keys
[i
], sizeof(dns_name_t
));
885 isc_mem_put(mctx
, *keysp
, count
* sizeof(dns_name_t
*));
893 ns_config_getport(const cfg_obj_t
*config
, in_port_t
*portp
) {
894 const cfg_obj_t
*maps
[3];
895 const cfg_obj_t
*options
= NULL
;
896 const cfg_obj_t
*portobj
= NULL
;
900 (void)cfg_map_get(config
, "options", &options
);
904 maps
[i
++] = ns_g_defaults
;
907 result
= ns_config_get(maps
, "port", &portobj
);
908 INSIST(result
== ISC_R_SUCCESS
);
909 if (cfg_obj_asuint32(portobj
) >= ISC_UINT16_MAX
) {
910 cfg_obj_log(portobj
, ns_g_lctx
, ISC_LOG_ERROR
,
911 "port '%u' out of range",
912 cfg_obj_asuint32(portobj
));
913 return (ISC_R_RANGE
);
915 *portp
= (in_port_t
)cfg_obj_asuint32(portobj
);
916 return (ISC_R_SUCCESS
);
920 ns_config_getdscp(const cfg_obj_t
*config
, isc_dscp_t
*dscpp
) {
921 const cfg_obj_t
*options
= NULL
;
922 const cfg_obj_t
*dscpobj
= NULL
;
925 (void)cfg_map_get(config
, "options", &options
);
927 return (ISC_R_SUCCESS
);
929 result
= cfg_map_get(options
, "dscp", &dscpobj
);
930 if (result
!= ISC_R_SUCCESS
|| dscpobj
== NULL
) {
932 return (ISC_R_SUCCESS
);
934 if (cfg_obj_asuint32(dscpobj
) >= 64) {
935 cfg_obj_log(dscpobj
, ns_g_lctx
, ISC_LOG_ERROR
,
936 "dscp '%u' out of range",
937 cfg_obj_asuint32(dscpobj
));
938 return (ISC_R_RANGE
);
940 *dscpp
= (isc_dscp_t
)cfg_obj_asuint32(dscpobj
);
941 return (ISC_R_SUCCESS
);
944 struct keyalgorithms
{
946 enum { hmacnone
, hmacmd5
, hmacsha1
, hmacsha224
,
947 hmacsha256
, hmacsha384
, hmacsha512
} hmac
;
951 { "hmac-md5", hmacmd5
, DST_ALG_HMACMD5
, 128 },
952 { "hmac-md5.sig-alg.reg.int", hmacmd5
, DST_ALG_HMACMD5
, 0 },
953 { "hmac-md5.sig-alg.reg.int.", hmacmd5
, DST_ALG_HMACMD5
, 0 },
954 { "hmac-sha1", hmacsha1
, DST_ALG_HMACSHA1
, 160 },
955 { "hmac-sha224", hmacsha224
, DST_ALG_HMACSHA224
, 224 },
956 { "hmac-sha256", hmacsha256
, DST_ALG_HMACSHA256
, 256 },
957 { "hmac-sha384", hmacsha384
, DST_ALG_HMACSHA384
, 384 },
958 { "hmac-sha512", hmacsha512
, DST_ALG_HMACSHA512
, 512 },
959 { NULL
, hmacnone
, DST_ALG_UNKNOWN
, 0 }
963 ns_config_getkeyalgorithm(const char *str
, dns_name_t
**name
,
964 isc_uint16_t
*digestbits
)
966 return (ns_config_getkeyalgorithm2(str
, name
, NULL
, digestbits
));
970 ns_config_getkeyalgorithm2(const char *str
, dns_name_t
**name
,
971 unsigned int *typep
, isc_uint16_t
*digestbits
)
978 for (i
= 0; algorithms
[i
].str
!= NULL
; i
++) {
979 len
= strlen(algorithms
[i
].str
);
980 if (strncasecmp(algorithms
[i
].str
, str
, len
) == 0 &&
982 (algorithms
[i
].size
!= 0 && str
[len
] == '-')))
985 if (algorithms
[i
].str
== NULL
)
986 return (ISC_R_NOTFOUND
);
987 if (str
[len
] == '-') {
988 result
= isc_parse_uint16(&bits
, str
+ len
+ 1, 10);
989 if (result
!= ISC_R_SUCCESS
)
991 if (bits
> algorithms
[i
].size
)
992 return (ISC_R_RANGE
);
993 } else if (algorithms
[i
].size
== 0)
996 bits
= algorithms
[i
].size
;
999 switch (algorithms
[i
].hmac
) {
1000 case hmacmd5
: *name
= dns_tsig_hmacmd5_name
; break;
1001 case hmacsha1
: *name
= dns_tsig_hmacsha1_name
; break;
1002 case hmacsha224
: *name
= dns_tsig_hmacsha224_name
; break;
1003 case hmacsha256
: *name
= dns_tsig_hmacsha256_name
; break;
1004 case hmacsha384
: *name
= dns_tsig_hmacsha384_name
; break;
1005 case hmacsha512
: *name
= dns_tsig_hmacsha512_name
; break;
1011 *typep
= algorithms
[i
].type
;
1012 if (digestbits
!= NULL
)
1014 return (ISC_R_SUCCESS
);