mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-22 18:19:42 +00:00
Code Issues Releases Wiki Activity
bind/lib/isccfg/namedconf.c

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

4008 lines
126 KiB
C
Raw Normal View History

Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
/*
update copyright notice
2011-01-04 23:47:14 +00:00
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
*
* SPDX-License-Identifier: MPL-2.0
Update the copyright information in all files in the repository This commit converts the license handling to adhere to the REUSE specification. It specifically: 1. Adds used licnses to LICENSES/ directory 2. Add "isc" template for adding the copyright boilerplate 3. Changes all source files to include copyright and SPDX license header, this includes all the C sources, documentation, zone files, configuration files. There are notes in the doc/dev/copyrights file on how to add correct headers to the new files. 4. Handle the rest that can't be modified via .reuse/dep5 file. The binary (or otherwise unmodifiable) files could have license places next to them in <foo>.license file, but this would lead to cluttered repository and most of the files handled in the .reuse/dep5 file are system test files.
2021-06-03 08:37:05 +02:00
*
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
Update license headers to not include years in copyright in all applicable files
2018-02-23 09:53:12 +01:00
*
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*! \file */
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
Replace custom isc_u?intNN_t types with C99 u?intNN_t types
2018-03-28 14:19:37 +02:00
#include <inttypes.h>
Replace custom isc_boolean_t with C standard bool type
2018-04-17 08:29:14 -07:00
#include <stdbool.h>
[master] silence warning
2018-01-22 13:07:24 -08:00
#include <stdlib.h>
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
#include <string.h>
#include <isc/lex.h>
2630. [func] Improved syntax for DDNS autoconfiguration: use "update-policy local;" to switch on local DDNS in a zone. [RT #19875]
2009-07-14 22:54:57 +00:00
#include <isc/mem.h>
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
#include <isc/result.h>
#include <isc/string.h>
#include <isc/util.h>
[master] max-zone-ttl 3746. [func] New "max-zone-ttl" option enforces maximum TTLs for zones. If loading a zone containing a higher TTL, the load fails. DDNS updates with higher TTLs are accepted but the TTL is truncated. (Note: Currently supported for master zones only; inline-signing slaves will be added.) [RT #38405]
2014-02-18 23:26:50 -08:00
#include <dns/ttl.h>
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
#include <isccfg/cfg.h>
#include <isccfg/grammar.h>
#include <isccfg/log.h>
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
#include <isccfg/namedconf.h>
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
use token.value.as_textregion.base, not token.value.pointer
2002-01-22 19:31:57 +00:00
#define TOKEN_STRING(pctx) (pctx->token.value.as_textregion.base)
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*% Check a return value. */
2630. [func] Improved syntax for DDNS autoconfiguration: use "update-policy local;" to switch on local DDNS in a zone. [RT #19875]
2009-07-14 22:54:57 +00:00
#define CHECK(op) \
do { \
result = (op); \
if (result != ISC_R_SUCCESS) \
goto cleanup; \
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
} while (0)
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*% Clean up a configuration object if non-NULL. */
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
#define CLEANUP_OBJ(obj) \
do { \
if ((obj) != NULL) \
cfg_obj_destroy(pctx, &(obj)); \
} while (0)
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* Forward declarations of static functions.
*/
static isc_result_t
parse_keyvalue(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret);
2630. [func] Improved syntax for DDNS autoconfiguration: use "update-policy local;" to switch on local DDNS in a zone. [RT #19875]
2009-07-14 22:54:57 +00:00
static isc_result_t
parse_optional_keyvalue(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret);
static isc_result_t
parse_updatepolicy(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret);
checkpoint
2010-05-29 10:36:22 +00:00
static void
print_updatepolicy(cfg_printer_t *pctx, const cfg_obj_t *obj);
2630. [func] Improved syntax for DDNS autoconfiguration: use "update-policy local;" to switch on local DDNS in a zone. [RT #19875]
2009-07-14 22:54:57 +00:00
static void
doc_updatepolicy(cfg_printer_t *pctx, const cfg_type_t *type);
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1991. [cleanup] The configuration data, once read, should be treated as readonly. Expand the use of const to enforce this at compile time. [RT #15813]
2006-02-28 02:39:52 +00:00
static void
print_keyvalue(cfg_printer_t *pctx, const cfg_obj_t *obj);
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static void
doc_keyvalue(cfg_printer_t *pctx, const cfg_type_t *type);
static void
doc_optional_keyvalue(cfg_printer_t *pctx, const cfg_type_t *type);
enable listen-on parameters to be specified in any order updated the parser to allow the "port", "tls" and "http" paramters to "listen-on" and "listen-on-v6" to be specified in any order. previously the parser would throw an error if any other order was used than port, tls, http.
2021-02-03 11:36:33 -08:00
static isc_result_t
cfg_parse_kv_tuple(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret);
static void
cfg_print_kv_tuple(cfg_printer_t *pctx, const cfg_obj_t *obj);
static void
cfg_doc_kv_tuple(cfg_printer_t *pctx, const cfg_type_t *type);
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_acl;
4437. [func] Minimal-responses now has two additional modes no-auth and no-auth-recursive which suppress adding the NS records to the authority section as well as the associated address records for the nameservers. [RT #42005]
2016-08-12 10:48:51 +10:00
static cfg_type_t cfg_type_bracketed_namesockaddrkeylist;
Fix the configuration type used by the "server-addresses" option Contrary to what the documentation states, the "server-addresses" static-stub zone option does not accept custom port numbers. Fix the configuration type used by the "server-addresses" option to ensure documentation matches source code. Remove a check_zoneconf() test which is unnecessary with this fix in place.
2018-10-18 15:48:44 +02:00
static cfg_type_t cfg_type_bracketed_netaddrlist;
1684. [func] ixfr-from-differences now takes master and slave in addition to yes and no at the options and view levels.
2004-10-14 00:49:34 +00:00
static cfg_type_t cfg_type_bracketed_sockaddrnameportlist;
Add 'tls' configuration support for the 'forwarders' option A 'tls' statement can be specified both for individual addresses and for the whole list (as a default value when an individual address doesn't have its own 'tls' set), just as it was done before for the 'port' value. Create a new function 'print_rawqstring()' to print a string residing in a 'isc_textregion_t' type parameter. Create a new function 'copy_string()' to copy a string from a 'cfg_obj_t' object into a 'isc_textregion_t'.
2022-12-08 10:57:37 +00:00
static cfg_type_t cfg_type_bracketed_sockaddrtlslist;
Verify HTTP paths both in incoming requests and in config file This commit adds the code (and some tests) which allows verifying validity of HTTP paths both in incoming HTTP requests and in BIND's configuration file.
2021-05-19 18:03:11 +03:00
static cfg_type_t cfg_type_bracketed_http_endpoint_list;
Add new 'checkds' configuration option Add a new configuration option to set how the checkds method should work. Acceptable values are 'yes', 'no', and 'explicit'. When set to 'yes', the checkds method is to lookup the parental agents by querying the NS records of the parent zone. When set to 'no', no checkds method is enabled. Users should run the 'rndc checkds' command to signal that DS records are published and withdrawn. When set to 'explicit', the parental agents are explicitly configured with the 'parental-agents' configuration option.
2023-03-08 14:56:08 +01:00
static cfg_type_t cfg_type_checkdstype;
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
static cfg_type_t cfg_type_controls;
static cfg_type_t cfg_type_controls_sockaddr;
static cfg_type_t cfg_type_destinationlist;
static cfg_type_t cfg_type_dialuptype;
4437. [func] Minimal-responses now has two additional modes no-auth and no-auth-recursive which suppress adding the NS records to the authority section as well as the associated address records for the nameservers. [RT #42005]
2016-08-12 10:48:51 +10:00
static cfg_type_t cfg_type_dlz;
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
static cfg_type_t cfg_type_dnssecpolicy;
4437. [func] Minimal-responses now has two additional modes no-auth and no-auth-recursive which suppress adding the NS records to the authority section as well as the associated address records for the nameservers. [RT #42005]
2016-08-12 10:48:51 +10:00
static cfg_type_t cfg_type_dnstap;
static cfg_type_t cfg_type_dnstapoutput;
static cfg_type_t cfg_type_dyndb;
Add parser support for DoH configuration options This commit adds stub parser support and tests for: - an "http" global option for HTTP/2 endpoint configuration. - command line options to set http or https port numbers by specifying -p http=PORT or -p https=PORT. (NOTE: this change only affects syntax; specifying HTTP and HTTPS ports on the command line currently has no effect.) - named.conf options "http-port" and "https-port" - HTTPSPORT environment variable for use when running tests.
2020-09-16 12:21:32 -07:00
static cfg_type_t cfg_type_http_description;
1684. [func] ixfr-from-differences now takes master and slave in addition to yes and no at the options and view levels.
2004-10-14 00:49:34 +00:00
static cfg_type_t cfg_type_ixfrdifftype;
add syntax and setter/getter functions to configure max-ixfr-ratio
2020-02-21 10:53:08 -08:00
static cfg_type_t cfg_type_ixfrratio;
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
static cfg_type_t cfg_type_key;
static cfg_type_t cfg_type_logfile;
static cfg_type_t cfg_type_logging;
static cfg_type_t cfg_type_logseverity;
[master] timestamp suffixes for log files 4579. [func] Logging channels and dnstap output files can now be configured with a "suffix" option, set to either "increment" or "timestamp", indicating whether to use incrementing numbers or timestamps as the file suffix when rolling over a log file. [RT #42838]
2017-03-08 23:20:40 -08:00
static cfg_type_t cfg_type_logsuffix;
[master] dnstap size and versions options 4572. [func] The "dnstap-output" option can now take "size" and "versions" parameters to indicate the maximum size a dnstap log file can grow before rolling to a new file, and how many old files to retain. [RT #44502]
2017-02-06 16:03:37 -08:00
static cfg_type_t cfg_type_logversions;
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
static cfg_type_t cfg_type_remoteselement;
Allow for key lifetime unlimited The keyword 'unlimited' can be used instead of PT0S which means the same but is more comprehensible for users. Also fix some redundant "none" parameters in the kasp test.
2020-02-06 15:41:47 +01:00
static cfg_type_t cfg_type_maxduration;
4437. [func] Minimal-responses now has two additional modes no-auth and no-auth-recursive which suppress adding the NS records to the authority section as well as the associated address records for the nameservers. [RT #42005]
2016-08-12 10:48:51 +10:00
static cfg_type_t cfg_type_minimal;
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
static cfg_type_t cfg_type_nameportiplist;
static cfg_type_t cfg_type_notifytype;
2294. [func] Allow the experimental statistics channels to have multiple connections and ACL. Note: the stats-server and stats-server-v6 options available in the previous beta releases are replaced with the generic statistics-channels statment.
2008-01-17 00:15:14 +00:00
static cfg_type_t cfg_type_optional_allow;
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
static cfg_type_t cfg_type_optional_class;
static cfg_type_t cfg_type_optional_facility;
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_optional_keyref;
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
static cfg_type_t cfg_type_optional_port;
Add new 'source[-v6]' option for remote servers Add a new way to configure the preferred source address when talking to remote servers such as primaries and parental-agents. This will eventually deprecate options such as 'parental-source', 'parental-source-v6', 'transfer-source', etc. Example of the new configuration: parental-agents "parents" port 5353 \ source 10.10.10.10 port 5354 dscp 54 \ source-v6 2001:db8::10 port 5355 dscp 55 { 10.10.10.11; 2001:db8::11; };
2022-12-13 17:28:19 +01:00
static cfg_type_t cfg_type_optional_sourceaddr4;
static cfg_type_t cfg_type_optional_sourceaddr6;
[master] DDoS mitigation features 3938. [func] Added quotas to be used in recursive resolvers that are under high query load for names in zones whose authoritative servers are nonresponsive or are experiencing a denial of service attack. - "fetches-per-server" limits the number of simultaneous queries that can be sent to any single authoritative server. The configured value is a starting point; it is automatically adjusted downward if the server is partially or completely non-responsive. The algorithm used to adjust the quota can be configured via the "fetch-quota-params" option. - "fetches-per-zone" limits the number of simultaneous queries that can be sent for names within a single domain. (Note: Unlike "fetches-per-server", this value is not self-tuning.) - New stats counters have been added to count queries spilled due to these quotas. See the ARM for details of these options. [RT #37125]
2015-07-08 22:53:39 -07:00
static cfg_type_t cfg_type_optional_uint32;
add parser support for TLS configuration options This commit adds stub parser support and tests for: - "tls" statement, specifying key and cert. - an optional "tls" keyvalue in listen-on statements for DoT configuration. Documentation for these options has also been added to the ARM, but needs further work.
2020-09-16 12:21:32 -07:00
static cfg_type_t cfg_type_optional_tls;
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_options;
enable listen-on parameters to be specified in any order updated the parser to allow the "port", "tls" and "http" paramters to "listen-on" and "listen-on-v6" to be specified in any order. previously the parser would throw an error if any other order was used than port, tls, http.
2021-02-03 11:36:33 -08:00
static cfg_type_t cfg_type_plugin;
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
static cfg_type_t cfg_type_portiplist;
[master] allow different time formats: local, iso8601, iso8601-utc 4518. [func] The "print-time" option in the logging configuration can now take arguments "local", "iso8601" or "iso8601-utc" to indicate the format in which the date and time should be logged. For backward compatibility, "yes" is a synonym for "local". [RT #42585]
2016-11-22 23:34:47 -08:00
static cfg_type_t cfg_type_printtime;
- qname minimization: - make qname-minimization option tristate {strict,relaxed,disabled} - go straight for the record if we hit NXDOMAIN in relaxed mode - go straight for the record after 3 labels without new delegation or 7 labels total - use start of fetch (and not time of response) as 'now' time for querying cache for zonecut when following delegation.
2018-05-11 12:27:56 +02:00
static cfg_type_t cfg_type_qminmethod;
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_querysource4;
static cfg_type_t cfg_type_querysource6;
static cfg_type_t cfg_type_querysource;
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
static cfg_type_t cfg_type_server;
static cfg_type_t cfg_type_server_key_kludge;
static cfg_type_t cfg_type_size;
static cfg_type_t cfg_type_sizenodefault;
4223. [func] Add support for setting max-cache-size to percentage of available physical memory, set default to 90%. [RT #38442]
2015-09-28 11:08:50 +02:00
static cfg_type_t cfg_type_sizeorpercent;
Set a LMDB mapsize and also provide a config option to control it (#44954)
2017-04-26 23:43:35 +05:30
static cfg_type_t cfg_type_sizeval;
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_sockaddr4wild;
static cfg_type_t cfg_type_sockaddr6wild;
2294. [func] Allow the experimental statistics channels to have multiple connections and ACL. Note: the stats-server and stats-server-v6 options available in the previous beta releases are replaced with the generic statistics-channels statment.
2008-01-17 00:15:14 +00:00
static cfg_type_t cfg_type_statschannels;
add parser support for TLS configuration options This commit adds stub parser support and tests for: - "tls" statement, specifying key and cert. - an optional "tls" keyvalue in listen-on statements for DoT configuration. Documentation for these options has also been added to the ARM, but needs further work.
2020-09-16 12:21:32 -07:00
static cfg_type_t cfg_type_tlsconf;
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
static cfg_type_t cfg_type_view;
static cfg_type_t cfg_type_viewopts;
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_zone;
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*% listen-on */
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
enable listen-on parameters to be specified in any order updated the parser to allow the "port", "tls" and "http" paramters to "listen-on" and "listen-on-v6" to be specified in any order. previously the parser would throw an error if any other order was used than port, tls, http.
2021-02-03 11:36:33 -08:00
static cfg_tuplefielddef_t listenon_tuple_fields[] = {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "port", &cfg_type_optional_port, 0 },
enable listen-on parameters to be specified in any order updated the parser to allow the "port", "tls" and "http" paramters to "listen-on" and "listen-on-v6" to be specified in any order. previously the parser would throw an error if any other order was used than port, tls, http.
2021-02-03 11:36:33 -08:00
{ "tls", &cfg_type_astring, 0 },
Re-enable some TLS-related options for non-DoH builds This commit fixes a regression introduced at ea80bcc41c933efaf4572a36c961913a6e8a58b0. Some options, which are common to both DoH and DoT were mistakenly disabled for non-DoH builds. That is a mistake, because DoH does not imply DoT and vice versa. Not fixing this would make DoT functionality not accessible without DoH.
2021-09-01 10:38:01 +03:00
#if HAVE_LIBNGHTTP2
enable listen-on parameters to be specified in any order updated the parser to allow the "port", "tls" and "http" paramters to "listen-on" and "listen-on-v6" to be specified in any order. previously the parser would throw an error if any other order was used than port, tls, http.
2021-02-03 11:36:33 -08:00
{ "http", &cfg_type_astring, 0 },
Make the DNS over HTTPS support optional This commit adds two new autoconf options `--enable-doh` (enabled by default) and `--with-libnghttp2` (mandatory when DoH is enabled). When DoH support is disabled the library is not linked-in and support for http(s) protocol is disabled in the netmgr, named and dig.
2021-04-21 13:52:15 +02:00
#else
{ "http", &cfg_type_astring, CFG_CLAUSEFLAG_NOTCONFIGURED },
#endif
enable listen-on parameters to be specified in any order updated the parser to allow the "port", "tls" and "http" paramters to "listen-on" and "listen-on-v6" to be specified in any order. previously the parser would throw an error if any other order was used than port, tls, http.
2021-02-03 11:36:33 -08:00
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_listen_tuple = {
"listenon tuple", cfg_parse_kv_tuple, cfg_print_kv_tuple,
cfg_doc_kv_tuple, &cfg_rep_tuple, listenon_tuple_fields
};
static cfg_tuplefielddef_t listenon_fields[] = {
{ "tuple", &cfg_type_listen_tuple, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "acl", &cfg_type_bracketed_aml, 0 },
{ NULL, NULL, 0 }
};
[master] add DSCP support 3535. [func] Add support for setting Differentiated Services Code Point (DSCP) values in named. Most configuration options which take a "port" option (e.g., listen-on, forwarders, also-notify, masters, notify-source, etc) can now also take a "dscp" option specifying a code point for use with outgoing traffic, if supported by the underlying OS. [RT #27596]
2013-03-22 12:27:54 -07:00
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_listenon = { "listenon", cfg_parse_tuple,
[master] add DSCP support 3535. [func] Add support for setting Differentiated Services Code Point (DSCP) values in named. Most configuration options which take a "port" option (e.g., listen-on, forwarders, also-notify, masters, notify-source, etc) can now also take a "dscp" option specifying a code point for use with outgoing traffic, if supported by the underlying OS. [RT #27596]
2013-03-22 12:27:54 -07:00
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, listenon_fields };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*% acl */
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
Extend ACL syntax handling code with 'port' and 'transport' options This commit extends ACL syntax handling code with 'port' and 'transport' options. Currently, the extended syntax is available only for allow-transfer options.
2021-11-04 16:52:49 +02:00
/*
* Encrypted transfer related definitions
*/
static cfg_tuplefielddef_t cfg_transport_acl_tuple_fields[] = {
{ "port", &cfg_type_optional_port, 0 },
{ "transport", &cfg_type_astring, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_transport_acl_tuple = {
"transport-acl tuple", cfg_parse_kv_tuple,
cfg_print_kv_tuple, cfg_doc_kv_tuple,
&cfg_rep_tuple, cfg_transport_acl_tuple_fields
};
static cfg_tuplefielddef_t cfg_transport_acl_fields[] = {
{ "port-transport", &cfg_transport_acl_tuple, 0 },
{ "aml", &cfg_type_bracketed_aml, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_transport_acl = {
"transport-acl", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, cfg_transport_acl_fields
};
/*
* NOTE: To enable syntax which allows specifying port and protocol,
* replace 'cfg_type_bracketed_aml' with
* 'cfg_type_transport_acl'.
*
* Example: acl port 853 protocol tls { ... };
*/
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_tuplefielddef_t acl_fields[] = { { "name", &cfg_type_astring, 0 },
{ "value", &cfg_type_bracketed_aml,
0 },
{ NULL, NULL, 0 } };
static cfg_type_t cfg_type_acl = { "acl", cfg_parse_tuple,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, acl_fields };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
/*% remote servers, used for primaries and parental agents */
static cfg_tuplefielddef_t remotes_fields[] = {
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
{ "name", &cfg_type_astring, 0 },
{ "port", &cfg_type_optional_port, 0 },
Add new 'source[-v6]' option for remote servers Add a new way to configure the preferred source address when talking to remote servers such as primaries and parental-agents. This will eventually deprecate options such as 'parental-source', 'parental-source-v6', 'transfer-source', etc. Example of the new configuration: parental-agents "parents" port 5353 \ source 10.10.10.10 port 5354 dscp 54 \ source-v6 2001:db8::10 port 5355 dscp 55 { 10.10.10.11; 2001:db8::11; };
2022-12-13 17:28:19 +01:00
{ "source", &cfg_type_optional_sourceaddr4, 0 },
{ "source-v6", &cfg_type_optional_sourceaddr6, 0 },
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
{ "addresses", &cfg_type_bracketed_namesockaddrkeylist, 0 },
{ NULL, NULL, 0 }
};
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
static cfg_type_t cfg_type_remoteservers = { "remote-servers", cfg_parse_tuple,
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, remotes_fields };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* "sockaddrkeylist", a list of socket addresses with optional keys
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
* and an optional default port, as used in the remote-servers option.
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* E.g.,
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
* "port 1234 { myservers; 10.0.0.1 key foo; 1::2 port 69; }"
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
*/
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
static cfg_tuplefielddef_t namesockaddrkey_fields[] = {
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
{ "remoteselement", &cfg_type_remoteselement, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "key", &cfg_type_optional_keyref, 0 },
implement xfrin via XoT Add support for a "tls" key/value pair for zone primaries, referencing either a "tls" configuration statement or "ephemeral". If set to use TLS, zones will send SOA and AXFR/IXFR queries over a TLS channel.
2021-01-14 12:51:25 +01:00
{ "tls", &cfg_type_optional_tls, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 },
};
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
static cfg_type_t cfg_type_namesockaddrkey = {
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
"namesockaddrkey", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, namesockaddrkey_fields
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
static cfg_type_t cfg_type_bracketed_namesockaddrkeylist = {
"bracketed_namesockaddrkeylist",
cfg_parse_bracketed_list,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_print_bracketed_list,
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_namesockaddrkey
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
static cfg_tuplefielddef_t namesockaddrkeylist_fields[] = {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "port", &cfg_type_optional_port, 0 },
Add new 'source[-v6]' option for remote servers Add a new way to configure the preferred source address when talking to remote servers such as primaries and parental-agents. This will eventually deprecate options such as 'parental-source', 'parental-source-v6', 'transfer-source', etc. Example of the new configuration: parental-agents "parents" port 5353 \ source 10.10.10.10 port 5354 dscp 54 \ source-v6 2001:db8::10 port 5355 dscp 55 { 10.10.10.11; 2001:db8::11; };
2022-12-13 17:28:19 +01:00
{ "source", &cfg_type_optional_sourceaddr4, 0 },
{ "source-v6", &cfg_type_optional_sourceaddr6, 0 },
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
{ "addresses", &cfg_type_bracketed_namesockaddrkeylist, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
static cfg_type_t cfg_type_namesockaddrkeylist = {
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
"sockaddrkeylist", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, namesockaddrkeylist_fields
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
3109. [func] The also-notify option now uses the same syntax as a zone's masters clause. This means it is now possible to specify a TSIG key to use when sending notifies to a given server, or to include an explicit named masters list in an also-notfiy statement. [RT #23508]
2011-05-06 21:23:51 +00:00
* A list of socket addresses with an optional default port, as used
Add 'tls' configuration support for the 'forwarders' option A 'tls' statement can be specified both for individual addresses and for the whole list (as a default value when an individual address doesn't have its own 'tls' set), just as it was done before for the 'port' value. Create a new function 'print_rawqstring()' to print a string residing in a 'isc_textregion_t' type parameter. Create a new function 'copy_string()' to copy a string from a 'cfg_obj_t' object into a 'isc_textregion_t'.
2022-12-08 10:57:37 +00:00
* in the 'forwarders' option. E.g., "{ 10.0.0.1; 1::2 port 69; }"
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
*/
static cfg_tuplefielddef_t portiplist_fields[] = {
{ "port", &cfg_type_optional_port, 0 },
Add 'tls' configuration support for the 'forwarders' option A 'tls' statement can be specified both for individual addresses and for the whole list (as a default value when an individual address doesn't have its own 'tls' set), just as it was done before for the 'port' value. Create a new function 'print_rawqstring()' to print a string residing in a 'isc_textregion_t' type parameter. Create a new function 'copy_string()' to copy a string from a 'cfg_obj_t' object into a 'isc_textregion_t'.
2022-12-08 10:57:37 +00:00
{ "tls", &cfg_type_optional_tls, 0 },
{ "addresses", &cfg_type_bracketed_sockaddrtlslist, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_portiplist = { "portiplist", cfg_parse_tuple,
3109. [func] The also-notify option now uses the same syntax as a zone's masters clause. This means it is now possible to specify a TSIG key to use when sending notifies to a given server, or to include an explicit named masters list in an also-notfiy statement. [RT #23508]
2011-05-06 21:23:51 +00:00
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, portiplist_fields };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* A list of RR types, used in grant statements.
* Note that the old parser allows quotes around the RR type names.
*/
static cfg_type_t cfg_type_rrtypelist = {
2609. [func] Simplify the configuration of dynamic zones: - add ddns-confgen command to generate configuration text for named.conf - add zone option "ddns-autoconf yes;", which causes named to generate a TSIG session key and allow updates to the zone using that key - add '-l' (localhost) option to nsupdate, which causes nsupdate to connect to a locally-running named process using the session key generated by named [RT #19284]
2009-06-10 00:27:22 +00:00
"rrtypelist", cfg_parse_spacelist, cfg_print_spacelist,
update copyright notice
2009-06-10 23:47:47 +00:00
cfg_doc_terminal, &cfg_rep_list, &cfg_type_astring
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
static const char *mode_enums[] = { "deny", "grant", NULL };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_mode = {
update copyright notice
2009-07-10 23:47:58 +00:00
"mode", cfg_parse_enum, cfg_print_ustring,
2622. [bug] Printing of named.conf grammar was broken. [RT #19919]
2009-07-10 07:33:21 +00:00
cfg_doc_enum, &cfg_rep_string, &mode_enums
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
2609. [func] Simplify the configuration of dynamic zones: - add ddns-confgen command to generate configuration text for named.conf - add zone option "ddns-autoconf yes;", which causes named to generate a TSIG session key and allow updates to the zone using that key - add '-l' (localhost) option to nsupdate, which causes nsupdate to connect to a locally-running named process using the session key generated by named [RT #19284]
2009-06-10 00:27:22 +00:00
static isc_result_t
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
parse_matchtype(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
2609. [func] Simplify the configuration of dynamic zones: - add ddns-confgen command to generate configuration text for named.conf - add zone option "ddns-autoconf yes;", which causes named to generate a TSIG session key and allow updates to the zone using that key - add '-l' (localhost) option to nsupdate, which causes nsupdate to connect to a locally-running named process using the session key generated by named [RT #19284]
2009-06-10 00:27:22 +00:00
isc_result_t result;
CHECK(cfg_peektoken(pctx, 0));
if (pctx->token.type == isc_tokentype_string &&
strcasecmp(TOKEN_STRING(pctx), "zonesub") == 0)
{
update copyright notice
2009-06-10 23:47:47 +00:00
pctx->flags |= CFG_PCTX_SKIP;
2609. [func] Simplify the configuration of dynamic zones: - add ddns-confgen command to generate configuration text for named.conf - add zone option "ddns-autoconf yes;", which causes named to generate a TSIG session key and allow updates to the zone using that key - add '-l' (localhost) option to nsupdate, which causes nsupdate to connect to a locally-running named process using the session key generated by named [RT #19284]
2009-06-10 00:27:22 +00:00
}
return (cfg_parse_enum(pctx, type, ret));
cleanup:
return (result);
}
static isc_result_t
2622. [bug] Printing of named.conf grammar was broken. [RT #19919]
2009-07-10 07:33:21 +00:00
parse_matchname(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
2609. [func] Simplify the configuration of dynamic zones: - add ddns-confgen command to generate configuration text for named.conf - add zone option "ddns-autoconf yes;", which causes named to generate a TSIG session key and allow updates to the zone using that key - add '-l' (localhost) option to nsupdate, which causes nsupdate to connect to a locally-running named process using the session key generated by named [RT #19284]
2009-06-10 00:27:22 +00:00
isc_result_t result;
cfg_obj_t *obj = NULL;
if ((pctx->flags & CFG_PCTX_SKIP) != 0) {
pctx->flags &= ~CFG_PCTX_SKIP;
CHECK(cfg_parse_void(pctx, NULL, &obj));
} else {
result = cfg_parse_astring(pctx, type, &obj);
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
2609. [func] Simplify the configuration of dynamic zones: - add ddns-confgen command to generate configuration text for named.conf - add zone option "ddns-autoconf yes;", which causes named to generate a TSIG session key and allow updates to the zone using that key - add '-l' (localhost) option to nsupdate, which causes nsupdate to connect to a locally-running named process using the session key generated by named [RT #19284]
2009-06-10 00:27:22 +00:00
*ret = obj;
cleanup:
return (result);
}
2622. [bug] Printing of named.conf grammar was broken. [RT #19919]
2009-07-10 07:33:21 +00:00
static void
doc_matchname(cfg_printer_t *pctx, const cfg_type_t *type) {
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, "[ ");
2622. [bug] Printing of named.conf grammar was broken. [RT #19919]
2009-07-10 07:33:21 +00:00
cfg_doc_obj(pctx, type->of);
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ]");
2622. [bug] Printing of named.conf grammar was broken. [RT #19919]
2009-07-10 07:33:21 +00:00
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static const char *matchtype_enums[] = { "6to4-self",
add krb5-selfsub and ms-selfsub
2018-08-30 18:31:17 +10:00
"external",
"krb5-self",
"krb5-selfsub",
"krb5-subdomain",
Add {krb5,ms}-subdomain-self-rhs update policy rules The new rules compare the target name in PTR and SRV records against the machine name embedded in the kerberos principal. This can be used to further restrict what PTR and SRV records can be added or deleted via dynamic updates if desired.
2018-08-24 09:19:38 +10:00
"krb5-subdomain-self-rhs",
add krb5-selfsub and ms-selfsub
2018-08-30 18:31:17 +10:00
"ms-self",
"ms-selfsub",
"ms-subdomain",
Add {krb5,ms}-subdomain-self-rhs update policy rules The new rules compare the target name in PTR and SRV records against the machine name embedded in the kerberos principal. This can be used to further restrict what PTR and SRV records can be added or deleted via dynamic updates if desired.
2018-08-24 09:19:38 +10:00
"ms-subdomain-self-rhs",
add krb5-selfsub and ms-selfsub
2018-08-30 18:31:17 +10:00
"name",
"self",
"selfsub",
"selfwild",
"subdomain",
"tcp-self",
"wildcard",
"zonesub",
NULL };
Use clang-format to reformat the source files
2020-02-12 13:59:18 +01:00
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_matchtype = { "matchtype", parse_matchtype,
2609. [func] Simplify the configuration of dynamic zones: - add ddns-confgen command to generate configuration text for named.conf - add zone option "ddns-autoconf yes;", which causes named to generate a TSIG session key and allow updates to the zone using that key - add '-l' (localhost) option to nsupdate, which causes nsupdate to connect to a locally-running named process using the session key generated by named [RT #19284]
2009-06-10 00:27:22 +00:00
cfg_print_ustring, cfg_doc_enum,
update copyright notice
2009-06-10 23:47:47 +00:00
&cfg_rep_string, &matchtype_enums };
2609. [func] Simplify the configuration of dynamic zones: - add ddns-confgen command to generate configuration text for named.conf - add zone option "ddns-autoconf yes;", which causes named to generate a TSIG session key and allow updates to the zone using that key - add '-l' (localhost) option to nsupdate, which causes nsupdate to connect to a locally-running named process using the session key generated by named [RT #19284]
2009-06-10 00:27:22 +00:00
static cfg_type_t cfg_type_matchname = {
"optional_matchname", parse_matchname, cfg_print_ustring,
Various little fixes found by coccinelle The coccinellery repository provides many little semantic patches to fix common problems in the code. The number of semantic patches in the coccinellery repository is high and most of the semantic patches apply only for Linux, so it doesn't make sense to run them on regular basis as the processing takes a lot of time. The list of issue found in BIND 9, by no means complete, includes: - double assignment to a variable - `continue` at the end of the loop - double checks for `NULL` - useless checks for `NULL` (cannot be `NULL`, because of earlier return) - using `0` instead of `NULL` - useless extra condition (`if (foo) return; if (!foo) { ...; }`) - removing & in front of static functions passed as arguments
2019-09-09 14:05:31 +02:00
doc_matchname, &cfg_rep_tuple, &cfg_type_ustring
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* A grant statement, used in the update policy.
*/
static cfg_tuplefielddef_t grant_fields[] = {
{ "mode", &cfg_type_mode, 0 },
update copyright notice
2008-01-18 23:46:58 +00:00
{ "identity", &cfg_type_astring, 0 }, /* domain name */
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "matchtype", &cfg_type_matchtype, 0 },
2609. [func] Simplify the configuration of dynamic zones: - add ddns-confgen command to generate configuration text for named.conf - add zone option "ddns-autoconf yes;", which causes named to generate a TSIG session key and allow updates to the zone using that key - add '-l' (localhost) option to nsupdate, which causes nsupdate to connect to a locally-running named process using the session key generated by named [RT #19284]
2009-06-10 00:27:22 +00:00
{ "name", &cfg_type_matchname, 0 }, /* domain name */
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "types", &cfg_type_rrtypelist, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_grant = { "grant", cfg_parse_tuple,
2622. [bug] Printing of named.conf grammar was broken. [RT #19919]
2009-07-10 07:33:21 +00:00
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, grant_fields };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_updatepolicy = {
checkpoint
2010-05-29 10:36:22 +00:00
"update_policy", parse_updatepolicy, print_updatepolicy,
doc_updatepolicy, &cfg_rep_list, &cfg_type_grant
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
2630. [func] Improved syntax for DDNS autoconfiguration: use "update-policy local;" to switch on local DDNS in a zone. [RT #19875]
2009-07-14 22:54:57 +00:00
static isc_result_t
parse_updatepolicy(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
isc_result_t result;
CHECK(cfg_gettoken(pctx, 0));
if (pctx->token.type == isc_tokentype_special &&
pctx->token.value.as_char == '{')
{
2641. [bug] Fixed an error in parsing update-policy syntax, added a regression test to check it. [RT #20007]
2009-07-29 17:52:00 +00:00
cfg_ungettoken(pctx);
2630. [func] Improved syntax for DDNS autoconfiguration: use "update-policy local;" to switch on local DDNS in a zone. [RT #19875]
2009-07-14 22:54:57 +00:00
return (cfg_parse_bracketed_list(pctx, type, ret));
}
if (pctx->token.type == isc_tokentype_string &&
strcasecmp(TOKEN_STRING(pctx), "local") == 0)
{
cfg_obj_t *obj = NULL;
CHECK(cfg_create_obj(pctx, &cfg_type_ustring, &obj));
obj->value.string.length = strlen("local");
Remove blocks checking whether isc_mem_get() failed using the coccinelle
2019-07-16 15:52:14 +02:00
obj->value.string.base =
isc_mem_get(pctx->mctx, obj->value.string.length + 1);
[master] replace memcpy() with memmove(). 3698. [cleanup] Replaced all uses of memcpy() with memmove(). [RT #35120]
2014-01-08 16:27:10 -08:00
memmove(obj->value.string.base, "local", 5);
2630. [func] Improved syntax for DDNS autoconfiguration: use "update-policy local;" to switch on local DDNS in a zone. [RT #19875]
2009-07-14 22:54:57 +00:00
obj->value.string.base[5] = '\0';
*ret = obj;
return (ISC_R_SUCCESS);
}
cfg_ungettoken(pctx);
return (ISC_R_UNEXPECTEDTOKEN);
cleanup:
return (result);
}
checkpoint
2010-05-29 10:36:22 +00:00
static void
print_updatepolicy(cfg_printer_t *pctx, const cfg_obj_t *obj) {
if (cfg_obj_isstring(obj)) {
cfg_print_ustring(pctx, obj);
} else {
cfg_print_bracketed_list(pctx, obj);
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
checkpoint
2010-05-29 10:36:22 +00:00
}
2630. [func] Improved syntax for DDNS autoconfiguration: use "update-policy local;" to switch on local DDNS in a zone. [RT #19875]
2009-07-14 22:54:57 +00:00
static void
doc_updatepolicy(cfg_printer_t *pctx, const cfg_type_t *type) {
2889. [bug] Element of the grammar where not properly reported. [RT #21046]
2010-05-13 03:16:55 +00:00
cfg_print_cstr(pctx, "( local | { ");
2630. [func] Improved syntax for DDNS autoconfiguration: use "update-policy local;" to switch on local DDNS in a zone. [RT #19875]
2009-07-14 22:54:57 +00:00
cfg_doc_obj(pctx, type->of);
Add missing closing ')' to update-policy documentation The opening '(' before local was not being matched by a closing ')' after the closing '};'.
2022-11-04 06:03:44 +00:00
cfg_print_cstr(pctx, "; ... } )");
2630. [func] Improved syntax for DDNS autoconfiguration: use "update-policy local;" to switch on local DDNS in a zone. [RT #19875]
2009-07-14 22:54:57 +00:00
}
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* A view statement.
*/
static cfg_tuplefielddef_t view_fields[] = {
{ "name", &cfg_type_astring, 0 },
{ "class", &cfg_type_optional_class, 0 },
{ "options", &cfg_type_viewopts, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_view = { "view", cfg_parse_tuple,
2622. [bug] Printing of named.conf grammar was broken. [RT #19919]
2009-07-10 07:33:21 +00:00
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, view_fields };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* A zone statement.
*/
static cfg_tuplefielddef_t zone_fields[] = {
{ "name", &cfg_type_astring, 0 },
{ "class", &cfg_type_optional_class, 0 },
{ "options", &cfg_type_zoneopts, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_zone = { "zone", cfg_parse_tuple,
2622. [bug] Printing of named.conf grammar was broken. [RT #19919]
2009-07-10 07:33:21 +00:00
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, zone_fields };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
/*%
* A dnssec-policy statement.
*/
static cfg_tuplefielddef_t dnssecpolicy_fields[] = {
{ "name", &cfg_type_astring, 0 },
{ "options", &cfg_type_dnssecpolicyopts, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_dnssecpolicy = {
"dnssec-policy", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, dnssecpolicy_fields
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* A "category" clause in the "logging" statement.
*/
static cfg_tuplefielddef_t category_fields[] = {
{ "name", &cfg_type_astring, 0 },
{ "destinations", &cfg_type_destinationlist, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_category = { "category", cfg_parse_tuple,
2622. [bug] Printing of named.conf grammar was broken. [RT #19919]
2009-07-10 07:33:21 +00:00
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, category_fields };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
Allow for key lifetime unlimited The keyword 'unlimited' can be used instead of PT0S which means the same but is more comprehensible for users. Also fix some redundant "none" parameters in the kasp test.
2020-02-06 15:41:47 +01:00
static isc_result_t
parse_maxduration(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
return (cfg_parse_enum_or_other(pctx, type, &cfg_type_duration, ret));
}
static void
doc_maxduration(cfg_printer_t *pctx, const cfg_type_t *type) {
cfg_doc_enum_or_other(pctx, type, &cfg_type_duration);
}
/*%
* A duration or "unlimited", but not "default".
*/
static const char *maxduration_enums[] = { "unlimited", NULL };
static cfg_type_t cfg_type_maxduration = {
"maxduration_no_default", parse_maxduration, cfg_print_ustring,
doc_maxduration, &cfg_rep_duration, maxduration_enums
};
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
2665. [func] Clarify syntax for managed-keys {} statement, add ARM documentation about RFC 5011 support. [RT #19874]
2009-09-01 07:14:26 +00:00
* A dnssec key, as used in the "trusted-keys" statement.
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
*/
2619. [func] Add support for RFC 5011, automatic trust anchor maintenance. The new "managed-keys" statement can be used in place of "trusted-keys" for zones which support this protocol. (Note: this syntax is expected to change prior to 9.7.0 final.) [RT #19248]
2009-06-30 02:53:46 +00:00
static cfg_tuplefielddef_t dnsseckey_fields[] = {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "name", &cfg_type_astring, 0 },
add "static-ds" and "initial-ds" keywords to config parser
2019-09-15 22:15:29 -07:00
{ "anchortype", &cfg_type_void, 0 },
Minor fixes in trust anchor code This commit makes some minor changes to the trust anchor code: 1. Replace the undescriptive n1, n2 and n3 identifiers with slightly better rdata1, rdata2, and rdata3. 2. Fix an occurrence where in the error log message a static number 32 was printed, rather than the rdata3 length. 3. Add a default case to the switch statement checking DS digest algorithms to catch unknown algorithms.
2019-12-02 09:29:02 +01:00
{ "rdata1", &cfg_type_uint32, 0 },
{ "rdata2", &cfg_type_uint32, 0 },
{ "rdata3", &cfg_type_uint32, 0 },
add "static-ds" and "initial-ds" keywords to config parser
2019-09-15 22:15:29 -07:00
{ "data", &cfg_type_qstring, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
2619. [func] Add support for RFC 5011, automatic trust anchor maintenance. The new "managed-keys" statement can be used in place of "trusted-keys" for zones which support this protocol. (Note: this syntax is expected to change prior to 9.7.0 final.) [RT #19248]
2009-06-30 02:53:46 +00:00
static cfg_type_t cfg_type_dnsseckey = { "dnsseckey", cfg_parse_tuple,
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, dnsseckey_fields };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
Make key-directory optional The key-directory keyword actually does nothing right now but may be useful in the future if we want to differentiate between key directories or HSM keys, or if we want to speficy different directories for different keys or policies. Make it optional for the time being.
2020-02-06 15:56:58 +01:00
/*%
* Optional enums.
*
*/
static isc_result_t
parse_optional_enum(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
return (cfg_parse_enum_or_other(pctx, type, &cfg_type_void, ret));
}
static void
doc_optional_enum(cfg_printer_t *pctx, const cfg_type_t *type) {
UNUSED(type);
cfg_print_cstr(pctx, "[ ");
cfg_doc_enum(pctx, type);
cfg_print_cstr(pctx, " ]");
}
2665. [func] Clarify syntax for managed-keys {} statement, add ARM documentation about RFC 5011 support. [RT #19874]
2009-09-01 07:14:26 +00:00
/*%
"dnssec-keys" is now a synonym for "managed-keys" - managed-keys is now deprecated as well as trusted-keys, though it continues to work as a synonym for dnssec-keys - references to managed-keys have been updated throughout the code. - tests have been updated to use dnssec-keys format - also the trusted-keys entries have been removed from the generated bind.keys.h file and are no longer generated by bindkeys.pl.
2018-10-05 12:00:42 -07:00
* A key initialization specifier, as used in the
Rename 'dnssec-keys' to 'trust-anchors'
2019-12-04 11:06:40 +01:00
* "trust-anchors" (or synonymous "managed-keys") statement.
2665. [func] Clarify syntax for managed-keys {} statement, add ARM documentation about RFC 5011 support. [RT #19874]
2009-09-01 07:14:26 +00:00
*/
add "static-ds" and "initial-ds" keywords to config parser
2019-09-15 22:15:29 -07:00
static const char *anchortype_enums[] = { "static-key", "initial-key",
"static-ds", "initial-ds", NULL };
static cfg_type_t cfg_type_anchortype = { "anchortype", cfg_parse_enum,
cfg_print_ustring, cfg_doc_enum,
&cfg_rep_string, anchortype_enums };
2665. [func] Clarify syntax for managed-keys {} statement, add ARM documentation about RFC 5011 support. [RT #19874]
2009-09-01 07:14:26 +00:00
static cfg_tuplefielddef_t managedkey_fields[] = {
{ "name", &cfg_type_astring, 0 },
add "static-ds" and "initial-ds" keywords to config parser
2019-09-15 22:15:29 -07:00
{ "anchortype", &cfg_type_anchortype, 0 },
Minor fixes in trust anchor code This commit makes some minor changes to the trust anchor code: 1. Replace the undescriptive n1, n2 and n3 identifiers with slightly better rdata1, rdata2, and rdata3. 2. Fix an occurrence where in the error log message a static number 32 was printed, rather than the rdata3 length. 3. Add a default case to the switch statement checking DS digest algorithms to catch unknown algorithms.
2019-12-02 09:29:02 +01:00
{ "rdata1", &cfg_type_uint32, 0 },
{ "rdata2", &cfg_type_uint32, 0 },
{ "rdata3", &cfg_type_uint32, 0 },
add "static-ds" and "initial-ds" keywords to config parser
2019-09-15 22:15:29 -07:00
{ "data", &cfg_type_qstring, 0 },
2665. [func] Clarify syntax for managed-keys {} statement, add ARM documentation about RFC 5011 support. [RT #19874]
2009-09-01 07:14:26 +00:00
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_managedkey = { "managedkey", cfg_parse_tuple,
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, managedkey_fields };
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
/*%
* DNSSEC key roles.
*/
static const char *dnsseckeyrole_enums[] = { "csk", "ksk", "zsk", NULL };
static cfg_type_t cfg_type_dnsseckeyrole = {
"dnssec-key-role", cfg_parse_enum, cfg_print_ustring,
cfg_doc_enum, &cfg_rep_string, &dnsseckeyrole_enums
};
/*%
* DNSSEC key storage types.
*/
static const char *dnsseckeystore_enums[] = { "key-directory", NULL };
static cfg_type_t cfg_type_dnsseckeystore = {
Make key-directory optional The key-directory keyword actually does nothing right now but may be useful in the future if we want to differentiate between key directories or HSM keys, or if we want to speficy different directories for different keys or policies. Make it optional for the time being.
2020-02-06 15:56:58 +01:00
"dnssec-key-storage", parse_optional_enum, cfg_print_ustring,
doc_optional_enum, &cfg_rep_string, dnsseckeystore_enums
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
};
/*%
* A dnssec key, as used in the "keys" statement in a "dnssec-policy".
*/
add support for key algorithm mnemonics in dnssec-policy
2020-02-06 12:13:20 -08:00
static keyword_type_t algorithm_kw = { "algorithm", &cfg_type_ustring };
Use keywords in dnssec-policy keys configuration Add keywords 'lifetime' and 'algorithm' to make the key configuration more clear.
2019-10-21 13:26:30 +02:00
static cfg_type_t cfg_type_algorithm = { "algorithm", parse_keyvalue,
print_keyvalue, doc_keyvalue,
add support for key algorithm mnemonics in dnssec-policy
2020-02-06 12:13:20 -08:00
&cfg_rep_string, &algorithm_kw };
Use keywords in dnssec-policy keys configuration Add keywords 'lifetime' and 'algorithm' to make the key configuration more clear.
2019-10-21 13:26:30 +02:00
Allow for key lifetime unlimited The keyword 'unlimited' can be used instead of PT0S which means the same but is more comprehensible for users. Also fix some redundant "none" parameters in the kasp test.
2020-02-06 15:41:47 +01:00
static keyword_type_t lifetime_kw = { "lifetime",
&cfg_type_duration_or_unlimited };
Use keywords in dnssec-policy keys configuration Add keywords 'lifetime' and 'algorithm' to make the key configuration more clear.
2019-10-21 13:26:30 +02:00
static cfg_type_t cfg_type_lifetime = { "lifetime", parse_keyvalue,
print_keyvalue, doc_keyvalue,
&cfg_rep_duration, &lifetime_kw };
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
static cfg_tuplefielddef_t kaspkey_fields[] = {
{ "role", &cfg_type_dnsseckeyrole, 0 },
{ "keystore-type", &cfg_type_dnsseckeystore, 0 },
Use keywords in dnssec-policy keys configuration Add keywords 'lifetime' and 'algorithm' to make the key configuration more clear.
2019-10-21 13:26:30 +02:00
{ "lifetime", &cfg_type_lifetime, 0 },
{ "algorithm", &cfg_type_algorithm, 0 },
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
{ "length", &cfg_type_optional_uint32, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_kaspkey = { "kaspkey", cfg_parse_tuple,
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, kaspkey_fields };
Add kasp nsec3param configuration Add configuration and documentation on how to enable NSEC3 when using dnssec-policy for signing your zones.
2020-10-09 14:19:10 +02:00
/*%
* NSEC3 parameters.
*/
static keyword_type_t nsec3iter_kw = { "iterations", &cfg_type_uint32 };
static cfg_type_t cfg_type_nsec3iter = {
"iterations", parse_optional_keyvalue, print_keyvalue,
doc_optional_keyvalue, &cfg_rep_uint32, &nsec3iter_kw
};
static keyword_type_t nsec3optout_kw = { "optout", &cfg_type_boolean };
static cfg_type_t cfg_type_nsec3optout = {
"optout", parse_optional_keyvalue,
print_keyvalue, doc_optional_keyvalue,
&cfg_rep_boolean, &nsec3optout_kw
};
Change nsec3param salt config to saltlen Upon request from Mark, change the configuration of salt to salt length. Introduce a new function 'dns_zone_checknsec3aram' that can be used upon reconfiguration to check if the existing NSEC3 parameters are in sync with the configuration. If a salt is used that matches the configured salt length, don't change the NSEC3 parameters.
2020-10-23 15:02:19 +02:00
static keyword_type_t nsec3salt_kw = { "salt-length", &cfg_type_uint32 };
Add kasp nsec3param configuration Add configuration and documentation on how to enable NSEC3 when using dnssec-policy for signing your zones.
2020-10-09 14:19:10 +02:00
static cfg_type_t cfg_type_nsec3salt = {
Change nsec3param salt config to saltlen Upon request from Mark, change the configuration of salt to salt length. Introduce a new function 'dns_zone_checknsec3aram' that can be used upon reconfiguration to check if the existing NSEC3 parameters are in sync with the configuration. If a salt is used that matches the configured salt length, don't change the NSEC3 parameters.
2020-10-23 15:02:19 +02:00
"salt-length", parse_optional_keyvalue, print_keyvalue,
doc_optional_keyvalue, &cfg_rep_uint32, &nsec3salt_kw
Add kasp nsec3param configuration Add configuration and documentation on how to enable NSEC3 when using dnssec-policy for signing your zones.
2020-10-09 14:19:10 +02:00
};
static cfg_tuplefielddef_t nsec3param_fields[] = {
{ "iterations", &cfg_type_nsec3iter, 0 },
{ "optout", &cfg_type_nsec3optout, 0 },
Change nsec3param salt config to saltlen Upon request from Mark, change the configuration of salt to salt length. Introduce a new function 'dns_zone_checknsec3aram' that can be used upon reconfiguration to check if the existing NSEC3 parameters are in sync with the configuration. If a salt is used that matches the configured salt length, don't change the NSEC3 parameters.
2020-10-23 15:02:19 +02:00
{ "salt-length", &cfg_type_nsec3salt, 0 },
Add kasp nsec3param configuration Add configuration and documentation on how to enable NSEC3 when using dnssec-policy for signing your zones.
2020-10-09 14:19:10 +02:00
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_nsec3 = { "nsec3param", cfg_parse_tuple,
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, nsec3param_fields };
Use keywords in dnssec-policy keys configuration Add keywords 'lifetime' and 'algorithm' to make the key configuration more clear.
2019-10-21 13:26:30 +02:00
/*%
* Wild class, type, name.
*/
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static keyword_type_t wild_class_kw = { "class", &cfg_type_ustring };
static cfg_type_t cfg_type_optional_wild_class = {
"optional_wild_class", parse_optional_keyvalue, print_keyvalue,
doc_optional_keyvalue, &cfg_rep_string, &wild_class_kw
};
static keyword_type_t wild_type_kw = { "type", &cfg_type_ustring };
static cfg_type_t cfg_type_optional_wild_type = {
"optional_wild_type", parse_optional_keyvalue, print_keyvalue,
doc_optional_keyvalue, &cfg_rep_string, &wild_type_kw
};
static keyword_type_t wild_name_kw = { "name", &cfg_type_qstring };
static cfg_type_t cfg_type_optional_wild_name = {
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
"optional_wild_name", parse_optional_keyvalue, print_keyvalue,
doc_optional_keyvalue, &cfg_rep_string, &wild_name_kw
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* An rrset ordering element.
*/
static cfg_tuplefielddef_t rrsetorderingelement_fields[] = {
{ "class", &cfg_type_optional_wild_class, 0 },
{ "type", &cfg_type_optional_wild_type, 0 },
{ "name", &cfg_type_optional_wild_name, 0 },
update copyright notice
2008-01-18 23:46:58 +00:00
{ "order", &cfg_type_ustring, 0 }, /* must be literal "order" */
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "ordering", &cfg_type_ustring, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_rrsetorderingelement = {
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
"rrsetorderingelement", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, rrsetorderingelement_fields
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* A global or view "check-names" option. Note that the zone
* "check-names" option has a different syntax.
*/
1586. [func] "check-names" is now implemented.
2004-02-27 20:41:51 +00:00
[master] allow primary/secondary as synonyms for master/slave 4848. [func] Zone types "primary" and "secondary" can now be used as synonyms for "master" and "slave" in named.conf. [RT #46713]
2017-12-15 01:47:05 -08:00
static const char *checktype_enums[] = { "primary", "master", "secondary",
"slave", "response", NULL };
1586. [func] "check-names" is now implemented.
2004-02-27 20:41:51 +00:00
static cfg_type_t cfg_type_checktype = { "checktype", cfg_parse_enum,
cfg_print_ustring, cfg_doc_enum,
&cfg_rep_string, &checktype_enums };
static const char *checkmode_enums[] = { "fail", "warn", "ignore", NULL };
static cfg_type_t cfg_type_checkmode = { "checkmode", cfg_parse_enum,
cfg_print_ustring, cfg_doc_enum,
&cfg_rep_string, &checkmode_enums };
3559. [func] Check that both forms of Sender Policy Framework records exist or do not exist. [RT #33355]
2013-04-30 13:49:41 +10:00
static const char *warn_enums[] = { "warn", "ignore", NULL };
static cfg_type_t cfg_type_warn = {
"warn", cfg_parse_enum, cfg_print_ustring,
cfg_doc_enum, &cfg_rep_string, &warn_enums
};
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_tuplefielddef_t checknames_fields[] = {
1586. [func] "check-names" is now implemented.
2004-02-27 20:41:51 +00:00
{ "type", &cfg_type_checktype, 0 },
{ "mode", &cfg_type_checkmode, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
2801. [func] Detect and report records that are different according to DNSSEC but are sematically equal according to plain DNS. Apply plain DNS comparisons rather than DNSSEC comparisons when processing UPDATE requests. dnssec-signzone now removes such semantically duplicate records prior to signing the RRset. named-checkzone -r {ignore|warn|fail} (default warn) named-compilezone -r {ignore|warn|fail} (default warn) named.conf: check-dup-records {ignore|warn|fail};
2009-12-04 21:09:34 +00:00
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_checknames = { "checknames", cfg_parse_tuple,
[master] add DSCP support 3535. [func] Add support for setting Differentiated Services Code Point (DSCP) values in named. Most configuration options which take a "port" option (e.g., listen-on, forwarders, also-notify, masters, notify-source, etc) can now also take a "dscp" option specifying a code point for use with outgoing traffic, if supported by the underlying OS. [RT #27596]
2013-03-22 12:27:54 -07:00
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, checknames_fields };
Fix the configuration type used by the "server-addresses" option Contrary to what the documentation states, the "server-addresses" static-stub zone option does not accept custom port numbers. Fix the configuration type used by the "server-addresses" option to ensure documentation matches source code. Remove a check_zoneconf() test which is unnecessary with this fix in place.
2018-10-18 15:48:44 +02:00
static cfg_type_t cfg_type_bracketed_netaddrlist = { "bracketed_netaddrlist",
cfg_parse_bracketed_list,
[master] add DSCP support 3535. [func] Add support for setting Differentiated Services Code Point (DSCP) values in named. Most configuration options which take a "port" option (e.g., listen-on, forwarders, also-notify, masters, notify-source, etc) can now also take a "dscp" option specifying a code point for use with outgoing traffic, if supported by the underlying OS. [RT #27596]
2013-03-22 12:27:54 -07:00
cfg_print_bracketed_list,
cfg_doc_bracketed_list,
&cfg_rep_list,
Fix the configuration type used by the "server-addresses" option Contrary to what the documentation states, the "server-addresses" static-stub zone option does not accept custom port numbers. Fix the configuration type used by the "server-addresses" option to ensure documentation matches source code. Remove a check_zoneconf() test which is unnecessary with this fix in place.
2018-10-18 15:48:44 +02:00
&cfg_type_netaddr };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
Add 'tls' configuration support for the 'forwarders' option A 'tls' statement can be specified both for individual addresses and for the whole list (as a default value when an individual address doesn't have its own 'tls' set), just as it was done before for the 'port' value. Create a new function 'print_rawqstring()' to print a string residing in a 'isc_textregion_t' type parameter. Create a new function 'copy_string()' to copy a string from a 'cfg_obj_t' object into a 'isc_textregion_t'.
2022-12-08 10:57:37 +00:00
static cfg_type_t cfg_type_bracketed_sockaddrtlslist = {
"bracketed_sockaddrtlslist",
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_sockaddrtls
};
fully remove DSCP The "dscp" option is now marked as "ancient" and it is a configuration error to use it or to configure DSCP values for any source-address option.
2023-01-09 16:57:41 -08:00
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
static const char *autodnssec_enums[] = { "allow", "maintain", "off", NULL };
2712. [func] New 'auto-dnssec' zone option allows zone signing to be fully automated in zones configured for dynamic DNS. 'auto-dnssec allow;' permits a zone to be signed by creating keys for it in the key-directory and using 'rndc sign <zone>'. 'auto-dnssec maintain;' allows that too, plus it also keeps the zone's DNSSEC keys up to date according to their timing metadata. [RT #19943]
2009-10-12 20:48:12 +00:00
static cfg_type_t cfg_type_autodnssec = {
"autodnssec", cfg_parse_enum, cfg_print_ustring,
cfg_doc_enum, &cfg_rep_string, &autodnssec_enums
};
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
static const char *dnssecupdatemode_enums[] = { "maintain", "no-resign", NULL };
3116. [func] New 'dnssec-update-mode' option controls updates of DNSSEC records in signed dynamic zones. Set to 'no-resign' to disable automatic RRSIG regeneration while retaining the ability to sign new or changed data. [RT #24533]
2011-05-23 20:10:03 +00:00
static cfg_type_t cfg_type_dnssecupdatemode = {
"dnssecupdatemode", cfg_parse_enum, cfg_print_ustring,
cfg_doc_enum, &cfg_rep_string, &dnssecupdatemode_enums
};
[master] serial-update-method date; 3811. [func] "serial-update-method date;" sets serial number on dynamic update to today's date in YYYYMMDDNN format. (Thanks to Bradley Forschinger.) [RT #24903]
2014-04-17 16:05:50 -07:00
static const char *updatemethods_enums[] = { "date", "increment", "unixtime",
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
NULL };
3130. [func] Support alternate methods for managing a dynamic zone's serial number. Two methods are currently defined using serial-update-method, "increment" (default) and "unixtime". [RT #23849]
2011-07-01 02:25:48 +00:00
static cfg_type_t cfg_type_updatemethod = {
"updatemethod", cfg_parse_enum, cfg_print_ustring,
cfg_doc_enum, &cfg_rep_string, &updatemethods_enums
};
[master] better zone-statistics syntax 3501. [func] zone-statistics now takes three options: full, terse, and none. "yes" and "no" are retained as synonyms for full and terse, respectively. [RT #29165]
2013-02-27 11:53:58 -08:00
/*
* zone-statistics: full, terse, or none.
*
* for backward compatibility, we also support boolean values.
* yes represents "full", no represents "terse". in the future we
* may change no to mean "none".
*/
static const char *zonestat_enums[] = { "full", "terse", "none", NULL };
static isc_result_t
parse_zonestat(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
[master] better zone-statistics syntax 3501. [func] zone-statistics now takes three options: full, terse, and none. "yes" and "no" are retained as synonyms for full and terse, respectively. [RT #29165]
2013-02-27 11:53:58 -08:00
}
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
static void
doc_zonestat(cfg_printer_t *pctx, const cfg_type_t *type) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
cfg_doc_enum_or_other(pctx, type, &cfg_type_boolean);
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
}
[master] better zone-statistics syntax 3501. [func] zone-statistics now takes three options: full, terse, and none. "yes" and "no" are retained as synonyms for full and terse, respectively. [RT #29165]
2013-02-27 11:53:58 -08:00
static cfg_type_t cfg_type_zonestat = { "zonestat", parse_zonestat,
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
cfg_print_ustring, doc_zonestat,
[master] better zone-statistics syntax 3501. [func] zone-statistics now takes three options: full, terse, and none. "yes" and "no" are retained as synonyms for full and terse, respectively. [RT #29165]
2013-02-27 11:53:58 -08:00
&cfg_rep_string, zonestat_enums };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_rrsetorder = { "rrsetorder",
[master] add DSCP support 3535. [func] Add support for setting Differentiated Services Code Point (DSCP) values in named. Most configuration options which take a "port" option (e.g., listen-on, forwarders, also-notify, masters, notify-source, etc) can now also take a "dscp" option specifying a code point for use with outgoing traffic, if supported by the underlying OS. [RT #27596]
2013-03-22 12:27:54 -07:00
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_rrsetorderingelement };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static keyword_type_t port_kw = { "port", &cfg_type_uint32 };
static cfg_type_t cfg_type_optional_port = {
"optional_port", parse_optional_keyvalue, print_keyvalue,
doc_optional_keyvalue, &cfg_rep_uint32, &port_kw
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*% A list of keys, as in the "key" clause of the controls statement. */
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_keylist = { "keylist",
2619. [func] Add support for RFC 5011, automatic trust anchor maintenance. The new "managed-keys" statement can be used in place of "trusted-keys" for zones which support this protocol. (Note: this syntax is expected to change prior to 9.7.0 final.) [RT #19248]
2009-06-30 02:53:46 +00:00
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_astring };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
deprecate "trusted-keys" - trusted-keys is now flagged as deprecated, but still works - managed-keys can be used to configure permanent trust anchors by using the "static-key" keyword in place of "initial-key" - parser now uses an enum for static-key and initial-key keywords
2018-08-15 16:59:45 -07:00
/*% A list of dnssec keys, as in "trusted-keys". Deprecated. */
"dnssec-keys" is now a synonym for "managed-keys" - managed-keys is now deprecated as well as trusted-keys, though it continues to work as a synonym for dnssec-keys - references to managed-keys have been updated throughout the code. - tests have been updated to use dnssec-keys format - also the trusted-keys entries have been removed from the generated bind.keys.h file and are no longer generated by bindkeys.pl.
2018-10-05 12:00:42 -07:00
static cfg_type_t cfg_type_trustedkeys = { "trustedkeys",
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
2619. [func] Add support for RFC 5011, automatic trust anchor maintenance. The new "managed-keys" statement can be used in place of "trusted-keys" for zones which support this protocol. (Note: this syntax is expected to change prior to 9.7.0 final.) [RT #19248]
2009-06-30 02:53:46 +00:00
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_dnsseckey };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
2665. [func] Clarify syntax for managed-keys {} statement, add ARM documentation about RFC 5011 support. [RT #19874]
2009-09-01 07:14:26 +00:00
/*%
add "static-ds" and "initial-ds" keywords to config parser
2019-09-15 22:15:29 -07:00
* A list of managed trust anchors. Each entry contains a name, a keyword
* ("static-key", initial-key", "static-ds" or "initial-ds"), and the
* fields associated with either a DNSKEY or a DS record.
2665. [func] Clarify syntax for managed-keys {} statement, add ARM documentation about RFC 5011 support. [RT #19874]
2009-09-01 07:14:26 +00:00
*/
"dnssec-keys" is now a synonym for "managed-keys" - managed-keys is now deprecated as well as trusted-keys, though it continues to work as a synonym for dnssec-keys - references to managed-keys have been updated throughout the code. - tests have been updated to use dnssec-keys format - also the trusted-keys entries have been removed from the generated bind.keys.h file and are no longer generated by bindkeys.pl.
2018-10-05 12:00:42 -07:00
static cfg_type_t cfg_type_dnsseckeys = { "dnsseckeys",
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
2665. [func] Clarify syntax for managed-keys {} statement, add ARM documentation about RFC 5011 support. [RT #19874]
2009-09-01 07:14:26 +00:00
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_managedkey };
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
/*%
* A list of key entries, used in a DNSSEC Key and Signing Policy.
*/
static cfg_type_t cfg_type_kaspkeys = { "kaspkeys",
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_kaspkey };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static const char *forwardtype_enums[] = { "first", "only", NULL };
static cfg_type_t cfg_type_forwardtype = {
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
"forwardtype", cfg_parse_enum, cfg_print_ustring,
cfg_doc_enum, &cfg_rep_string, &forwardtype_enums
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
remove {root-}delegation-only complete the removal of the delegation-only and root-delegation-only options, and the delegation-only zone type.
2023-03-22 16:57:54 -07:00
static const char *zonetype_enums[] = { "primary", "master", "secondary",
"slave", "mirror", "forward",
"hint", "redirect", "static-stub",
"stub", NULL };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_zonetype = { "zonetype", cfg_parse_enum,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_print_ustring, cfg_doc_enum,
1913. [func] Automatic empty zone creation for D.F.IP6.ARPA and friends. Note: RFC 1918 zones are not yet covered by this but are likely to be in a future release. New options: empty-server, empty-contact, empty-zones-enable and disable-empty-zone.
2005-08-18 00:57:31 +00:00
&cfg_rep_string, &zonetype_enums };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static const char *loglevel_enums[] = { "critical", "error", "warning",
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
"notice", "info", "dynamic",
NULL };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_loglevel = { "loglevel", cfg_parse_enum,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_print_ustring, cfg_doc_enum,
&cfg_rep_string, &loglevel_enums };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static const char *transferformat_enums[] = { "many-answers", "one-answer",
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
NULL };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_transferformat = {
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
"transferformat", cfg_parse_enum, cfg_print_ustring,
cfg_doc_enum, &cfg_rep_string, &transferformat_enums
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* The special keyword "none", as used in the pid-file option.
*/
static void
1991. [cleanup] The configuration data, once read, should be treated as readonly. Expand the use of const to enforce this at compile time. [RT #15813]
2006-02-28 02:39:52 +00:00
print_none(cfg_printer_t *pctx, const cfg_obj_t *obj) {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
UNUSED(obj);
2889. [bug] Element of the grammar where not properly reported. [RT #21046]
2010-05-13 03:16:55 +00:00
cfg_print_cstr(pctx, "none");
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
}
static cfg_type_t cfg_type_none = { "none", NULL, print_none,
NULL, &cfg_rep_void, NULL };
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* A quoted string or the special keyword "none". Used in the pid-file option.
*/
static isc_result_t
parse_qstringornone(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
isc_result_t result;
2630. [func] Improved syntax for DDNS autoconfiguration: use "update-policy local;" to switch on local DDNS in a zone. [RT #19875]
2009-07-14 22:54:57 +00:00
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
CHECK(cfg_gettoken(pctx, CFG_LEXOPT_QSTRING));
if (pctx->token.type == isc_tokentype_string &&
use token.value.as_textregion.base, not token.value.pointer
2002-01-22 19:31:57 +00:00
strcasecmp(TOKEN_STRING(pctx), "none") == 0)
{
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
return (cfg_create_obj(pctx, &cfg_type_none, ret));
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
cfg_ungettoken(pctx);
return (cfg_parse_qstring(pctx, type, ret));
cleanup:
return (result);
}
static void
doc_qstringornone(cfg_printer_t *pctx, const cfg_type_t *type) {
UNUSED(type);
2889. [bug] Element of the grammar where not properly reported. [RT #21046]
2010-05-13 03:16:55 +00:00
cfg_print_cstr(pctx, "( <quoted_string> | none )");
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
}
static cfg_type_t cfg_type_qstringornone = { "qstringornone",
2630. [func] Improved syntax for DDNS autoconfiguration: use "update-policy local;" to switch on local DDNS in a zone. [RT #19875]
2009-07-14 22:54:57 +00:00
parse_qstringornone,
NULL,
doc_qstringornone,
NULL,
NULL };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
3001. [func] Added a default trust anchor for the root zone, which can be switched on by setting "dnssec-validation auto;" in the named.conf options. [RT #21727]
2011-01-03 23:45:08 +00:00
* A boolean ("yes" or "no"), or the special keyword "auto".
* Used in the dnssec-validation option.
1417. [func] ID.SERVER/CHAOS is now a built in zone. See "server-id" for how to configure.
2003-01-20 05:46:11 +00:00
*/
3001. [func] Added a default trust anchor for the root zone, which can be switched on by setting "dnssec-validation auto;" in the named.conf options. [RT #21727]
2011-01-03 23:45:08 +00:00
static void
print_auto(cfg_printer_t *pctx, const cfg_obj_t *obj) {
UNUSED(obj);
cfg_print_cstr(pctx, "auto");
}
static cfg_type_t cfg_type_auto = { "auto", NULL, print_auto,
NULL, &cfg_rep_void, NULL };
static isc_result_t
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
parse_boolorauto(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
3001. [func] Added a default trust anchor for the root zone, which can be switched on by setting "dnssec-validation auto;" in the named.conf options. [RT #21727]
2011-01-03 23:45:08 +00:00
isc_result_t result;
CHECK(cfg_gettoken(pctx, CFG_LEXOPT_QSTRING));
if (pctx->token.type == isc_tokentype_string &&
strcasecmp(TOKEN_STRING(pctx), "auto") == 0)
{
return (cfg_create_obj(pctx, &cfg_type_auto, ret));
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
3001. [func] Added a default trust anchor for the root zone, which can be switched on by setting "dnssec-validation auto;" in the named.conf options. [RT #21727]
2011-01-03 23:45:08 +00:00
cfg_ungettoken(pctx);
return (cfg_parse_boolean(pctx, type, ret));
cleanup:
return (result);
}
static void
print_boolorauto(cfg_printer_t *pctx, const cfg_obj_t *obj) {
if (obj->type->rep == &cfg_rep_void) {
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, "auto");
3001. [func] Added a default trust anchor for the root zone, which can be switched on by setting "dnssec-validation auto;" in the named.conf options. [RT #21727]
2011-01-03 23:45:08 +00:00
} else if (obj->value.boolean) {
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, "yes");
3001. [func] Added a default trust anchor for the root zone, which can be switched on by setting "dnssec-validation auto;" in the named.conf options. [RT #21727]
2011-01-03 23:45:08 +00:00
} else {
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, "no");
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
3001. [func] Added a default trust anchor for the root zone, which can be switched on by setting "dnssec-validation auto;" in the named.conf options. [RT #21727]
2011-01-03 23:45:08 +00:00
}
static void
doc_boolorauto(cfg_printer_t *pctx, const cfg_type_t *type) {
UNUSED(type);
cfg_print_cstr(pctx, "( yes | no | auto )");
}
static cfg_type_t cfg_type_boolorauto = {
"boolorauto", parse_boolorauto, print_boolorauto, doc_boolorauto, NULL,
NULL
};
1417. [func] ID.SERVER/CHAOS is now a built in zone. See "server-id" for how to configure.
2003-01-20 05:46:11 +00:00
3001. [func] Added a default trust anchor for the root zone, which can be switched on by setting "dnssec-validation auto;" in the named.conf options. [RT #21727]
2011-01-03 23:45:08 +00:00
/*%
* keyword hostname
*/
1417. [func] ID.SERVER/CHAOS is now a built in zone. See "server-id" for how to configure.
2003-01-20 05:46:11 +00:00
static void
1991. [cleanup] The configuration data, once read, should be treated as readonly. Expand the use of const to enforce this at compile time. [RT #15813]
2006-02-28 02:39:52 +00:00
print_hostname(cfg_printer_t *pctx, const cfg_obj_t *obj) {
1417. [func] ID.SERVER/CHAOS is now a built in zone. See "server-id" for how to configure.
2003-01-20 05:46:11 +00:00
UNUSED(obj);
2889. [bug] Element of the grammar where not properly reported. [RT #21046]
2010-05-13 03:16:55 +00:00
cfg_print_cstr(pctx, "hostname");
1417. [func] ID.SERVER/CHAOS is now a built in zone. See "server-id" for how to configure.
2003-01-20 05:46:11 +00:00
}
static cfg_type_t cfg_type_hostname = { "hostname", NULL,
print_hostname, NULL,
&cfg_rep_boolean, NULL };
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
spelling arguement vs arguments
2005-10-26 04:35:56 +00:00
* "server-id" argument.
1417. [func] ID.SERVER/CHAOS is now a built in zone. See "server-id" for how to configure.
2003-01-20 05:46:11 +00:00
*/
static isc_result_t
parse_serverid(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
isc_result_t result;
CHECK(cfg_gettoken(pctx, CFG_LEXOPT_QSTRING));
if (pctx->token.type == isc_tokentype_string &&
strcasecmp(TOKEN_STRING(pctx), "none") == 0)
{
return (cfg_create_obj(pctx, &cfg_type_none, ret));
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
1417. [func] ID.SERVER/CHAOS is now a built in zone. See "server-id" for how to configure.
2003-01-20 05:46:11 +00:00
if (pctx->token.type == isc_tokentype_string &&
strcasecmp(TOKEN_STRING(pctx), "hostname") == 0)
{
4104. [bug] Address uninitialized elements. [RT #39252]
2015-04-17 14:04:47 +10:00
result = cfg_create_obj(pctx, &cfg_type_hostname, ret);
if (result == ISC_R_SUCCESS) {
Replace custom isc_boolean_t with C standard bool type
2018-04-17 08:29:14 -07:00
(*ret)->value.boolean = true;
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
4104. [bug] Address uninitialized elements. [RT #39252]
2015-04-17 14:04:47 +10:00
return (result);
1417. [func] ID.SERVER/CHAOS is now a built in zone. See "server-id" for how to configure.
2003-01-20 05:46:11 +00:00
}
cfg_ungettoken(pctx);
return (cfg_parse_qstring(pctx, type, ret));
cleanup:
return (result);
}
static void
doc_serverid(cfg_printer_t *pctx, const cfg_type_t *type) {
UNUSED(type);
2889. [bug] Element of the grammar where not properly reported. [RT #21046]
2010-05-13 03:16:55 +00:00
cfg_print_cstr(pctx, "( <quoted_string> | none | hostname )");
1417. [func] ID.SERVER/CHAOS is now a built in zone. See "server-id" for how to configure.
2003-01-20 05:46:11 +00:00
}
static cfg_type_t cfg_type_serverid = { "serverid", parse_serverid, NULL,
doc_serverid, NULL, NULL };
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
1442. [func] New fuctions for manipulating port lists: dns_portlist_create(), dns_portlist_add(), dns_portlist_remove(), dns_portlist_match(), dns_portlist_attach() and dns_portlist_detach(). 1441. [func] It is now possible to tell dig to bind to a specific source port. 1440. [func] It is now possible to tell named to avoid using certian source ports (avoid-v4-udp-ports, avoid-v6-udp-ports). developer: marka reviewer: explorer
2003-02-26 05:05:16 +00:00
* Port list.
*/
4194. [bug] named-checkconf -p failed to properly print a port range. [RT #40634]
2015-09-09 16:49:11 +10:00
static void
print_porttuple(cfg_printer_t *pctx, const cfg_obj_t *obj) {
cfg_print_cstr(pctx, "range ");
cfg_print_tuple(pctx, obj);
}
2375. [security] Fully randomize UDP query ports to improve forgery resilience. [RT #17949, #18098]
2008-06-23 19:41:20 +00:00
static cfg_tuplefielddef_t porttuple_fields[] = {
{ "loport", &cfg_type_uint32, 0 },
{ "hiport", &cfg_type_uint32, 0 },
{ NULL, NULL, 0 }
};
4194. [bug] named-checkconf -p failed to properly print a port range. [RT #40634]
2015-09-09 16:49:11 +10:00
static cfg_type_t cfg_type_porttuple = { "porttuple", cfg_parse_tuple,
print_porttuple, cfg_doc_tuple,
2375. [security] Fully randomize UDP query ports to improve forgery resilience. [RT #17949, #18098]
2008-06-23 19:41:20 +00:00
&cfg_rep_tuple, porttuple_fields };
1442. [func] New fuctions for manipulating port lists: dns_portlist_create(), dns_portlist_add(), dns_portlist_remove(), dns_portlist_match(), dns_portlist_attach() and dns_portlist_detach(). 1441. [func] It is now possible to tell dig to bind to a specific source port. 1440. [func] It is now possible to tell named to avoid using certian source ports (avoid-v4-udp-ports, avoid-v6-udp-ports). developer: marka reviewer: explorer
2003-02-26 05:05:16 +00:00
static isc_result_t
2375. [security] Fully randomize UDP query ports to improve forgery resilience. [RT #17949, #18098]
2008-06-23 19:41:20 +00:00
parse_port(cfg_parser_t *pctx, cfg_obj_t **ret) {
1442. [func] New fuctions for manipulating port lists: dns_portlist_create(), dns_portlist_add(), dns_portlist_remove(), dns_portlist_match(), dns_portlist_attach() and dns_portlist_detach(). 1441. [func] It is now possible to tell dig to bind to a specific source port. 1440. [func] It is now possible to tell named to avoid using certian source ports (avoid-v4-udp-ports, avoid-v6-udp-ports). developer: marka reviewer: explorer
2003-02-26 05:05:16 +00:00
isc_result_t result;
update copyright notice
2008-01-18 23:46:58 +00:00
1442. [func] New fuctions for manipulating port lists: dns_portlist_create(), dns_portlist_add(), dns_portlist_remove(), dns_portlist_match(), dns_portlist_attach() and dns_portlist_detach(). 1441. [func] It is now possible to tell dig to bind to a specific source port. 1440. [func] It is now possible to tell named to avoid using certian source ports (avoid-v4-udp-ports, avoid-v6-udp-ports). developer: marka reviewer: explorer
2003-02-26 05:05:16 +00:00
CHECK(cfg_parse_uint32(pctx, NULL, ret));
if ((*ret)->value.uint32 > 0xffff) {
cfg_parser_error(pctx, CFG_LOG_NEAR, "invalid port");
cfg_obj_destroy(pctx, ret);
result = ISC_R_RANGE;
}
update copyright notice
2008-06-23 23:47:11 +00:00
1442. [func] New fuctions for manipulating port lists: dns_portlist_create(), dns_portlist_add(), dns_portlist_remove(), dns_portlist_match(), dns_portlist_attach() and dns_portlist_detach(). 1441. [func] It is now possible to tell dig to bind to a specific source port. 1440. [func] It is now possible to tell named to avoid using certian source ports (avoid-v4-udp-ports, avoid-v6-udp-ports). developer: marka reviewer: explorer
2003-02-26 05:05:16 +00:00
cleanup:
return (result);
}
2375. [security] Fully randomize UDP query ports to improve forgery resilience. [RT #17949, #18098]
2008-06-23 19:41:20 +00:00
static isc_result_t
parse_portrange(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
isc_result_t result;
cfg_obj_t *obj = NULL;
UNUSED(type);
CHECK(cfg_peektoken(pctx, ISC_LEXOPT_NUMBER | ISC_LEXOPT_CNUMBER));
if (pctx->token.type == isc_tokentype_number) {
CHECK(parse_port(pctx, ret));
} else {
CHECK(cfg_gettoken(pctx, 0));
if (pctx->token.type != isc_tokentype_string ||
strcasecmp(TOKEN_STRING(pctx), "range") != 0)
{
cfg_parser_error(pctx, CFG_LOG_NEAR,
"expected integer or 'range'");
return (ISC_R_UNEXPECTEDTOKEN);
}
CHECK(cfg_create_tuple(pctx, &cfg_type_porttuple, &obj));
CHECK(parse_port(pctx, &obj->value.tuple[0]));
CHECK(parse_port(pctx, &obj->value.tuple[1]));
if (obj->value.tuple[0]->value.uint32 >
Update sources to Clang 15 formatting
2022-11-02 19:33:14 +01:00
obj->value.tuple[1]->value.uint32)
{
2375. [security] Fully randomize UDP query ports to improve forgery resilience. [RT #17949, #18098]
2008-06-23 19:41:20 +00:00
cfg_parser_error(pctx, CFG_LOG_NOPREP,
"low port '%u' must not be larger "
"than high port",
obj->value.tuple[0]->value.uint32);
result = ISC_R_RANGE;
goto cleanup;
}
*ret = obj;
obj = NULL;
}
cleanup:
if (obj != NULL) {
cfg_obj_destroy(pctx, &obj);
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
2375. [security] Fully randomize UDP query ports to improve forgery resilience. [RT #17949, #18098]
2008-06-23 19:41:20 +00:00
return (result);
}
static cfg_type_t cfg_type_portrange = { "portrange", parse_portrange,
NULL, cfg_doc_terminal,
1442. [func] New fuctions for manipulating port lists: dns_portlist_create(), dns_portlist_add(), dns_portlist_remove(), dns_portlist_match(), dns_portlist_attach() and dns_portlist_detach(). 1441. [func] It is now possible to tell dig to bind to a specific source port. 1440. [func] It is now possible to tell named to avoid using certian source ports (avoid-v4-udp-ports, avoid-v6-udp-ports). developer: marka reviewer: explorer
2003-02-26 05:05:16 +00:00
NULL, NULL };
Add 'tls' configuration support for the 'forwarders' option A 'tls' statement can be specified both for individual addresses and for the whole list (as a default value when an individual address doesn't have its own 'tls' set), just as it was done before for the 'port' value. Create a new function 'print_rawqstring()' to print a string residing in a 'isc_textregion_t' type parameter. Create a new function 'copy_string()' to copy a string from a 'cfg_obj_t' object into a 'isc_textregion_t'.
2022-12-08 10:57:37 +00:00
static cfg_type_t cfg_type_bracketed_portlist = { "bracketed_portlist",
2375. [security] Fully randomize UDP query ports to improve forgery resilience. [RT #17949, #18098]
2008-06-23 19:41:20 +00:00
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_portrange };
1442. [func] New fuctions for manipulating port lists: dns_portlist_create(), dns_portlist_add(), dns_portlist_remove(), dns_portlist_match(), dns_portlist_attach() and dns_portlist_detach(). 1441. [func] It is now possible to tell dig to bind to a specific source port. 1440. [func] It is now possible to tell named to avoid using certian source ports (avoid-v4-udp-ports, avoid-v6-udp-ports). developer: marka reviewer: explorer
2003-02-26 05:05:16 +00:00
Remove AES algorithm for DNS cookies The AES algorithm for DNS cookies was being kept for legacy reasons, and it can be safely removed in the next major release. Remove both the AES usage for DNS cookies and the AES implementation itself.
2023-11-07 14:42:33 +01:00
static const char *cookiealg_enums[] = { "siphash24", NULL };
4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are avaliable: send-cookie, cookie-secret, cookie-algorithm and nocookie-udp-size. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]
2015-07-06 09:44:24 +10:00
static cfg_type_t cfg_type_cookiealg = { "cookiealg", cfg_parse_enum,
cfg_print_ustring, cfg_doc_enum,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
&cfg_rep_string, &cookiealg_enums };
4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are avaliable: send-cookie, cookie-secret, cookie-algorithm and nocookie-udp-size. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]
2015-07-06 09:44:24 +10:00
[master] DDoS mitigation features 3938. [func] Added quotas to be used in recursive resolvers that are under high query load for names in zones whose authoritative servers are nonresponsive or are experiencing a denial of service attack. - "fetches-per-server" limits the number of simultaneous queries that can be sent to any single authoritative server. The configured value is a starting point; it is automatically adjusted downward if the server is partially or completely non-responsive. The algorithm used to adjust the quota can be configured via the "fetch-quota-params" option. - "fetches-per-zone" limits the number of simultaneous queries that can be sent for names within a single domain. (Note: Unlike "fetches-per-server", this value is not self-tuning.) - New stats counters have been added to count queries spilled due to these quotas. See the ARM for details of these options. [RT #37125]
2015-07-08 22:53:39 -07:00
/*%
* fetch-quota-params
*/
static cfg_tuplefielddef_t fetchquota_fields[] = {
{ "frequency", &cfg_type_uint32, 0 },
{ "low", &cfg_type_fixedpoint, 0 },
{ "high", &cfg_type_fixedpoint, 0 },
{ "discount", &cfg_type_fixedpoint, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_fetchquota = { "fetchquota", cfg_parse_tuple,
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, fetchquota_fields };
/*%
* fetches-per-server or fetches-per-zone
*/
static const char *response_enums[] = { "drop", "fail", NULL };
static cfg_type_t cfg_type_responsetype = {
[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]
2015-10-02 12:32:42 -07:00
"responsetype", parse_optional_enum, cfg_print_ustring,
doc_optional_enum, &cfg_rep_string, response_enums
[master] DDoS mitigation features 3938. [func] Added quotas to be used in recursive resolvers that are under high query load for names in zones whose authoritative servers are nonresponsive or are experiencing a denial of service attack. - "fetches-per-server" limits the number of simultaneous queries that can be sent to any single authoritative server. The configured value is a starting point; it is automatically adjusted downward if the server is partially or completely non-responsive. The algorithm used to adjust the quota can be configured via the "fetch-quota-params" option. - "fetches-per-zone" limits the number of simultaneous queries that can be sent for names within a single domain. (Note: Unlike "fetches-per-server", this value is not self-tuning.) - New stats counters have been added to count queries spilled due to these quotas. See the ARM for details of these options. [RT #37125]
2015-07-08 22:53:39 -07:00
};
static cfg_tuplefielddef_t fetchesper_fields[] = {
{ "fetches", &cfg_type_uint32, 0 },
{ "response", &cfg_type_responsetype, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_fetchesper = { "fetchesper", cfg_parse_tuple,
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, fetchesper_fields };
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* Clauses that can be found within the top level of the named.conf
* file only.
*/
static cfg_clausedef_t namedconf_clauses[] = {
{ "acl", &cfg_type_acl, CFG_CLAUSEFLAG_MULTI },
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
{ "controls", &cfg_type_controls, CFG_CLAUSEFLAG_MULTI },
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
{ "dnssec-policy", &cfg_type_dnssecpolicy, CFG_CLAUSEFLAG_MULTI },
More config element are not valid without DOH / DOT
2021-08-24 14:01:46 +10:00
#if HAVE_LIBNGHTTP2
Add parser support for DoH configuration options This commit adds stub parser support and tests for: - an "http" global option for HTTP/2 endpoint configuration. - command line options to set http or https port numbers by specifying -p http=PORT or -p https=PORT. (NOTE: this change only affects syntax; specifying HTTP and HTTPS ports on the command line currently has no effect.) - named.conf options "http-port" and "https-port" - HTTPSPORT environment variable for use when running tests.
2020-09-16 12:21:32 -07:00
{ "http", &cfg_type_http_description, CFG_CLAUSEFLAG_MULTI },
More config element are not valid without DOH / DOT
2021-08-24 14:01:46 +10:00
#else
{ "http", &cfg_type_http_description,
CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_NOTCONFIGURED },
#endif
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "logging", &cfg_type_logging, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "lwres", NULL, CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_ANCIENT },
add a CFG_CLAUSEFLAG_NODOC flag for use with outdated terms "masters" and "default-masters" are now flagged so they will not be included in the named.conf man page, despite being accepted as valid options by the parser for backward compatibiility.
2022-02-25 16:33:30 -08:00
{ "masters", &cfg_type_remoteservers,
CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_NODOC },
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
{ "options", &cfg_type_options, 0 },
Add parental-agents configuration Introduce a way to configure parental agents that can be used to query DS records to be used in automatic key rollovers.
2021-05-07 11:36:40 +02:00
{ "parental-agents", &cfg_type_remoteservers, CFG_CLAUSEFLAG_MULTI },
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
{ "primaries", &cfg_type_remoteservers, CFG_CLAUSEFLAG_MULTI },
2294. [func] Allow the experimental statistics channels to have multiple connections and ACL. Note: the stats-server and stats-server-v6 options available in the previous beta releases are replaced with the generic statistics-channels statment.
2008-01-17 00:15:14 +00:00
{ "statistics-channels", &cfg_type_statschannels,
CFG_CLAUSEFLAG_MULTI },
add parser support for TLS configuration options This commit adds stub parser support and tests for: - "tls" statement, specifying key and cert. - an optional "tls" keyvalue in listen-on statements for DoT configuration. Documentation for these options has also been added to the ARM, but needs further work.
2020-09-16 12:21:32 -07:00
{ "tls", &cfg_type_tlsconf, CFG_CLAUSEFLAG_MULTI },
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
{ "view", &cfg_type_view, CFG_CLAUSEFLAG_MULTI },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* Clauses that can occur at the top level or in the view
* statement, but not in the options block.
*/
static cfg_clausedef_t namedconf_or_view_clauses[] = {
3931. [cleanup] Cleanup how dlz grammer is defined. [RT #36879]
2014-08-26 15:01:29 +10:00
{ "dlz", &cfg_type_dlz, CFG_CLAUSEFLAG_MULTI },
[master] merge dyndb 4224. [func] Added support for "dyndb", a new interface for loading zone data from an external database, developed by Red Hat for the FreeIPA project. DynDB drivers fully implement the BIND database API, and are capable of significantly better performance and functionality than DLZ drivers, while taking advantage of advanced database features not available in BIND such as multi-master replication. Thanks to Adam Tkac and Petr Spacek of Red Hat. [RT #35271]
2015-09-28 23:12:35 -07:00
{ "dyndb", &cfg_type_dyndb, CFG_CLAUSEFLAG_MULTI },
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
{ "key", &cfg_type_key, CFG_CLAUSEFLAG_MULTI },
"dnssec-keys" is now a synonym for "managed-keys" - managed-keys is now deprecated as well as trusted-keys, though it continues to work as a synonym for dnssec-keys - references to managed-keys have been updated throughout the code. - tests have been updated to use dnssec-keys format - also the trusted-keys entries have been removed from the generated bind.keys.h file and are no longer generated by bindkeys.pl.
2018-10-05 12:00:42 -07:00
{ "managed-keys", &cfg_type_dnsseckeys,
CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_DEPRECATED },
name change from "hook modules" to "plugins" - "hook" is now used only for hook points and hook actions - the "hook" statement in named.conf is now "plugin" - ns_module and ns_modlist are now ns_plugin and ns_plugins - ns_module_load is renamed ns_plugin_register - the mandatory functions in plugin modules (hook_register, hook_check, hook_version, hook_destroy) have been renamed
2018-11-30 15:32:03 -08:00
{ "plugin", &cfg_type_plugin, CFG_CLAUSEFLAG_MULTI },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "server", &cfg_type_server, CFG_CLAUSEFLAG_MULTI },
Rename 'dnssec-keys' to 'trust-anchors'
2019-12-04 11:06:40 +01:00
{ "trust-anchors", &cfg_type_dnsseckeys, CFG_CLAUSEFLAG_MULTI },
"dnssec-keys" is now a synonym for "managed-keys" - managed-keys is now deprecated as well as trusted-keys, though it continues to work as a synonym for dnssec-keys - references to managed-keys have been updated throughout the code. - tests have been updated to use dnssec-keys format - also the trusted-keys entries have been removed from the generated bind.keys.h file and are no longer generated by bindkeys.pl.
2018-10-05 12:00:42 -07:00
{ "trusted-keys", &cfg_type_trustedkeys,
deprecate "trusted-keys" - trusted-keys is now flagged as deprecated, but still works - managed-keys can be used to configure permanent trust anchors by using the "static-key" keyword in place of "initial-key" - parser now uses an enum for static-key and initial-key keywords
2018-08-15 16:59:45 -07:00
CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_DEPRECATED },
document zone grammar more correctly the "zone" clause can be documented using, for instance, `cfg_test --zonegrammar primary", which prints only options that are valid in primary zones. this was not the method being used when generating the named.conf man page; instead, "zone" was documented with all possible options, and no zone types at all. this commit removes "zone" from the generic documentation and adds include statements in named.conf.rst so that correct zone grammars will be included in the man page.
2022-02-23 17:36:11 -08:00
{ "zone", &cfg_type_zone, CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_NODOC },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
2572. [func] Simplify DLV configuration, with a new option "dnssec-lookaside auto;" This is the equivalent of "dnssec-lookaside . trust-anchor dlv.isc.org;" plus setting a trusted-key for dlv.isc.org. Note: The trusted key is hard-coded into named, but is also stored in (and can be overridden by) $sysconfdir/bind.keys. As the ISC DLV key rolls over it can be kept up to date by replacing the bind.keys file with a key downloaded from https://www.isc.org/solutions/dlv. [RT #18685]
2009-03-04 02:42:31 +00:00
/*%
* Clauses that can occur in the bind.keys file.
*/
static cfg_clausedef_t bindkeys_clauses[] = {
"dnssec-keys" is now a synonym for "managed-keys" - managed-keys is now deprecated as well as trusted-keys, though it continues to work as a synonym for dnssec-keys - references to managed-keys have been updated throughout the code. - tests have been updated to use dnssec-keys format - also the trusted-keys entries have been removed from the generated bind.keys.h file and are no longer generated by bindkeys.pl.
2018-10-05 12:00:42 -07:00
{ "managed-keys", &cfg_type_dnsseckeys,
CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_DEPRECATED },
Rename 'dnssec-keys' to 'trust-anchors'
2019-12-04 11:06:40 +01:00
{ "trust-anchors", &cfg_type_dnsseckeys, CFG_CLAUSEFLAG_MULTI },
"dnssec-keys" is now a synonym for "managed-keys" - managed-keys is now deprecated as well as trusted-keys, though it continues to work as a synonym for dnssec-keys - references to managed-keys have been updated throughout the code. - tests have been updated to use dnssec-keys format - also the trusted-keys entries have been removed from the generated bind.keys.h file and are no longer generated by bindkeys.pl.
2018-10-05 12:00:42 -07:00
{ "trusted-keys", &cfg_type_trustedkeys,
CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_DEPRECATED },
2572. [func] Simplify DLV configuration, with a new option "dnssec-lookaside auto;" This is the equivalent of "dnssec-lookaside . trust-anchor dlv.isc.org;" plus setting a trusted-key for dlv.isc.org. Note: The trusted key is hard-coded into named, but is also stored in (and can be overridden by) $sysconfdir/bind.keys. As the ISC DLV key rolls over it can be kept up to date by replacing the bind.keys file with a key downloaded from https://www.isc.org/solutions/dlv. [RT #18685]
2009-03-04 02:42:31 +00:00
{ NULL, NULL, 0 }
};
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
static const char *fstrm_model_enums[] = { "mpsc", "spsc", NULL };
4447. [tuning] Allow the fstrm_iothr_init() options to be set using named.conf to control how dnstap manages the data flow. [RT #42974]
2016-08-18 11:16:06 +10:00
static cfg_type_t cfg_type_fstrm_model = {
"model", cfg_parse_enum, cfg_print_ustring,
cfg_doc_enum, &cfg_rep_string, &fstrm_model_enums
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* Clauses that can be found within the 'options' statement.
*/
static cfg_clausedef_t options_clauses[] = {
Add a answer-cookie named config option (cherry picked from commit 29305073575459a66f0a93b9becc4863fd1c0c6b)
2018-03-19 18:09:05 +05:30
{ "answer-cookie", &cfg_type_boolean, 0 },
3733. [func] Improve interface scanning support. Interface information will be automatically updated if the OS supports routing sockets. Use "automatic-interface-scan no;" to disable. Add "rndc scan" to trigger a scan. [RT #23027]
2014-02-07 17:16:37 +11:00
{ "automatic-interface-scan", &cfg_type_boolean, 0 },
mark "port" as deprecated for source address options Deprecate the use of "port" when configuring query-source(-v6), transfer-source(-v6), notify-source(-v6), parental-source(-v6), etc. Also deprecate use-{v4,v6}-udp-ports and avoid-{v4,v6}udp-ports.
2023-01-06 17:01:06 -08:00
{ "avoid-v4-udp-ports", &cfg_type_bracketed_portlist,
CFG_CLAUSEFLAG_DEPRECATED },
{ "avoid-v6-udp-ports", &cfg_type_bracketed_portlist,
CFG_CLAUSEFLAG_DEPRECATED },
remove /etc/bind.keys the built-in trust anchors in named and delv are sufficent for validation. named still needs to be able to load trust anchors from a bind.keys file for testing purposes, but it doesn't need to be the default behavior. we now only load trust anchors from a file if explicitly specified via the "bindkeys-file" option in named or the "-a" command line argument to delv. documentation has been cleaned up to remove references to /etc/bind.keys. Closes #3850.
2023-02-03 14:57:17 -08:00
{ "bindkeys-file", &cfg_type_qstring, CFG_CLAUSEFLAG_TESTONLY },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "blackhole", &cfg_type_bracketed_aml, 0 },
4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are avaliable: send-cookie, cookie-secret, cookie-algorithm and nocookie-udp-size. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]
2015-07-06 09:44:24 +10:00
{ "cookie-algorithm", &cfg_type_cookiealg, 0 },
4699. [func] Multiple cookie-secret clauses can now be specified. The first one specified is used to generate new server cookies. [RT #45672]
2017-09-05 09:19:45 +10:00
{ "cookie-secret", &cfg_type_sstring, CFG_CLAUSEFLAG_MULTI },
Mark setting operating system limits from named.conf as ancient After deprecating the operating system limits settings (coresize, datasize, files and stacksize), mark them as ancient and remove the code that sets the values from config.
2022-11-13 10:28:17 +01:00
{ "coresize", &cfg_type_size, CFG_CLAUSEFLAG_ANCIENT },
{ "datasize", &cfg_type_size, CFG_CLAUSEFLAG_ANCIENT },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "deallocate-on-exit", NULL, CFG_CLAUSEFLAG_ANCIENT },
alphabetize options_clauses
2017-08-14 07:22:20 +00:00
{ "directory", &cfg_type_qstring, CFG_CLAUSEFLAG_CALLBACK },
allow configuration of dnsrps library path for testing purposes, we need to be able to specify a library path from which to load the dnsrps implementation. this can now be done with the "dnsrps-library" option. DNSRPS can now be enabled in configure regardless of whether librpz.so is currently installed on the system.
2023-03-13 14:13:39 -07:00
#ifdef USE_DNSRPS
{ "dnsrps-library", &cfg_type_qstring, 0 },
#else /* ifdef USE_DNSRPS */
{ "dnsrps-library", &cfg_type_qstring, CFG_CLAUSEFLAG_NOTCONFIGURED },
#endif /* ifdef USE_DNSRPS */
[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]
2015-10-02 12:32:42 -07:00
#ifdef HAVE_DNSTAP
{ "dnstap-output", &cfg_type_dnstapoutput, 0 },
{ "dnstap-identity", &cfg_type_serverid, 0 },
{ "dnstap-version", &cfg_type_qstringornone, 0 },
netmgr: Add additional safeguards to netmgr/tls.c This commit adds couple of additional safeguards against running sends/reads on inactive sockets. The changes was modeled after the changes we made to netmgr/tcpdns.c
2020-11-10 11:23:05 +01:00
#else /* ifdef HAVE_DNSTAP */
alphabetize options_clauses
2017-08-14 07:22:20 +00:00
{ "dnstap-output", &cfg_type_dnstapoutput,
CFG_CLAUSEFLAG_NOTCONFIGURED },
{ "dnstap-identity", &cfg_type_serverid, CFG_CLAUSEFLAG_NOTCONFIGURED },
{ "dnstap-version", &cfg_type_qstringornone,
CFG_CLAUSEFLAG_NOTCONFIGURED },
#endif /* ifdef HAVE_DNSTAP */
fully remove DSCP The "dscp" option is now marked as "ancient" and it is a configuration error to use it or to configure DSCP values for any source-address option.
2023-01-09 16:57:41 -08:00
{ "dscp", &cfg_type_uint32, CFG_CLAUSEFLAG_ANCIENT },
alphabetize options_clauses
2017-08-14 07:22:20 +00:00
{ "dump-file", &cfg_type_qstring, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "fake-iquery", NULL, CFG_CLAUSEFLAG_ANCIENT },
Mark setting operating system limits from named.conf as ancient After deprecating the operating system limits settings (coresize, datasize, files and stacksize), mark them as ancient and remove the code that sets the values from config.
2022-11-13 10:28:17 +01:00
{ "files", &cfg_type_size, CFG_CLAUSEFLAG_ANCIENT },
alphabetize options_clauses
2017-08-14 07:22:20 +00:00
{ "flush-zones-on-shutdown", &cfg_type_boolean, 0 },
#ifdef HAVE_DNSTAP
4447. [tuning] Allow the fstrm_iothr_init() options to be set using named.conf to control how dnstap manages the data flow. [RT #42974]
2016-08-18 11:16:06 +10:00
{ "fstrm-set-buffer-hint", &cfg_type_uint32, 0 },
{ "fstrm-set-flush-timeout", &cfg_type_uint32, 0 },
{ "fstrm-set-input-queue-size", &cfg_type_uint32, 0 },
{ "fstrm-set-output-notify-threshold", &cfg_type_uint32, 0 },
{ "fstrm-set-output-queue-model", &cfg_type_fstrm_model, 0 },
{ "fstrm-set-output-queue-size", &cfg_type_uint32, 0 },
Extend ttlval to accept ISO 8601 durations The ttlval configuration types are replaced by duration configuration types. The duration is an ISO 8601 duration that is going to be used for DNSSEC key timings such as key lifetimes, signature resign intervals and refresh periods, etc. But it is also still allowed to use the BIND ttlval ways of configuring intervals (number plus optional unit). A duration is stored as an array of 7 different time parts. A duration can either be expressed in weeks, or in a combination of the other datetime indicators. Add several unit tests to ensure the correct value is parsed given different string values.
2019-09-02 15:46:28 +02:00
{ "fstrm-set-reopen-interval", &cfg_type_duration, 0 },
netmgr: Add additional safeguards to netmgr/tls.c This commit adds couple of additional safeguards against running sends/reads on inactive sockets. The changes was modeled after the changes we made to netmgr/tcpdns.c
2020-11-10 11:23:05 +01:00
#else /* ifdef HAVE_DNSTAP */
4447. [tuning] Allow the fstrm_iothr_init() options to be set using named.conf to control how dnstap manages the data flow. [RT #42974]
2016-08-18 11:16:06 +10:00
{ "fstrm-set-buffer-hint", &cfg_type_uint32,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
CFG_CLAUSEFLAG_NOTCONFIGURED },
4447. [tuning] Allow the fstrm_iothr_init() options to be set using named.conf to control how dnstap manages the data flow. [RT #42974]
2016-08-18 11:16:06 +10:00
{ "fstrm-set-flush-timeout", &cfg_type_uint32,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
CFG_CLAUSEFLAG_NOTCONFIGURED },
4447. [tuning] Allow the fstrm_iothr_init() options to be set using named.conf to control how dnstap manages the data flow. [RT #42974]
2016-08-18 11:16:06 +10:00
{ "fstrm-set-input-queue-size", &cfg_type_uint32,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
CFG_CLAUSEFLAG_NOTCONFIGURED },
4447. [tuning] Allow the fstrm_iothr_init() options to be set using named.conf to control how dnstap manages the data flow. [RT #42974]
2016-08-18 11:16:06 +10:00
{ "fstrm-set-output-notify-threshold", &cfg_type_uint32,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
CFG_CLAUSEFLAG_NOTCONFIGURED },
4447. [tuning] Allow the fstrm_iothr_init() options to be set using named.conf to control how dnstap manages the data flow. [RT #42974]
2016-08-18 11:16:06 +10:00
{ "fstrm-set-output-queue-model", &cfg_type_fstrm_model,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
CFG_CLAUSEFLAG_NOTCONFIGURED },
4447. [tuning] Allow the fstrm_iothr_init() options to be set using named.conf to control how dnstap manages the data flow. [RT #42974]
2016-08-18 11:16:06 +10:00
{ "fstrm-set-output-queue-size", &cfg_type_uint32,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
CFG_CLAUSEFLAG_NOTCONFIGURED },
Extend ttlval to accept ISO 8601 durations The ttlval configuration types are replaced by duration configuration types. The duration is an ISO 8601 duration that is going to be used for DNSSEC key timings such as key lifetimes, signature resign intervals and refresh periods, etc. But it is also still allowed to use the BIND ttlval ways of configuring intervals (number plus optional unit). A duration is stored as an array of 7 different time parts. A duration can either be expressed in weeks, or in a combination of the other datetime indicators. Add several unit tests to ensure the correct value is parsed given different string values.
2019-09-02 15:46:28 +02:00
{ "fstrm-set-reopen-interval", &cfg_type_duration,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
CFG_CLAUSEFLAG_NOTCONFIGURED },
[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]
2015-10-02 12:32:42 -07:00
#endif /* HAVE_DNSTAP */
remove all support for legacy GeoIP
2019-06-27 21:08:20 -07:00
#if defined(HAVE_GEOIP2)
[master] add geoip support 3504. [func] Add support for ACLs based on geographic location, using MaxMind GeoIP databases. Based on code contributed by Ken Brownfield <kb@slide.com>. [RT #30681]
2013-02-27 17:19:39 -08:00
{ "geoip-directory", &cfg_type_qstringornone, 0 },
netmgr: Add additional safeguards to netmgr/tls.c This commit adds couple of additional safeguards against running sends/reads on inactive sockets. The changes was modeled after the changes we made to netmgr/tcpdns.c
2020-11-10 11:23:05 +01:00
#else /* if defined(HAVE_GEOIP2) */
add CFG_CLAUSEFLAG_NOTCONFIGURED flag
2014-02-21 12:48:39 +11:00
{ "geoip-directory", &cfg_type_qstringornone,
CFG_CLAUSEFLAG_NOTCONFIGURED },
remove all support for legacy GeoIP
2019-06-27 21:08:20 -07:00
#endif /* HAVE_GEOIP2 */
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "geoip-use-ecs", NULL, CFG_CLAUSEFLAG_ANCIENT },
{ "has-old-clients", NULL, CFG_CLAUSEFLAG_ANCIENT },
deprecate "dialup" and "heartbeat-interval" these options concentrate zone maintenance actions into bursts for the benefit of servers with intermittent connections. that's no longer something we really need to optimize.
2023-07-03 16:34:22 -07:00
{ "heartbeat-interval", &cfg_type_uint32, CFG_CLAUSEFLAG_DEPRECATED },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "host-statistics", NULL, CFG_CLAUSEFLAG_ANCIENT },
{ "host-statistics-max", NULL, CFG_CLAUSEFLAG_ANCIENT },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "hostname", &cfg_type_qstringornone, 0 },
Extend ttlval to accept ISO 8601 durations The ttlval configuration types are replaced by duration configuration types. The duration is an ISO 8601 duration that is going to be used for DNSSEC key timings such as key lifetimes, signature resign intervals and refresh periods, etc. But it is also still allowed to use the BIND ttlval ways of configuring intervals (number plus optional unit). A duration is stored as an array of 7 different time parts. A duration can either be expressed in weeks, or in a combination of the other datetime indicators. Add several unit tests to ensure the correct value is parsed given different string values.
2019-09-02 15:46:28 +02:00
{ "interface-interval", &cfg_type_duration, 0 },
Declare the keep-response-order obsolete The keep-response-order option has been introduced when TCP pipelining has been introduced to BIND 9 as a failsafe for possibly non-compliant clients. Declare the keep-response-order obsolete as all DNS clients should either support out-of-order processing or don't send more DNS queries until the DNS response for the previous one has been received.
2022-01-27 10:13:10 +01:00
{ "keep-response-order", &cfg_type_bracketed_aml,
CFG_CLAUSEFLAG_OBSOLETE },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "listen-on", &cfg_type_listenon, CFG_CLAUSEFLAG_MULTI },
{ "listen-on-v6", &cfg_type_listenon, CFG_CLAUSEFLAG_MULTI },
Remove the lock-file configuration and -X argument to named The lock-file configuration (both from configuration file and -X argument to named) has better alternatives nowadays. Modern process supervisor should be used to ensure that a single named process is running on a given configuration. Alternatively, it's possible to wrap the named with flock(1).
2023-10-26 11:55:54 +02:00
{ "lock-file", &cfg_type_qstringornone, CFG_CLAUSEFLAG_ANCIENT },
2903. [bug] managed-keys-directory missing from namedconf.c. [RT #21370]
2010-05-21 14:10:32 +00:00
{ "managed-keys-directory", &cfg_type_qstring, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "match-mapped-addresses", &cfg_type_boolean, 0 },
3339. [func] Allow the maximum supported rsa exponent size to be specified: "max-rsa-exponent-size <value>;" [RT #29228]
2012-06-14 15:44:20 +10:00
{ "max-rsa-exponent-size", &cfg_type_uint32, 0 },
2250. [func] New flag 'memstatistics' to state whether the memory statistics file should be written or not. Additionally named's -m option will cause the statistics file to be written. [RT #17113]
2007-09-26 03:22:45 +00:00
{ "memstatistics", &cfg_type_boolean, 0 },
alphabetize options_clauses
2017-08-14 07:22:20 +00:00
{ "memstatistics-file", &cfg_type_qstring, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "multiple-cnames", NULL, CFG_CLAUSEFLAG_ANCIENT },
{ "named-xfer", NULL, CFG_CLAUSEFLAG_ANCIENT },
3956. [func] Notify messages are now rate limited by notify-rate and startup-notify-rate instead of serial-query-rate. [RT #24454] 3955. [bug] Notify messages due to changes are no longer queued behind startup notify messages. [RT #24454]
2014-09-29 10:01:08 +10:00
{ "notify-rate", &cfg_type_uint32, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "pid-file", &cfg_type_qstringornone, 0 },
{ "port", &cfg_type_uint32, 0 },
DoT test Preliminary test for DNSoverTLS - add the dot-port template to system tests, test a simple query to an authoritative.
2020-10-12 23:06:55 +02:00
{ "tls-port", &cfg_type_uint32, 0 },
Make the DNS over HTTPS support optional This commit adds two new autoconf options `--enable-doh` (enabled by default) and `--with-libnghttp2` (mandatory when DoH is enabled). When DoH support is disabled the library is not linked-in and support for http(s) protocol is disabled in the netmgr, named and dig.
2021-04-21 13:52:15 +02:00
#if HAVE_LIBNGHTTP2
Add parser support for DoH configuration options This commit adds stub parser support and tests for: - an "http" global option for HTTP/2 endpoint configuration. - command line options to set http or https port numbers by specifying -p http=PORT or -p https=PORT. (NOTE: this change only affects syntax; specifying HTTP and HTTPS ports on the command line currently has no effect.) - named.conf options "http-port" and "https-port" - HTTPSPORT environment variable for use when running tests.
2020-09-16 12:21:32 -07:00
{ "http-port", &cfg_type_uint32, 0 },
Add (http-)listener-clients option (DoH quota mechanism) This commit adds support for http-listener-clients global options as well as ability to override the default in an HTTP server description, like: http local-http-server { ... listener-clients 100; ... }; This way we have ability to specify per-listener active connections quota globally and then override it when required. This is exactly what AT&T requested us: they wanted a functionality to specify quota globally and then override it for specific IPs. This change functionality makes such a configuration possible. It makes sense: for example, one could have different quotas for internal and external clients. Or, for example, one could use BIND's internal ability to serve encrypted DoH with some sane quota value for internal clients, while having un-encrypted DoH listener without quota to put BIND behind a load balancer doing TLS offloading for external clients. Moreover, the code no more shares the quota with TCP, which makes little sense anyway (see tcp-clients option), because of the nature of interaction of DoH clients: they tend to keep idle opened connections for longer periods of time, preventing the TCP and TLS client from being served. Thus, the need to have a separate, generally larger, quota for them. Also, the change makes any option within "http <name> { ... };" statement optional, making it easier to override only required default options. By default, the DoH connections are limited to 300 per listener. I hope that it is a good initial guesstimate.
2021-05-14 14:18:57 +03:00
{ "http-listener-clients", &cfg_type_uint32, 0 },
Make max number of HTTP/2 streams configurable This commit makes number of concurrent HTTP/2 streams per connection configurable as a mean to fight DDoS attacks. As soon as the limit is reached, BIND terminates the whole session. The commit adds a global configuration option (http-streams-per-connection) which can be overridden in an http <name> {...} statement like follows: http local-http-server { ... streams-per-connection 100; ... }; For now the default value is 100, which should be enough (e.g. NGINX uses 128, but it is a full-featured WEB-server). When using lower numbers (e.g. ~70), it is possible to hit the limit with e.g. flamethrower.
2021-05-18 12:03:58 +03:00
{ "http-streams-per-connection", &cfg_type_uint32, 0 },
Add parser support for DoH configuration options This commit adds stub parser support and tests for: - an "http" global option for HTTP/2 endpoint configuration. - command line options to set http or https port numbers by specifying -p http=PORT or -p https=PORT. (NOTE: this change only affects syntax; specifying HTTP and HTTPS ports on the command line currently has no effect.) - named.conf options "http-port" and "https-port" - HTTPSPORT environment variable for use when running tests.
2020-09-16 12:21:32 -07:00
{ "https-port", &cfg_type_uint32, 0 },
Make the DNS over HTTPS support optional This commit adds two new autoconf options `--enable-doh` (enabled by default) and `--with-libnghttp2` (mandatory when DoH is enabled). When DoH support is disabled the library is not linked-in and support for http(s) protocol is disabled in the netmgr, named and dig.
2021-04-21 13:52:15 +02:00
#else
{ "http-port", &cfg_type_uint32, CFG_CLAUSEFLAG_NOTCONFIGURED },
Add (http-)listener-clients option (DoH quota mechanism) This commit adds support for http-listener-clients global options as well as ability to override the default in an HTTP server description, like: http local-http-server { ... listener-clients 100; ... }; This way we have ability to specify per-listener active connections quota globally and then override it when required. This is exactly what AT&T requested us: they wanted a functionality to specify quota globally and then override it for specific IPs. This change functionality makes such a configuration possible. It makes sense: for example, one could have different quotas for internal and external clients. Or, for example, one could use BIND's internal ability to serve encrypted DoH with some sane quota value for internal clients, while having un-encrypted DoH listener without quota to put BIND behind a load balancer doing TLS offloading for external clients. Moreover, the code no more shares the quota with TCP, which makes little sense anyway (see tcp-clients option), because of the nature of interaction of DoH clients: they tend to keep idle opened connections for longer periods of time, preventing the TCP and TLS client from being served. Thus, the need to have a separate, generally larger, quota for them. Also, the change makes any option within "http <name> { ... };" statement optional, making it easier to override only required default options. By default, the DoH connections are limited to 300 per listener. I hope that it is a good initial guesstimate.
2021-05-14 14:18:57 +03:00
{ "http-listener-clients", &cfg_type_uint32,
CFG_CLAUSEFLAG_NOTCONFIGURED },
Make max number of HTTP/2 streams configurable This commit makes number of concurrent HTTP/2 streams per connection configurable as a mean to fight DDoS attacks. As soon as the limit is reached, BIND terminates the whole session. The commit adds a global configuration option (http-streams-per-connection) which can be overridden in an http <name> {...} statement like follows: http local-http-server { ... streams-per-connection 100; ... }; For now the default value is 100, which should be enough (e.g. NGINX uses 128, but it is a full-featured WEB-server). When using lower numbers (e.g. ~70), it is possible to hit the limit with e.g. flamethrower.
2021-05-18 12:03:58 +03:00
{ "http-streams-per-connection", &cfg_type_uint32,
CFG_CLAUSEFLAG_NOTCONFIGURED },
Make the DNS over HTTPS support optional This commit adds two new autoconf options `--enable-doh` (enabled by default) and `--with-libnghttp2` (mandatory when DoH is enabled). When DoH support is disabled the library is not linked-in and support for http(s) protocol is disabled in the netmgr, named and dig.
2021-04-21 13:52:15 +02:00
{ "https-port", &cfg_type_uint32, CFG_CLAUSEFLAG_NOTCONFIGURED },
#endif
1537. [func] New option "querylog". If set specify whether query logging is to be enabled or disabled at startup.
2004-03-02 01:15:00 +00:00
{ "querylog", &cfg_type_boolean, 0 },
flag "random-device" as ancient the "random-device" option was made non-functional in 9.13. this commit removes it from the configuration parser; setting it is now an error.
2022-09-13 18:13:51 -07:00
{ "random-device", &cfg_type_qstringornone, CFG_CLAUSEFLAG_ANCIENT },
alphabetize options_clauses
2017-08-14 07:22:20 +00:00
{ "recursing-file", &cfg_type_qstring, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "recursive-clients", &cfg_type_uint32, 0 },
Rename the configuration option to load balance sockets to reuseport After some back and forth, it was decidede to match the configuration option with unbound ("so-reuseport"), PowerDNS ("reuseport") and/or nginx ("reuseport").
2022-04-06 17:00:24 +02:00
{ "reuseport", &cfg_type_boolean, 0 },
clean up some deprecated/obsolete options and doc - removed documentation of -S option from named man page - removed documentation of reserved-sockets from ARM - simplified documentation of dnssec-secure-to-insecure - it now just says it's obsolete rather than describing what it doesn't do anymore - marked three formerly obsolete options as ancient: parent-registration-delay, reserved-sockets, and suppress-initial-notify
2023-02-08 10:33:06 -08:00
{ "reserved-sockets", &cfg_type_uint32, CFG_CLAUSEFLAG_ANCIENT },
2924. [func] 'rndc secroots' dump a combined summary of the current managed keys combined with trusted keys. [RT #20904]
2010-06-25 03:24:05 +00:00
{ "secroots-file", &cfg_type_qstring, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "serial-queries", NULL, CFG_CLAUSEFLAG_ANCIENT },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "serial-query-rate", &cfg_type_uint32, 0 },
1417. [func] ID.SERVER/CHAOS is now a built in zone. See "server-id" for how to configure.
2003-01-20 05:46:11 +00:00
{ "server-id", &cfg_type_serverid, 0 },
alphabetize options_clauses
2017-08-14 07:22:20 +00:00
{ "session-keyalg", &cfg_type_astring, 0 },
{ "session-keyfile", &cfg_type_qstringornone, 0 },
{ "session-keyname", &cfg_type_astring, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "sit-secret", NULL, CFG_CLAUSEFLAG_ANCIENT },
Mark setting operating system limits from named.conf as ancient After deprecating the operating system limits settings (coresize, datasize, files and stacksize), mark them as ancient and remove the code that sets the values from config.
2022-11-13 10:28:17 +01:00
{ "stacksize", &cfg_type_size, CFG_CLAUSEFLAG_ANCIENT },
3956. [func] Notify messages are now rate limited by notify-rate and startup-notify-rate instead of serial-query-rate. [RT #24454] 3955. [bug] Notify messages due to changes are no longer queued behind startup notify messages. [RT #24454]
2014-09-29 10:01:08 +10:00
{ "startup-notify-rate", &cfg_type_uint32, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "statistics-file", &cfg_type_qstring, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "statistics-interval", NULL, CFG_CLAUSEFLAG_ANCIENT },
[master] EDNS padding and keepalive support 4549. [func] Added support for the EDNS TCP Keepalive option (RFC 7828). [RT #42126] 4548. [func] Added support for the EDNS Padding option (RFC 7830). [RT #42094]
2017-01-04 09:16:30 -08:00
{ "tcp-advertised-timeout", &cfg_type_uint32, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "tcp-clients", &cfg_type_uint32, 0 },
[master] EDNS padding and keepalive support 4549. [func] Added support for the EDNS TCP Keepalive option (RFC 7828). [RT #42126] 4548. [func] Added support for the EDNS Padding option (RFC 7830). [RT #42094]
2017-01-04 09:16:30 -08:00
{ "tcp-idle-timeout", &cfg_type_uint32, 0 },
{ "tcp-initial-timeout", &cfg_type_uint32, 0 },
{ "tcp-keepalive-timeout", &cfg_type_uint32, 0 },
merge rt4112
2002-11-12 23:38:12 +00:00
{ "tcp-listen-queue", &cfg_type_uint32, 0 },
Add configuration option to set send/recv buffers on the nm sockets This commit adds a new configuration option to set the receive and send buffer sizes on the TCP and UDP netmgr sockets. The default is `0` which doesn't set any value and just uses the value set by the operating system. There's no magic value here - set it too small and the performance will drop, set it too large, the buffers can fill-up with queries that have already timeouted on the client side and nobody is interested for the answer and this would just make the server clog up even more by making it produce useless work. The `netstat -su` can be used on POSIX systems to monitor the receive and send buffer errors.
2020-12-02 20:51:38 +01:00
{ "tcp-receive-buffer", &cfg_type_uint32, 0 },
{ "tcp-send-buffer", &cfg_type_uint32, 0 },
Remove TKEY Mode 2 (Diffie-Hellman) Completely remove the TKEY Mode 2 (Diffie-Hellman Exchanged Keying) from BIND 9 (from named, named.conf and all the tools). The TKEY usage is fringe at best and in all known cases, GSSAPI is being used as it should. The draft-eastlake-dnsop-rfc2930bis-tkey specifies that: 4.2 Diffie-Hellman Exchanged Keying (Deprecated) The use of this mode (#2) is NOT RECOMMENDED for the following two reasons but the specification is still included in Appendix A in case an implementation is needed for compatibility with old TKEY implementations. See Section 4.6 on ECDH Exchanged Keying. The mixing function used does not meet current cryptographic standards because it uses MD5 [RFC6151]. RSA keys must be excessively long to achieve levels of security required by current standards. We might optionally implement Elliptic Curve Diffie-Hellman (ECDH) key exchange mode 6 if the draft ever reaches the RFC status. Meanwhile the insecure DH mode needs to be removed.
2023-02-28 16:05:34 +01:00
{ "tkey-dhkey", NULL, CFG_CLAUSEFLAG_ANCIENT },
alphabetize options_clauses
2017-08-14 07:22:20 +00:00
{ "tkey-domain", &cfg_type_qstring, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "tkey-gssapi-credential", &cfg_type_qstring, 0 },
2989. [func] Added support for writable DLZ zones. (Contributed by Andrew Tridgell of the Samba project.) [RT #22629] 2988. [experimental] Added a "dlopen" DLZ driver, allowing the creation of external DLZ drivers that can be loaded as shared objects at runtime rather than linked with named. Currently this is switched on via a compile-time option, "configure --with-dlz-dlopen". Note: the syntax for configuring DLZ zones is likely to be refined in future releases. (Contributed by Andrew Tridgell of the Samba project.) [RT #22629] 2987. [func] Improve ease of configuring TKEY/GSS updates by adding a "tkey-gssapi-keytab" option. If set, updates will be allowed with any key matching a principal in the specified keytab file. "tkey-gssapi-credential" is no longer required and is expected to be deprecated. (Contributed by Andrew Tridgell of the Samba project.) [RT #22629]
2010-12-18 01:56:23 +00:00
{ "tkey-gssapi-keytab", &cfg_type_qstring, 0 },
Use optimal message sizes to improve compression in AXFRs (#40996)
2015-12-15 13:22:15 +05:30
{ "transfer-message-size", &cfg_type_uint32, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "transfers-in", &cfg_type_uint32, 0 },
{ "transfers-out", &cfg_type_uint32, 0 },
alphabetize options_clauses
2017-08-14 07:22:20 +00:00
{ "transfers-per-ns", &cfg_type_uint32, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "treat-cr-as-space", NULL, CFG_CLAUSEFLAG_ANCIENT },
Add configuration option to set send/recv buffers on the nm sockets This commit adds a new configuration option to set the receive and send buffer sizes on the TCP and UDP netmgr sockets. The default is `0` which doesn't set any value and just uses the value set by the operating system. There's no magic value here - set it too small and the performance will drop, set it too large, the buffers can fill-up with queries that have already timeouted on the client side and nobody is interested for the answer and this would just make the server clog up even more by making it produce useless work. The `netstat -su` can be used on POSIX systems to monitor the receive and send buffer errors.
2020-12-02 20:51:38 +01:00
{ "udp-receive-buffer", &cfg_type_uint32, 0 },
{ "udp-send-buffer", &cfg_type_uint32, 0 },
add a configuration option for the update quota add an "update-quota" option to configure the update quota.
2022-09-01 16:22:46 -07:00
{ "update-quota", &cfg_type_uint32, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "use-id-pool", NULL, CFG_CLAUSEFLAG_ANCIENT },
{ "use-ixfr", NULL, CFG_CLAUSEFLAG_ANCIENT },
mark "port" as deprecated for source address options Deprecate the use of "port" when configuring query-source(-v6), transfer-source(-v6), notify-source(-v6), parental-source(-v6), etc. Also deprecate use-{v4,v6}-udp-ports and avoid-{v4,v6}udp-ports.
2023-01-06 17:01:06 -08:00
{ "use-v4-udp-ports", &cfg_type_bracketed_portlist,
CFG_CLAUSEFLAG_DEPRECATED },
{ "use-v6-udp-ports", &cfg_type_bracketed_portlist,
CFG_CLAUSEFLAG_DEPRECATED },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "version", &cfg_type_qstringornone, 0 },
{ NULL, NULL, 0 }
};
1510. [func] New view option "root-delegation-only". Apply delegation-only check to all TLDs and root. Note there are some TLDs that are NOT delegation only (e.g. DE and MUSEUM) these can be excluded from the checks buy using exclude. root-delegation-only exclude { "DE"; "MUSEUM"; };
2003-09-19 12:39:49 +00:00
static cfg_type_t cfg_type_namelist = { "namelist",
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
option to disable validation under specified names - added new 'validate-except' option, which configures an NTA with expiry of 0xffffffff. NTAs with that value in the expiry field do not expire, are are not written out when saving the NTA table and are not dumped by rndc secroots
2018-04-30 16:10:17 -07:00
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_astring };
1510. [func] New view option "root-delegation-only". Apply delegation-only check to all TLDs and root. Note there are some TLDs that are NOT delegation only (e.g. DE and MUSEUM) these can be excluded from the checks buy using exclude. root-delegation-only exclude { "DE"; "MUSEUM"; };
2003-09-19 12:39:49 +00:00
static keyword_type_t exclude_kw = { "exclude", &cfg_type_namelist };
static cfg_type_t cfg_type_optional_exclude = {
"optional_exclude", parse_optional_keyvalue, print_keyvalue,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
doc_optional_keyvalue, &cfg_rep_list, &exclude_kw
};
1510. [func] New view option "root-delegation-only". Apply delegation-only check to all TLDs and root. Note there are some TLDs that are NOT delegation only (e.g. DE and MUSEUM) these can be excluded from the checks buy using exclude. root-delegation-only exclude { "DE"; "MUSEUM"; };
2003-09-19 12:39:49 +00:00
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
static keyword_type_t exceptionnames_kw = { "except-from", &cfg_type_namelist };
2604. [func] Add support for DNS rebinding attack prevention through new options, deny-answer-addresses and deny-answer-aliases. Based on contributed code from JD Nurmi, Google. [RT #18192]
2009-05-29 22:22:37 +00:00
static cfg_type_t cfg_type_optional_exceptionnames = {
"optional_allow", parse_optional_keyvalue, print_keyvalue,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
doc_optional_keyvalue, &cfg_rep_list, &exceptionnames_kw
};
2604. [func] Add support for DNS rebinding attack prevention through new options, deny-answer-addresses and deny-answer-aliases. Based on contributed code from JD Nurmi, Google. [RT #18192]
2009-05-29 22:22:37 +00:00
static cfg_tuplefielddef_t denyaddresses_fields[] = {
{ "acl", &cfg_type_bracketed_aml, 0 },
{ "except-from", &cfg_type_optional_exceptionnames, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_denyaddresses = {
"denyaddresses", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, denyaddresses_fields
};
static cfg_tuplefielddef_t denyaliases_fields[] = {
{ "name", &cfg_type_namelist, 0 },
{ "except-from", &cfg_type_optional_exceptionnames, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_denyaliases = {
"denyaliases", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, denyaliases_fields
};
1558. [func] New DNSSEC 'disable-algorithms'. Support entry into child zones for which we don't have a supported algorithm. Such child zones are treated as unsigned. 1557. [func] Implement missing DNSSEC tests for * NOQNAME proof with wildcard answers. * NOWILDARD proof with NXDOMAIN. Cache and return NOQNAME with wildcard answers.
2004-01-14 02:06:51 +00:00
static cfg_type_t cfg_type_algorithmlist = { "algorithmlist",
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_astring };
1558. [func] New DNSSEC 'disable-algorithms'. Support entry into child zones for which we don't have a supported algorithm. Such child zones are treated as unsigned. 1557. [func] Implement missing DNSSEC tests for * NOQNAME proof with wildcard answers. * NOWILDARD proof with NXDOMAIN. Cache and return NOQNAME with wildcard answers.
2004-01-14 02:06:51 +00:00
static cfg_tuplefielddef_t disablealgorithm_fields[] = {
{ "name", &cfg_type_astring, 0 },
{ "algorithms", &cfg_type_algorithmlist, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_disablealgorithm = {
"disablealgorithm", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, disablealgorithm_fields
};
3387. [func] Support for a DS digest can be disabled at runtime with disable-ds-digests. [RT #21581]
2012-10-03 12:38:43 +10:00
static cfg_type_t cfg_type_dsdigestlist = { "dsdigestlist",
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_astring };
3387. [func] Support for a DS digest can be disabled at runtime with disable-ds-digests. [RT #21581]
2012-10-03 12:38:43 +10:00
static cfg_tuplefielddef_t disabledsdigest_fields[] = {
{ "name", &cfg_type_astring, 0 },
{ "digests", &cfg_type_dsdigestlist, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_disabledsdigest = {
"disabledsdigest", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, disabledsdigest_fields
};
1600. [bug] Duplicate zone pre-load checks were not case insensitive. 1599. [bug] Fix memory leak on error path when checking named.conf. 1598. [func] Specify that certain parts of the namespace must be secure (dnssec-must-be-secure).
2004-04-15 23:40:27 +00:00
static cfg_tuplefielddef_t mustbesecure_fields[] = {
update copyright notice
2008-01-18 23:46:58 +00:00
{ "name", &cfg_type_astring, 0 },
{ "value", &cfg_type_boolean, 0 },
{ NULL, NULL, 0 }
1600. [bug] Duplicate zone pre-load checks were not case insensitive. 1599. [bug] Fix memory leak on error path when checking named.conf. 1598. [func] Specify that certain parts of the namespace must be secure (dnssec-must-be-secure).
2004-04-15 23:40:27 +00:00
};
static cfg_type_t cfg_type_mustbesecure = {
"mustbesecure", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, mustbesecure_fields
};
Remove the mastefile-format map option As previously announced, this commit removes the masterfile-format format 'map' from named, all the tools, the documentation and the system tests.
2021-09-16 11:46:13 +02:00
static const char *masterformat_enums[] = { "raw", "text", NULL };
1817. [func] add support for additional zone file formats for improving loading performance. The masterfile-format option in named.conf can be used to specify a non-default format. A new separate command named-compilezone was provided to generate zone files in a new format.
2005-06-20 01:05:33 +00:00
static cfg_type_t cfg_type_masterformat = {
"masterformat", cfg_parse_enum, cfg_print_ustring,
cfg_doc_enum, &cfg_rep_string, &masterformat_enums
};
[master] masterfile-style 3814. [func] The "masterfile-style" zone option controls the formatting of dumped zone files. Options are "relative" (multiline format) and "full" (one record per line). The default is "relative". [RT #20798]
2014-04-17 17:10:29 -07:00
static const char *masterstyle_enums[] = { "full", "relative", NULL };
static cfg_type_t cfg_type_masterstyle = {
"masterstyle", cfg_parse_enum, cfg_print_ustring,
cfg_doc_enum, &cfg_rep_string, &masterstyle_enums
};
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
[master] EDNS padding and keepalive support 4549. [func] Added support for the EDNS TCP Keepalive option (RFC 7828). [RT #42126] 4548. [func] Added support for the EDNS Padding option (RFC 7830). [RT #42094]
2017-01-04 09:16:30 -08:00
static keyword_type_t blocksize_kw = { "block-size", &cfg_type_uint32 };
static cfg_type_t cfg_type_blocksize = { "blocksize", parse_keyvalue,
print_keyvalue, doc_keyvalue,
&cfg_rep_uint32, &blocksize_kw };
static cfg_tuplefielddef_t resppadding_fields[] = {
{ "acl", &cfg_type_bracketed_aml, 0 },
{ "block-size", &cfg_type_blocksize, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_resppadding = {
"resppadding", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, resppadding_fields
};
[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]
2015-10-02 12:32:42 -07:00
/*%
* dnstap {
[master] Doxygen fixes and cleanups 4773. [doc] Fixed generating Doxygen documentation for functions annotated using certain macros. Miscellaneous Doxygen-related cleanups. [RT #46276]
2017-10-17 06:53:14 +02:00
* &lt;message type&gt; [query | response] ;
[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]
2015-10-02 12:32:42 -07:00
* ...
* }
*
extend DNSTAP to record UPDATE requests and responses as a separate type
2018-10-02 14:13:14 -07:00
* ... where message type is one of: client, resolver, auth, forwarder,
* update, all
[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]
2015-10-02 12:32:42 -07:00
*/
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
static const char *dnstap_types[] = { "all", "auth", "client",
extend DNSTAP to record UPDATE requests and responses as a separate type
2018-10-02 14:13:14 -07:00
"forwarder", "resolver", "update",
NULL };
[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]
2015-10-02 12:32:42 -07:00
static const char *dnstap_modes[] = { "query", "response", NULL };
static cfg_type_t cfg_type_dnstap_type = { "dnstap_type", cfg_parse_enum,
cfg_print_ustring, cfg_doc_enum,
&cfg_rep_string, dnstap_types };
static cfg_type_t cfg_type_dnstap_mode = {
"dnstap_mode", parse_optional_enum, cfg_print_ustring,
doc_optional_enum, &cfg_rep_string, dnstap_modes
};
static cfg_tuplefielddef_t dnstap_fields[] = {
{ "type", &cfg_type_dnstap_type, 0 },
{ "mode", &cfg_type_dnstap_mode, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_dnstap_entry = { "dnstap_value", cfg_parse_tuple,
cfg_print_tuple, cfg_doc_tuple,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
&cfg_rep_tuple, dnstap_fields };
[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]
2015-10-02 12:32:42 -07:00
static cfg_type_t cfg_type_dnstap = { "dnstap",
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_dnstap_entry };
/*%
* dnstap-output
*/
[master] fix memory leak from dnstap-output parsing
2017-02-06 22:13:51 -08:00
static isc_result_t
parse_dtout(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
isc_result_t result;
cfg_obj_t *obj = NULL;
const cfg_tuplefielddef_t *fields = type->of;
CHECK(cfg_create_tuple(pctx, type, &obj));
/* Parse the mandatory "mode" and "path" fields */
CHECK(cfg_parse_obj(pctx, fields[0].type, &obj->value.tuple[0]));
CHECK(cfg_parse_obj(pctx, fields[1].type, &obj->value.tuple[1]));
/* Parse "versions" and "size" fields in any order. */
for (;;) {
CHECK(cfg_peektoken(pctx, 0));
if (pctx->token.type == isc_tokentype_string) {
CHECK(cfg_gettoken(pctx, 0));
if (strcasecmp(TOKEN_STRING(pctx), "size") == 0 &&
Update sources to Clang 15 formatting
2022-11-02 19:33:14 +01:00
obj->value.tuple[2] == NULL)
{
[master] fix memory leak from dnstap-output parsing
2017-02-06 22:13:51 -08:00
CHECK(cfg_parse_obj(pctx, fields[2].type,
&obj->value.tuple[2]));
} else if (strcasecmp(TOKEN_STRING(pctx), "versions") ==
0 &&
obj->value.tuple[3] == NULL)
{
CHECK(cfg_parse_obj(pctx, fields[3].type,
&obj->value.tuple[3]));
[master] timestamp suffixes for log files 4579. [func] Logging channels and dnstap output files can now be configured with a "suffix" option, set to either "increment" or "timestamp", indicating whether to use incrementing numbers or timestamps as the file suffix when rolling over a log file. [RT #42838]
2017-03-08 23:20:40 -08:00
} else if (strcasecmp(TOKEN_STRING(pctx), "suffix") ==
0 &&
obj->value.tuple[4] == NULL)
{
CHECK(cfg_parse_obj(pctx, fields[4].type,
&obj->value.tuple[4]));
[master] fix memory leak from dnstap-output parsing
2017-02-06 22:13:51 -08:00
} else {
cfg_parser_error(pctx, CFG_LOG_NEAR,
"unexpected token");
result = ISC_R_UNEXPECTEDTOKEN;
goto cleanup;
}
} else {
break;
}
}
[master] dnstap size and versions options 4572. [func] The "dnstap-output" option can now take "size" and "versions" parameters to indicate the maximum size a dnstap log file can grow before rolling to a new file, and how many old files to retain. [RT #44502]
2017-02-06 16:03:37 -08:00
[master] fix memory leak from dnstap-output parsing
2017-02-06 22:13:51 -08:00
/* Create void objects for missing optional values. */
if (obj->value.tuple[2] == NULL) {
CHECK(cfg_parse_void(pctx, NULL, &obj->value.tuple[2]));
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
[master] fix memory leak from dnstap-output parsing
2017-02-06 22:13:51 -08:00
if (obj->value.tuple[3] == NULL) {
CHECK(cfg_parse_void(pctx, NULL, &obj->value.tuple[3]));
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
[master] timestamp suffixes for log files 4579. [func] Logging channels and dnstap output files can now be configured with a "suffix" option, set to either "increment" or "timestamp", indicating whether to use incrementing numbers or timestamps as the file suffix when rolling over a log file. [RT #42838]
2017-03-08 23:20:40 -08:00
if (obj->value.tuple[4] == NULL) {
CHECK(cfg_parse_void(pctx, NULL, &obj->value.tuple[4]));
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
[master] fix memory leak from dnstap-output parsing
2017-02-06 22:13:51 -08:00
*ret = obj;
return (ISC_R_SUCCESS);
cleanup:
CLEANUP_OBJ(obj);
return (result);
}
static void
print_dtout(cfg_printer_t *pctx, const cfg_obj_t *obj) {
cfg_print_obj(pctx, obj->value.tuple[0]); /* mode */
cfg_print_obj(pctx, obj->value.tuple[1]); /* file */
if (obj->value.tuple[2]->type->print != cfg_print_void) {
cfg_print_cstr(pctx, " size ");
cfg_print_obj(pctx, obj->value.tuple[2]);
}
if (obj->value.tuple[3]->type->print != cfg_print_void) {
cfg_print_cstr(pctx, " versions ");
cfg_print_obj(pctx, obj->value.tuple[3]);
}
[master] timestamp suffixes for log files 4579. [func] Logging channels and dnstap output files can now be configured with a "suffix" option, set to either "increment" or "timestamp", indicating whether to use incrementing numbers or timestamps as the file suffix when rolling over a log file. [RT #42838]
2017-03-08 23:20:40 -08:00
if (obj->value.tuple[4]->type->print != cfg_print_void) {
cfg_print_cstr(pctx, " suffix ");
cfg_print_obj(pctx, obj->value.tuple[4]);
}
[master] fix memory leak from dnstap-output parsing
2017-02-06 22:13:51 -08:00
}
static void
doc_dtout(cfg_printer_t *pctx, const cfg_type_t *type) {
UNUSED(type);
cfg_print_cstr(pctx, "( file | unix ) <quoted_string>");
cfg_print_cstr(pctx, " ");
cfg_print_cstr(pctx, "[ size ( unlimited | <size> ) ]");
cfg_print_cstr(pctx, " ");
cfg_print_cstr(pctx, "[ versions ( unlimited | <integer> ) ]");
[master] timestamp suffixes for log files 4579. [func] Logging channels and dnstap output files can now be configured with a "suffix" option, set to either "increment" or "timestamp", indicating whether to use incrementing numbers or timestamps as the file suffix when rolling over a log file. [RT #42838]
2017-03-08 23:20:40 -08:00
cfg_print_cstr(pctx, " ");
cfg_print_cstr(pctx, "[ suffix ( increment | timestamp ) ]");
[master] fix memory leak from dnstap-output parsing
2017-02-06 22:13:51 -08:00
}
[master] dnstap size and versions options 4572. [func] The "dnstap-output" option can now take "size" and "versions" parameters to indicate the maximum size a dnstap log file can grow before rolling to a new file, and how many old files to retain. [RT #44502]
2017-02-06 16:03:37 -08:00
[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]
2015-10-02 12:32:42 -07:00
static const char *dtoutmode_enums[] = { "file", "unix", NULL };
static cfg_type_t cfg_type_dtmode = { "dtmode", cfg_parse_enum,
cfg_print_ustring, cfg_doc_enum,
&cfg_rep_string, &dtoutmode_enums };
static cfg_tuplefielddef_t dtout_fields[] = {
{ "mode", &cfg_type_dtmode, 0 },
{ "path", &cfg_type_qstring, 0 },
[master] fix memory leak from dnstap-output parsing
2017-02-06 22:13:51 -08:00
{ "size", &cfg_type_sizenodefault, 0 },
{ "versions", &cfg_type_logversions, 0 },
[master] timestamp suffixes for log files 4579. [func] Logging channels and dnstap output files can now be configured with a "suffix" option, set to either "increment" or "timestamp", indicating whether to use incrementing numbers or timestamps as the file suffix when rolling over a log file. [RT #42838]
2017-03-08 23:20:40 -08:00
{ "suffix", &cfg_type_logsuffix, 0 },
[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]
2015-10-02 12:32:42 -07:00
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_dnstapoutput = { "dnstapoutput", parse_dtout,
[master] fix memory leak from dnstap-output parsing
2017-02-06 22:13:51 -08:00
print_dtout, doc_dtout,
[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]
2015-10-02 12:32:42 -07:00
&cfg_rep_tuple, dtout_fields };
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
/*%
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
* response-policy {
[master] Doxygen fixes and cleanups 4773. [doc] Fixed generating Doxygen documentation for functions annotated using certain macros. Miscellaneous Doxygen-related cleanups. [RT #46276]
2017-10-17 06:53:14 +02:00
* zone &lt;string&gt; [ policy (given|disabled|passthru|drop|tcp-only|
* nxdomain|nodata|cname &lt;domain&gt; ) ]
Allow RPZ rewrite logging to be configured on a per-zone basis (#39754)
2015-07-06 08:48:37 +05:30
* [ recursive-only yes|no ] [ log yes|no ]
[master] DNS Response Policy Service API 4713. [func] Added support for the DNS Response Policy Service (DNSRPS) API, which allows named to use an external response policy daemon when built with "configure --enable-dnsrps". Thanks to Vernon Schryver and Farsight Security. [RT #43376]
2017-09-11 11:53:42 -07:00
* [ max-policy-ttl number ]
* [ nsip-enable yes|no ] [ nsdname-enable yes|no ];
update comment as per rt39703
2015-06-05 11:09:35 +10:00
* } [ recursive-only yes|no ] [ max-policy-ttl number ]
4576. [func] The RPZ implementation has been substantially refactored for improved performance and reliability. [RT #43449]
2017-02-20 11:57:28 +01:00
* [ min-update-interval number ]
[master] RPZ speedup (phase 2, multiple RPZ's) 3495. [func] Support multiple response-policy zones, while improving RPZ performance. [RT #32476]
2013-02-25 12:46:51 -08:00
* [ break-dnssec yes|no ] [ min-ns-dots number ]
[master] DNS Response Policy Service API 4713. [func] Added support for the DNS Response Policy Service (DNSRPS) API, which allows named to use an external response policy daemon when built with "configure --enable-dnsrps". Thanks to Vernon Schryver and Farsight Security. [RT #43376]
2017-09-11 11:53:42 -07:00
* [ qname-wait-recurse yes|no ]
* [ nsip-enable yes|no ] [ nsdname-enable yes|no ]
* [ dnsrps-enable yes|no ]
* [ dnsrps-options { DNSRPS configuration string } ];
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
*/
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
static void
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
doc_rpz_policy(cfg_printer_t *pctx, const cfg_type_t *type) {
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
const char *const *p;
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
/*
* This is cfg_doc_enum() without the trailing " )".
*/
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, "( ");
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
for (p = type->of; *p != NULL; p++) {
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
cfg_print_cstr(pctx, *p);
if (p[1] != NULL) {
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " | ");
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
}
}
static void
doc_rpz_cname(cfg_printer_t *pctx, const cfg_type_t *type) {
cfg_doc_terminal(pctx, type);
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " )");
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
}
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
/*
* Parse
[master] rpz work 3620. [func] Added "rpz-client-ip" policy triggers, enabling RPZ responses to be configured on the basis of the client IP address; this can be used, for example, to blacklist misbehaving recursive or stub resolvers. [RT #33605] 3619. [bug] Fixed a bug in RPZ with "recursive-only no;" [RT #33776]
2013-07-12 14:46:47 -07:00
* given|disabled|passthru|drop|tcp-only|nxdomain|nodata|cname <domain>
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
*/
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
static isc_result_t
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
cfg_parse_rpz_policy(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
isc_result_t result;
[master] add cfg_parse_buffer3() function with linenum parameter 4482. [cleanup] Change #4455 was incomplete. [RT #43252]
2016-10-10 17:11:21 -07:00
cfg_obj_t *obj = NULL;
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
const cfg_tuplefielddef_t *fields;
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
CHECK(cfg_create_tuple(pctx, type, &obj));
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
fields = type->of;
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
CHECK(cfg_parse_obj(pctx, fields[0].type, &obj->value.tuple[0]));
/*
* parse cname domain only after "policy cname"
*/
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
if (strcasecmp("cname", cfg_obj_asstring(obj->value.tuple[0])) != 0) {
CHECK(cfg_parse_void(pctx, NULL, &obj->value.tuple[1]));
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
} else {
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
CHECK(cfg_parse_obj(pctx, fields[1].type,
&obj->value.tuple[1]));
}
*ret = obj;
return (ISC_R_SUCCESS);
cleanup:
CLEANUP_OBJ(obj);
return (result);
}
/*
[master] DDoS mitigation features 3938. [func] Added quotas to be used in recursive resolvers that are under high query load for names in zones whose authoritative servers are nonresponsive or are experiencing a denial of service attack. - "fetches-per-server" limits the number of simultaneous queries that can be sent to any single authoritative server. The configured value is a starting point; it is automatically adjusted downward if the server is partially or completely non-responsive. The algorithm used to adjust the quota can be configured via the "fetch-quota-params" option. - "fetches-per-zone" limits the number of simultaneous queries that can be sent for names within a single domain. (Note: Unlike "fetches-per-server", this value is not self-tuning.) - New stats counters have been added to count queries spilled due to these quotas. See the ARM for details of these options. [RT #37125]
2015-07-08 22:53:39 -07:00
* Parse a tuple consisting of any kind of required field followed
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
* by 2 or more optional keyvalues that can be in any order.
*/
static isc_result_t
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_parse_kv_tuple(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
const cfg_tuplefielddef_t *fields, *f;
[master] add cfg_parse_buffer3() function with linenum parameter 4482. [cleanup] Change #4455 was incomplete. [RT #43252]
2016-10-10 17:11:21 -07:00
cfg_obj_t *obj = NULL;
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
int fn;
isc_result_t result;
CHECK(cfg_create_tuple(pctx, type, &obj));
/*
* The zone first field is required and always first.
*/
fields = type->of;
CHECK(cfg_parse_obj(pctx, fields[0].type, &obj->value.tuple[0]));
for (;;) {
CHECK(cfg_peektoken(pctx, CFG_LEXOPT_QSTRING));
if (pctx->token.type != isc_tokentype_string) {
break;
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
for (fn = 1, f = &fields[1];; ++fn, ++f) {
if (f->name == NULL) {
cfg_parser_error(pctx, 0, "unexpected '%s'",
TOKEN_STRING(pctx));
result = ISC_R_UNEXPECTEDTOKEN;
goto cleanup;
}
if (obj->value.tuple[fn] == NULL &&
strcasecmp(f->name, TOKEN_STRING(pctx)) == 0)
{
break;
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
}
CHECK(cfg_gettoken(pctx, 0));
CHECK(cfg_parse_obj(pctx, f->type, &obj->value.tuple[fn]));
}
for (fn = 1, f = &fields[1]; f->name != NULL; ++fn, ++f) {
if (obj->value.tuple[fn] == NULL) {
CHECK(cfg_parse_void(pctx, NULL,
&obj->value.tuple[fn]));
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
}
*ret = obj;
return (ISC_R_SUCCESS);
cleanup:
CLEANUP_OBJ(obj);
return (result);
}
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
static void
cfg_print_kv_tuple(cfg_printer_t *pctx, const cfg_obj_t *obj) {
unsigned int i;
const cfg_tuplefielddef_t *fields, *f;
const cfg_obj_t *fieldobj;
fields = obj->type->of;
for (f = fields, i = 0; f->name != NULL; f++, i++) {
fieldobj = obj->value.tuple[i];
if (fieldobj->type->print == cfg_print_void) {
continue;
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
if (i != 0) {
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ");
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
cfg_print_cstr(pctx, f->name);
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ");
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
}
cfg_print_obj(pctx, fieldobj);
}
}
static void
cfg_doc_kv_tuple(cfg_printer_t *pctx, const cfg_type_t *type) {
const cfg_tuplefielddef_t *fields, *f;
fields = type->of;
for (f = fields; f->name != NULL; f++) {
add a CFG_CLAUSEFLAG_NODOC flag for use with outdated terms "masters" and "default-masters" are now flagged so they will not be included in the named.conf man page, despite being accepted as valid options by the parser for backward compatibiility.
2022-02-25 16:33:30 -08:00
if ((f->flags & CFG_CLAUSEFLAG_NODOC) != 0) {
continue;
}
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
if (f != fields) {
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " [ ");
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
cfg_print_cstr(pctx, f->name);
if (f->type->doc != cfg_doc_void) {
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ");
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
}
cfg_doc_obj(pctx, f->type);
if (f != fields) {
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ]");
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
}
}
allow unquoted response-policy zone names
2018-10-28 23:25:46 -07:00
static keyword_type_t zone_kw = { "zone", &cfg_type_astring };
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
static cfg_type_t cfg_type_rpz_zone = { "zone", parse_keyvalue,
print_keyvalue, doc_keyvalue,
&cfg_rep_string, &zone_kw };
[master] rpz work 3620. [func] Added "rpz-client-ip" policy triggers, enabling RPZ responses to be configured on the basis of the client IP address; this can be used, for example, to blacklist misbehaving recursive or stub resolvers. [RT #33605] 3619. [bug] Fixed a bug in RPZ with "recursive-only no;" [RT #33776]
2013-07-12 14:46:47 -07:00
/*
* "no-op" is an obsolete equivalent of "passthru".
*/
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
static const char *rpz_policies[] = { "cname", "disabled", "drop",
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
"given", "no-op", "nodata",
"nxdomain", "passthru", "tcp-only",
NULL };
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
static cfg_type_t cfg_type_rpz_policy_name = {
"policy name", cfg_parse_enum, cfg_print_ustring,
doc_rpz_policy, &cfg_rep_string, &rpz_policies
};
static cfg_type_t cfg_type_rpz_cname = {
"quoted_string", cfg_parse_astring, NULL,
doc_rpz_cname, &cfg_rep_string, NULL
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
};
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
static cfg_tuplefielddef_t rpz_policy_fields[] = {
{ "policy name", &cfg_type_rpz_policy_name, 0 },
{ "cname", &cfg_type_rpz_cname, 0 },
{ NULL, NULL, 0 }
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
};
static cfg_type_t cfg_type_rpz_policy = { "policy tuple", cfg_parse_rpz_policy,
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, rpz_policy_fields };
static cfg_tuplefielddef_t rpz_zone_fields[] = {
{ "zone name", &cfg_type_rpz_zone, 0 },
add the ability to control whether SOA records are added response-policy modified answers
2019-02-14 17:50:10 +11:00
{ "add-soa", &cfg_type_boolean, 0 },
Allow RPZ rewrite logging to be configured on a per-zone basis (#39754)
2015-07-06 08:48:37 +05:30
{ "log", &cfg_type_boolean, 0 },
Extend ttlval to accept ISO 8601 durations The ttlval configuration types are replaced by duration configuration types. The duration is an ISO 8601 duration that is going to be used for DNSSEC key timings such as key lifetimes, signature resign intervals and refresh periods, etc. But it is also still allowed to use the BIND ttlval ways of configuring intervals (number plus optional unit). A duration is stored as an array of 7 different time parts. A duration can either be expressed in weeks, or in a combination of the other datetime indicators. Add several unit tests to ensure the correct value is parsed given different string values.
2019-09-02 15:46:28 +02:00
{ "max-policy-ttl", &cfg_type_duration, 0 },
{ "min-update-interval", &cfg_type_duration, 0 },
4356. [func] Add the ability to specify whether to wait for nameserver addresses to be looked up or not to rpz with a new modifying directive 'nsip-wait-recurse'. [RT #35009]
2016-05-05 16:29:05 +10:00
{ "policy", &cfg_type_rpz_policy, 0 },
{ "recursive-only", &cfg_type_boolean, 0 },
[master] DNS Response Policy Service API 4713. [func] Added support for the DNS Response Policy Service (DNSRPS) API, which allows named to use an external response policy daemon when built with "configure --enable-dnsrps". Thanks to Vernon Schryver and Farsight Security. [RT #43376]
2017-09-11 11:53:42 -07:00
{ "nsip-enable", &cfg_type_boolean, 0 },
{ "nsdname-enable", &cfg_type_boolean, 0 },
Add extended DNS error configuration option for RPZ zones Implement the configuration option with its checking and parsing parts. The option should be later used by BIND to set an extended error code (EDE) for the queries modified in the result of RPZ processing.
2022-08-26 14:11:47 +00:00
{ "ede", &cfg_type_ustring, 0 },
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
{ NULL, NULL, 0 }
};
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
static cfg_type_t cfg_type_rpz_tuple = { "rpz tuple", cfg_parse_kv_tuple,
cfg_print_kv_tuple, cfg_doc_kv_tuple,
&cfg_rep_tuple, rpz_zone_fields };
static cfg_type_t cfg_type_rpz_list = { "zone list",
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_rpz_tuple };
static cfg_tuplefielddef_t rpz_fields[] = {
{ "zone list", &cfg_type_rpz_list, 0 },
add the ability to control whether SOA records are added response-policy modified answers
2019-02-14 17:50:10 +11:00
{ "add-soa", &cfg_type_boolean, 0 },
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
{ "break-dnssec", &cfg_type_boolean, 0 },
Extend ttlval to accept ISO 8601 durations The ttlval configuration types are replaced by duration configuration types. The duration is an ISO 8601 duration that is going to be used for DNSSEC key timings such as key lifetimes, signature resign intervals and refresh periods, etc. But it is also still allowed to use the BIND ttlval ways of configuring intervals (number plus optional unit). A duration is stored as an array of 7 different time parts. A duration can either be expressed in weeks, or in a combination of the other datetime indicators. Add several unit tests to ensure the correct value is parsed given different string values.
2019-09-02 15:46:28 +02:00
{ "max-policy-ttl", &cfg_type_duration, 0 },
{ "min-update-interval", &cfg_type_duration, 0 },
[master] RPZ speedup (phase 2, multiple RPZ's) 3495. [func] Support multiple response-policy zones, while improving RPZ performance. [RT #32476]
2013-02-25 12:46:51 -08:00
{ "min-ns-dots", &cfg_type_uint32, 0 },
4356. [func] Add the ability to specify whether to wait for nameserver addresses to be looked up or not to rpz with a new modifying directive 'nsip-wait-recurse'. [RT #35009]
2016-05-05 16:29:05 +10:00
{ "nsip-wait-recurse", &cfg_type_boolean, 0 },
Added RPZ configuration option "nsdname-wait-recurse" This new option was added to fill a gap in RPZ configuration options. It was possible to instruct BIND wheter NSIP rewritting rules would apply or not, as long as the required data was already in cache or not, respectively, by means of the option nsip-wait-recurse. A value of yes (default) could incur a little processing cost, since BIND would need to recurse to find NS addresses in case they were not in the cache. This behavior could be changed by setting nsip-wait-recurse value to no, in which case BIND would promptly return some error code if the NS IP addresses data were not in cache, then BIND would start a recursive query in background, so future similar requests would have the required data (NS IPs) in cache, allowing BIND to apply NSIP rules accordingly. A similar feature wasn't available for NSDNAME triggers, so this commit adds the option nsdname-wait-recurse to fill this gap, as it was expected by couple BIND users.
2020-03-02 14:52:10 -03:00
{ "nsdname-wait-recurse", &cfg_type_boolean, 0 },
[master] RPZ speedup (phase 2, multiple RPZ's) 3495. [func] Support multiple response-policy zones, while improving RPZ performance. [RT #32476]
2013-02-25 12:46:51 -08:00
{ "qname-wait-recurse", &cfg_type_boolean, 0 },
4356. [func] Add the ability to specify whether to wait for nameserver addresses to be looked up or not to rpz with a new modifying directive 'nsip-wait-recurse'. [RT #35009]
2016-05-05 16:29:05 +10:00
{ "recursive-only", &cfg_type_boolean, 0 },
[master] DNS Response Policy Service API 4713. [func] Added support for the DNS Response Policy Service (DNSRPS) API, which allows named to use an external response policy daemon when built with "configure --enable-dnsrps". Thanks to Vernon Schryver and Farsight Security. [RT #43376]
2017-09-11 11:53:42 -07:00
{ "nsip-enable", &cfg_type_boolean, 0 },
{ "nsdname-enable", &cfg_type_boolean, 0 },
#ifdef USE_DNSRPS
{ "dnsrps-enable", &cfg_type_boolean, 0 },
{ "dnsrps-options", &cfg_type_bracketed_text, 0 },
netmgr: Add additional safeguards to netmgr/tls.c This commit adds couple of additional safeguards against running sends/reads on inactive sockets. The changes was modeled after the changes we made to netmgr/tcpdns.c
2020-11-10 11:23:05 +01:00
#else /* ifdef USE_DNSRPS */
[master] DNS Response Policy Service API 4713. [func] Added support for the DNS Response Policy Service (DNSRPS) API, which allows named to use an external response policy daemon when built with "configure --enable-dnsrps". Thanks to Vernon Schryver and Farsight Security. [RT #43376]
2017-09-11 11:53:42 -07:00
{ "dnsrps-enable", &cfg_type_boolean, CFG_CLAUSEFLAG_NOTCONFIGURED },
{ "dnsrps-options", &cfg_type_bracketed_text,
CFG_CLAUSEFLAG_NOTCONFIGURED },
#endif /* ifdef USE_DNSRPS */
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_rpz = { "rpz",
Squashed commit of the following: commit aea73609ac5d41ed091360e94370798965f28f05 commit eef7f44c57a060b24a426eb8888e16176a0a69b1 commit a88a26d864ad399fa2d40e3b9659b4d26f454ca1 commit 1b90d59568e7e3b65690c6bd075cf4d60b03e454 Merge: 74d8f73 cd02924 commit 74d8f73ed553bb64a305e284905762f7ff0029aa commit 9a59ef6bbd4befe91e5691e8b85afe1cb7ab0706 commit c63606a53b4f1bb7066b37d3cfe588e9dc21a119 commit 2c392a840c8838455d144ce163bd873bee400c97 commit 0241f53563e6e7bed462a883d98a8931f01e0980 commit 79fe22b5d6f04bdaa3073cf54d41952194e879e1 commit 351b3049625f2edd39729dd85413e961b97d4b3b commit 7207674fc77c9a10d84c0cb94e36d1c09bb31459 commit 543ad34cf08f901c20b438c9d2f45482cff13d5e commit fc45b99ce4438627fdcbeb4365695ba0065fa46f commit c425207f57e0a5157372aa7edbb79b13170563e5 commit ef8c5e23ca284e0ea02f69ce1f356d537c19d93b commit ba0d4e3aa51efe412cfa1d031651f949442d1802 commit 41c7969c7cb6884b93011f7ace3fd9522efc021e and more from CVS for rt26172 Add - optional "recursive-only yes|no" to the response-policy statement - optional max-policy-ttl to limit the lies that "recursive-only no" can introduce into resolvers' caches - test that queries with RD=0 are not rewritten by default - performance smoke test Change encoding of PASSTHRU action to "rpz-passthru". (The old encoding is still accepted.) Fix rt26180 assert botch in zone_findrdataset() in this branch as well. Fix missing signatures on NOERROR results despite RPZ hits when there are signatures and the client asks for DNSSEC,
2012-05-31 02:03:34 +00:00
cfg_parse_kv_tuple,
cfg_print_kv_tuple,
cfg_doc_kv_tuple,
&cfg_rep_tuple,
rpz_fields };
3008. [func] Response policy zones (RPZ) support. [RT #21726]
2011-01-13 01:59:28 +00:00
4376. [experimental] Added support for Catalog Zones, a new method for provisioning secondary servers in which a list of zones to be served is stored in a DNS zone and can be propagated to slaves via AXFR/IXFR. [RT #41581] 4375. [func] Add support for automatic reallocation of isc_buffer to isc_buffer_put* functions. [RT #42394]
2016-05-26 21:23:19 +02:00
/*
* Catalog zones
*/
static cfg_type_t cfg_type_catz_zone = { "zone", parse_keyvalue,
print_keyvalue, doc_keyvalue,
&cfg_rep_string, &zone_kw };
static cfg_tuplefielddef_t catz_zone_fields[] = {
{ "zone name", &cfg_type_catz_zone, 0 },
add a CFG_CLAUSEFLAG_NODOC flag for use with outdated terms "masters" and "default-masters" are now flagged so they will not be included in the named.conf man page, despite being accepted as valid options by the parser for backward compatibiility.
2022-02-25 16:33:30 -08:00
{ "default-masters", &cfg_type_namesockaddrkeylist,
CFG_CLAUSEFLAG_NODOC },
Add synonym configuration options for catalog zones This commit adds 'primaries' and 'default-primaries' catalog zones configuration options synonyms for 'masters' and 'default-masters' respectively.
2021-09-03 00:56:47 +00:00
{ "default-primaries", &cfg_type_namesockaddrkeylist, 0 },
[master] zone-directory option for catalog zones 4380. [experimental] Added a "zone-directory" option to "catalog-zones" syntax, allowing local masterfiles for slaves that are provisioned by catalog zones to be stored in a directory other than the server's working directory. [RT #42527]
2016-05-31 10:36:27 -07:00
{ "zone-directory", &cfg_type_qstring, 0 },
4376. [experimental] Added support for Catalog Zones, a new method for provisioning secondary servers in which a list of zones to be served is stored in a DNS zone and can be propagated to slaves via AXFR/IXFR. [RT #41581] 4375. [func] Add support for automatic reallocation of isc_buffer to isc_buffer_put* functions. [RT #42394]
2016-05-26 21:23:19 +02:00
{ "in-memory", &cfg_type_boolean, 0 },
Extend ttlval to accept ISO 8601 durations The ttlval configuration types are replaced by duration configuration types. The duration is an ISO 8601 duration that is going to be used for DNSSEC key timings such as key lifetimes, signature resign intervals and refresh periods, etc. But it is also still allowed to use the BIND ttlval ways of configuring intervals (number plus optional unit). A duration is stored as an array of 7 different time parts. A duration can either be expressed in weeks, or in a combination of the other datetime indicators. Add several unit tests to ensure the correct value is parsed given different string values.
2019-09-02 15:46:28 +02:00
{ "min-update-interval", &cfg_type_duration, 0 },
4376. [experimental] Added support for Catalog Zones, a new method for provisioning secondary servers in which a list of zones to be served is stored in a DNS zone and can be propagated to slaves via AXFR/IXFR. [RT #41581] 4375. [func] Add support for automatic reallocation of isc_buffer to isc_buffer_put* functions. [RT #42394]
2016-05-26 21:23:19 +02:00
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_catz_tuple = {
"catz tuple", cfg_parse_kv_tuple, cfg_print_kv_tuple,
cfg_doc_kv_tuple, &cfg_rep_tuple, catz_zone_fields
};
static cfg_type_t cfg_type_catz_list = { "zone list",
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_catz_tuple };
static cfg_tuplefielddef_t catz_fields[] = {
{ "zone list", &cfg_type_catz_list, 0 }, { NULL, NULL, 0 }
};
static cfg_type_t cfg_type_catz = {
"catz", cfg_parse_kv_tuple, cfg_print_kv_tuple,
cfg_doc_kv_tuple, &cfg_rep_tuple, catz_fields
};
[master] DNS RRL 3494. [func] DNS RRL: Blunt the impact of DNS reflection and amplification attacks by rate-limiting substantially- identical responses. [RT #28130]
2013-02-25 10:49:30 -08:00
/*
* rate-limit
*/
static cfg_clausedef_t rrl_clauses[] = {
{ "all-per-second", &cfg_type_uint32, 0 },
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
{ "errors-per-second", &cfg_type_uint32, 0 },
{ "exempt-clients", &cfg_type_bracketed_aml, 0 },
[master] fixed several RRL issues 3554. [bug] RRL failed to correctly rate-limit upward referrals and failed to count dropped error responses in the statistics. [RT #33225]
2013-04-25 14:40:32 -07:00
{ "ipv4-prefix-length", &cfg_type_uint32, 0 },
{ "ipv6-prefix-length", &cfg_type_uint32, 0 },
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
{ "log-only", &cfg_type_boolean, 0 },
[master] DNS RRL 3494. [func] DNS RRL: Blunt the impact of DNS reflection and amplification attacks by rate-limiting substantially- identical responses. [RT #28130]
2013-02-25 10:49:30 -08:00
{ "max-table-size", &cfg_type_uint32, 0 },
{ "min-table-size", &cfg_type_uint32, 0 },
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
{ "nodata-per-second", &cfg_type_uint32, 0 },
{ "nxdomains-per-second", &cfg_type_uint32, 0 },
{ "qps-scale", &cfg_type_uint32, 0 },
{ "referrals-per-second", &cfg_type_uint32, 0 },
{ "responses-per-second", &cfg_type_uint32, 0 },
{ "slip", &cfg_type_uint32, 0 },
{ "window", &cfg_type_uint32, 0 },
[master] DNS RRL 3494. [func] DNS RRL: Blunt the impact of DNS reflection and amplification attacks by rate-limiting substantially- identical responses. [RT #28130]
2013-02-25 10:49:30 -08:00
{ NULL, NULL, 0 }
};
static cfg_clausedef_t *rrl_clausesets[] = { rrl_clauses, NULL };
static cfg_type_t cfg_type_rrl = { "rate-limit", cfg_parse_map, cfg_print_map,
cfg_doc_map, &cfg_rep_map, rrl_clausesets };
3703. [func] Prefetch about to expire records if they are queried for, see prefetch option for details. [RT #35041]
2014-01-12 21:29:15 +11:00
static isc_result_t
parse_optional_uint32(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
isc_result_t result;
UNUSED(type);
CHECK(cfg_peektoken(pctx, ISC_LEXOPT_NUMBER | ISC_LEXOPT_CNUMBER));
if (pctx->token.type == isc_tokentype_number) {
CHECK(cfg_parse_obj(pctx, &cfg_type_uint32, ret));
} else {
CHECK(cfg_parse_obj(pctx, &cfg_type_void, ret));
}
cleanup:
return (result);
}
static void
doc_optional_uint32(cfg_printer_t *pctx, const cfg_type_t *type) {
UNUSED(type);
cfg_print_cstr(pctx, "[ <integer> ]");
}
static cfg_type_t cfg_type_optional_uint32 = { "optional_uint32",
parse_optional_uint32,
NULL,
doc_optional_uint32,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
NULL,
NULL };
3703. [func] Prefetch about to expire records if they are queried for, see prefetch option for details. [RT #35041]
2014-01-12 21:29:15 +11:00
static cfg_tuplefielddef_t prefetch_fields[] = {
{ "trigger", &cfg_type_uint32, 0 },
{ "eligible", &cfg_type_optional_uint32, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_prefetch = { "prefetch", cfg_parse_tuple,
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, prefetch_fields };
2981. [func] Partial DNS64 support (AAAA synthesis). [RT #21991]
2010-12-08 02:46:17 +00:00
/*
* DNS64.
*/
static cfg_clausedef_t dns64_clauses[] = {
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
{ "break-dnssec", &cfg_type_boolean, 0 },
2981. [func] Partial DNS64 support (AAAA synthesis). [RT #21991]
2010-12-08 02:46:17 +00:00
{ "clients", &cfg_type_bracketed_aml, 0 },
{ "exclude", &cfg_type_bracketed_aml, 0 },
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
{ "mapped", &cfg_type_bracketed_aml, 0 },
2981. [func] Partial DNS64 support (AAAA synthesis). [RT #21991]
2010-12-08 02:46:17 +00:00
{ "recursive-only", &cfg_type_boolean, 0 },
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
{ "suffix", &cfg_type_netaddr6, 0 },
2981. [func] Partial DNS64 support (AAAA synthesis). [RT #21991]
2010-12-08 02:46:17 +00:00
{ NULL, NULL, 0 },
};
static cfg_clausedef_t *dns64_clausesets[] = { dns64_clauses, NULL };
static cfg_type_t cfg_type_dns64 = { "dns64", cfg_parse_netprefix_map,
cfg_print_map, cfg_doc_map,
&cfg_rep_map, dns64_clausesets };
Added option for disabling stale-answer-client-timeout This commit allows to specify "disabled" or "off" in stale-answer-client-timeout statement. The logic to support this behavior will be added in the subsequent commits. This commit also ensures an upper bound to stale-answer-client-timeout which equals to one second less than 'resolver-query-timeout'.
2020-12-18 16:24:56 -03:00
static const char *staleanswerclienttimeout_enums[] = { "disabled", "off",
NULL };
static isc_result_t
parse_staleanswerclienttimeout(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
return (cfg_parse_enum_or_other(pctx, type, &cfg_type_uint32, ret));
}
static void
doc_staleanswerclienttimeout(cfg_printer_t *pctx, const cfg_type_t *type) {
cfg_doc_enum_or_other(pctx, type, &cfg_type_uint32);
}
static cfg_type_t cfg_type_staleanswerclienttimeout = {
"staleanswerclienttimeout",
parse_staleanswerclienttimeout,
cfg_print_ustring,
doc_staleanswerclienttimeout,
&cfg_rep_string,
staleanswerclienttimeout_enums
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* Clauses that can be found within the 'view' statement,
* with defaults in the 'options' statement.
*/
static cfg_clausedef_t view_clauses[] = {
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "acache-cleaning-interval", NULL, CFG_CLAUSEFLAG_ANCIENT },
{ "acache-enable", NULL, CFG_CLAUSEFLAG_ANCIENT },
{ "additional-from-auth", NULL, CFG_CLAUSEFLAG_ANCIENT },
{ "additional-from-cache", NULL, CFG_CLAUSEFLAG_ANCIENT },
2936. [func] Improved configuration syntax and multiple-view support for addzone/delzone feature (see change #2930). Removed "new-zone-file" option, replaced with "allow-new-zones (yes|no)". The new-zone-file for each view is now created automatically, with a filename generated from a hash of the view name. It is no longer necessary to "include" the new-zone-file in named.conf; this happens automatically. Zones that were not added via "rndc addzone" can no longer be removed with "rndc delzone". [RT #19447]
2010-08-11 18:14:20 +00:00
{ "allow-new-zones", &cfg_type_boolean, 0 },
1676. [func] New option "allow-query-cache". This lets allow-query be used to specify the default zone access level rather than having to have every zone override the global value. allow-query-cache can be set at both the options and view levels. If allow-query-cache is not set allow-query applies.
2004-10-21 00:58:33 +00:00
{ "allow-query-cache", &cfg_type_bracketed_aml, 0 },
2165. [func] Allow the destination address of a query to determine if we will answer the query or recurse. allow-query-on, allow-recursion-on and allow-query-cache-on. [RT #16291]
2007-03-29 06:36:31 +00:00
{ "allow-query-cache-on", &cfg_type_bracketed_aml, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "allow-recursion", &cfg_type_bracketed_aml, 0 },
2165. [func] Allow the destination address of a query to determine if we will answer the query or recurse. allow-query-on, allow-recursion-on and allow-query-cache-on. [RT #16291]
2007-03-29 06:36:31 +00:00
{ "allow-recursion-on", &cfg_type_bracketed_aml, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "allow-v6-synthesis", NULL, CFG_CLAUSEFLAG_ANCIENT },
2526. [func] New named option "attach-cache" that allows multiple views to share a single cache to save memory and improve lookup efficiency. [RT 18905]
2009-01-09 22:24:37 +00:00
{ "attach-cache", &cfg_type_astring, 0 },
Obsolete CLAUSEFLAG NEWDEFAULT The 'new default' option was introduced in 2002 to signal that a default option had changed its default value, in this specific case the value for 'auth-nxdomain'. However, this default has been unchanged for 18 years now, and logging that the default has changed does not have significant value nowadays. This is also a good example that the clause flag 'new default' is broken: it is easy to get out of date. It is also easy to forget, because we have changed the default value for 'max-stale-ttl' and haven't been flagging it with 'new default' Also, if the operator cares for a specific value it should set it explicitly. Using the default is telling the software: use whatever you think is best, and this may change over time. Default value changes should be mentioned in the release note, but do not require further special treatment.
2020-12-08 11:37:46 +01:00
{ "auth-nxdomain", &cfg_type_boolean, 0 },
mark "cache-file" as ancient and remove all code implementing it "cache-file" was already documented as intended for testing purposes only and not to be used, so we can remove it without waiting. this commit marks the option as "ancient", and removes all the documentation and implementing code, including dns_cache_setfilename() and dns_cache_dump(). it also removes the documentation for the '-x cachefile` parameter to named, which had already been removed, but the man page was not updated at the time.
2021-09-15 01:05:05 -07:00
{ "cache-file", &cfg_type_qstring, CFG_CLAUSEFLAG_ANCIENT },
4376. [experimental] Added support for Catalog Zones, a new method for provisioning secondary servers in which a list of zones to be served is stored in a DNS zone and can be propagated to slaves via AXFR/IXFR. [RT #41581] 4375. [func] Add support for automatic reallocation of isc_buffer to isc_buffer_put* functions. [RT #42394]
2016-05-26 21:23:19 +02:00
{ "catalog-zones", &cfg_type_catz, 0 },
2353. [func] Add support for Name Server ID (RFC 5001). 'dig +nsid' requests NSID from server. 'request-nsid yes;' causes recursive server to send NSID requests to upstream servers. Server responds to NSID requests with the string configured by 'server-id' option. [RT #17091]
2008-04-03 02:01:08 +00:00
{ "check-names", &cfg_type_checknames, CFG_CLAUSEFLAG_MULTI },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "cleaning-interval", NULL, CFG_CLAUSEFLAG_ANCIENT },
2353. [func] Add support for Name Server ID (RFC 5001). 'dig +nsid' requests NSID from server. 'request-nsid yes;' causes recursive server to send NSID requests to upstream servers. Server responds to NSID requests with the string configured by 'server-id' option. [RT #17091]
2008-04-03 02:01:08 +00:00
{ "clients-per-query", &cfg_type_uint32, 0 },
2604. [func] Add support for DNS rebinding attack prevention through new options, deny-answer-addresses and deny-answer-aliases. Based on contributed code from JD Nurmi, Google. [RT #18192]
2009-05-29 22:22:37 +00:00
{ "deny-answer-addresses", &cfg_type_denyaddresses, 0 },
{ "deny-answer-aliases", &cfg_type_denyaliases, 0 },
1558. [func] New DNSSEC 'disable-algorithms'. Support entry into child zones for which we don't have a supported algorithm. Such child zones are treated as unsigned. 1557. [func] Implement missing DNSSEC tests for * NOQNAME proof with wildcard answers. * NOWILDARD proof with NXDOMAIN. Cache and return NOQNAME with wildcard answers.
2004-01-14 02:06:51 +00:00
{ "disable-algorithms", &cfg_type_disablealgorithm,
CFG_CLAUSEFLAG_MULTI },
3387. [func] Support for a DS digest can be disabled at runtime with disable-ds-digests. [RT #21581]
2012-10-03 12:38:43 +10:00
{ "disable-ds-digests", &cfg_type_disabledsdigest,
CFG_CLAUSEFLAG_MULTI },
2353. [func] Add support for Name Server ID (RFC 5001). 'dig +nsid' requests NSID from server. 'request-nsid yes;' causes recursive server to send NSID requests to upstream servers. Server responds to NSID requests with the string configured by 'server-id' option. [RT #17091]
2008-04-03 02:01:08 +00:00
{ "disable-empty-zone", &cfg_type_astring, CFG_CLAUSEFLAG_MULTI },
2981. [func] Partial DNS64 support (AAAA synthesis). [RT #21991]
2010-12-08 02:46:17 +00:00
{ "dns64", &cfg_type_dns64, CFG_CLAUSEFLAG_MULTI },
3004. [func] DNS64 reverse support. [RT #22769]
2011-01-07 04:31:39 +00:00
{ "dns64-contact", &cfg_type_astring, 0 },
sort view_clauses
2017-08-31 08:40:33 +10:00
{ "dns64-server", &cfg_type_astring, 0 },
[master] DNS Response Policy Service API 4713. [func] Added support for the DNS Response Policy Service (DNSRPS) API, which allows named to use an external response policy daemon when built with "configure --enable-dnsrps". Thanks to Vernon Schryver and Farsight Security. [RT #43376]
2017-09-11 11:53:42 -07:00
#ifdef USE_DNSRPS
{ "dnsrps-enable", &cfg_type_boolean, 0 },
{ "dnsrps-options", &cfg_type_bracketed_text, 0 },
netmgr: Add additional safeguards to netmgr/tls.c This commit adds couple of additional safeguards against running sends/reads on inactive sockets. The changes was modeled after the changes we made to netmgr/tcpdns.c
2020-11-10 11:23:05 +01:00
#else /* ifdef USE_DNSRPS */
[master] DNS Response Policy Service API 4713. [func] Added support for the DNS Response Policy Service (DNSRPS) API, which allows named to use an external response policy daemon when built with "configure --enable-dnsrps". Thanks to Vernon Schryver and Farsight Security. [RT #43376]
2017-09-11 11:53:42 -07:00
{ "dnsrps-enable", &cfg_type_boolean, CFG_CLAUSEFLAG_NOTCONFIGURED },
{ "dnsrps-options", &cfg_type_bracketed_text,
CFG_CLAUSEFLAG_NOTCONFIGURED },
#endif /* ifdef USE_DNSRPS */
2353. [func] Add support for Name Server ID (RFC 5001). 'dig +nsid' requests NSID from server. 'request-nsid yes;' causes recursive server to send NSID requests to upstream servers. Server responds to NSID requests with the string configured by 'server-id' option. [RT #17091]
2008-04-03 02:01:08 +00:00
{ "dnssec-accept-expired", &cfg_type_boolean, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "dnssec-enable", NULL, CFG_CLAUSEFLAG_ANCIENT },
{ "dnssec-lookaside", NULL,
CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_ANCIENT },
1600. [bug] Duplicate zone pre-load checks were not case insensitive. 1599. [bug] Fix memory leak on error path when checking named.conf. 1598. [func] Specify that certain parts of the namespace must be secure (dnssec-must-be-secure).
2004-04-15 23:40:27 +00:00
{ "dnssec-must-be-secure", &cfg_type_mustbesecure,
Deprecate 'dnssec-must-be-secure' option The dnssec-must-be-secure feature was added in the early days of BIND 9 and DNSSEC and it makes sense only as a debugging feature. Remove the feature to simplify the code.
2023-09-04 13:08:48 +02:00
CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_DEPRECATED },
3001. [func] Added a default trust anchor for the root zone, which can be switched on by setting "dnssec-validation auto;" in the named.conf options. [RT #21727]
2011-01-03 23:45:08 +00:00
{ "dnssec-validation", &cfg_type_boolorauto, 0 },
[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]
2015-10-02 12:32:42 -07:00
#ifdef HAVE_DNSTAP
{ "dnstap", &cfg_type_dnstap, 0 },
netmgr: Add additional safeguards to netmgr/tls.c This commit adds couple of additional safeguards against running sends/reads on inactive sockets. The changes was modeled after the changes we made to netmgr/tcpdns.c
2020-11-10 11:23:05 +01:00
#else /* ifdef HAVE_DNSTAP */
[master] dnstap 4235. [func] Added support in named for "dnstap", a fast method of capturing and logging DNS traffic, and a new command "dnstap-read" to read a dnstap log file. Use "configure --enable-dnstap" to enable this feature (note that this requires libprotobuf-c and libfstrm). See the ARM for configuration details. Thanks to Robert Edmonds of Farsight Security. [RT #40211]
2015-10-02 12:32:42 -07:00
{ "dnstap", &cfg_type_dnstap, CFG_CLAUSEFLAG_NOTCONFIGURED },
#endif /* HAVE_DNSTAP */
2353. [func] Add support for Name Server ID (RFC 5001). 'dig +nsid' requests NSID from server. 'request-nsid yes;' causes recursive server to send NSID requests to upstream servers. Server responds to NSID requests with the string configured by 'server-id' option. [RT #17091]
2008-04-03 02:01:08 +00:00
{ "dual-stack-servers", &cfg_type_nameportiplist, 0 },
{ "edns-udp-size", &cfg_type_uint32, 0 },
{ "empty-contact", &cfg_type_astring, 0 },
{ "empty-server", &cfg_type_astring, 0 },
{ "empty-zones-enable", &cfg_type_boolean, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "fetch-glue", NULL, CFG_CLAUSEFLAG_ANCIENT },
[master] DDoS mitigation features 3938. [func] Added quotas to be used in recursive resolvers that are under high query load for names in zones whose authoritative servers are nonresponsive or are experiencing a denial of service attack. - "fetches-per-server" limits the number of simultaneous queries that can be sent to any single authoritative server. The configured value is a starting point; it is automatically adjusted downward if the server is partially or completely non-responsive. The algorithm used to adjust the quota can be configured via the "fetch-quota-params" option. - "fetches-per-zone" limits the number of simultaneous queries that can be sent for names within a single domain. (Note: Unlike "fetches-per-server", this value is not self-tuning.) - New stats counters have been added to count queries spilled due to these quotas. See the ARM for details of these options. [RT #37125]
2015-07-08 22:53:39 -07:00
{ "fetch-quota-params", &cfg_type_fetchquota, 0 },
{ "fetches-per-server", &cfg_type_fetchesper, 0 },
{ "fetches-per-zone", &cfg_type_fetchesper, 0 },
Remove the option 'filter-aaaa' options The 'filter-aaaa', 'filter-aaaa-on-v4', and 'filter-aaaa-on-v6' options are replaced by the filter-aaaa plugin. This plugin was introduced in 9.13.5 and so it is safe to remove the named.conf options.
2020-12-14 10:36:17 +01:00
{ "filter-aaaa", &cfg_type_bracketed_aml, CFG_CLAUSEFLAG_ANCIENT },
{ "filter-aaaa-on-v4", &cfg_type_boolean, CFG_CLAUSEFLAG_ANCIENT },
{ "filter-aaaa-on-v6", &cfg_type_boolean, CFG_CLAUSEFLAG_ANCIENT },
Obsolete the "glue-cache" option The "glue-cache" option was marked as deprecated by commit 5ae33351f286feb25a965bf3c9e6b122ab495342 (first released in BIND 9.17.6, back in October 2020), so now obsolete that option, removing all code and documentation related to it. Note: this causes the glue cache feature to be permanently enabled, not disabled.
2022-06-30 15:24:08 +02:00
{ "glue-cache", &cfg_type_boolean, CFG_CLAUSEFLAG_ANCIENT },
Implement ipv4only.arpa forward and reverse zones as per RFC 8880.
2018-07-05 15:29:30 +10:00
{ "ipv4only-enable", &cfg_type_boolean, 0 },
{ "ipv4only-contact", &cfg_type_astring, 0 },
{ "ipv4only-server", &cfg_type_astring, 0 },
1684. [func] ixfr-from-differences now takes master and slave in addition to yes and no at the options and view levels.
2004-10-14 00:49:34 +00:00
{ "ixfr-from-differences", &cfg_type_ixfrdifftype, 0 },
Extend ttlval to accept ISO 8601 durations The ttlval configuration types are replaced by duration configuration types. The duration is an ISO 8601 duration that is going to be used for DNSSEC key timings such as key lifetimes, signature resign intervals and refresh periods, etc. But it is also still allowed to use the BIND ttlval ways of configuring intervals (number plus optional unit). A duration is stored as an array of 7 different time parts. A duration can either be expressed in weeks, or in a combination of the other datetime indicators. Add several unit tests to ensure the correct value is parsed given different string values.
2019-09-02 15:46:28 +02:00
{ "lame-ttl", &cfg_type_duration, 0 },
Set a LMDB mapsize and also provide a config option to control it (#44954)
2017-04-26 23:43:35 +05:30
#ifdef HAVE_LMDB
{ "lmdb-mapsize", &cfg_type_sizeval, 0 },
netmgr: Add additional safeguards to netmgr/tls.c This commit adds couple of additional safeguards against running sends/reads on inactive sockets. The changes was modeled after the changes we made to netmgr/tcpdns.c
2020-11-10 11:23:05 +01:00
#else /* ifdef HAVE_LMDB */
Obsolete CLAUSEFLAG NOOP The clause flag 'not operational' is promoted to 'not configured'.
2020-12-08 11:34:15 +01:00
{ "lmdb-mapsize", &cfg_type_sizeval, CFG_CLAUSEFLAG_NOTCONFIGURED },
Set a LMDB mapsize and also provide a config option to control it (#44954)
2017-04-26 23:43:35 +05:30
#endif /* ifdef HAVE_LMDB */
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "max-acache-size", NULL, CFG_CLAUSEFLAG_ANCIENT },
4223. [func] Add support for setting max-cache-size to percentage of available physical memory, set default to 90%. [RT #38442]
2015-09-28 11:08:50 +02:00
{ "max-cache-size", &cfg_type_sizeorpercent, 0 },
Extend ttlval to accept ISO 8601 durations The ttlval configuration types are replaced by duration configuration types. The duration is an ISO 8601 duration that is going to be used for DNSSEC key timings such as key lifetimes, signature resign intervals and refresh periods, etc. But it is also still allowed to use the BIND ttlval ways of configuring intervals (number plus optional unit). A duration is stored as an array of 7 different time parts. A duration can either be expressed in weeks, or in a combination of the other datetime indicators. Add several unit tests to ensure the correct value is parsed given different string values.
2019-09-02 15:46:28 +02:00
{ "max-cache-ttl", &cfg_type_duration, 0 },
1891. [func] Limit the number of recursive clients that can be waiting for a single query (<qname,qtype,qclass>) to resolve. New options clients-per-query and max-clients-per-query.
2005-06-27 00:15:45 +00:00
{ "max-clients-per-query", &cfg_type_uint32, 0 },
Extend ttlval to accept ISO 8601 durations The ttlval configuration types are replaced by duration configuration types. The duration is an ISO 8601 duration that is going to be used for DNSSEC key timings such as key lifetimes, signature resign intervals and refresh periods, etc. But it is also still allowed to use the BIND ttlval ways of configuring intervals (number plus optional unit). A duration is stored as an array of 7 different time parts. A duration can either be expressed in weeks, or in a combination of the other datetime indicators. Add several unit tests to ensure the correct value is parsed given different string values.
2019-09-02 15:46:28 +02:00
{ "max-ncache-ttl", &cfg_type_duration, 0 },
[master] limit recursion depth and iterative queries 4006. [security] A flaw in delegation handling could be exploited to put named into an infinite loop. This has been addressed by placing limits on the number of levels of recursion named will allow (default 7), and the number of iterative queries that it will send (default 50) before terminating a recursive query (CVE-2014-8500). The recursion depth limit is configured via the "max-recursion-depth" option. [RT #35780]
2014-11-17 23:24:44 -08:00
{ "max-recursion-depth", &cfg_type_uint32, 0 },
[master] add max-recursion-queries also fixes and documentation for max-recursion-depth
2014-11-18 22:00:40 -08:00
{ "max-recursion-queries", &cfg_type_uint32, 0 },
Extend ttlval to accept ISO 8601 durations The ttlval configuration types are replaced by duration configuration types. The duration is an ISO 8601 duration that is going to be used for DNSSEC key timings such as key lifetimes, signature resign intervals and refresh periods, etc. But it is also still allowed to use the BIND ttlval ways of configuring intervals (number plus optional unit). A duration is stored as an array of 7 different time parts. A duration can either be expressed in weeks, or in a combination of the other datetime indicators. Add several unit tests to ensure the correct value is parsed given different string values.
2019-09-02 15:46:28 +02:00
{ "max-stale-ttl", &cfg_type_duration, 0 },
2353. [func] Add support for Name Server ID (RFC 5001). 'dig +nsid' requests NSID from server. 'request-nsid yes;' causes recursive server to send NSID requests to upstream servers. Server responds to NSID requests with the string configured by 'server-id' option. [RT #17091]
2008-04-03 02:01:08 +00:00
{ "max-udp-size", &cfg_type_uint32, 0 },
4693. [func] Synthesis of responses from DNSSEC-verified records. Stage 1 covers NXDOMAIN synthesis from NSEC records. This is controlled by synth-from-dnssec and is enabled by default. [RT #40138]
2017-08-31 07:57:50 +10:00
{ "message-compression", &cfg_type_boolean, 0 },
Extend ttlval to accept ISO 8601 durations The ttlval configuration types are replaced by duration configuration types. The duration is an ISO 8601 duration that is going to be used for DNSSEC key timings such as key lifetimes, signature resign intervals and refresh periods, etc. But it is also still allowed to use the BIND ttlval ways of configuring intervals (number plus optional unit). A duration is stored as an array of 7 different time parts. A duration can either be expressed in weeks, or in a combination of the other datetime indicators. Add several unit tests to ensure the correct value is parsed given different string values.
2019-09-02 15:46:28 +02:00
{ "min-cache-ttl", &cfg_type_duration, 0 },
{ "min-ncache-ttl", &cfg_type_duration, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "min-roots", NULL, CFG_CLAUSEFLAG_ANCIENT },
[master] minimal-any 4371. [func] New "minimal-any" option reduces the size of UDP responses for qtype ANY by returning a single arbitrarily selected RRset instead of all RRsets. Thanks to Tony Finch. [RT #41615]
2016-05-25 13:54:34 -07:00
{ "minimal-any", &cfg_type_boolean, 0 },
4437. [func] Minimal-responses now has two additional modes no-auth and no-auth-recursive which suppress adding the NS records to the authority section as well as the associated address records for the nameservers. [RT #42005]
2016-08-12 10:48:51 +10:00
{ "minimal-responses", &cfg_type_minimal, 0 },
[master] new-zones-directory option 4610. [func] The "new-zones-directory" option specifies the location of NZF or NZD files for storing configuration of zones added by "rndc addzone". Thanks to Petr Menšík. [RT #44853]
2017-04-23 23:16:53 -07:00
{ "new-zones-directory", &cfg_type_qstring, 0 },
4693. [func] Synthesis of responses from DNSSEC-verified records. Stage 1 covers NXDOMAIN synthesis from NSEC records. This is controlled by synth-from-dnssec and is enabled by default. [RT #40138]
2017-08-31 07:57:50 +10:00
{ "no-case-compress", &cfg_type_bracketed_aml, 0 },
{ "nocookie-udp-size", &cfg_type_uint32, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "nosit-udp-size", NULL, CFG_CLAUSEFLAG_ANCIENT },
Extend ttlval to accept ISO 8601 durations The ttlval configuration types are replaced by duration configuration types. The duration is an ISO 8601 duration that is going to be used for DNSSEC key timings such as key lifetimes, signature resign intervals and refresh periods, etc. But it is also still allowed to use the BIND ttlval ways of configuring intervals (number plus optional unit). A duration is stored as an array of 7 different time parts. A duration can either be expressed in weeks, or in a combination of the other datetime indicators. Add several unit tests to ensure the correct value is parsed given different string values.
2019-09-02 15:46:28 +02:00
{ "nta-lifetime", &cfg_type_duration, 0 },
{ "nta-recheck", &cfg_type_duration, 0 },
4108. [func] A additional nxdomain redirect (nxdomain-redirect) method is now supported. [RT #37989]
2015-04-23 16:57:15 +10:00
{ "nxdomain-redirect", &cfg_type_astring, 0 },
2353. [func] Add support for Name Server ID (RFC 5001). 'dig +nsid' requests NSID from server. 'request-nsid yes;' causes recursive server to send NSID requests to upstream servers. Server responds to NSID requests with the string configured by 'server-id' option. [RT #17091]
2008-04-03 02:01:08 +00:00
{ "preferred-glue", &cfg_type_astring, 0 },
4693. [func] Synthesis of responses from DNSSEC-verified records. Stage 1 covers NXDOMAIN synthesis from NSEC records. This is controlled by synth-from-dnssec and is enabled by default. [RT #40138]
2017-08-31 07:57:50 +10:00
{ "prefetch", &cfg_type_prefetch, 0 },
2353. [func] Add support for Name Server ID (RFC 5001). 'dig +nsid' requests NSID from server. 'request-nsid yes;' causes recursive server to send NSID requests to upstream servers. Server responds to NSID requests with the string configured by 'server-id' option. [RT #17091]
2008-04-03 02:01:08 +00:00
{ "provide-ixfr", &cfg_type_boolean, 0 },
- qname minimization: - make qname-minimization option tristate {strict,relaxed,disabled} - go straight for the record if we hit NXDOMAIN in relaxed mode - go straight for the record after 3 labels without new delegation or 7 labels total - use start of fetch (and not time of response) as 'now' time for querying cache for zonecut when following delegation.
2018-05-11 12:27:56 +02:00
{ "qname-minimization", &cfg_type_qminmethod, 0 },
2353. [func] Add support for Name Server ID (RFC 5001). 'dig +nsid' requests NSID from server. 'request-nsid yes;' causes recursive server to send NSID requests to upstream servers. Server responds to NSID requests with the string configured by 'server-id' option. [RT #17091]
2008-04-03 02:01:08 +00:00
/*
* Note that the query-source option syntax is different
* from the other -source options.
*/
{ "query-source", &cfg_type_querysource4, 0 },
{ "query-source-v6", &cfg_type_querysource6, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "queryport-pool-ports", NULL, CFG_CLAUSEFLAG_ANCIENT },
{ "queryport-pool-updateinterval", NULL, CFG_CLAUSEFLAG_ANCIENT },
4222. [func] Bias IPv6 servers when selecting the next server to query. [RT #40836]
2015-09-28 18:57:19 +10:00
{ "rate-limit", &cfg_type_rrl, 0 },
2353. [func] Add support for Name Server ID (RFC 5001). 'dig +nsid' requests NSID from server. 'request-nsid yes;' causes recursive server to send NSID requests to upstream servers. Server responds to NSID requests with the string configured by 'server-id' option. [RT #17091]
2008-04-03 02:01:08 +00:00
{ "recursion", &cfg_type_boolean, 0 },
{ "request-nsid", &cfg_type_boolean, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "request-sit", NULL, CFG_CLAUSEFLAG_ANCIENT },
Updated CHANGES note to include require-server-cookie: 4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are available: send-cookie, cookie-secret, cookie-algorithm, nocookie-udp-size and require-server-cookie. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]
2015-08-13 08:26:23 +10:00
{ "require-server-cookie", &cfg_type_boolean, 0 },
4700. [func] Serving of stale answers is now supported. This allows named to provide stale cached answers when the authoritative server is under attack. See max-stale-ttl, stale-answer-enable, stale-answer-ttl. [RT #44790]
2017-09-06 09:58:29 +10:00
{ "resolver-nonbackoff-tries", &cfg_type_uint32, 0 },
3011. [func] Change the default query timeout from 30 seconds to 10. Allow setting this in named.conf using the new 'resolver-query-timeout' option, which specifies a max time in seconds. 0 means 'default' and anything longer than 30 will be silently set to 30. [RT #22852]
2011-02-03 05:41:55 +00:00
{ "resolver-query-timeout", &cfg_type_uint32, 0 },
4700. [func] Serving of stale answers is now supported. This allows named to provide stale cached answers when the authoritative server is under attack. See max-stale-ttl, stale-answer-enable, stale-answer-ttl. [RT #44790]
2017-09-06 09:58:29 +10:00
{ "resolver-retry-interval", &cfg_type_uint32, 0 },
[master] EDNS padding and keepalive support 4549. [func] Added support for the EDNS TCP Keepalive option (RFC 7828). [RT #42126] 4548. [func] Added support for the EDNS Padding option (RFC 7830). [RT #42094]
2017-01-04 09:16:30 -08:00
{ "response-padding", &cfg_type_resppadding, 0 },
4222. [func] Bias IPv6 servers when selecting the next server to query. [RT #40836]
2015-09-28 18:57:19 +10:00
{ "response-policy", &cfg_type_rpz, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "rfc2308-type1", NULL, CFG_CLAUSEFLAG_ANCIENT },
deprecate delegation-only and root-delegation only These options and zone type were created to address the SiteFinder controversy, in which certain TLD's redirected queries rather than returning NXDOMAIN. since TLD's are now DNSSEC-signed, this is no longer likely to be a problem. The deprecation message for 'type delegation-only' is issued from the configuration checker rather than the parser. therefore, isccfg_check_namedconf() has been modified to take a 'nodeprecate' parameter to suppress the warning when named-checkconf is used with the command-line option to ignore warnings on deprecated options (-i).
2023-03-22 15:01:30 -07:00
{ "root-delegation-only", &cfg_type_optional_exclude,
remove {root-}delegation-only complete the removal of the delegation-only and root-delegation-only options, and the delegation-only zone type.
2023-03-22 16:57:54 -07:00
CFG_CLAUSEFLAG_ANCIENT },
add named.conf option root-key-sentinel
2018-03-13 15:17:22 +11:00
{ "root-key-sentinel", &cfg_type_boolean, 0 },
2353. [func] Add support for Name Server ID (RFC 5001). 'dig +nsid' requests NSID from server. 'request-nsid yes;' causes recursive server to send NSID requests to upstream servers. Server responds to NSID requests with the string configured by 'server-id' option. [RT #17091]
2008-04-03 02:01:08 +00:00
{ "rrset-order", &cfg_type_rrsetorder, 0 },
4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are avaliable: send-cookie, cookie-secret, cookie-algorithm and nocookie-udp-size. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]
2015-07-06 09:44:24 +10:00
{ "send-cookie", &cfg_type_boolean, 0 },
Extend ttlval to accept ISO 8601 durations The ttlval configuration types are replaced by duration configuration types. The duration is an ISO 8601 duration that is going to be used for DNSSEC key timings such as key lifetimes, signature resign intervals and refresh periods, etc. But it is also still allowed to use the BIND ttlval ways of configuring intervals (number plus optional unit). A duration is stored as an array of 7 different time parts. A duration can either be expressed in weeks, or in a combination of the other datetime indicators. Add several unit tests to ensure the correct value is parsed given different string values.
2019-09-02 15:46:28 +02:00
{ "servfail-ttl", &cfg_type_duration, 0 },
2353. [func] Add support for Name Server ID (RFC 5001). 'dig +nsid' requests NSID from server. 'request-nsid yes;' causes recursive server to send NSID requests to upstream servers. Server responds to NSID requests with the string configured by 'server-id' option. [RT #17091]
2008-04-03 02:01:08 +00:00
{ "sortlist", &cfg_type_bracketed_aml, 0 },
4700. [func] Serving of stale answers is now supported. This allows named to provide stale cached answers when the authoritative server is under attack. See max-stale-ttl, stale-answer-enable, stale-answer-ttl. [RT #44790]
2017-09-06 09:58:29 +10:00
{ "stale-answer-enable", &cfg_type_boolean, 0 },
Added option for disabling stale-answer-client-timeout This commit allows to specify "disabled" or "off" in stale-answer-client-timeout statement. The logic to support this behavior will be added in the subsequent commits. This commit also ensures an upper bound to stale-answer-client-timeout which equals to one second less than 'resolver-query-timeout'.
2020-12-18 16:24:56 -03:00
{ "stale-answer-client-timeout", &cfg_type_staleanswerclienttimeout,
0 },
Extend ttlval to accept ISO 8601 durations The ttlval configuration types are replaced by duration configuration types. The duration is an ISO 8601 duration that is going to be used for DNSSEC key timings such as key lifetimes, signature resign intervals and refresh periods, etc. But it is also still allowed to use the BIND ttlval ways of configuring intervals (number plus optional unit). A duration is stored as an array of 7 different time parts. A duration can either be expressed in weeks, or in a combination of the other datetime indicators. Add several unit tests to ensure the correct value is parsed given different string values.
2019-09-02 15:46:28 +02:00
{ "stale-answer-ttl", &cfg_type_duration, 0 },
Add stale-cache-enable option and disable serve-stable by default The current serve-stale implementation in BIND 9 stores all received records in the cache for a max-stale-ttl interval (default 12 hours). This allows DNS operators to turn the serve-stale answers in an event of large authoritative DNS outage. The caching of the stale answers needs to be enabled before the outage happens or the feature would be otherwise useless. The negative consequence of the default setting is the inevitable cache-bloat that happens for every and each DNS operator running named. In this MR, a new configuration option `stale-cache-enable` is introduced that allows the operators to selectively enable or disable the serve-stale feature of BIND 9 based on their decision. The newly introduced option has been disabled by default, e.g. serve-stale is disabled in the default configuration and has to be enabled if required.
2020-07-21 10:38:55 +02:00
{ "stale-cache-enable", &cfg_type_boolean, 0 },
Add stale-refresh-time option Before this update, BIND would attempt to do a full recursive resolution process for each query received if the requested rrset had its ttl expired. If the resolution fails for any reason, only then BIND would check for stale rrset in cache (if 'stale-cache-enable' and 'stale-answer-enable' is on). The problem with this approach is that if an authoritative server is unreachable or is failing to respond, it is very unlikely that the problem will be fixed in the next seconds. A better approach to improve performance in those cases, is to mark the moment in which a resolution failed, and if new queries arrive for that same rrset, try to respond directly from the stale cache, and do that for a window of time configured via 'stale-refresh-time'. Only when this interval expires we then try to do a normal refresh of the rrset. The logic behind this commit is as following: - In query.c / query_gotanswer(), if the test of 'result' variable falls to the default case, an error is assumed to have happened, and a call to 'query_usestale()' is made to check if serving of stale rrset is enabled in configuration. - If serving of stale answers is enabled, a flag will be turned on in the query context to look for stale records: query.c:6839 qctx->client->query.dboptions |= DNS_DBFIND_STALEOK; - A call to query_lookup() will be made again, inside it a call to 'dns_db_findext()' is made, which in turn will invoke rbdb.c / cache_find(). - In rbtdb.c / cache_find() the important bits of this change is the call to 'check_stale_header()', which is a function that yields true if we should skip the stale entry, or false if we should consider it. - In check_stale_header() we now check if the DNS_DBFIND_STALEOK option is set, if that is the case we know that this new search for stale records was made due to a failure in a normal resolution, so we keep track of the time in which the failured occured in rbtdb.c:4559: header->last_refresh_fail_ts = search->now; - In check_stale_header(), if DNS_DBFIND_STALEOK is not set, then we know this is a normal lookup, if the record is stale and the query time is between last failure time + stale-refresh-time window, then we return false so cache_find() knows it can consider this stale rrset entry to return as a response. The last additions are two new methods to the database interface: - setservestale_refresh - getservestale_refresh Those were added so rbtdb can be aware of the value set in configuration option, since in that level we have no access to the view object.
2020-10-19 17:02:03 -03:00
{ "stale-refresh-time", &cfg_type_duration, 0 },
Obsolete CLAUSEFLAG NOTIMP and NYI The clause flags 'not implented' and 'not implemented yet' are the same as 'obsoleted' when it comes to behavior. These options will now be treated similar as obsoleted (the idea being that if an option is implemented it should be functional). The new options for DoT are new options and rather than flagging them obsolete, they should have been flagged as experimental, signalling that these options are subject to change in the future.
2020-12-08 11:26:08 +01:00
{ "suppress-initial-notify", &cfg_type_boolean,
clean up some deprecated/obsolete options and doc - removed documentation of -S option from named man page - removed documentation of reserved-sockets from ARM - simplified documentation of dnssec-secure-to-insecure - it now just says it's obsolete rather than describing what it doesn't do anymore - marked three formerly obsolete options as ancient: parent-registration-delay, reserved-sockets, and suppress-initial-notify
2023-02-08 10:33:06 -08:00
CFG_CLAUSEFLAG_ANCIENT },
4693. [func] Synthesis of responses from DNSSEC-verified records. Stage 1 covers NXDOMAIN synthesis from NSEC records. This is controlled by synth-from-dnssec and is enabled by default. [RT #40138]
2017-08-31 07:57:50 +10:00
{ "synth-from-dnssec", &cfg_type_boolean, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "topology", NULL, CFG_CLAUSEFLAG_ANCIENT },
2353. [func] Add support for Name Server ID (RFC 5001). 'dig +nsid' requests NSID from server. 'request-nsid yes;' causes recursive server to send NSID requests to upstream servers. Server responds to NSID requests with the string configured by 'server-id' option. [RT #17091]
2008-04-03 02:01:08 +00:00
{ "transfer-format", &cfg_type_transferformat, 0 },
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
{ "trust-anchor-telemetry", &cfg_type_boolean,
CFG_CLAUSEFLAG_EXPERIMENTAL },
Add the ability to use DNS64 internally Add a configuration option, resolver-use-dns64, which when true will cause named to map IPv4 address to IPv6 addresses using the view's DNS64 mapping rules when making iterative queries.
2019-07-22 02:26:39 +10:00
{ "resolver-use-dns64", &cfg_type_boolean, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "use-queryport-pool", NULL, CFG_CLAUSEFLAG_ANCIENT },
option to disable validation under specified names - added new 'validate-except' option, which configures an NTA with expiry of 0xffffffff. NTAs with that value in the expiry field do not expire, are are not written out when saving the NTA table and are not dumped by rndc secroots
2018-04-30 16:10:17 -07:00
{ "validate-except", &cfg_type_namelist, 0 },
4222. [func] Bias IPv6 servers when selecting the next server to query. [RT #40836]
2015-09-28 18:57:19 +10:00
{ "v6-bias", &cfg_type_uint32, 0 },
2353. [func] Add support for Name Server ID (RFC 5001). 'dig +nsid' requests NSID from server. 'request-nsid yes;' causes recursive server to send NSID requests to upstream servers. Server responds to NSID requests with the string configured by 'server-id' option. [RT #17091]
2008-04-03 02:01:08 +00:00
{ "zero-no-soa-ttl-cache", &cfg_type_boolean, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* Clauses that can be found within the 'view' statement only.
*/
static cfg_clausedef_t view_only_clauses[] = {
{ "match-clients", &cfg_type_bracketed_aml, 0 },
{ "match-destinations", &cfg_type_bracketed_aml, 0 },
{ "match-recursive-only", &cfg_type_boolean, 0 },
{ NULL, NULL, 0 }
};
2349. [func] Provide incremental re-signing support for secure dynamic zones. [RT #1091] back out incorrect branch rt1091 and apply correct branch rt1091a.
2008-04-02 02:37:42 +00:00
/*%
* Sig-validity-interval.
*/
static cfg_tuplefielddef_t validityinterval_fields[] = {
{ "validity", &cfg_type_uint32, 0 },
{ "re-sign", &cfg_type_optional_uint32, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_validityinterval = {
"validityinterval", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, validityinterval_fields
};
Add new 'checkds' configuration option Add a new configuration option to set how the checkds method should work. Acceptable values are 'yes', 'no', and 'explicit'. When set to 'yes', the checkds method is to lookup the parental agents by querying the NS records of the parent zone. When set to 'no', no checkds method is enabled. Users should run the 'rndc checkds' command to signal that DS records are published and withdrawn. When set to 'explicit', the parental agents are explicitly configured with the 'parental-agents' configuration option.
2023-03-08 14:56:08 +01:00
/*%
* Checkds type.
*/
static const char *checkds_enums[] = { "explicit", NULL };
static isc_result_t
parse_checkds_type(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
}
static void
doc_checkds_type(cfg_printer_t *pctx, const cfg_type_t *type) {
cfg_doc_enum_or_other(pctx, type, &cfg_type_boolean);
}
static cfg_type_t cfg_type_checkdstype = {
"checkdstype", parse_checkds_type, cfg_print_ustring,
doc_checkds_type, &cfg_rep_string, checkds_enums,
};
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
/*%
* Clauses that can be found in a 'dnssec-policy' statement.
*/
static cfg_clausedef_t dnssecpolicy_clauses[] = {
Add configuration option 'cdnskey' Add the 'cdnskey' configuration option to 'dnssec-policy'.
2023-05-11 14:11:45 +02:00
{ "cdnskey", &cfg_type_boolean, 0 },
Make cds-digest-type plural Allow for configuring multiple CDS records with different digest types (currently only SHA-256 and SHA-384 are allowed).
2023-02-10 15:18:36 +01:00
{ "cds-digest-types", &cfg_type_algorithmlist, 0 },
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
{ "dnskey-ttl", &cfg_type_duration, 0 },
Add inline-signing to dnssec-policy Add an option to enable/disable inline-signing inside the dnssec-policy clause. The existing inline-signing option that is set in the zone clause takes priority, but if it is omitted, then the value that is set in dnssec-policy is taken. The built-in policies use inline-signing. This means that if you want to use the default policy without inline-signing you either have to set it explicitly in the zone clause: zone "example" { ... dnssec-policy default; inline-signing no; }; Or create a new policy, only overriding the inline-signing option: dnssec-policy "default-dynamic" { inline-signing no; }; zone "example" { ... dnssec-policy default-dynamic; }; This also means that if you are going insecure with a dynamic zone, the built-in "insecure" policy needs to be accompanied with "inline-signing no;".
2023-04-03 17:00:36 +02:00
{ "inline-signing", &cfg_type_boolean, 0 },
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
{ "keys", &cfg_type_kaspkeys, 0 },
rename 'zone-max-ttl' to 'max-zone-ttl' for consistency
2020-02-05 22:09:48 -08:00
{ "max-zone-ttl", &cfg_type_duration, 0 },
Add kasp nsec3param configuration Add configuration and documentation on how to enable NSEC3 when using dnssec-policy for signing your zones.
2020-10-09 14:19:10 +02:00
{ "nsec3param", &cfg_type_nsec3, 0 },
rename 'zone-max-ttl' to 'max-zone-ttl' for consistency
2020-02-05 22:09:48 -08:00
{ "parent-ds-ttl", &cfg_type_duration, 0 },
{ "parent-propagation-delay", &cfg_type_duration, 0 },
Make 'parent-registration-delay' obsolete With the introduction of 'checkds', the 'parent-registration-delay' option becomes obsolete.
2020-07-31 09:58:59 +02:00
{ "parent-registration-delay", &cfg_type_duration,
clean up some deprecated/obsolete options and doc - removed documentation of -S option from named man page - removed documentation of reserved-sockets from ARM - simplified documentation of dnssec-secure-to-insecure - it now just says it's obsolete rather than describing what it doesn't do anymore - marked three formerly obsolete options as ancient: parent-registration-delay, reserved-sockets, and suppress-initial-notify
2023-02-08 10:33:06 -08:00
CFG_CLAUSEFLAG_ANCIENT },
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
{ "publish-safety", &cfg_type_duration, 0 },
Add purge-keys config option Add a new option 'purge-keys' to 'dnssec-policy' that will purge key files for deleted keys. The option determines how long key files should be retained prior to removing the corresponding files from disk. If set to 0, the option is disabled and 'named' will not remove key files from disk.
2021-02-08 12:02:19 +01:00
{ "purge-keys", &cfg_type_duration, 0 },
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
{ "retire-safety", &cfg_type_duration, 0 },
{ "signatures-refresh", &cfg_type_duration, 0 },
{ "signatures-validity", &cfg_type_duration, 0 },
{ "signatures-validity-dnskey", &cfg_type_duration, 0 },
kasp: Expose more key timings When doing rollover in a timely manner we need to have access to the relevant kasp configured durations. Most of these are simple get functions, but 'dns_kasp_signdelay' will calculate the maximum time that is needed with this policy to resign the complete zone (taking into account the refresh interval and signature validity). Introduce parent-propagation-delay, parent-registration-delay, parent-ds-ttl, zone-max-ttl, zone-propagation-delay.
2019-10-16 18:36:38 +02:00
{ "zone-propagation-delay", &cfg_type_duration, 0 },
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
{ NULL, NULL, 0 }
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* Clauses that can be found in a 'zone' statement,
* with defaults in the 'view' or 'options' statement.
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
*
* Note: CFG_ZONE_* options indicate in which zone types this clause is
* legal.
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
*/
Extend ACL syntax handling code with 'port' and 'transport' options This commit extends ACL syntax handling code with 'port' and 'transport' options. Currently, the extended syntax is available only for allow-transfer options.
2021-11-04 16:52:49 +02:00
/*
* NOTE: To enable syntax which allows specifying port and protocol
* within 'allow-*' clauses, replace 'cfg_type_bracketed_aml' with
* 'cfg_type_transport_acl'.
*
* Example: allow-transfer port 853 protocol tls { ... };
*/
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_clausedef_t zone_clauses[] = {
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "allow-notify", &cfg_type_bracketed_aml,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "allow-query", &cfg_type_bracketed_aml,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
CFG_ZONE_STUB | CFG_ZONE_REDIRECT | CFG_ZONE_STATICSTUB },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "allow-query-on", &cfg_type_bracketed_aml,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
CFG_ZONE_STUB | CFG_ZONE_REDIRECT | CFG_ZONE_STATICSTUB },
Extend ACL syntax handling code with 'port' and 'transport' options This commit extends ACL syntax handling code with 'port' and 'transport' options. Currently, the extended syntax is available only for allow-transfer options.
2021-11-04 16:52:49 +02:00
{ "allow-transfer", &cfg_type_transport_acl,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
{ "allow-update", &cfg_type_bracketed_aml, CFG_ZONE_PRIMARY },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "allow-update-forwarding", &cfg_type_bracketed_aml,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "also-notify", &cfg_type_namesockaddrkeylist,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "alt-transfer-source", &cfg_type_sockaddr4wild,
Deprecate alt-transfer-source and companions Deprecate the alternate transfer sources from BIND 8.
2022-11-23 08:13:25 +01:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
Remove setting alternate transfer source Remove parsing the configuration options 'alt-transfer-source', 'alt-transfer-source-v6', and 'use-alt-transfer-source', and remove the corresponding code that implements the feature.
2022-12-02 16:38:52 +01:00
CFG_CLAUSEFLAG_ANCIENT },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "alt-transfer-source-v6", &cfg_type_sockaddr6wild,
Deprecate alt-transfer-source and companions Deprecate the alternate transfer sources from BIND 8.
2022-11-23 08:13:25 +01:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
Remove setting alternate transfer source Remove parsing the configuration options 'alt-transfer-source', 'alt-transfer-source-v6', and 'use-alt-transfer-source', and remove the corresponding code that implements the feature.
2022-12-02 16:38:52 +01:00
CFG_CLAUSEFLAG_ANCIENT },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "auto-dnssec", &cfg_type_autodnssec,
Remove the auto-dnssec option Mark the "auto-dnssec" option ancient (effectively disallowing it from the configuration).
2023-07-04 17:06:36 +02:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_ANCIENT },
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
{ "check-dup-records", &cfg_type_checkmode, CFG_ZONE_PRIMARY },
{ "check-integrity", &cfg_type_boolean, CFG_ZONE_PRIMARY },
{ "check-mx", &cfg_type_checkmode, CFG_ZONE_PRIMARY },
{ "check-mx-cname", &cfg_type_checkmode, CFG_ZONE_PRIMARY },
{ "check-sibling", &cfg_type_boolean, CFG_ZONE_PRIMARY },
{ "check-spf", &cfg_type_warn, CFG_ZONE_PRIMARY },
{ "check-srv-cname", &cfg_type_checkmode, CFG_ZONE_PRIMARY },
Add check-svcb to named check-svcb signals whether to perform additional contraint tests when loading / update primary zone files.
2022-10-05 17:49:07 +11:00
{ "check-svcb", &cfg_type_boolean, CFG_ZONE_PRIMARY },
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
{ "check-wildcard", &cfg_type_boolean, CFG_ZONE_PRIMARY },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "dialup", &cfg_type_dialuptype,
deprecate "dialup" and "heartbeat-interval" these options concentrate zone maintenance actions into bursts for the benefit of servers with intermittent connections. that's no longer something we really need to optimize.
2023-07-03 16:34:22 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_STUB |
CFG_CLAUSEFLAG_DEPRECATED },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "dnssec-dnskey-kskonly", &cfg_type_boolean,
Obsolete dnssec-dnskey-kskonly update-check-ksk These two configuration options worked in conjunction with 'auto-dnssec' to determine KSK usage, and thus are now obsoleted. However, in the code we keep KSK processing so that when a zone is reconfigured from using 'dnssec-policy' immediately to 'none' (without going through 'insecure'), the zone is not immediately made bogus. Add one more test case for going straight to none, now with a dynamic zone (no inline-signing).
2023-07-11 13:57:49 +02:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "dnssec-loadkeys-interval", &cfg_type_uint32,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
dnssec-policy inheritance from options/view 'dnssec-policy' can now also be set on the options and view level and a zone that does not set 'dnssec-policy' explicitly will inherit it from the view or options level. This requires a new keyword to be introduced: 'none'. If set to 'none' the zone will not be DNSSEC maintained, in other words it will stay unsigned. You can use this to break the inheritance. Of course you can also break the inheritance by referring to a different policy. The keywords 'default' and 'none' are not allowed when configuring your own dnssec-policy statement. Add appropriate tests for checking the configuration (checkconf) and add tests to the kasp system test to verify the inheritance works. Edit the kasp system test such that it can deal with unsigned zones and views (so setting a TSIG on the query).
2019-11-05 17:22:35 +01:00
{ "dnssec-policy", &cfg_type_astring,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
Obsolete dnssec-secure-to-insecure option Now that the key management operations using dynamic updates feature has been removed, the 'dnssec-secure-to-insecure' option has become obsoleted.
2022-11-07 14:40:28 +01:00
{ "dnssec-secure-to-insecure", &cfg_type_boolean,
CFG_ZONE_PRIMARY | CFG_CLAUSEFLAG_OBSOLETE },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "dnssec-update-mode", &cfg_type_dnssecupdatemode,
Obsolete dnssec-update-mode We no longer support 'no-resign' and thus the configuration option becomes obsolete. Remove the corresponding dnssec system test cases.
2023-07-11 16:49:45 +02:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "forward", &cfg_type_forwardtype,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_STUB |
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
CFG_ZONE_STATICSTUB | CFG_ZONE_FORWARD },
{ "forwarders", &cfg_type_portiplist,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_STUB |
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
CFG_ZONE_STATICSTUB | CFG_ZONE_FORWARD },
{ "key-directory", &cfg_type_qstring,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "maintain-ixfr-base", NULL, CFG_CLAUSEFLAG_ANCIENT },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "masterfile-format", &cfg_type_masterformat,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
CFG_ZONE_STUB | CFG_ZONE_REDIRECT },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "masterfile-style", &cfg_type_masterstyle,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
CFG_ZONE_STUB | CFG_ZONE_REDIRECT },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "max-ixfr-log-size", NULL, CFG_CLAUSEFLAG_ANCIENT },
add syntax and setter/getter functions to configure max-ixfr-ratio
2020-02-21 10:53:08 -08:00
{ "max-ixfr-ratio", &cfg_type_ixfrratio,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "max-journal-size", &cfg_type_size,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "max-records", &cfg_type_uint32,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "max-refresh-time", &cfg_type_uint32,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "max-retry-time", &cfg_type_uint32,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "max-transfer-idle-in", &cfg_type_uint32,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "max-transfer-idle-out", &cfg_type_uint32,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_MIRROR | CFG_ZONE_SECONDARY },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "max-transfer-time-in", &cfg_type_uint32,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "max-transfer-time-out", &cfg_type_uint32,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_MIRROR | CFG_ZONE_SECONDARY },
Allow for key lifetime unlimited The keyword 'unlimited' can be used instead of PT0S which means the same but is more comprehensible for users. Also fix some redundant "none" parameters in the kasp test.
2020-02-06 15:41:47 +01:00
{ "max-zone-ttl", &cfg_type_maxduration,
mark max-zone-ttl deprecated in options and zone The "max-zone-ttl" option should now be configured as part of "dnssec-policy". The option with the same name in "zone" and "options" is hereby flagged as deprecated, and its functionality will be removed in a future release.
2022-07-11 13:38:51 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_REDIRECT | CFG_CLAUSEFLAG_DEPRECATED },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "min-refresh-time", &cfg_type_uint32,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "min-retry-time", &cfg_type_uint32,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "multi-master", &cfg_type_boolean,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "notify", &cfg_type_notifytype,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "notify-delay", &cfg_type_uint32,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "notify-source", &cfg_type_sockaddr4wild,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "notify-source-v6", &cfg_type_sockaddr6wild,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "notify-to-soa", &cfg_type_boolean,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "nsec3-test-zone", &cfg_type_boolean,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_CLAUSEFLAG_TESTONLY | CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
Add "parental-source[-v6]" config option Similar to "notify-source" and "transfer-source", add options to set the source address when querying parental agents for DS records.
2021-05-14 11:33:51 +02:00
{ "parental-source", &cfg_type_sockaddr4wild,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
Add "parental-source[-v6]" config option Similar to "notify-source" and "transfer-source", add options to set the source address when querying parental agents for DS records.
2021-05-14 11:33:51 +02:00
{ "parental-source-v6", &cfg_type_sockaddr6wild,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "request-expire", &cfg_type_boolean,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
{ "request-ixfr", &cfg_type_boolean,
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
{ "serial-update-method", &cfg_type_updatemethod, CFG_ZONE_PRIMARY },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "sig-signing-nodes", &cfg_type_uint32,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "sig-signing-signatures", &cfg_type_uint32,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "sig-signing-type", &cfg_type_uint32,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "sig-validity-interval", &cfg_type_validityinterval,
Obsolete sig-validity-interval dnskey-sig-validity These two configuration options worked in conjunction with 'auto-dnssec' to set the signature validity, and thus are now obsoleted.
2023-07-05 10:59:24 +02:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE },
new option "dnskey-sig-validity" - overrides "sig-validity-interval" for DNSKEY, CDNSKEY and CDS RRSIGs
2018-03-12 22:14:26 -07:00
{ "dnskey-sig-validity", &cfg_type_uint32,
Obsolete sig-validity-interval dnskey-sig-validity These two configuration options worked in conjunction with 'auto-dnssec' to set the signature validity, and thus are now obsoleted.
2023-07-05 10:59:24 +02:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "transfer-source", &cfg_type_sockaddr4wild,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "transfer-source-v6", &cfg_type_sockaddr6wild,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "try-tcp-refresh", &cfg_type_boolean,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "update-check-ksk", &cfg_type_boolean,
Obsolete dnssec-dnskey-kskonly update-check-ksk These two configuration options worked in conjunction with 'auto-dnssec' to determine KSK usage, and thus are now obsoleted. However, in the code we keep KSK processing so that when a zone is reconfigured from using 'dnssec-policy' immediately to 'none' (without going through 'insecure'), the zone is not immediately made bogus. Add one more test case for going straight to none, now with a dynamic zone (no inline-signing).
2023-07-11 13:57:49 +02:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "use-alt-transfer-source", &cfg_type_boolean,
Deprecate alt-transfer-source and companions Deprecate the alternate transfer sources from BIND 8.
2022-11-23 08:13:25 +01:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
Remove setting alternate transfer source Remove parsing the configuration options 'alt-transfer-source', 'alt-transfer-source-v6', and 'use-alt-transfer-source', and remove the corresponding code that implements the feature.
2022-12-02 16:38:52 +01:00
CFG_CLAUSEFLAG_ANCIENT },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "zero-no-soa-ttl", &cfg_type_boolean,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "zone-statistics", &cfg_type_zonestat,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
* Clauses that can be found in a 'zone' statement only.
*
* Note: CFG_ZONE_* options indicate in which zone types this clause is
* legal.
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
*/
static cfg_clausedef_t zone_only_clauses[] = {
/*
* Note that the format of the check-names option is different between
* the zone options and the global/view options. Ugh.
*/
[master] fix test failure by sorting "type" to the top of zone clauses
2018-01-22 13:18:50 -08:00
{ "type", &cfg_type_zonetype,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_DELEGATION |
CFG_ZONE_HINT | CFG_ZONE_REDIRECT | CFG_ZONE_FORWARD },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "check-names", &cfg_type_checkmode,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
CFG_ZONE_HINT | CFG_ZONE_STUB },
Add new 'checkds' configuration option Add a new configuration option to set how the checkds method should work. Acceptable values are 'yes', 'no', and 'explicit'. When set to 'yes', the checkds method is to lookup the parental agents by querying the NS records of the parent zone. When set to 'no', no checkds method is enabled. Users should run the 'rndc checkds' command to signal that DS records are published and withdrawn. When set to 'explicit', the parental agents are explicitly configured with the 'parental-agents' configuration option.
2023-03-08 14:56:08 +01:00
{ "checkds", &cfg_type_checkdstype,
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "database", &cfg_type_astring,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
CFG_ZONE_STUB },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "delegation-only", &cfg_type_boolean,
deprecate delegation-only and root-delegation only These options and zone type were created to address the SiteFinder controversy, in which certain TLD's redirected queries rather than returning NXDOMAIN. since TLD's are now DNSSEC-signed, this is no longer likely to be a problem. The deprecation message for 'type delegation-only' is issued from the configuration checker rather than the parser. therefore, isccfg_check_namedconf() has been modified to take a 'nodeprecate' parameter to suppress the warning when named-checkconf is used with the command-line option to ignore warnings on deprecated options (-i).
2023-03-22 15:01:30 -07:00
CFG_ZONE_HINT | CFG_ZONE_STUB | CFG_ZONE_FORWARD |
remove {root-}delegation-only complete the removal of the delegation-only and root-delegation-only options, and the delegation-only zone type.
2023-03-22 16:57:54 -07:00
CFG_CLAUSEFLAG_ANCIENT },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "dlz", &cfg_type_astring,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_REDIRECT },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "file", &cfg_type_qstring,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
CFG_ZONE_STUB | CFG_ZONE_HINT | CFG_ZONE_REDIRECT },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "in-view", &cfg_type_astring, CFG_ZONE_INVIEW },
inline-signing should have been in zone_only_clauses
2021-02-26 10:00:09 +11:00
{ "inline-signing", &cfg_type_boolean,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "ixfr-base", NULL, CFG_CLAUSEFLAG_ANCIENT },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "ixfr-from-differences", &cfg_type_boolean,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "ixfr-tmp-file", NULL, CFG_CLAUSEFLAG_ANCIENT },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "journal", &cfg_type_qstring,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
{ "masters", &cfg_type_namesockaddrkeylist,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
add a CFG_CLAUSEFLAG_NODOC flag for use with outdated terms "masters" and "default-masters" are now flagged so they will not be included in the named.conf man page, despite being accepted as valid options by the parser for backward compatibiility.
2022-02-25 16:33:30 -08:00
CFG_ZONE_REDIRECT | CFG_CLAUSEFLAG_NODOC },
Add parental-agents configuration Introduce a way to configure parental agents that can be used to query DS records to be used in automatic key rollovers.
2021-05-07 11:36:40 +02:00
{ "parental-agents", &cfg_type_namesockaddrkeylist,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
add "primaries" as a synonym for "masters" in named.conf as "type primary" is preferred over "type master" now, it makes sense to make "primaries" available as a synonym too. added a correctness check to ensure "primaries" and "masters" cannot both be used in the same zone.
2020-06-17 02:02:27 -07:00
{ "primaries", &cfg_type_namesockaddrkeylist,
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
add "primaries" as a synonym for "masters" in named.conf as "type primary" is preferred over "type master" now, it makes sense to make "primaries" available as a synonym too. added a correctness check to ensure "primaries" and "masters" cannot both be used in the same zone.
2020-06-17 02:02:27 -07:00
CFG_ZONE_REDIRECT },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "pubkey", NULL, CFG_CLAUSEFLAG_ANCIENT },
Fix the configuration type used by the "server-addresses" option Contrary to what the documentation states, the "server-addresses" static-stub zone option does not accept custom port numbers. Fix the configuration type used by the "server-addresses" option to ensure documentation matches source code. Remove a check_zoneconf() test which is unnecessary with this fix in place.
2018-10-18 15:48:44 +02:00
{ "server-addresses", &cfg_type_bracketed_netaddrlist,
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
CFG_ZONE_STATICSTUB },
{ "server-names", &cfg_type_namelist, CFG_ZONE_STATICSTUB },
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
{ "update-policy", &cfg_type_updatepolicy, CFG_ZONE_PRIMARY },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*% The top-level named.conf syntax. */
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_clausedef_t *namedconf_clausesets[] = { namedconf_clauses,
namedconf_or_view_clauses,
NULL };
Remove LIB<*>_EXTERNAL_DATA defines After Windows has been removed, the LIB<*>_EXTERNAL_DATA defines were just dummy leftovers. Remove them.
2021-06-10 08:06:48 +02:00
cfg_type_t cfg_type_namedconf = { "namedconf", cfg_parse_mapbody,
cfg_print_mapbody, cfg_doc_mapbody,
&cfg_rep_map, namedconf_clausesets };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
Rename 'dnssec-keys' to 'trust-anchors'
2019-12-04 11:06:40 +01:00
/*% The bind.keys syntax (trust-anchors/managed-keys/trusted-keys only). */
2572. [func] Simplify DLV configuration, with a new option "dnssec-lookaside auto;" This is the equivalent of "dnssec-lookaside . trust-anchor dlv.isc.org;" plus setting a trusted-key for dlv.isc.org. Note: The trusted key is hard-coded into named, but is also stored in (and can be overridden by) $sysconfdir/bind.keys. As the ISC DLV key rolls over it can be kept up to date by replacing the bind.keys file with a key downloaded from https://www.isc.org/solutions/dlv. [RT #18685]
2009-03-04 02:42:31 +00:00
static cfg_clausedef_t *bindkeys_clausesets[] = { bindkeys_clauses, NULL };
Remove LIB<*>_EXTERNAL_DATA defines After Windows has been removed, the LIB<*>_EXTERNAL_DATA defines were just dummy leftovers. Remove them.
2021-06-10 08:06:48 +02:00
cfg_type_t cfg_type_bindkeys = { "bindkeys", cfg_parse_mapbody,
cfg_print_mapbody, cfg_doc_mapbody,
&cfg_rep_map, bindkeys_clausesets };
2572. [func] Simplify DLV configuration, with a new option "dnssec-lookaside auto;" This is the equivalent of "dnssec-lookaside . trust-anchor dlv.isc.org;" plus setting a trusted-key for dlv.isc.org. Note: The trusted key is hard-coded into named, but is also stored in (and can be overridden by) $sysconfdir/bind.keys. As the ISC DLV key rolls over it can be kept up to date by replacing the bind.keys file with a key downloaded from https://www.isc.org/solutions/dlv. [RT #18685]
2009-03-04 02:42:31 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*% The "options" statement syntax. */
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_clausedef_t *options_clausesets[] = { options_clauses, view_clauses,
zone_clauses, NULL };
static cfg_type_t cfg_type_options = { "options", cfg_parse_map,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_print_map, cfg_doc_map,
&cfg_rep_map, options_clausesets };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*% The "view" statement syntax. */
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_clausedef_t *view_clausesets[] = { view_only_clauses,
namedconf_or_view_clauses,
view_clauses, zone_clauses,
NULL };
4222. [func] Bias IPv6 servers when selecting the next server to query. [RT #40836]
2015-09-28 18:57:19 +10:00
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_viewopts = { "view", cfg_parse_map,
4222. [func] Bias IPv6 servers when selecting the next server to query. [RT #40836]
2015-09-28 18:57:19 +10:00
cfg_print_map, cfg_doc_map,
&cfg_rep_map, view_clausesets };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*% The "zone" statement syntax. */
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_clausedef_t *zone_clausesets[] = { zone_only_clauses, zone_clauses,
NULL };
Remove LIB<*>_EXTERNAL_DATA defines After Windows has been removed, the LIB<*>_EXTERNAL_DATA defines were just dummy leftovers. Remove them.
2021-06-10 08:06:48 +02:00
cfg_type_t cfg_type_zoneopts = { "zoneopts", cfg_parse_map, cfg_print_map,
cfg_doc_map, &cfg_rep_map, zone_clausesets };
update copyright notice
2008-01-18 23:46:58 +00:00
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
/*% The "dnssec-policy" statement syntax. */
static cfg_clausedef_t *dnssecpolicy_clausesets[] = { dnssecpolicy_clauses,
NULL };
Remove LIB<*>_EXTERNAL_DATA defines After Windows has been removed, the LIB<*>_EXTERNAL_DATA defines were just dummy leftovers. Remove them.
2021-06-10 08:06:48 +02:00
cfg_type_t cfg_type_dnssecpolicyopts = {
Introduce dnssec-policy configuration This commit introduces the initial `dnssec-policy` configuration statement. It has an initial set of options to deal with signature and key maintenance. Add some checks to ensure that dnssec-policy is configured at the right locations, and that policies referenced to in zone statements actually exist. Add some checks that when a user adds the new `dnssec-policy` configuration, it will no longer contain existing DNSSEC configuration options. Specifically: `inline-signing`, `auto-dnssec`, `dnssec-dnskey-kskonly`, `dnssec-secure-to-insecure`, `update-check-ksk`, `dnssec-update-mode`, `dnskey-sig-validity`, and `sig-validity-interval`. Test a good kasp configuration, and some bad configurations.
2019-09-02 16:24:48 +02:00
"dnssecpolicyopts", cfg_parse_map, cfg_print_map,
cfg_doc_map, &cfg_rep_map, dnssecpolicy_clausesets
};
1913. [func] Integrate contibuted DLZ code into named. [RT #11382]
2005-09-05 00:12:29 +00:00
/*% The "dynamically loadable zones" statement syntax. */
update copyright notice
2008-01-18 23:46:58 +00:00
3931. [cleanup] Cleanup how dlz grammer is defined. [RT #36879]
2014-08-26 15:01:29 +10:00
static cfg_clausedef_t dlz_clauses[] = { { "database", &cfg_type_astring, 0 },
{ "search", &cfg_type_boolean, 0 },
{ NULL, NULL, 0 } };
1913. [func] Integrate contibuted DLZ code into named. [RT #11382]
2005-09-05 00:12:29 +00:00
static cfg_clausedef_t *dlz_clausesets[] = { dlz_clauses, NULL };
3931. [cleanup] Cleanup how dlz grammer is defined. [RT #36879]
2014-08-26 15:01:29 +10:00
static cfg_type_t cfg_type_dlz = { "dlz", cfg_parse_named_map,
cfg_print_map, cfg_doc_map,
&cfg_rep_map, dlz_clausesets };
update copyright notice
2008-01-18 23:46:58 +00:00
[master] merge dyndb 4224. [func] Added support for "dyndb", a new interface for loading zone data from an external database, developed by Red Hat for the FreeIPA project. DynDB drivers fully implement the BIND database API, and are capable of significantly better performance and functionality than DLZ drivers, while taking advantage of advanced database features not available in BIND such as multi-master replication. Thanks to Adam Tkac and Petr Spacek of Red Hat. [RT #35271]
2015-09-28 23:12:35 -07:00
/*%
* The "dyndb" statement syntax.
*/
static cfg_tuplefielddef_t dyndb_fields[] = {
{ "name", &cfg_type_astring, 0 },
{ "library", &cfg_type_qstring, 0 },
{ "parameters", &cfg_type_bracketed_text, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_dyndb = { "dyndb", cfg_parse_tuple,
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, dyndb_fields };
add hook statement to configuration parser - allow multiple "hook" statements at global or view level - add "optional bracketed text" type for optional parameter list - load hook module from specified path rather than hardcoded path - add a hooktable pointer (and a callback for freeing it) to the view structure - change the hooktable functions so they no longer update ns__hook_table by default, and modify PROCESS_HOOK so it uses the view hooktable, if set, rather than ns__hook_table. (ns__hook_table is retained for use by unit tests.) - update the filter-aaaa system test to load filter-aaaa.so - add a prereq script to check for dlopen support before running the filter-aaaa system test not yet done: - configuration parameters are not being passed to the filter-aaaa module; the filter-aaaa ACL and filter-aaaa-on-{v4,v6} settings are still stored in dns_view
2018-08-12 11:19:36 -07:00
/*%
name change from "hook modules" to "plugins" - "hook" is now used only for hook points and hook actions - the "hook" statement in named.conf is now "plugin" - ns_module and ns_modlist are now ns_plugin and ns_plugins - ns_module_load is renamed ns_plugin_register - the mandatory functions in plugin modules (hook_register, hook_check, hook_version, hook_destroy) have been renamed
2018-11-30 15:32:03 -08:00
* The "plugin" statement syntax.
* Currently only one plugin type is supported: query.
add hook statement to configuration parser - allow multiple "hook" statements at global or view level - add "optional bracketed text" type for optional parameter list - load hook module from specified path rather than hardcoded path - add a hooktable pointer (and a callback for freeing it) to the view structure - change the hooktable functions so they no longer update ns__hook_table by default, and modify PROCESS_HOOK so it uses the view hooktable, if set, rather than ns__hook_table. (ns__hook_table is retained for use by unit tests.) - update the filter-aaaa system test to load filter-aaaa.so - add a prereq script to check for dlopen support before running the filter-aaaa system test not yet done: - configuration parameters are not being passed to the filter-aaaa module; the filter-aaaa ACL and filter-aaaa-on-{v4,v6} settings are still stored in dns_view
2018-08-12 11:19:36 -07:00
*/
name change from "hook modules" to "plugins" - "hook" is now used only for hook points and hook actions - the "hook" statement in named.conf is now "plugin" - ns_module and ns_modlist are now ns_plugin and ns_plugins - ns_module_load is renamed ns_plugin_register - the mandatory functions in plugin modules (hook_register, hook_check, hook_version, hook_destroy) have been renamed
2018-11-30 15:32:03 -08:00
static const char *plugin_enums[] = { "query", NULL };
static cfg_type_t cfg_type_plugintype = { "plugintype", cfg_parse_enum,
cfg_print_ustring, cfg_doc_enum,
&cfg_rep_string, plugin_enums };
static cfg_tuplefielddef_t plugin_fields[] = {
{ "type", &cfg_type_plugintype, 0 },
add hook statement to configuration parser - allow multiple "hook" statements at global or view level - add "optional bracketed text" type for optional parameter list - load hook module from specified path rather than hardcoded path - add a hooktable pointer (and a callback for freeing it) to the view structure - change the hooktable functions so they no longer update ns__hook_table by default, and modify PROCESS_HOOK so it uses the view hooktable, if set, rather than ns__hook_table. (ns__hook_table is retained for use by unit tests.) - update the filter-aaaa system test to load filter-aaaa.so - add a prereq script to check for dlopen support before running the filter-aaaa system test not yet done: - configuration parameters are not being passed to the filter-aaaa module; the filter-aaaa ACL and filter-aaaa-on-{v4,v6} settings are still stored in dns_view
2018-08-12 11:19:36 -07:00
{ "library", &cfg_type_astring, 0 },
{ "parameters", &cfg_type_optional_bracketed_text, 0 },
{ NULL, NULL, 0 }
};
name change from "hook modules" to "plugins" - "hook" is now used only for hook points and hook actions - the "hook" statement in named.conf is now "plugin" - ns_module and ns_modlist are now ns_plugin and ns_plugins - ns_module_load is renamed ns_plugin_register - the mandatory functions in plugin modules (hook_register, hook_check, hook_version, hook_destroy) have been renamed
2018-11-30 15:32:03 -08:00
static cfg_type_t cfg_type_plugin = { "plugin", cfg_parse_tuple,
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, plugin_fields };
add hook statement to configuration parser - allow multiple "hook" statements at global or view level - add "optional bracketed text" type for optional parameter list - load hook module from specified path rather than hardcoded path - add a hooktable pointer (and a callback for freeing it) to the view structure - change the hooktable functions so they no longer update ns__hook_table by default, and modify PROCESS_HOOK so it uses the view hooktable, if set, rather than ns__hook_table. (ns__hook_table is retained for use by unit tests.) - update the filter-aaaa system test to load filter-aaaa.so - add a prereq script to check for dlopen support before running the filter-aaaa system test not yet done: - configuration parameters are not being passed to the filter-aaaa module; the filter-aaaa ACL and filter-aaaa-on-{v4,v6} settings are still stored in dns_view
2018-08-12 11:19:36 -07:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* Clauses that can be found within the 'key' statement.
*/
static cfg_clausedef_t key_clauses[] = { { "algorithm", &cfg_type_astring, 0 },
3701. [func] named-checkconf can now suppress the printing of shared secrets by specifying '-x'. [RT #34465]
2014-01-10 16:56:36 +11:00
{ "secret", &cfg_type_sstring, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 } };
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
static cfg_clausedef_t *key_clausesets[] = { key_clauses, NULL };
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
static cfg_type_t cfg_type_key = { "key", cfg_parse_named_map,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_print_map, cfg_doc_map,
update copyright notice
2008-01-18 23:46:58 +00:00
&cfg_rep_map, key_clausesets };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* Clauses that can be found in a 'server' statement.
Add server christmas tree test This sets as many server options as possible at once to detect cut-and-paste bugs when implementing new server options in peer.c. Most of the accessor functions are similar and it is easy to miss updating a macro name or structure element name when adding new accessor functions. checkconf/setup.sh is there to minimise the difference to branches with optional server options where the list is updated at runtime.
2021-12-01 14:52:31 +11:00
*
Move bind9/check to isccfg/check Since it is part of the configuration machinery
2022-12-16 10:39:15 +00:00
* Please update lib/isccfg/check.c and
Add server christmas tree test This sets as many server options as possible at once to detect cut-and-paste bugs when implementing new server options in peer.c. Most of the accessor functions are similar and it is easy to miss updating a macro name or structure element name when adding new accessor functions. checkconf/setup.sh is there to minimise the difference to branches with optional server options where the list is updated at runtime.
2021-12-01 14:52:31 +11:00
* bin/tests/system/checkconf/good-server-christmas-tree.conf.in to
* exercise the new clause when adding new clauses.
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
*/
static cfg_clausedef_t server_clauses[] = {
{ "bogus", &cfg_type_boolean, 0 },
alphabetize server_clauses
2014-07-22 14:00:27 +10:00
{ "edns", &cfg_type_boolean, 0 },
{ "edns-udp-size", &cfg_type_uint32, 0 },
3949. [experimental] Experimental support for draft-andrews-edns1 by sending EDNS(1) queries (define DRAFT_ANDREWS_EDNS1 when building). Add support for limiting the EDNS version advertised to servers: server { edns-version 0; }; Log the EDNS version received in the query log. [RT #35864]
2014-09-10 15:31:40 +10:00
{ "edns-version", &cfg_type_uint32, 0 },
alphabetize server_clauses
2014-07-22 14:00:27 +10:00
{ "keys", &cfg_type_server_key_kludge, 0 },
{ "max-udp-size", &cfg_type_uint32, 0 },
{ "notify-source", &cfg_type_sockaddr4wild, 0 },
{ "notify-source-v6", &cfg_type_sockaddr6wild, 0 },
[master] EDNS padding and keepalive support 4549. [func] Added support for the EDNS TCP Keepalive option (RFC 7828). [RT #42126] 4548. [func] Added support for the EDNS Padding option (RFC 7830). [RT #42094]
2017-01-04 09:16:30 -08:00
{ "padding", &cfg_type_uint32, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "provide-ixfr", &cfg_type_boolean, 0 },
alphabetize server_clauses
2014-07-22 14:00:27 +10:00
{ "query-source", &cfg_type_querysource4, 0 },
{ "query-source-v6", &cfg_type_querysource6, 0 },
3911. [func] Implement EDNS EXPIRE option client side. [RT #35925]
2014-08-06 11:50:40 +10:00
{ "request-expire", &cfg_type_boolean, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "request-ixfr", &cfg_type_boolean, 0 },
alphabetize server_clauses
2014-07-22 14:00:27 +10:00
{ "request-nsid", &cfg_type_boolean, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "request-sit", NULL, CFG_CLAUSEFLAG_ANCIENT },
Add server clause require-cookie Specifies if an UDP response requires a DNS COOKIE or not. Fallback to TCP if not present and not TSIG signed.
2020-11-24 10:44:40 +11:00
{ "require-cookie", &cfg_type_boolean, 0 },
4152. [func] Implement DNS COOKIE option. This replaces the experimental SIT option of BIND 9.10. The following named.conf directives are avaliable: send-cookie, cookie-secret, cookie-algorithm and nocookie-udp-size. The following dig options are available: +[no]cookie[=value] and +[no]badcookie. [RT #39928]
2015-07-06 09:44:24 +10:00
{ "send-cookie", &cfg_type_boolean, 0 },
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
{ "support-ixfr", NULL, CFG_CLAUSEFLAG_ANCIENT },
tcp-only and tcp-keepalive where out of alphabetical order
2017-08-14 07:00:02 +00:00
{ "tcp-keepalive", &cfg_type_boolean, 0 },
{ "tcp-only", &cfg_type_boolean, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "transfer-format", &cfg_type_transferformat, 0 },
1515. [func] Allow transfer source to be set in a server statement. [RT #6496] implemented by marka, reviewed and documented by jinmei. Notes: lib/dns/zone.c had to be modified manually. ARM html files were not regenerated (yet).
2003-09-25 18:16:50 +00:00
{ "transfer-source", &cfg_type_sockaddr4wild, 0 },
{ "transfer-source-v6", &cfg_type_sockaddr6wild, 0 },
alphabetize server_clauses
2014-07-22 14:00:27 +10:00
{ "transfers", &cfg_type_uint32, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
static cfg_clausedef_t *server_clausesets[] = { server_clauses, NULL };
static cfg_type_t cfg_type_server = { "server", cfg_parse_netprefix_map,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_print_map, cfg_doc_map,
&cfg_rep_map, server_clausesets };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* Clauses that can be found in a 'channel' clause in the
* 'logging' statement.
*
* These have some additional constraints that need to be
* checked after parsing:
* - There must exactly one of file/syslog/null/stderr
*/
[master] allow different time formats: local, iso8601, iso8601-utc 4518. [func] The "print-time" option in the logging configuration can now take arguments "local", "iso8601" or "iso8601-utc" to indicate the format in which the date and time should be logged. For backward compatibility, "yes" is a synonym for "local". [RT #42585]
2016-11-22 23:34:47 -08:00
static const char *printtime_enums[] = { "iso8601", "iso8601-utc", "local",
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
NULL };
[master] allow different time formats: local, iso8601, iso8601-utc 4518. [func] The "print-time" option in the logging configuration can now take arguments "local", "iso8601" or "iso8601-utc" to indicate the format in which the date and time should be logged. For backward compatibility, "yes" is a synonym for "local". [RT #42585]
2016-11-22 23:34:47 -08:00
static isc_result_t
parse_printtime(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
[master] allow different time formats: local, iso8601, iso8601-utc 4518. [func] The "print-time" option in the logging configuration can now take arguments "local", "iso8601" or "iso8601-utc" to indicate the format in which the date and time should be logged. For backward compatibility, "yes" is a synonym for "local". [RT #42585]
2016-11-22 23:34:47 -08:00
}
static void
doc_printtime(cfg_printer_t *pctx, const cfg_type_t *type) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
cfg_doc_enum_or_other(pctx, type, &cfg_type_boolean);
[master] allow different time formats: local, iso8601, iso8601-utc 4518. [func] The "print-time" option in the logging configuration can now take arguments "local", "iso8601" or "iso8601-utc" to indicate the format in which the date and time should be logged. For backward compatibility, "yes" is a synonym for "local". [RT #42585]
2016-11-22 23:34:47 -08:00
}
static cfg_type_t cfg_type_printtime = { "printtime", parse_printtime,
cfg_print_ustring, doc_printtime,
&cfg_rep_string, printtime_enums };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_clausedef_t channel_clauses[] = {
/* Destinations. We no longer require these to be first. */
{ "file", &cfg_type_logfile, 0 },
{ "syslog", &cfg_type_optional_facility, 0 },
{ "null", &cfg_type_void, 0 },
{ "stderr", &cfg_type_void, 0 },
/* Options. We now accept these for the null channel, too. */
{ "severity", &cfg_type_logseverity, 0 },
[master] allow different time formats: local, iso8601, iso8601-utc 4518. [func] The "print-time" option in the logging configuration can now take arguments "local", "iso8601" or "iso8601-utc" to indicate the format in which the date and time should be logged. For backward compatibility, "yes" is a synonym for "local". [RT #42585]
2016-11-22 23:34:47 -08:00
{ "print-time", &cfg_type_printtime, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "print-severity", &cfg_type_boolean, 0 },
{ "print-category", &cfg_type_boolean, 0 },
3991. [func] Add the ability to buffer logging output by specifying "buffered yes;" when defining a channel. [RT #26561]
2014-10-30 11:37:05 +11:00
{ "buffered", &cfg_type_boolean, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
static cfg_clausedef_t *channel_clausesets[] = { channel_clauses, NULL };
static cfg_type_t cfg_type_channel = { "channel", cfg_parse_named_map,
cfg_print_map, cfg_doc_map,
&cfg_rep_map, channel_clausesets };
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*% A list of log destination, used in the "category" clause. */
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_destinationlist = { "destinationlist",
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_astring };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* Clauses that can be found in a 'logging' statement.
*/
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
static cfg_clausedef_t logging_clauses[] = {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ "channel", &cfg_type_channel, CFG_CLAUSEFLAG_MULTI },
{ "category", &cfg_type_category, CFG_CLAUSEFLAG_MULTI },
{ NULL, NULL, 0 }
};
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
static cfg_clausedef_t *logging_clausesets[] = { logging_clauses, NULL };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_logging = { "logging", cfg_parse_map,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_print_map, cfg_doc_map,
&cfg_rep_map, logging_clausesets };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
2930. [experimental] New "rndc addzone" and "rndc delzone" commads allow dynamic addition and deletion of zones. To enable this feature, specify a "new-zone-file" option at the view or options level in named.conf. Zone configuration information for the new zones will be written into that file. To make the new zones persist after a restart, "include" the file into named.conf in the appropriate view. (Note: This feature is not yet documented, and its syntax is expected to change.) [RT #19447]
2010-07-11 00:12:57 +00:00
/*%
* For parsing an 'addzone' statement
*/
static cfg_tuplefielddef_t addzone_fields[] = {
{ "name", &cfg_type_astring, 0 },
{ "class", &cfg_type_optional_class, 0 },
{ "view", &cfg_type_optional_class, 0 },
{ "options", &cfg_type_zoneopts, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_addzone = { "zone", cfg_parse_tuple,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, addzone_fields };
2930. [experimental] New "rndc addzone" and "rndc delzone" commads allow dynamic addition and deletion of zones. To enable this feature, specify a "new-zone-file" option at the view or options level in named.conf. Zone configuration information for the new zones will be written into that file. To make the new zones persist after a restart, "include" the file into named.conf in the appropriate view. (Note: This feature is not yet documented, and its syntax is expected to change.) [RT #19447]
2010-07-11 00:12:57 +00:00
static cfg_clausedef_t addzoneconf_clauses[] = {
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
{ "zone", &cfg_type_addzone, CFG_CLAUSEFLAG_MULTI }, { NULL, NULL, 0 }
2930. [experimental] New "rndc addzone" and "rndc delzone" commads allow dynamic addition and deletion of zones. To enable this feature, specify a "new-zone-file" option at the view or options level in named.conf. Zone configuration information for the new zones will be written into that file. To make the new zones persist after a restart, "include" the file into named.conf in the appropriate view. (Note: This feature is not yet documented, and its syntax is expected to change.) [RT #19447]
2010-07-11 00:12:57 +00:00
};
static cfg_clausedef_t *addzoneconf_clausesets[] = { addzoneconf_clauses,
NULL };
Remove LIB<*>_EXTERNAL_DATA defines After Windows has been removed, the LIB<*>_EXTERNAL_DATA defines were just dummy leftovers. Remove them.
2021-06-10 08:06:48 +02:00
cfg_type_t cfg_type_addzoneconf = { "addzoneconf", cfg_parse_mapbody,
cfg_print_mapbody, cfg_doc_mapbody,
&cfg_rep_map, addzoneconf_clausesets };
2930. [experimental] New "rndc addzone" and "rndc delzone" commads allow dynamic addition and deletion of zones. To enable this feature, specify a "new-zone-file" option at the view or options level in named.conf. Zone configuration information for the new zones will be written into that file. To make the new zones persist after a restart, "include" the file into named.conf in the appropriate view. (Note: This feature is not yet documented, and its syntax is expected to change.) [RT #19447]
2010-07-11 00:12:57 +00:00
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static isc_result_t
Remove isc_resource API and set limits directly in named_os unit The only function left in the isc_resource API was setting the file limit. Replace the whole unit with a simple getrlimit to check the maximum value of RLIMIT_NOFILE and set the maximum back to rlimit_cur. This is more compatible than trying to set RLIMIT_UNLIMITED on the RLIMIT_NOFILE as it doesn't work on Linux (see man 5 proc on /proc/sys/fs/nr_open), neither it does on Darwin kernel (see man 2 getrlimit). The only place where the maximum value could be raised under privileged user would be BSDs, but the `named_os_adjustnofile()` were not called there before. We would apply the increased limits only on Linux and Sun platforms.
2022-11-13 11:04:30 +01:00
parse_unitstring(char *str, uint64_t *valuep) {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
char *endp;
unsigned int len;
Replace custom isc_u?intNN_t types with C99 u?intNN_t types
2018-03-28 14:19:37 +02:00
uint64_t value;
uint64_t unit;
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
Replace isc_string_touint64 with strtoull (C99)
2018-03-21 16:09:08 +00:00
value = strtoull(str, &endp, 10);
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
if (*endp == 0) {
*valuep = value;
return (ISC_R_SUCCESS);
}
len = strlen(str);
if (len < 2 || endp[1] != '\0') {
return (ISC_R_FAILURE);
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
switch (str[len - 1]) {
case 'k':
case 'K':
unit = 1024;
break;
case 'm':
case 'M':
unit = 1024 * 1024;
break;
case 'g':
case 'G':
unit = 1024 * 1024 * 1024;
break;
default:
return (ISC_R_FAILURE);
}
address or suppress cppcheck warnings
2019-08-08 13:52:44 +10:00
if (value > ((uint64_t)UINT64_MAX / unit)) {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
return (ISC_R_FAILURE);
address or suppress cppcheck warnings
2019-08-08 13:52:44 +10:00
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
*valuep = value * unit;
return (ISC_R_SUCCESS);
}
static isc_result_t
parse_sizeval(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
isc_result_t result;
cfg_obj_t *obj = NULL;
Replace custom isc_u?intNN_t types with C99 u?intNN_t types
2018-03-28 14:19:37 +02:00
uint64_t val;
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
UNUSED(type);
CHECK(cfg_gettoken(pctx, 0));
1462. [bug] parse_sizeval() failed to check the token type. [RT #5586]
2003-04-17 03:26:58 +00:00
if (pctx->token.type != isc_tokentype_string) {
result = ISC_R_UNEXPECTEDTOKEN;
goto cleanup;
}
use token.value.as_textregion.base, not token.value.pointer
2002-01-22 19:31:57 +00:00
CHECK(parse_unitstring(TOKEN_STRING(pctx), &val));
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
CHECK(cfg_create_obj(pctx, &cfg_type_uint64, &obj));
obj->value.uint64 = val;
*ret = obj;
return (ISC_R_SUCCESS);
cleanup:
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_parser_error(pctx, CFG_LOG_NEAR,
"expected integer and optional unit");
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
return (result);
}
4223. [func] Add support for setting max-cache-size to percentage of available physical memory, set default to 90%. [RT #38442]
2015-09-28 11:08:50 +02:00
static isc_result_t
parse_sizeval_percent(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
char *endp;
isc_result_t result;
cfg_obj_t *obj = NULL;
Replace custom isc_u?intNN_t types with C99 u?intNN_t types
2018-03-28 14:19:37 +02:00
uint64_t val;
uint64_t percent;
4223. [func] Add support for setting max-cache-size to percentage of available physical memory, set default to 90%. [RT #38442]
2015-09-28 11:08:50 +02:00
UNUSED(type);
CHECK(cfg_gettoken(pctx, 0));
if (pctx->token.type != isc_tokentype_string) {
result = ISC_R_UNEXPECTEDTOKEN;
goto cleanup;
}
Replace isc_string_touint64 with strtoull (C99)
2018-03-21 16:09:08 +00:00
percent = strtoull(TOKEN_STRING(pctx), &endp, 10);
4223. [func] Add support for setting max-cache-size to percentage of available physical memory, set default to 90%. [RT #38442]
2015-09-28 11:08:50 +02:00
if (*endp == '%' && *(endp + 1) == 0) {
CHECK(cfg_create_obj(pctx, &cfg_type_percentage, &obj));
Replace custom isc_u?intNN_t types with C99 u?intNN_t types
2018-03-28 14:19:37 +02:00
obj->value.uint32 = (uint32_t)percent;
4223. [func] Add support for setting max-cache-size to percentage of available physical memory, set default to 90%. [RT #38442]
2015-09-28 11:08:50 +02:00
*ret = obj;
return (ISC_R_SUCCESS);
} else {
CHECK(parse_unitstring(TOKEN_STRING(pctx), &val));
CHECK(cfg_create_obj(pctx, &cfg_type_uint64, &obj));
obj->value.uint64 = val;
*ret = obj;
return (ISC_R_SUCCESS);
}
cleanup:
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_parser_error(pctx, CFG_LOG_NEAR,
"expected integer and optional unit or percent");
4223. [func] Add support for setting max-cache-size to percentage of available physical memory, set default to 90%. [RT #38442]
2015-09-28 11:08:50 +02:00
return (result);
}
static void
doc_sizeval_percent(cfg_printer_t *pctx, const cfg_type_t *type) {
UNUSED(type);
cfg_print_cstr(pctx, "( ");
cfg_doc_terminal(pctx, &cfg_type_size);
cfg_print_cstr(pctx, " | ");
cfg_doc_terminal(pctx, &cfg_type_percentage);
cfg_print_cstr(pctx, " )");
}
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* A size value (number + optional unit).
*/
static cfg_type_t cfg_type_sizeval = { "sizeval", parse_sizeval,
cfg_print_uint64, cfg_doc_terminal,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
&cfg_rep_uint64, NULL };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* A size, "unlimited", or "default".
*/
static isc_result_t
parse_size(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
return (cfg_parse_enum_or_other(pctx, type, &cfg_type_sizeval, ret));
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
}
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
static void
doc_size(cfg_printer_t *pctx, const cfg_type_t *type) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
cfg_doc_enum_or_other(pctx, type, &cfg_type_sizeval);
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
}
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
static const char *size_enums[] = { "default", "unlimited", NULL };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_size = {
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
"size", parse_size, cfg_print_ustring,
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
doc_size, &cfg_rep_string, size_enums
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* A size or "unlimited", but not "default".
*/
static const char *sizenodefault_enums[] = { "unlimited", NULL };
static cfg_type_t cfg_type_sizenodefault = {
4223. [func] Add support for setting max-cache-size to percentage of available physical memory, set default to 90%. [RT #38442]
2015-09-28 11:08:50 +02:00
"size_no_default", parse_size, cfg_print_ustring,
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
doc_size, &cfg_rep_string, sizenodefault_enums
};
4223. [func] Add support for setting max-cache-size to percentage of available physical memory, set default to 90%. [RT #38442]
2015-09-28 11:08:50 +02:00
/*%
* A size in absolute values or percents.
*/
static cfg_type_t cfg_type_sizeval_percent = {
"sizeval_percent", parse_sizeval_percent, cfg_print_ustring,
doc_sizeval_percent, &cfg_rep_string, NULL
};
/*%
* A size in absolute values or percents, or "unlimited", or "default"
*/
static isc_result_t
parse_size_or_percent(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
return (cfg_parse_enum_or_other(pctx, type, &cfg_type_sizeval_percent,
4223. [func] Add support for setting max-cache-size to percentage of available physical memory, set default to 90%. [RT #38442]
2015-09-28 11:08:50 +02:00
ret));
}
static void
doc_parse_size_or_percent(cfg_printer_t *pctx, const cfg_type_t *type) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
UNUSED(type);
cfg_print_cstr(pctx, "( default | unlimited | ");
cfg_doc_terminal(pctx, &cfg_type_sizeval);
cfg_print_cstr(pctx, " | ");
cfg_doc_terminal(pctx, &cfg_type_percentage);
cfg_print_cstr(pctx, " )");
4223. [func] Add support for setting max-cache-size to percentage of available physical memory, set default to 90%. [RT #38442]
2015-09-28 11:08:50 +02:00
}
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
static const char *sizeorpercent_enums[] = { "default", "unlimited", NULL };
4223. [func] Add support for setting max-cache-size to percentage of available physical memory, set default to 90%. [RT #38442]
2015-09-28 11:08:50 +02:00
static cfg_type_t cfg_type_sizeorpercent = {
"size_or_percent", parse_size_or_percent, cfg_print_ustring,
doc_parse_size_or_percent, &cfg_rep_string, sizeorpercent_enums
};
add syntax and setter/getter functions to configure max-ixfr-ratio
2020-02-21 10:53:08 -08:00
/*%
* An IXFR size ratio: percentage, or "unlimited".
*/
static isc_result_t
parse_ixfrratio(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
return (cfg_parse_enum_or_other(pctx, type, &cfg_type_percentage, ret));
}
static void
doc_ixfrratio(cfg_printer_t *pctx, const cfg_type_t *type) {
UNUSED(type);
cfg_print_cstr(pctx, "( unlimited | ");
cfg_doc_terminal(pctx, &cfg_type_percentage);
cfg_print_cstr(pctx, " )");
}
static const char *ixfrratio_enums[] = { "unlimited", NULL };
static cfg_type_t cfg_type_ixfrratio = { "ixfr_ratio", parse_ixfrratio,
NULL, doc_ixfrratio,
NULL, ixfrratio_enums };
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* optional_keyvalue
*/
static isc_result_t
parse_maybe_optional_keyvalue(cfg_parser_t *pctx, const cfg_type_t *type,
Replace custom isc_boolean_t with C standard bool type
2018-04-17 08:29:14 -07:00
bool optional, cfg_obj_t **ret) {
update copyright notice
2008-01-18 23:46:58 +00:00
isc_result_t result;
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
cfg_obj_t *obj = NULL;
const keyword_type_t *kw = type->of;
CHECK(cfg_peektoken(pctx, 0));
if (pctx->token.type == isc_tokentype_string &&
use token.value.as_textregion.base, not token.value.pointer
2002-01-22 19:31:57 +00:00
strcasecmp(TOKEN_STRING(pctx), kw->name) == 0)
{
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
CHECK(cfg_gettoken(pctx, 0));
CHECK(kw->type->parse(pctx, kw->type, &obj));
obj->type = type; /* XXX kludge */
} else {
if (optional) {
CHECK(cfg_parse_void(pctx, NULL, &obj));
} else {
cfg_parser_error(pctx, CFG_LOG_NEAR, "expected '%s'",
kw->name);
result = ISC_R_UNEXPECTEDTOKEN;
goto cleanup;
}
}
*ret = obj;
cleanup:
return (result);
}
static isc_result_t
parse_keyvalue(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
Replace custom isc_boolean_t with C standard bool type
2018-04-17 08:29:14 -07:00
return (parse_maybe_optional_keyvalue(pctx, type, false, ret));
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
}
static isc_result_t
[master] add DSCP support 3535. [func] Add support for setting Differentiated Services Code Point (DSCP) values in named. Most configuration options which take a "port" option (e.g., listen-on, forwarders, also-notify, masters, notify-source, etc) can now also take a "dscp" option specifying a code point for use with outgoing traffic, if supported by the underlying OS. [RT #27596]
2013-03-22 12:27:54 -07:00
parse_optional_keyvalue(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
Replace custom isc_boolean_t with C standard bool type
2018-04-17 08:29:14 -07:00
return (parse_maybe_optional_keyvalue(pctx, type, true, ret));
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
}
static void
1991. [cleanup] The configuration data, once read, should be treated as readonly. Expand the use of const to enforce this at compile time. [RT #15813]
2006-02-28 02:39:52 +00:00
print_keyvalue(cfg_printer_t *pctx, const cfg_obj_t *obj) {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
const keyword_type_t *kw = obj->type->of;
cfg_print_cstr(pctx, kw->name);
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ");
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
kw->type->print(pctx, obj);
}
static void
doc_keyvalue(cfg_printer_t *pctx, const cfg_type_t *type) {
const keyword_type_t *kw = type->of;
cfg_print_cstr(pctx, kw->name);
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ");
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
cfg_doc_obj(pctx, kw->type);
}
static void
doc_optional_keyvalue(cfg_printer_t *pctx, const cfg_type_t *type) {
const keyword_type_t *kw = type->of;
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, "[ ");
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
cfg_print_cstr(pctx, kw->name);
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ");
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
cfg_doc_obj(pctx, kw->type);
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ]");
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
}
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
static const char *dialup_enums[] = { "notify", "notify-passive", "passive",
"refresh", NULL };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static isc_result_t
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
parse_dialup_type(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
}
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
static void
doc_dialup_type(cfg_printer_t *pctx, const cfg_type_t *type) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
cfg_doc_enum_or_other(pctx, type, &cfg_type_boolean);
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_dialuptype = { "dialuptype", parse_dialup_type,
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
cfg_print_ustring, doc_dialup_type,
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
&cfg_rep_string, dialup_enums };
add "primary-only" as a synonym for "master-only" update the "notify" option to use RFC 8499 terminology as well.
2020-06-17 02:45:07 -07:00
static const char *notify_enums[] = { "explicit", "master-only", "primary-only",
NULL };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static isc_result_t
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
parse_notify_type(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
}
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
static void
doc_notify_type(cfg_printer_t *pctx, const cfg_type_t *type) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
cfg_doc_enum_or_other(pctx, type, &cfg_type_boolean);
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_notifytype = {
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
"notifytype", parse_notify_type, cfg_print_ustring,
update copyright notice
2008-01-18 23:46:58 +00:00
doc_notify_type, &cfg_rep_string, notify_enums,
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
4437. [func] Minimal-responses now has two additional modes no-auth and no-auth-recursive which suppress adding the NS records to the authority section as well as the associated address records for the nameservers. [RT #42005]
2016-08-12 10:48:51 +10:00
static const char *minimal_enums[] = { "no-auth", "no-auth-recursive", NULL };
static isc_result_t
parse_minimal(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
4437. [func] Minimal-responses now has two additional modes no-auth and no-auth-recursive which suppress adding the NS records to the authority section as well as the associated address records for the nameservers. [RT #42005]
2016-08-12 10:48:51 +10:00
}
static void
doc_minimal(cfg_printer_t *pctx, const cfg_type_t *type) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
cfg_doc_enum_or_other(pctx, type, &cfg_type_boolean);
4437. [func] Minimal-responses now has two additional modes no-auth and no-auth-recursive which suppress adding the NS records to the authority section as well as the associated address records for the nameservers. [RT #42005]
2016-08-12 10:48:51 +10:00
}
static cfg_type_t cfg_type_minimal = {
"minimal", parse_minimal, cfg_print_ustring,
doc_minimal, &cfg_rep_string, minimal_enums,
};
[master] allow primary/secondary as synonyms for master/slave 4848. [func] Zone types "primary" and "secondary" can now be used as synonyms for "master" and "slave" in named.conf. [RT #46713]
2017-12-15 01:47:05 -08:00
static const char *ixfrdiff_enums[] = { "primary", "master", "secondary",
"slave", NULL };
1684. [func] ixfr-from-differences now takes master and slave in addition to yes and no at the options and view levels.
2004-10-14 00:49:34 +00:00
static isc_result_t
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
parse_ixfrdiff_type(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
1684. [func] ixfr-from-differences now takes master and slave in addition to yes and no at the options and view levels.
2004-10-14 00:49:34 +00:00
}
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
static void
doc_ixfrdiff_type(cfg_printer_t *pctx, const cfg_type_t *type) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
cfg_doc_enum_or_other(pctx, type, &cfg_type_boolean);
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
}
1684. [func] ixfr-from-differences now takes master and slave in addition to yes and no at the options and view levels.
2004-10-14 00:49:34 +00:00
static cfg_type_t cfg_type_ixfrdifftype = {
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
"ixfrdiff", parse_ixfrdiff_type, cfg_print_ustring,
update copyright notice
2008-01-18 23:46:58 +00:00
doc_ixfrdiff_type, &cfg_rep_string, ixfrdiff_enums,
1684. [func] ixfr-from-differences now takes master and slave in addition to yes and no at the options and view levels.
2004-10-14 00:49:34 +00:00
};
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static keyword_type_t key_kw = { "key", &cfg_type_astring };
Remove LIB<*>_EXTERNAL_DATA defines After Windows has been removed, the LIB<*>_EXTERNAL_DATA defines were just dummy leftovers. Remove them.
2021-06-10 08:06:48 +02:00
cfg_type_t cfg_type_keyref = { "keyref", parse_keyvalue, print_keyvalue,
doc_keyvalue, &cfg_rep_string, &key_kw };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_optional_keyref = {
"optional_keyref", parse_optional_keyvalue, print_keyvalue,
doc_optional_keyvalue, &cfg_rep_string, &key_kw
};
- qname minimization: - make qname-minimization option tristate {strict,relaxed,disabled} - go straight for the record if we hit NXDOMAIN in relaxed mode - go straight for the record after 3 labels without new delegation or 7 labels total - use start of fetch (and not time of response) as 'now' time for querying cache for zonecut when following delegation.
2018-05-11 12:27:56 +02:00
static const char *qminmethod_enums[] = { "strict", "relaxed", "disabled",
Add qname-minimization off as an option; test fixes
2018-06-12 10:20:43 +02:00
"off", NULL };
- qname minimization: - make qname-minimization option tristate {strict,relaxed,disabled} - go straight for the record if we hit NXDOMAIN in relaxed mode - go straight for the record after 3 labels without new delegation or 7 labels total - use start of fetch (and not time of response) as 'now' time for querying cache for zonecut when following delegation.
2018-05-11 12:27:56 +02:00
static cfg_type_t cfg_type_qminmethod = { "qminmethod", cfg_parse_enum,
cfg_print_ustring, cfg_doc_enum,
&cfg_rep_string, qminmethod_enums };
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* A "controls" statement is represented as a map with the multivalued
update copyright notice
2008-01-18 23:46:58 +00:00
* "inet" and "unix" clauses.
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
*/
static keyword_type_t controls_allow_kw = { "allow", &cfg_type_bracketed_aml };
1814. [func] UNIX domain controls are now supported.
2005-02-23 01:09:23 +00:00
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_controls_allow = {
"controls_allow", parse_keyvalue, print_keyvalue,
doc_keyvalue, &cfg_rep_list, &controls_allow_kw
};
static keyword_type_t controls_keys_kw = { "keys", &cfg_type_keylist };
1814. [func] UNIX domain controls are now supported.
2005-02-23 01:09:23 +00:00
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_controls_keys = {
"controls_keys", parse_optional_keyvalue, print_keyvalue,
doc_optional_keyvalue, &cfg_rep_list, &controls_keys_kw
};
Allow non-destructive control channel access using a "read-only" clause (#40498)
2015-11-11 13:29:38 +05:30
static keyword_type_t controls_readonly_kw = { "read-only", &cfg_type_boolean };
static cfg_type_t cfg_type_controls_readonly = {
"controls_readonly", parse_optional_keyvalue, print_keyvalue,
doc_optional_keyvalue, &cfg_rep_boolean, &controls_readonly_kw
};
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_tuplefielddef_t inetcontrol_fields[] = {
{ "address", &cfg_type_controls_sockaddr, 0 },
{ "allow", &cfg_type_controls_allow, 0 },
{ "keys", &cfg_type_controls_keys, 0 },
Allow non-destructive control channel access using a "read-only" clause (#40498)
2015-11-11 13:29:38 +05:30
{ "read-only", &cfg_type_controls_readonly, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
1814. [func] UNIX domain controls are now supported.
2005-02-23 01:09:23 +00:00
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_inetcontrol = {
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
"inetcontrol", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, inetcontrol_fields
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
1814. [func] UNIX domain controls are now supported.
2005-02-23 01:09:23 +00:00
static keyword_type_t controls_perm_kw = { "perm", &cfg_type_uint32 };
static cfg_type_t cfg_type_controls_perm = {
"controls_perm", parse_keyvalue, print_keyvalue,
doc_keyvalue, &cfg_rep_uint32, &controls_perm_kw
};
static keyword_type_t controls_owner_kw = { "owner", &cfg_type_uint32 };
static cfg_type_t cfg_type_controls_owner = {
"controls_owner", parse_keyvalue, print_keyvalue,
doc_keyvalue, &cfg_rep_uint32, &controls_owner_kw
};
static keyword_type_t controls_group_kw = { "group", &cfg_type_uint32 };
static cfg_type_t cfg_type_controls_group = {
"controls_allow", parse_keyvalue, print_keyvalue,
doc_keyvalue, &cfg_rep_uint32, &controls_group_kw
};
static cfg_tuplefielddef_t unixcontrol_fields[] = {
{ "path", &cfg_type_qstring, 0 },
{ "perm", &cfg_type_controls_perm, 0 },
{ "owner", &cfg_type_controls_owner, 0 },
{ "group", &cfg_type_controls_group, 0 },
{ "keys", &cfg_type_controls_keys, 0 },
Allow non-destructive control channel access using a "read-only" clause (#40498)
2015-11-11 13:29:38 +05:30
{ "read-only", &cfg_type_controls_readonly, 0 },
1814. [func] UNIX domain controls are now supported.
2005-02-23 01:09:23 +00:00
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_unixcontrol = {
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
"unixcontrol", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, unixcontrol_fields
1814. [func] UNIX domain controls are now supported.
2005-02-23 01:09:23 +00:00
};
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_clausedef_t controls_clauses[] = {
{ "inet", &cfg_type_inetcontrol, CFG_CLAUSEFLAG_MULTI },
1814. [func] UNIX domain controls are now supported.
2005-02-23 01:09:23 +00:00
{ "unix", &cfg_type_unixcontrol, CFG_CLAUSEFLAG_MULTI },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
1648. [func] Update dnssec-lookaside named.conf syntax to support multiple dnssec-lookaside namespaces (not yet implemented).
2004-06-04 02:31:43 +00:00
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_clausedef_t *controls_clausesets[] = { controls_clauses, NULL };
static cfg_type_t cfg_type_controls = { "controls", cfg_parse_map,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
cfg_print_map, cfg_doc_map,
&cfg_rep_map, &controls_clausesets };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
2294. [func] Allow the experimental statistics channels to have multiple connections and ACL. Note: the stats-server and stats-server-v6 options available in the previous beta releases are replaced with the generic statistics-channels statment.
2008-01-17 00:15:14 +00:00
/*%
* A "statistics-channels" statement is represented as a map with the
update copyright notice
2008-01-18 23:46:58 +00:00
* multivalued "inet" clauses.
2294. [func] Allow the experimental statistics channels to have multiple connections and ACL. Note: the stats-server and stats-server-v6 options available in the previous beta releases are replaced with the generic statistics-channels statment.
2008-01-17 00:15:14 +00:00
*/
static void
doc_optional_bracketed_list(cfg_printer_t *pctx, const cfg_type_t *type) {
const keyword_type_t *kw = type->of;
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, "[ ");
Fix documentation for: 2294. [func] Allow the experimental statistics channels to have multiple connections and ACL.
2008-01-17 21:38:24 +00:00
cfg_print_cstr(pctx, kw->name);
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ");
2294. [func] Allow the experimental statistics channels to have multiple connections and ACL. Note: the stats-server and stats-server-v6 options available in the previous beta releases are replaced with the generic statistics-channels statment.
2008-01-17 00:15:14 +00:00
cfg_doc_obj(pctx, kw->type);
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ]");
2294. [func] Allow the experimental statistics channels to have multiple connections and ACL. Note: the stats-server and stats-server-v6 options available in the previous beta releases are replaced with the generic statistics-channels statment.
2008-01-17 00:15:14 +00:00
}
static cfg_type_t cfg_type_optional_allow = {
"optional_allow", parse_optional_keyvalue,
print_keyvalue, doc_optional_bracketed_list,
&cfg_rep_list, &controls_allow_kw
};
static cfg_tuplefielddef_t statserver_fields[] = {
{ "address", &cfg_type_controls_sockaddr, 0 }, /* reuse controls def */
{ "allow", &cfg_type_optional_allow, 0 },
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_statschannel = {
"statschannel", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, statserver_fields
};
static cfg_clausedef_t statservers_clauses[] = {
{ "inet", &cfg_type_statschannel, CFG_CLAUSEFLAG_MULTI },
{ NULL, NULL, 0 }
};
static cfg_clausedef_t *statservers_clausesets[] = { statservers_clauses,
NULL };
static cfg_type_t cfg_type_statschannels = {
"statistics-channels", cfg_parse_map, cfg_print_map,
cfg_doc_map, &cfg_rep_map, &statservers_clausesets
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* An optional class, as used in view and zone statements.
*/
static isc_result_t
[master] add geoip support 3504. [func] Add support for ACLs based on geographic location, using MaxMind GeoIP databases. Based on code contributed by Ken Brownfield <kb@slide.com>. [RT #30681]
2013-02-27 17:19:39 -08:00
parse_optional_class(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
isc_result_t result;
UNUSED(type);
CHECK(cfg_peektoken(pctx, 0));
if (pctx->token.type == isc_tokentype_string) {
CHECK(cfg_parse_obj(pctx, &cfg_type_ustring, ret));
} else {
CHECK(cfg_parse_obj(pctx, &cfg_type_void, ret));
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
cleanup:
return (result);
}
document optional class
2015-09-18 13:25:31 +10:00
static void
doc_optional_class(cfg_printer_t *pctx, const cfg_type_t *type) {
UNUSED(type);
cfg_print_cstr(pctx, "[ <class> ]");
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_optional_class = { "optional_class",
document optional class
2015-09-18 13:25:31 +10:00
parse_optional_class,
NULL,
doc_optional_class,
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
NULL,
NULL };
static isc_result_t
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
parse_querysource(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
isc_result_t result;
cfg_obj_t *obj = NULL;
isc_netaddr_t netaddr;
[master] add DSCP support 3535. [func] Add support for setting Differentiated Services Code Point (DSCP) values in named. Most configuration options which take a "port" option (e.g., listen-on, forwarders, also-notify, masters, notify-source, etc) can now also take a "dscp" option specifying a code point for use with outgoing traffic, if supported by the underlying OS. [RT #27596]
2013-03-22 12:27:54 -07:00
in_port_t port = 0;
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
unsigned int have_address = 0;
unsigned int have_port = 0;
Add 'tls' configuration support for the 'forwarders' option A 'tls' statement can be specified both for individual addresses and for the whole list (as a default value when an individual address doesn't have its own 'tls' set), just as it was done before for the 'port' value. Create a new function 'print_rawqstring()' to print a string residing in a 'isc_textregion_t' type parameter. Create a new function 'copy_string()' to copy a string from a 'cfg_obj_t' object into a 'isc_textregion_t'.
2022-12-08 10:57:37 +00:00
unsigned int have_tls = 0;
1596. [func] Accept 'notify-source' style syntax for query-source.
2004-03-30 02:05:40 +00:00
const unsigned int *flagp = type->of;
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
Hint the compiler with ISC_UNREACHABLE(); that code after INSIST(0); cannot be reached
2018-11-07 15:00:07 +07:00
if ((*flagp & CFG_ADDR_V4OK) != 0) {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
isc_netaddr_any(&netaddr);
Hint the compiler with ISC_UNREACHABLE(); that code after INSIST(0); cannot be reached
2018-11-07 15:00:07 +07:00
} else if ((*flagp & CFG_ADDR_V6OK) != 0) {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
isc_netaddr_any6(&netaddr);
Hint the compiler with ISC_UNREACHABLE(); that code after INSIST(0); cannot be reached
2018-11-07 15:00:07 +07:00
} else {
Simplify way we tag unreachable code with only ISC_UNREACHABLE() Previously, the unreachable code paths would have to be tagged with: INSIST(0); ISC_UNREACHABLE(); There was also older parts of the code that used comment annotation: /* NOTREACHED */ Unify the handling of unreachable code paths to just use: UNREACHABLE(); The UNREACHABLE() macro now asserts when reached and also uses __builtin_unreachable(); when such builtin is available in the compiler.
2021-10-11 12:50:17 +02:00
UNREACHABLE();
Hint the compiler with ISC_UNREACHABLE(); that code after INSIST(0); cannot be reached
2018-11-07 15:00:07 +07:00
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
for (;;) {
CHECK(cfg_peektoken(pctx, 0));
if (pctx->token.type == isc_tokentype_string) {
use token.value.as_textregion.base, not token.value.pointer
2002-01-22 19:31:57 +00:00
if (strcasecmp(TOKEN_STRING(pctx), "address") == 0) {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
/* read "address" */
update copyright notice
2008-01-18 23:46:58 +00:00
CHECK(cfg_gettoken(pctx, 0));
1596. [func] Accept 'notify-source' style syntax for query-source.
2004-03-30 02:05:40 +00:00
CHECK(cfg_parse_rawaddr(pctx, *flagp,
use token.value.as_textregion.base, not token.value.pointer
2002-01-22 19:31:57 +00:00
&netaddr));
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
have_address++;
use token.value.as_textregion.base, not token.value.pointer
2002-01-22 19:31:57 +00:00
} else if (strcasecmp(TOKEN_STRING(pctx), "port") == 0)
{
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
/* read "port" */
mark "port" as deprecated for source address options Deprecate the use of "port" when configuring query-source(-v6), transfer-source(-v6), notify-source(-v6), parental-source(-v6), etc. Also deprecate use-{v4,v6}-udp-ports and avoid-{v4,v6}udp-ports.
2023-01-06 17:01:06 -08:00
if ((pctx->flags & CFG_PCTX_NODEPRECATED) == 0)
{
cfg_parser_warning(
pctx, 0,
"token 'port' is deprecated");
}
update copyright notice
2008-01-18 23:46:58 +00:00
CHECK(cfg_gettoken(pctx, 0));
use token.value.as_textregion.base, not token.value.pointer
2002-01-22 19:31:57 +00:00
CHECK(cfg_parse_rawport(pctx, CFG_ADDR_WILDOK,
&port));
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
have_port++;
Add 'tls' configuration support for the 'forwarders' option A 'tls' statement can be specified both for individual addresses and for the whole list (as a default value when an individual address doesn't have its own 'tls' set), just as it was done before for the 'port' value. Create a new function 'print_rawqstring()' to print a string residing in a 'isc_textregion_t' type parameter. Create a new function 'copy_string()' to copy a string from a 'cfg_obj_t' object into a 'isc_textregion_t'.
2022-12-08 10:57:37 +00:00
} else if (strcasecmp(TOKEN_STRING(pctx), "tls") == 0) {
/* We do not expect TLS here, not parsing. */
++have_tls;
} else if (have_port == 0 && have_tls == 0 &&
have_address == 0)
{
1596. [func] Accept 'notify-source' style syntax for query-source.
2004-03-30 02:05:40 +00:00
return (cfg_parse_sockaddr(pctx, type, ret));
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
} else {
cfg_parser_error(pctx, CFG_LOG_NEAR,
remove nonfunctional DSCP implementation DSCP has not been fully working since the network manager was introduced in 9.16, and has been completely broken since 9.18. This seems to have caused very few difficulties for anyone, so we have now marked it as obsolete and removed the implementation. To ensure that old config files don't fail, the code to parse dscp key-value pairs is still present, but a warning is logged that the feature is obsolete and should not be used. Nothing is done with configured values, and there is no longer any range checking.
2023-01-05 22:18:55 -08:00
"expected 'address' "
"or 'port'");
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
return (ISC_R_UNEXPECTEDTOKEN);
}
} else {
break;
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
}
Add 'tls' configuration support for the 'forwarders' option A 'tls' statement can be specified both for individual addresses and for the whole list (as a default value when an individual address doesn't have its own 'tls' set), just as it was done before for the 'port' value. Create a new function 'print_rawqstring()' to print a string residing in a 'isc_textregion_t' type parameter. Create a new function 'copy_string()' to copy a string from a 'cfg_obj_t' object into a 'isc_textregion_t'.
2022-12-08 10:57:37 +00:00
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
if (have_address > 1 || have_port > 1 || have_address + have_port == 0)
{
cfg_parser_error(pctx, 0, "expected one address and/or port");
return (ISC_R_UNEXPECTEDTOKEN);
}
Add 'tls' configuration support for the 'forwarders' option A 'tls' statement can be specified both for individual addresses and for the whole list (as a default value when an individual address doesn't have its own 'tls' set), just as it was done before for the 'port' value. Create a new function 'print_rawqstring()' to print a string residing in a 'isc_textregion_t' type parameter. Create a new function 'copy_string()' to copy a string from a 'cfg_obj_t' object into a 'isc_textregion_t'.
2022-12-08 10:57:37 +00:00
if (have_tls > 0) {
cfg_parser_error(pctx, 0, "unexpected tls");
return (ISC_R_UNEXPECTEDTOKEN);
}
1596. [func] Accept 'notify-source' style syntax for query-source.
2004-03-30 02:05:40 +00:00
CHECK(cfg_create_obj(pctx, &cfg_type_querysource, &obj));
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
isc_sockaddr_fromnetaddr(&obj->value.sockaddr, &netaddr, port);
*ret = obj;
return (ISC_R_SUCCESS);
cleanup:
cfg_parser_error(pctx, CFG_LOG_NEAR, "invalid query source");
CLEANUP_OBJ(obj);
return (result);
}
static void
1991. [cleanup] The configuration data, once read, should be treated as readonly. Expand the use of const to enforce this at compile time. [RT #15813]
2006-02-28 02:39:52 +00:00
print_querysource(cfg_printer_t *pctx, const cfg_obj_t *obj) {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
isc_netaddr_t na;
isc_netaddr_fromsockaddr(&na, &obj->value.sockaddr);
2889. [bug] Element of the grammar where not properly reported. [RT #21046]
2010-05-13 03:16:55 +00:00
cfg_print_cstr(pctx, "address ");
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
cfg_print_rawaddr(pctx, &na);
2889. [bug] Element of the grammar where not properly reported. [RT #21046]
2010-05-13 03:16:55 +00:00
cfg_print_cstr(pctx, " port ");
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
cfg_print_rawuint(pctx, isc_sockaddr_getport(&obj->value.sockaddr));
}
Add doc function for cfg_type_querysource4 and cfg_type_querysource6 (#43768)
2016-12-02 11:16:08 +05:30
static void
doc_querysource(cfg_printer_t *pctx, const cfg_type_t *type) {
const unsigned int *flagp = type->of;
mark "port" as deprecated for source address options Deprecate the use of "port" when configuring query-source(-v6), transfer-source(-v6), notify-source(-v6), parental-source(-v6), etc. Also deprecate use-{v4,v6}-udp-ports and avoid-{v4,v6}udp-ports.
2023-01-06 17:01:06 -08:00
cfg_print_cstr(pctx, "[ address ] ( ");
Turn (int & flag) into (int & flag) != 0 when implicitly typed to bool
2018-10-11 11:57:57 +02:00
if ((*flagp & CFG_ADDR_V4OK) != 0) {
Add doc function for cfg_type_querysource4 and cfg_type_querysource6 (#43768)
2016-12-02 11:16:08 +05:30
cfg_print_cstr(pctx, "<ipv4_address>");
Turn (int & flag) into (int & flag) != 0 when implicitly typed to bool
2018-10-11 11:57:57 +02:00
} else if ((*flagp & CFG_ADDR_V6OK) != 0) {
Add doc function for cfg_type_querysource4 and cfg_type_querysource6 (#43768)
2016-12-02 11:16:08 +05:30
cfg_print_cstr(pctx, "<ipv6_address>");
Turn (int & flag) into (int & flag) != 0 when implicitly typed to bool
2018-10-11 11:57:57 +02:00
} else {
Simplify way we tag unreachable code with only ISC_UNREACHABLE() Previously, the unreachable code paths would have to be tagged with: INSIST(0); ISC_UNREACHABLE(); There was also older parts of the code that used comment annotation: /* NOTREACHED */ Unify the handling of unreachable code paths to just use: UNREACHABLE(); The UNREACHABLE() macro now asserts when reached and also uses __builtin_unreachable(); when such builtin is available in the compiler.
2021-10-11 12:50:17 +02:00
UNREACHABLE();
Turn (int & flag) into (int & flag) != 0 when implicitly typed to bool
2018-10-11 11:57:57 +02:00
}
mark "port" as deprecated for source address options Deprecate the use of "port" when configuring query-source(-v6), transfer-source(-v6), notify-source(-v6), parental-source(-v6), etc. Also deprecate use-{v4,v6}-udp-ports and avoid-{v4,v6}udp-ports.
2023-01-06 17:01:06 -08:00
cfg_print_cstr(pctx, " | * )");
Add doc function for cfg_type_querysource4 and cfg_type_querysource6 (#43768)
2016-12-02 11:16:08 +05:30
}
fully remove DSCP The "dscp" option is now marked as "ancient" and it is a configuration error to use it or to configure DSCP values for any source-address option.
2023-01-09 16:57:41 -08:00
static unsigned int sockaddr4wild_flags = CFG_ADDR_WILDOK | CFG_ADDR_V4OK;
static unsigned int sockaddr6wild_flags = CFG_ADDR_WILDOK | CFG_ADDR_V6OK;
2122. [func] Experimental http server and statistics support for named via xml.
2006-12-21 06:03:37 +00:00
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_querysource4 = {
Add doc function for cfg_type_querysource4 and cfg_type_querysource6 (#43768)
2016-12-02 11:16:08 +05:30
"querysource4", parse_querysource, NULL, doc_querysource,
1596. [func] Accept 'notify-source' style syntax for query-source.
2004-03-30 02:05:40 +00:00
NULL, &sockaddr4wild_flags
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
1596. [func] Accept 'notify-source' style syntax for query-source.
2004-03-30 02:05:40 +00:00
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_querysource6 = {
Add doc function for cfg_type_querysource4 and cfg_type_querysource6 (#43768)
2016-12-02 11:16:08 +05:30
"querysource6", parse_querysource, NULL, doc_querysource,
1596. [func] Accept 'notify-source' style syntax for query-source.
2004-03-30 02:05:40 +00:00
NULL, &sockaddr6wild_flags
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
1596. [func] Accept 'notify-source' style syntax for query-source.
2004-03-30 02:05:40 +00:00
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_querysource = { "querysource", NULL,
1596. [func] Accept 'notify-source' style syntax for query-source.
2004-03-30 02:05:40 +00:00
print_querysource, NULL,
&cfg_rep_sockaddr, NULL };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* The socket address syntax in the "controls" statement is silly.
* It allows both socket address families, but also allows "*",
* which is gratuitously interpreted as the IPv4 wildcard address.
*/
static unsigned int controls_sockaddr_flags = CFG_ADDR_V4OK | CFG_ADDR_V6OK |
mark "port" as deprecated for source address options Deprecate the use of "port" when configuring query-source(-v6), transfer-source(-v6), notify-source(-v6), parental-source(-v6), etc. Also deprecate use-{v4,v6}-udp-ports and avoid-{v4,v6}udp-ports.
2023-01-06 17:01:06 -08:00
CFG_ADDR_WILDOK | CFG_ADDR_PORTOK;
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_controls_sockaddr = {
"controls_sockaddr", cfg_parse_sockaddr, cfg_print_sockaddr,
cfg_doc_sockaddr, &cfg_rep_sockaddr, &controls_sockaddr_flags
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* Handle the special kludge syntax of the "keys" clause in the "server"
* statement, which takes a single key with or without braces and semicolon.
*/
static isc_result_t
3069. [cleanup] Silence warnings messages from clang static analysis. [RT #20256]
2011-03-11 06:11:27 +00:00
parse_server_key_kludge(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
isc_result_t result;
Replace custom isc_boolean_t with C standard bool type
2018-04-17 08:29:14 -07:00
bool braces = false;
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
UNUSED(type);
/* Allow opening brace. */
CHECK(cfg_peektoken(pctx, 0));
if (pctx->token.type == isc_tokentype_special &&
pctx->token.value.as_char == '{')
{
3069. [cleanup] Silence warnings messages from clang static analysis. [RT #20256]
2011-03-11 06:11:27 +00:00
CHECK(cfg_gettoken(pctx, 0));
Replace custom isc_boolean_t with C standard bool type
2018-04-17 08:29:14 -07:00
braces = true;
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
}
CHECK(cfg_parse_obj(pctx, &cfg_type_astring, ret));
if (braces) {
/* Skip semicolon if present. */
CHECK(cfg_peektoken(pctx, 0));
if (pctx->token.type == isc_tokentype_special &&
pctx->token.value.as_char == ';')
{
CHECK(cfg_gettoken(pctx, 0));
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
CHECK(cfg_parse_special(pctx, '}'));
}
cleanup:
return (result);
}
static cfg_type_t cfg_type_server_key_kludge = {
"server_key", parse_server_key_kludge, NULL, cfg_doc_terminal, NULL,
NULL
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* An optional logging facility.
*/
static isc_result_t
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
parse_optional_facility(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
isc_result_t result;
UNUSED(type);
CHECK(cfg_peektoken(pctx, CFG_LEXOPT_QSTRING));
if (pctx->token.type == isc_tokentype_string ||
pctx->token.type == isc_tokentype_qstring)
{
CHECK(cfg_parse_obj(pctx, &cfg_type_astring, ret));
} else {
CHECK(cfg_parse_obj(pctx, &cfg_type_void, ret));
}
cleanup:
return (result);
}
document that the syslog facility is optional
2015-09-18 13:12:50 +10:00
static void
doc_optional_facility(cfg_printer_t *pctx, const cfg_type_t *type) {
UNUSED(type);
cfg_print_cstr(pctx, "[ <syslog_facility> ]");
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_optional_facility = { "optional_facility",
document that the syslog facility is optional
2015-09-18 13:12:50 +10:00
parse_optional_facility,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
NULL,
doc_optional_facility,
NULL,
NULL };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* A log severity. Return as a string, except "debug N",
* which is returned as a keyword object.
*/
static keyword_type_t debug_kw = { "debug", &cfg_type_uint32 };
static cfg_type_t cfg_type_debuglevel = { "debuglevel", parse_keyvalue,
print_keyvalue, doc_keyvalue,
&cfg_rep_uint32, &debug_kw };
static isc_result_t
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
parse_logseverity(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
isc_result_t result;
UNUSED(type);
CHECK(cfg_peektoken(pctx, 0));
if (pctx->token.type == isc_tokentype_string &&
use token.value.as_textregion.base, not token.value.pointer
2002-01-22 19:31:57 +00:00
strcasecmp(TOKEN_STRING(pctx), "debug") == 0)
{
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
CHECK(cfg_gettoken(pctx, 0)); /* read "debug" */
CHECK(cfg_peektoken(pctx, ISC_LEXOPT_NUMBER));
if (pctx->token.type == isc_tokentype_number) {
CHECK(cfg_parse_uint32(pctx, NULL, ret));
} else {
/*
* The debug level is optional and defaults to 1.
* This makes little sense, but we support it for
* compatibility with BIND 8.
*/
CHECK(cfg_create_obj(pctx, &cfg_type_uint32, ret));
(*ret)->value.uint32 = 1;
}
(*ret)->type = &cfg_type_debuglevel; /* XXX kludge */
} else {
CHECK(cfg_parse_obj(pctx, &cfg_type_loglevel, ret));
}
cleanup:
return (result);
}
static cfg_type_t cfg_type_logseverity = { "log_severity", parse_logseverity,
NULL, cfg_doc_terminal,
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
NULL, NULL };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* The "file" clause of the "channel" statement.
* This is yet another special case.
*/
static const char *logversions_enums[] = { "unlimited", NULL };
static isc_result_t
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
parse_logversions(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
return (cfg_parse_enum_or_other(pctx, type, &cfg_type_uint32, ret));
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
}
2344. [bug] Improve "logging{ file ...; };" documentation. [RT #17888]
2008-03-27 03:30:53 +00:00
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
static void
doc_logversions(cfg_printer_t *pctx, const cfg_type_t *type) {
add a parser to filter-aaaa.so and pass in the parameters - make some cfg-parsing functions global so they can be run from filter-aaaa.so - add filter-aaaa options to the hook module's parser - mark filter-aaaa options in named.conf as obsolete, remove from named and checkconf, and update the filter-aaaa test not to use checkconf anymore - remove filter-aaaa-related struct members from dns_view
2018-08-12 23:06:00 -07:00
cfg_doc_enum_or_other(pctx, type, &cfg_type_uint32);
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_logversions = {
4196. [doc] Improve how "enum + other" types are documented. [RT #40608] 4195. [bug] 'max-zone-ttl unlimited;' was broken. [RT #40608]
2015-09-09 17:02:11 +10:00
"logversions", parse_logversions, cfg_print_ustring,
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
doc_logversions, &cfg_rep_string, logversions_enums
};
[master] timestamp suffixes for log files 4579. [func] Logging channels and dnstap output files can now be configured with a "suffix" option, set to either "increment" or "timestamp", indicating whether to use incrementing numbers or timestamps as the file suffix when rolling over a log file. [RT #42838]
2017-03-08 23:20:40 -08:00
static const char *logsuffix_enums[] = { "increment", "timestamp", NULL };
static cfg_type_t cfg_type_logsuffix = { "logsuffix", cfg_parse_enum,
cfg_print_ustring, cfg_doc_enum,
&cfg_rep_string, &logsuffix_enums };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_tuplefielddef_t logfile_fields[] = {
{ "file", &cfg_type_qstring, 0 },
{ "versions", &cfg_type_logversions, 0 },
{ "size", &cfg_type_size, 0 },
[master] timestamp suffixes for log files 4579. [func] Logging channels and dnstap output files can now be configured with a "suffix" option, set to either "increment" or "timestamp", indicating whether to use incrementing numbers or timestamps as the file suffix when rolling over a log file. [RT #42838]
2017-03-08 23:20:40 -08:00
{ "suffix", &cfg_type_logsuffix, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
static isc_result_t
parse_logfile(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
isc_result_t result;
cfg_obj_t *obj = NULL;
update copyright notice
2008-01-18 23:46:58 +00:00
const cfg_tuplefielddef_t *fields = type->of;
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
update copyright notice
2008-01-18 23:46:58 +00:00
CHECK(cfg_create_tuple(pctx, type, &obj));
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
/* Parse the mandatory "file" field */
CHECK(cfg_parse_obj(pctx, fields[0].type, &obj->value.tuple[0]));
/* Parse "versions" and "size" fields in any order. */
for (;;) {
CHECK(cfg_peektoken(pctx, 0));
if (pctx->token.type == isc_tokentype_string) {
update copyright notice
2008-01-18 23:46:58 +00:00
CHECK(cfg_gettoken(pctx, 0));
use token.value.as_textregion.base, not token.value.pointer
2002-01-22 19:31:57 +00:00
if (strcasecmp(TOKEN_STRING(pctx), "versions") == 0 &&
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
obj->value.tuple[1] == NULL)
{
CHECK(cfg_parse_obj(pctx, fields[1].type,
&obj->value.tuple[1]));
use token.value.as_textregion.base, not token.value.pointer
2002-01-22 19:31:57 +00:00
} else if (strcasecmp(TOKEN_STRING(pctx), "size") ==
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
0 &&
obj->value.tuple[2] == NULL)
{
CHECK(cfg_parse_obj(pctx, fields[2].type,
&obj->value.tuple[2]));
[master] timestamp suffixes for log files 4579. [func] Logging channels and dnstap output files can now be configured with a "suffix" option, set to either "increment" or "timestamp", indicating whether to use incrementing numbers or timestamps as the file suffix when rolling over a log file. [RT #42838]
2017-03-08 23:20:40 -08:00
} else if (strcasecmp(TOKEN_STRING(pctx), "suffix") ==
0 &&
obj->value.tuple[3] == NULL)
{
CHECK(cfg_parse_obj(pctx, fields[3].type,
&obj->value.tuple[3]));
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
} else {
break;
}
} else {
break;
}
}
/* Create void objects for missing optional values. */
if (obj->value.tuple[1] == NULL) {
CHECK(cfg_parse_void(pctx, NULL, &obj->value.tuple[1]));
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
if (obj->value.tuple[2] == NULL) {
CHECK(cfg_parse_void(pctx, NULL, &obj->value.tuple[2]));
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
[master] timestamp suffixes for log files 4579. [func] Logging channels and dnstap output files can now be configured with a "suffix" option, set to either "increment" or "timestamp", indicating whether to use incrementing numbers or timestamps as the file suffix when rolling over a log file. [RT #42838]
2017-03-08 23:20:40 -08:00
if (obj->value.tuple[3] == NULL) {
CHECK(cfg_parse_void(pctx, NULL, &obj->value.tuple[3]));
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
*ret = obj;
return (ISC_R_SUCCESS);
cleanup:
update copyright notice
2008-01-18 23:46:58 +00:00
CLEANUP_OBJ(obj);
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
return (result);
}
static void
1991. [cleanup] The configuration data, once read, should be treated as readonly. Expand the use of const to enforce this at compile time. [RT #15813]
2006-02-28 02:39:52 +00:00
print_logfile(cfg_printer_t *pctx, const cfg_obj_t *obj) {
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
cfg_print_obj(pctx, obj->value.tuple[0]); /* file */
if (obj->value.tuple[1]->type->print != cfg_print_void) {
2889. [bug] Element of the grammar where not properly reported. [RT #21046]
2010-05-13 03:16:55 +00:00
cfg_print_cstr(pctx, " versions ");
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
cfg_print_obj(pctx, obj->value.tuple[1]);
}
if (obj->value.tuple[2]->type->print != cfg_print_void) {
2889. [bug] Element of the grammar where not properly reported. [RT #21046]
2010-05-13 03:16:55 +00:00
cfg_print_cstr(pctx, " size ");
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
cfg_print_obj(pctx, obj->value.tuple[2]);
}
[master] timestamp suffixes for log files 4579. [func] Logging channels and dnstap output files can now be configured with a "suffix" option, set to either "increment" or "timestamp", indicating whether to use incrementing numbers or timestamps as the file suffix when rolling over a log file. [RT #42838]
2017-03-08 23:20:40 -08:00
if (obj->value.tuple[3]->type->print != cfg_print_void) {
cfg_print_cstr(pctx, " suffix ");
cfg_print_obj(pctx, obj->value.tuple[3]);
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
}
2344. [bug] Improve "logging{ file ...; };" documentation. [RT #17888]
2008-03-27 03:30:53 +00:00
static void
doc_logfile(cfg_printer_t *pctx, const cfg_type_t *type) {
UNUSED(type);
cfg_print_cstr(pctx, "<quoted_string>");
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ");
[master] timestamp suffixes for log files 4579. [func] Logging channels and dnstap output files can now be configured with a "suffix" option, set to either "increment" or "timestamp", indicating whether to use incrementing numbers or timestamps as the file suffix when rolling over a log file. [RT #42838]
2017-03-08 23:20:40 -08:00
cfg_print_cstr(pctx, "[ versions ( unlimited | <integer> ) ]");
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ");
2344. [bug] Improve "logging{ file ...; };" documentation. [RT #17888]
2008-03-27 03:30:53 +00:00
cfg_print_cstr(pctx, "[ size <size> ]");
[master] timestamp suffixes for log files 4579. [func] Logging channels and dnstap output files can now be configured with a "suffix" option, set to either "increment" or "timestamp", indicating whether to use incrementing numbers or timestamps as the file suffix when rolling over a log file. [RT #42838]
2017-03-08 23:20:40 -08:00
cfg_print_cstr(pctx, " ");
cfg_print_cstr(pctx, "[ suffix ( increment | timestamp ) ]");
2344. [bug] Improve "logging{ file ...; };" documentation. [RT #17888]
2008-03-27 03:30:53 +00:00
}
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_logfile = { "log_file", parse_logfile,
2344. [bug] Improve "logging{ file ...; };" documentation. [RT #17888]
2008-03-27 03:30:53 +00:00
print_logfile, doc_logfile,
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
&cfg_rep_tuple, logfile_fields };
mark "port" as deprecated for source address options Deprecate the use of "port" when configuring query-source(-v6), transfer-source(-v6), notify-source(-v6), parental-source(-v6), etc. Also deprecate use-{v4,v6}-udp-ports and avoid-{v4,v6}udp-ports.
2023-01-06 17:01:06 -08:00
/*% An IPv4 address, "*" accepted as wildcard. */
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_sockaddr4wild = {
"sockaddr4wild", cfg_parse_sockaddr, cfg_print_sockaddr,
cfg_doc_sockaddr, &cfg_rep_sockaddr, &sockaddr4wild_flags
};
mark "port" as deprecated for source address options Deprecate the use of "port" when configuring query-source(-v6), transfer-source(-v6), notify-source(-v6), parental-source(-v6), etc. Also deprecate use-{v4,v6}-udp-ports and avoid-{v4,v6}udp-ports.
2023-01-06 17:01:06 -08:00
/*% An IPv6 address, "*" accepted as wildcard. */
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_type_t cfg_type_sockaddr6wild = {
1515. [func] Allow transfer source to be set in a server statement. [RT #6496] implemented by marka, reviewed and documented by jinmei. Notes: lib/dns/zone.c had to be modified manually. ARM html files were not regenerated (yet).
2003-09-25 18:16:50 +00:00
"v6addrportwild", cfg_parse_sockaddr, cfg_print_sockaddr,
cfg_doc_sockaddr, &cfg_rep_sockaddr, &sockaddr6wild_flags
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
Add new 'source[-v6]' option for remote servers Add a new way to configure the preferred source address when talking to remote servers such as primaries and parental-agents. This will eventually deprecate options such as 'parental-source', 'parental-source-v6', 'transfer-source', etc. Example of the new configuration: parental-agents "parents" port 5353 \ source 10.10.10.10 port 5354 dscp 54 \ source-v6 2001:db8::10 port 5355 dscp 55 { 10.10.10.11; 2001:db8::11; };
2022-12-13 17:28:19 +01:00
static keyword_type_t sourceaddr4_kw = { "source", &cfg_type_sockaddr4wild };
static cfg_type_t cfg_type_optional_sourceaddr4 = {
"optional_sourceaddr4", parse_optional_keyvalue, print_keyvalue,
doc_optional_keyvalue, &cfg_rep_sockaddr, &sourceaddr4_kw
};
static keyword_type_t sourceaddr6_kw = { "source-v6", &cfg_type_sockaddr6wild };
static cfg_type_t cfg_type_optional_sourceaddr6 = {
"optional_sourceaddr6", parse_optional_keyvalue, print_keyvalue,
doc_optional_keyvalue, &cfg_rep_sockaddr, &sourceaddr6_kw
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
* rndc
*/
static cfg_clausedef_t rndcconf_options_clauses[] = {
{ "default-key", &cfg_type_astring, 0 },
{ "default-port", &cfg_type_uint32, 0 },
1680. [func] rndc: the source address can now be specified.
2004-07-23 04:15:27 +00:00
{ "default-server", &cfg_type_astring, 0 },
{ "default-source-address", &cfg_type_netaddr4wild, 0 },
{ "default-source-address-v6", &cfg_type_netaddr6wild, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
static cfg_clausedef_t *rndcconf_options_clausesets[] = {
rndcconf_options_clauses, NULL
};
static cfg_type_t cfg_type_rndcconf_options = {
1680. [func] rndc: the source address can now be specified.
2004-07-23 04:15:27 +00:00
"rndcconf_options", cfg_parse_map, cfg_print_map,
cfg_doc_map, &cfg_rep_map, rndcconf_options_clausesets
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
static cfg_clausedef_t rndcconf_server_clauses[] = {
{ "key", &cfg_type_astring, 0 },
{ "port", &cfg_type_uint32, 0 },
1680. [func] rndc: the source address can now be specified.
2004-07-23 04:15:27 +00:00
{ "source-address", &cfg_type_netaddr4wild, 0 },
{ "source-address-v6", &cfg_type_netaddr6wild, 0 },
1666. [bug] The optional port on hostnames in dual-stack-servers was being ignored. 1665. [func] rndc now allows addresses to be set in the server clauses.
2004-06-18 04:38:47 +00:00
{ "addresses", &cfg_type_bracketed_sockaddrnameportlist, 0 },
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
{ NULL, NULL, 0 }
};
static cfg_clausedef_t *rndcconf_server_clausesets[] = {
rndcconf_server_clauses, NULL
};
static cfg_type_t cfg_type_rndcconf_server = {
1680. [func] rndc: the source address can now be specified.
2004-07-23 04:15:27 +00:00
"rndcconf_server", cfg_parse_named_map, cfg_print_map,
cfg_doc_map, &cfg_rep_map, rndcconf_server_clausesets
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
};
static cfg_clausedef_t rndcconf_clauses[] = {
{ "key", &cfg_type_key, CFG_CLAUSEFLAG_MULTI },
{ "server", &cfg_type_rndcconf_server, CFG_CLAUSEFLAG_MULTI },
{ "options", &cfg_type_rndcconf_options, 0 },
{ NULL, NULL, 0 }
};
static cfg_clausedef_t *rndcconf_clausesets[] = { rndcconf_clauses, NULL };
Remove LIB<*>_EXTERNAL_DATA defines After Windows has been removed, the LIB<*>_EXTERNAL_DATA defines were just dummy leftovers. Remove them.
2021-06-10 08:06:48 +02:00
cfg_type_t cfg_type_rndcconf = { "rndcconf", cfg_parse_mapbody,
cfg_print_mapbody, cfg_doc_mapbody,
&cfg_rep_map, rndcconf_clausesets };
Split off the named.conf grammar into a source module separate from the configuration parser, to facilitate reuse of the latter for parsing non-BIND configuration files
2002-01-04 02:32:16 +00:00
static cfg_clausedef_t rndckey_clauses[] = { { "key", &cfg_type_key, 0 },
{ NULL, NULL, 0 } };
static cfg_clausedef_t *rndckey_clausesets[] = { rndckey_clauses, NULL };
Remove LIB<*>_EXTERNAL_DATA defines After Windows has been removed, the LIB<*>_EXTERNAL_DATA defines were just dummy leftovers. Remove them.
2021-06-10 08:06:48 +02:00
cfg_type_t cfg_type_rndckey = { "rndckey", cfg_parse_mapbody,
cfg_print_mapbody, cfg_doc_mapbody,
&cfg_rep_map, rndckey_clausesets };
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
2609. [func] Simplify the configuration of dynamic zones: - add ddns-confgen command to generate configuration text for named.conf - add zone option "ddns-autoconf yes;", which causes named to generate a TSIG session key and allow updates to the zone using that key - add '-l' (localhost) option to nsupdate, which causes nsupdate to connect to a locally-running named process using the session key generated by named [RT #19284]
2009-06-10 00:27:22 +00:00
/*
2630. [func] Improved syntax for DDNS autoconfiguration: use "update-policy local;" to switch on local DDNS in a zone. [RT #19875]
2009-07-14 22:54:57 +00:00
* session.key has exactly the same syntax as rndc.key, but it's defined
2609. [func] Simplify the configuration of dynamic zones: - add ddns-confgen command to generate configuration text for named.conf - add zone option "ddns-autoconf yes;", which causes named to generate a TSIG session key and allow updates to the zone using that key - add '-l' (localhost) option to nsupdate, which causes nsupdate to connect to a locally-running named process using the session key generated by named [RT #19284]
2009-06-10 00:27:22 +00:00
* separately for clarity (and so we can extend it someday, if needed).
*/
Remove LIB<*>_EXTERNAL_DATA defines After Windows has been removed, the LIB<*>_EXTERNAL_DATA defines were just dummy leftovers. Remove them.
2021-06-10 08:06:48 +02:00
cfg_type_t cfg_type_sessionkey = { "sessionkey", cfg_parse_mapbody,
cfg_print_mapbody, cfg_doc_mapbody,
&cfg_rep_map, rndckey_clausesets };
2609. [func] Simplify the configuration of dynamic zones: - add ddns-confgen command to generate configuration text for named.conf - add zone option "ddns-autoconf yes;", which causes named to generate a TSIG session key and allow updates to the zone using that key - add '-l' (localhost) option to nsupdate, which causes nsupdate to connect to a locally-running named process using the session key generated by named [RT #19284]
2009-06-10 00:27:22 +00:00
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
static cfg_tuplefielddef_t nameport_fields[] = {
{ "name", &cfg_type_astring, 0 },
{ "port", &cfg_type_optional_port, 0 },
{ NULL, NULL, 0 }
};
[master] add DSCP support 3535. [func] Add support for setting Differentiated Services Code Point (DSCP) values in named. Most configuration options which take a "port" option (e.g., listen-on, forwarders, also-notify, masters, notify-source, etc) can now also take a "dscp" option specifying a code point for use with outgoing traffic, if supported by the underlying OS. [RT #27596]
2013-03-22 12:27:54 -07:00
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
static cfg_type_t cfg_type_nameport = { "nameport", cfg_parse_tuple,
cfg_print_tuple, cfg_doc_tuple,
&cfg_rep_tuple, nameport_fields };
static void
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
doc_sockaddrnameport(cfg_printer_t *pctx, const cfg_type_t *type) {
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
UNUSED(type);
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, "( ");
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
cfg_print_cstr(pctx, "<quoted_string>");
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ");
2344. [bug] Improve "logging{ file ...; };" documentation. [RT #17888]
2008-03-27 03:30:53 +00:00
cfg_print_cstr(pctx, "[ port <integer> ]");
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " | ");
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
cfg_print_cstr(pctx, "<ipv4_address>");
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ");
2344. [bug] Improve "logging{ file ...; };" documentation. [RT #17888]
2008-03-27 03:30:53 +00:00
cfg_print_cstr(pctx, "[ port <integer> ]");
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " | ");
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
cfg_print_cstr(pctx, "<ipv6_address>");
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ");
2344. [bug] Improve "logging{ file ...; };" documentation. [RT #17888]
2008-03-27 03:30:53 +00:00
cfg_print_cstr(pctx, "[ port <integer> ]");
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " )");
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
}
static isc_result_t
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
parse_sockaddrnameport(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
update copyright notice
2008-01-18 23:46:58 +00:00
isc_result_t result;
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
cfg_obj_t *obj = NULL;
UNUSED(type);
CHECK(cfg_peektoken(pctx, CFG_LEXOPT_QSTRING));
if (pctx->token.type == isc_tokentype_string ||
pctx->token.type == isc_tokentype_qstring)
{
if (cfg_lookingat_netaddr(pctx, CFG_ADDR_V4OK | CFG_ADDR_V6OK))
{
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
CHECK(cfg_parse_sockaddr(pctx, &cfg_type_sockaddr,
ret));
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
} else {
const cfg_tuplefielddef_t *fields =
update copyright notice
2008-01-18 23:46:58 +00:00
cfg_type_nameport.of;
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
CHECK(cfg_create_tuple(pctx, &cfg_type_nameport, &obj));
CHECK(cfg_parse_obj(pctx, fields[0].type,
&obj->value.tuple[0]));
CHECK(cfg_parse_obj(pctx, fields[1].type,
&obj->value.tuple[1]));
[master] add DSCP support 3535. [func] Add support for setting Differentiated Services Code Point (DSCP) values in named. Most configuration options which take a "port" option (e.g., listen-on, forwarders, also-notify, masters, notify-source, etc) can now also take a "dscp" option specifying a code point for use with outgoing traffic, if supported by the underlying OS. [RT #27596]
2013-03-22 12:27:54 -07:00
CHECK(cfg_parse_obj(pctx, fields[2].type,
&obj->value.tuple[2]));
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
*ret = obj;
obj = NULL;
}
} else {
cfg_parser_error(pctx, CFG_LOG_NEAR,
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
"expected IP address or hostname");
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
return (ISC_R_UNEXPECTEDTOKEN);
}
cleanup:
update copyright notice
2008-01-18 23:46:58 +00:00
CLEANUP_OBJ(obj);
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
return (result);
}
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
static cfg_type_t cfg_type_sockaddrnameport = { "sockaddrnameport_element",
parse_sockaddrnameport,
NULL,
doc_sockaddrnameport,
NULL,
NULL };
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
static cfg_type_t cfg_type_bracketed_sockaddrnameportlist = {
"bracketed_sockaddrnameportlist",
cfg_parse_bracketed_list,
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
cfg_print_bracketed_list,
cfg_doc_bracketed_list,
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
&cfg_rep_list,
&cfg_type_sockaddrnameport
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
};
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
* A list of socket addresses or name with an optional default port,
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
* as used in the dual-stack-servers option. E.g.,
* "port 1234 { dual-stack-servers.net; 10.0.0.1; 1::2 port 69; }"
*/
static cfg_tuplefielddef_t nameportiplist_fields[] = {
{ "port", &cfg_type_optional_port, 0 },
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
{ "addresses", &cfg_type_bracketed_sockaddrnameportlist, 0 },
1412. [func] You can now specify servers to be tried if a nameserver has IPv6 address and you only support IPv4 or the reverse. See dual-stack-servers.
2003-01-16 03:59:28 +00:00
{ NULL, NULL, 0 }
};
static cfg_type_t cfg_type_nameportiplist = {
"nameportiplist", cfg_parse_tuple, cfg_print_tuple,
cfg_doc_tuple, &cfg_rep_tuple, nameportiplist_fields
};
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
1851. [doc] Doxygen comment markup. [RT #11398]
2005-04-27 04:57:32 +00:00
/*%
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
* remote servers element.
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
*/
static void
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
doc_remoteselement(cfg_printer_t *pctx, const cfg_type_t *type) {
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
UNUSED(type);
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, "( ");
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
cfg_print_cstr(pctx, "<remote-servers>");
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " | ");
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
cfg_print_cstr(pctx, "<ipv4_address>");
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ");
2344. [bug] Improve "logging{ file ...; };" documentation. [RT #17888]
2008-03-27 03:30:53 +00:00
cfg_print_cstr(pctx, "[ port <integer> ]");
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " | ");
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
cfg_print_cstr(pctx, "<ipv6_address>");
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " ");
2344. [bug] Improve "logging{ file ...; };" documentation. [RT #17888]
2008-03-27 03:30:53 +00:00
cfg_print_cstr(pctx, "[ port <integer> ]");
[master] rndc showzone / rndc delzone of non-added zones 4030. [func] "rndc delzone" is now applicable to zones that were configured in named.conf, as well as zones that were added via "rndc addzone". (Note, however, that if named.conf is not also modified, the deleted zone will return when named is reloaded.) [RT #37887] 4029. [func] "rndc showzone" displays the current configuration of a specified zone. [RT #37887]
2015-01-06 22:57:57 -08:00
cfg_print_cstr(pctx, " )");
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
}
static isc_result_t
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
parse_remoteselement(cfg_parser_t *pctx, const cfg_type_t *type,
cfg_obj_t **ret) {
update copyright notice
2008-01-18 23:46:58 +00:00
isc_result_t result;
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
cfg_obj_t *obj = NULL;
UNUSED(type);
CHECK(cfg_peektoken(pctx, CFG_LEXOPT_QSTRING));
if (pctx->token.type == isc_tokentype_string ||
pctx->token.type == isc_tokentype_qstring)
{
if (cfg_lookingat_netaddr(pctx, CFG_ADDR_V4OK | CFG_ADDR_V6OK))
{
4520. [cleanup] Alphabetise more of the grammar when printing it out. Fix unbalanced indenting. [RT #43755]
2016-11-29 15:28:28 +11:00
CHECK(cfg_parse_sockaddr(pctx, &cfg_type_sockaddr,
ret));
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
} else {
CHECK(cfg_parse_astring(pctx, &cfg_type_astring, ret));
Use clang-tidy to add curly braces around one-line statements The command used to reformat the files in this commit was: ./util/run-clang-tidy \ -clang-tidy-binary clang-tidy-11 -clang-apply-replacements-binary clang-apply-replacements-11 \ -checks=-*,readability-braces-around-statements \ -j 9 \ -fix \ -format \ -style=file \ -quiet clang-format -i --style=format $(git ls-files '*.c' '*.h') uncrustify -c .uncrustify.cfg --replace --no-backup $(git ls-files '*.c' '*.h') clang-format -i --style=format $(git ls-files '*.c' '*.h')
2020-02-13 21:48:23 +01:00
}
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
} else {
cfg_parser_error(pctx, CFG_LOG_NEAR,
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
"expected IP address or remote servers list "
"name");
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
return (ISC_R_UNEXPECTEDTOKEN);
}
cleanup:
update copyright notice
2008-01-18 23:46:58 +00:00
CLEANUP_OBJ(obj);
1443. [func] Masters lists can now be specified and referenced in zone masters clauses and other masters lists. developer: marka reviewer: explorer
2003-02-26 06:04:03 +00:00
return (result);
}
Change primaries objects to remote-servers Change the primaries configuration objects to the more generic remote-servers, that we can reuse for other purposes (such as parental-agents).
2021-05-07 11:31:15 +02:00
static cfg_type_t cfg_type_remoteselement = { "remotes_element",
parse_remoteselement,
NULL,
doc_remoteselement,
NULL,
NULL };
[master] max-zone-ttl 3746. [func] New "max-zone-ttl" option enforces maximum TTLs for zones. If loading a zone containing a higher TTL, the load fails. DDNS updates with higher TTLs are accepted but the TTL is truncated. (Note: Currently supported for master zones only; inline-signing slaves will be added.) [RT #38405]
2014-02-18 23:26:50 -08:00
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
static int
cmp_clause(const void *ap, const void *bp) {
const cfg_clausedef_t *a = (const cfg_clausedef_t *)ap;
const cfg_clausedef_t *b = (const cfg_clausedef_t *)bp;
return (strcmp(a->name, b->name));
}
Replace custom isc_boolean_t with C standard bool type
2018-04-17 08:29:14 -07:00
bool
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
cfg_clause_validforzone(const char *name, unsigned int ztype) {
const cfg_clausedef_t *clause;
Replace custom isc_boolean_t with C standard bool type
2018-04-17 08:29:14 -07:00
bool valid = false;
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
for (clause = zone_clauses; clause->name != NULL; clause++) {
if ((clause->flags & ztype) == 0 ||
Update sources to Clang 15 formatting
2022-11-02 19:33:14 +01:00
strcmp(clause->name, name) != 0)
{
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
continue;
}
Replace custom isc_boolean_t with C standard bool type
2018-04-17 08:29:14 -07:00
valid = true;
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
}
for (clause = zone_only_clauses; clause->name != NULL; clause++) {
if ((clause->flags & ztype) == 0 ||
Update sources to Clang 15 formatting
2022-11-02 19:33:14 +01:00
strcmp(clause->name, name) != 0)
{
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
continue;
}
Replace custom isc_boolean_t with C standard bool type
2018-04-17 08:29:14 -07:00
valid = true;
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
}
return (valid);
}
void
update docbook grammar, removing dnssec-looksaide - this required modification to the code that generates grammar text for the documentation, because the "dnssec-lookaside" option spanned more than one line in doc/misc/options, so grepping out only the lines marked "// obsolete" didn't remove the whole option. this commit adds an option to cfg_test to print named.conf clauses only if they don't have the obsolete, ancient, test-only, or not-yet-implemented flags set.
2019-08-07 10:31:19 -07:00
cfg_print_zonegrammar(const unsigned int zonetype, unsigned int flags,
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
void (*f)(void *closure, const char *text, int textlen),
void *closure) {
#define NCLAUSES \
(((sizeof(zone_clauses) + sizeof(zone_only_clauses)) / \
sizeof(clause[0])) - \
1)
cfg_printer_t pctx;
cfg_clausedef_t *clause = NULL;
cfg_clausedef_t clauses[NCLAUSES];
pctx.f = f;
pctx.closure = closure;
pctx.indent = 0;
update docbook grammar, removing dnssec-looksaide - this required modification to the code that generates grammar text for the documentation, because the "dnssec-lookaside" option spanned more than one line in doc/misc/options, so grepping out only the lines marked "// obsolete" didn't remove the whole option. this commit adds an option to cfg_test to print named.conf clauses only if they don't have the obsolete, ancient, test-only, or not-yet-implemented flags set.
2019-08-07 10:31:19 -07:00
pctx.flags = flags;
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
memmove(clauses, zone_clauses, sizeof(zone_clauses));
memmove(clauses + sizeof(zone_clauses) / sizeof(zone_clauses[0]) - 1,
zone_only_clauses, sizeof(zone_only_clauses));
qsort(clauses, NCLAUSES - 1, sizeof(clause[0]), cmp_clause);
cfg_print_cstr(&pctx, "zone <string> [ <class> ] {\n");
pctx.indent++;
switch (zonetype) {
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
case CFG_ZONE_PRIMARY:
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
cfg_print_indent(&pctx);
remove old zone type documentation we now document zone type as either "primary" or "secondary", omitting the old terms (though they are still accepted).
2022-02-23 17:18:38 -08:00
cfg_print_cstr(&pctx, "type primary;\n");
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
break;
change CFG_ZONE_MASTER and CFG_ZONE_SLAVE these values have been renamed as CFG_ZONE_PRIMARY and CFG_ZONE_SECONDARY.
2021-08-25 22:31:18 -07:00
case CFG_ZONE_SECONDARY:
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
cfg_print_indent(&pctx);
remove old zone type documentation we now document zone type as either "primary" or "secondary", omitting the old terms (though they are still accepted).
2022-02-23 17:18:38 -08:00
cfg_print_cstr(&pctx, "type secondary;\n");
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
break;
Handle "type mirror;" when parsing zone configuration Add a new zone type, CFG_ZONE_MIRROR, to libisccfg, in order to limit the list of options which are considered valid for mirror zones. Update the relevant configuration checks.
2018-10-09 10:54:51 +02:00
case CFG_ZONE_MIRROR:
cfg_print_indent(&pctx);
cfg_print_cstr(&pctx, "type mirror;\n");
break;
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
case CFG_ZONE_STUB:
cfg_print_indent(&pctx);
cfg_print_cstr(&pctx, "type stub;\n");
break;
case CFG_ZONE_HINT:
cfg_print_indent(&pctx);
cfg_print_cstr(&pctx, "type hint;\n");
break;
case CFG_ZONE_FORWARD:
cfg_print_indent(&pctx);
cfg_print_cstr(&pctx, "type forward;\n");
break;
case CFG_ZONE_STATICSTUB:
cfg_print_indent(&pctx);
cfg_print_cstr(&pctx, "type static-stub;\n");
break;
case CFG_ZONE_REDIRECT:
cfg_print_indent(&pctx);
cfg_print_cstr(&pctx, "type redirect;\n");
break;
case CFG_ZONE_INVIEW:
/* no zone type is specified for these */
break;
default:
Simplify way we tag unreachable code with only ISC_UNREACHABLE() Previously, the unreachable code paths would have to be tagged with: INSIST(0); ISC_UNREACHABLE(); There was also older parts of the code that used comment annotation: /* NOTREACHED */ Unify the handling of unreachable code paths to just use: UNREACHABLE(); The UNREACHABLE() macro now asserts when reached and also uses __builtin_unreachable(); when such builtin is available in the compiler.
2021-10-11 12:50:17 +02:00
UNREACHABLE();
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
}
for (clause = clauses; clause->name != NULL; clause++) {
update docbook grammar, removing dnssec-looksaide - this required modification to the code that generates grammar text for the documentation, because the "dnssec-lookaside" option spanned more than one line in doc/misc/options, so grepping out only the lines marked "// obsolete" didn't remove the whole option. this commit adds an option to cfg_test to print named.conf clauses only if they don't have the obsolete, ancient, test-only, or not-yet-implemented flags set.
2019-08-07 10:31:19 -07:00
if (((pctx.flags & CFG_PRINTER_ACTIVEONLY) != 0) &&
(((clause->flags & CFG_CLAUSEFLAG_OBSOLETE) != 0) ||
((clause->flags & CFG_CLAUSEFLAG_TESTONLY) != 0)))
{
continue;
}
add a CFG_CLAUSEFLAG_NODOC flag for use with outdated terms "masters" and "default-masters" are now flagged so they will not be included in the named.conf man page, despite being accepted as valid options by the parser for backward compatibiility.
2022-02-25 16:33:30 -08:00
if ((clause->flags & CFG_CLAUSEFLAG_ANCIENT) != 0 ||
(clause->flags & CFG_CLAUSEFLAG_NODOC) != 0)
{
Remove a lot of obsoleted options These options were ancient or made obsolete a long time ago, it is safe to remove them. Also stop printing ancient options, they should be treated the same as unknown options. Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr, acache-cleaning-interval, acache-enable, additional-from-auth, additional-from-cache, allow-v6-synthesis, dnssec-enable, max-acache-size, nosit-udp-size, queryport-pool-ports, queryport-pool-updateinterval, request-sit, use-queryport-pool, and support-ixfr.
2020-12-08 15:08:32 +01:00
continue;
}
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
if ((clause->flags & zonetype) == 0 ||
Update sources to Clang 15 formatting
2022-11-02 19:33:14 +01:00
strcasecmp(clause->name, "type") == 0)
{
[master] automatically generate named.conf grammars for the ARM 4873. [doc] Grammars for named.conf included in the ARM are now automatically generated by the configuration parser itself. As a side effect of the work needed to separate zone type grammars from each other, this also makes checking of zone statements in named-checkconf more correct and consistent. [RT #36957]
2018-01-22 11:00:45 -08:00
continue;
}
cfg_print_indent(&pctx);
cfg_print_cstr(&pctx, clause->name);
cfg_print_cstr(&pctx, " ");
cfg_doc_obj(&pctx, clause->type);
cfg_print_cstr(&pctx, ";");
cfg_print_clauseflags(&pctx, clause->flags);
cfg_print_cstr(&pctx, "\n");
}
pctx.indent--;
cfg_print_cstr(&pctx, "};\n");
}
add parser support for TLS configuration options This commit adds stub parser support and tests for: - "tls" statement, specifying key and cert. - an optional "tls" keyvalue in listen-on statements for DoT configuration. Documentation for these options has also been added to the ARM, but needs further work.
2020-09-16 12:21:32 -07:00
/*%
* "tls" and related statement syntax.
*/
Add "protocols" options to the "tls" clause This commit adds the ability to specify allowed TLS protocols versions within the "tls" clause. If an unsupported TLS protocol version is specified in a file, the configuration file will not pass verification. Also, this commit adds strict checks for "tls" clauses verification, in particular: - it ensures that loading configuration files containing duplicated "tls" clauses is not allowed; - it ensures that loading configuration files containing "tls" clauses missing "cert-file" or "key-file" is not allowed; - it ensures that loading configuration files containing "tls" clauses named as "ephemeral" or "none" is not allowed.
2021-09-13 15:39:36 +03:00
static cfg_type_t cfg_type_tlsprotos = { "tls_protocols",
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_astring };
add parser support for TLS configuration options This commit adds stub parser support and tests for: - "tls" statement, specifying key and cert. - an optional "tls" keyvalue in listen-on statements for DoT configuration. Documentation for these options has also been added to the ARM, but needs further work.
2020-09-16 12:21:32 -07:00
static cfg_clausedef_t tls_clauses[] = {
{ "key-file", &cfg_type_qstring, 0 },
{ "cert-file", &cfg_type_qstring, 0 },
implement xfrin via XoT Add support for a "tls" key/value pair for zone primaries, referencing either a "tls" configuration statement or "ephemeral". If set to use TLS, zones will send SOA and AXFR/IXFR queries over a TLS channel.
2021-01-14 12:51:25 +01:00
{ "ca-file", &cfg_type_qstring, 0 },
Rename "hostname" to "remote-hostname" within "tls" This commit renames "hostname" to "remote-hostname" within "tls" options to avoid semantic conflicts with generic "options" configuration.
2022-05-03 16:51:33 +03:00
{ "remote-hostname", &cfg_type_qstring, 0 },
DH-parameters loading support This commit adds support for loading DH-parameters (Diffie-Hellman parameters) via the new "dhparam-file" option within "tls" clause. In particular, Diffie-Hellman parameters are needed to enable the range of forward-secrecy enabled cyphers for TLSv1.2, which are getting silently disabled otherwise.
2021-09-16 14:48:30 +03:00
{ "dhparam-file", &cfg_type_qstring, 0 },
Add "protocols" options to the "tls" clause This commit adds the ability to specify allowed TLS protocols versions within the "tls" clause. If an unsupported TLS protocol version is specified in a file, the configuration file will not pass verification. Also, this commit adds strict checks for "tls" clauses verification, in particular: - it ensures that loading configuration files containing duplicated "tls" clauses is not allowed; - it ensures that loading configuration files containing "tls" clauses missing "cert-file" or "key-file" is not allowed; - it ensures that loading configuration files containing "tls" clauses named as "ephemeral" or "none" is not allowed.
2021-09-13 15:39:36 +03:00
{ "protocols", &cfg_type_tlsprotos, 0 },
Add "ciphers" options to the "tls" clause This commit adds support for setting TLS cipher list string in the format specified in the OpenSSL documentation (https://www.openssl.org/docs/man1.1.1/man1/ciphers.html). The syntax of the cipher list is verified so that specifying the wrong string will prevent the configuration from being loaded.
2021-09-20 14:25:59 +03:00
{ "ciphers", &cfg_type_astring, 0 },
Add "prefer-server-ciphers" options to the "tls" clause This commit adds support for enforcing the preference of server ciphers over the client ones. This way, the server attains control over the ciphers priority and, thus, can choose more strong cyphers when a client prioritises less strong ciphers over the more strong ones, which is beneficial when trying to achieve Perfect Forward Secrecy.
2021-09-20 16:53:27 +03:00
{ "prefer-server-ciphers", &cfg_type_boolean, 0 },
Add "session-tickets" options to the "tls" clause This commit adds the ability to enable or disable stateless TLS session resumption tickets (see RFC5077). Having this ability is twofold. Firstly, these tickets are encrypted by the server, and the algorithm might be weaker than the algorithm negotiated during the TLS session establishment (it is in general the case for TLSv1.2, but the generic principle applies to TLSv1.3 as well, despite it having better ciphers for session tickets). Thus, they might compromise Perfect Forward Secrecy. Secondly, disabling it might be necessary if the same TLS key/cert pair is supposed to be used by multiple servers to achieve, e.g., load balancing because the session ticket by default gets generated in runtime, while to achieve successful session resumption ability, in this case, would have required using a shared key. The proper alternative to having the ability to disable stateless TLS session resumption tickets is to implement a proper session tickets key rollover mechanism so that key rotation might be performed often (e.g. once an hour) to not compromise forward secrecy while retaining the associated performance benefits. That is much more work, though. On the other hand, having the ability to disable session tickets allows having a deployable configuration right now in the cases when either forward secrecy is wanted or sharing the TLS key/cert pair between multiple servers is needed (or both).
2021-09-21 14:09:56 +03:00
{ "session-tickets", &cfg_type_boolean, 0 },
add parser support for TLS configuration options This commit adds stub parser support and tests for: - "tls" statement, specifying key and cert. - an optional "tls" keyvalue in listen-on statements for DoT configuration. Documentation for these options has also been added to the ARM, but needs further work.
2020-09-16 12:21:32 -07:00
{ NULL, NULL, 0 }
};
static cfg_clausedef_t *tls_clausesets[] = { tls_clauses, NULL };
static cfg_type_t cfg_type_tlsconf = { "tlsconf", cfg_parse_named_map,
cfg_print_map, cfg_doc_map,
&cfg_rep_map, tls_clausesets };
static keyword_type_t tls_kw = { "tls", &cfg_type_astring };
static cfg_type_t cfg_type_optional_tls = {
"tlsoptional", parse_optional_keyvalue, print_keyvalue,
doc_optional_keyvalue, &cfg_rep_string, &tls_kw
};
Add parser support for DoH configuration options This commit adds stub parser support and tests for: - an "http" global option for HTTP/2 endpoint configuration. - command line options to set http or https port numbers by specifying -p http=PORT or -p https=PORT. (NOTE: this change only affects syntax; specifying HTTP and HTTPS ports on the command line currently has no effect.) - named.conf options "http-port" and "https-port" - HTTPSPORT environment variable for use when running tests.
2020-09-16 12:21:32 -07:00
/* http and https */
Verify HTTP paths both in incoming requests and in config file This commit adds the code (and some tests) which allows verifying validity of HTTP paths both in incoming HTTP requests and in BIND's configuration file.
2021-05-19 18:03:11 +03:00
static cfg_type_t cfg_type_bracketed_http_endpoint_list = {
"bracketed_http_endpoint_list",
cfg_parse_bracketed_list,
cfg_print_bracketed_list,
cfg_doc_bracketed_list,
&cfg_rep_list,
&cfg_type_qstring
};
Add parser support for DoH configuration options This commit adds stub parser support and tests for: - an "http" global option for HTTP/2 endpoint configuration. - command line options to set http or https port numbers by specifying -p http=PORT or -p https=PORT. (NOTE: this change only affects syntax; specifying HTTP and HTTPS ports on the command line currently has no effect.) - named.conf options "http-port" and "https-port" - HTTPSPORT environment variable for use when running tests.
2020-09-16 12:21:32 -07:00
static cfg_clausedef_t cfg_http_description_clauses[] = {
Verify HTTP paths both in incoming requests and in config file This commit adds the code (and some tests) which allows verifying validity of HTTP paths both in incoming HTTP requests and in BIND's configuration file.
2021-05-19 18:03:11 +03:00
{ "endpoints", &cfg_type_bracketed_http_endpoint_list, 0 },
Add (http-)listener-clients option (DoH quota mechanism) This commit adds support for http-listener-clients global options as well as ability to override the default in an HTTP server description, like: http local-http-server { ... listener-clients 100; ... }; This way we have ability to specify per-listener active connections quota globally and then override it when required. This is exactly what AT&T requested us: they wanted a functionality to specify quota globally and then override it for specific IPs. This change functionality makes such a configuration possible. It makes sense: for example, one could have different quotas for internal and external clients. Or, for example, one could use BIND's internal ability to serve encrypted DoH with some sane quota value for internal clients, while having un-encrypted DoH listener without quota to put BIND behind a load balancer doing TLS offloading for external clients. Moreover, the code no more shares the quota with TCP, which makes little sense anyway (see tcp-clients option), because of the nature of interaction of DoH clients: they tend to keep idle opened connections for longer periods of time, preventing the TCP and TLS client from being served. Thus, the need to have a separate, generally larger, quota for them. Also, the change makes any option within "http <name> { ... };" statement optional, making it easier to override only required default options. By default, the DoH connections are limited to 300 per listener. I hope that it is a good initial guesstimate.
2021-05-14 14:18:57 +03:00
{ "listener-clients", &cfg_type_uint32, 0 },
Make max number of HTTP/2 streams configurable This commit makes number of concurrent HTTP/2 streams per connection configurable as a mean to fight DDoS attacks. As soon as the limit is reached, BIND terminates the whole session. The commit adds a global configuration option (http-streams-per-connection) which can be overridden in an http <name> {...} statement like follows: http local-http-server { ... streams-per-connection 100; ... }; For now the default value is 100, which should be enough (e.g. NGINX uses 128, but it is a full-featured WEB-server). When using lower numbers (e.g. ~70), it is possible to hit the limit with e.g. flamethrower.
2021-05-18 12:03:58 +03:00
{ "streams-per-connection", &cfg_type_uint32, 0 },
Add (http-)listener-clients option (DoH quota mechanism) This commit adds support for http-listener-clients global options as well as ability to override the default in an HTTP server description, like: http local-http-server { ... listener-clients 100; ... }; This way we have ability to specify per-listener active connections quota globally and then override it when required. This is exactly what AT&T requested us: they wanted a functionality to specify quota globally and then override it for specific IPs. This change functionality makes such a configuration possible. It makes sense: for example, one could have different quotas for internal and external clients. Or, for example, one could use BIND's internal ability to serve encrypted DoH with some sane quota value for internal clients, while having un-encrypted DoH listener without quota to put BIND behind a load balancer doing TLS offloading for external clients. Moreover, the code no more shares the quota with TCP, which makes little sense anyway (see tcp-clients option), because of the nature of interaction of DoH clients: they tend to keep idle opened connections for longer periods of time, preventing the TCP and TLS client from being served. Thus, the need to have a separate, generally larger, quota for them. Also, the change makes any option within "http <name> { ... };" statement optional, making it easier to override only required default options. By default, the DoH connections are limited to 300 per listener. I hope that it is a good initial guesstimate.
2021-05-14 14:18:57 +03:00
{ NULL, NULL, 0 }
Add parser support for DoH configuration options This commit adds stub parser support and tests for: - an "http" global option for HTTP/2 endpoint configuration. - command line options to set http or https port numbers by specifying -p http=PORT or -p https=PORT. (NOTE: this change only affects syntax; specifying HTTP and HTTPS ports on the command line currently has no effect.) - named.conf options "http-port" and "https-port" - HTTPSPORT environment variable for use when running tests.
2020-09-16 12:21:32 -07:00
};
static cfg_clausedef_t *http_description_clausesets[] = {
cfg_http_description_clauses, NULL
};
static cfg_type_t cfg_type_http_description = {
"http_desc", cfg_parse_named_map, cfg_print_map,
cfg_doc_map, &cfg_rep_map, http_description_clausesets
};
Reference in New Issue Copy Permalink