/*

 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")

 *

 * SPDX-License-Identifier: MPL-2.0

 *

 * This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, you can obtain one at https://mozilla.org/MPL/2.0/.

 *

 * See the COPYRIGHT file distributed with this work for additional

 * information regarding copyright ownership.

 */

/*! \file */

#include <errno.h>

#include <inttypes.h>

#include <stdbool.h>

#include <isc/async.h>

#include <isc/atomic.h>

#include <isc/file.h>

#include <isc/hash.h>

#include <isc/hashmap.h>

#include <isc/hex.h>

#include <isc/loop.h>

#include <isc/md.h>

#include <isc/mutex.h>

#include <isc/overflow.h>

#include <isc/random.h>

#include <isc/ratelimiter.h>

#include <isc/refcount.h>

#include <isc/result.h>

#include <isc/rwlock.h>

#include <isc/serial.h>

#include <isc/stats.h>

#include <isc/stdtime.h>

#include <isc/strerr.h>

#include <isc/string.h>

#include <isc/thread.h>

#include <isc/tid.h>

#include <isc/timer.h>

#include <isc/tls.h>

#include <isc/util.h>

#include <dns/acl.h>

#include <dns/adb.h>

#include <dns/callbacks.h>

#include <dns/catz.h>

#include <dns/db.h>

#include <dns/dbiterator.h>

#include <dns/dlz.h>

#include <dns/dnssec.h>

#include <dns/journal.h>

#include <dns/kasp.h>

#include <dns/keydata.h>

#include <dns/keymgr.h>

#include <dns/keytable.h>

#include <dns/keyvalues.h>

#include <dns/log.h>

#include <dns/master.h>

#include <dns/masterdump.h>

#include <dns/message.h>

#include <dns/name.h>

#include <dns/nsec.h>

#include <dns/nsec3.h>

#include <dns/opcode.h>

#include <dns/peer.h>

#include <dns/private.h>

#include <dns/rcode.h>

#include <dns/rdata.h>

#include <dns/rdataclass.h>

#include <dns/rdatalist.h>

#include <dns/rdataset.h>

#include <dns/rdatasetiter.h>

#include <dns/rdatastruct.h>

#include <dns/rdatatype.h>

#include <dns/remote.h>

#include <dns/request.h>

#include <dns/resolver.h>

#include <dns/rriterator.h>

#include <dns/soa.h>

#include <dns/ssu.h>

#include <dns/stats.h>

#include <dns/time.h>

#include <dns/tsig.h>

#include <dns/update.h>

#include <dns/xfrin.h>

#include <dns/zone.h>

#include <dns/zoneverify.h>

#include <dns/zt.h>

#include <dst/dst.h>

#include "zone_p.h"

#define ZONE_MAGIC       ISC_MAGIC('Z', 'O', 'N', 'E')

#define DNS_ZONE_VALID(zone) ISC_MAGIC_VALID(zone, ZONE_MAGIC)

#define NOTIFY_MAGIC     ISC_MAGIC('N', 't', 'f', 'y')

#define DNS_NOTIFY_VALID(notify) ISC_MAGIC_VALID(notify, NOTIFY_MAGIC)

#define CHECKDS_MAGIC      ISC_MAGIC('C', 'h', 'D', 'S')

#define DNS_CHECKDS_VALID(checkds) ISC_MAGIC_VALID(checkds, CHECKDS_MAGIC)

#define STUB_MAGIC       ISC_MAGIC('S', 't', 'u', 'b')

#define DNS_STUB_VALID(stub) ISC_MAGIC_VALID(stub, STUB_MAGIC)

#define ZONEMGR_MAGIC   ISC_MAGIC('Z', 'm', 'g', 'r')

#define DNS_ZONEMGR_VALID(stub) ISC_MAGIC_VALID(stub, ZONEMGR_MAGIC)

#define FORWARD_MAGIC   ISC_MAGIC('F', 'o', 'r', 'w')

#define DNS_FORWARD_VALID(load) ISC_MAGIC_VALID(load, FORWARD_MAGIC)

#define IO_MAGIC     ISC_MAGIC('Z', 'm', 'I', 'O')

#define DNS_IO_VALID(load) ISC_MAGIC_VALID(load, IO_MAGIC)

#define KEYMGMT_MAGIC   ISC_MAGIC('M', 'g', 'm', 't')

#define DNS_KEYMGMT_VALID(load) ISC_MAGIC_VALID(load, KEYMGMT_MAGIC)

#define KEYFILEIO_MAGIC     ISC_MAGIC('K', 'y', 'I', 'O')

#define DNS_KEYFILEIO_VALID(kfio) ISC_MAGIC_VALID(kfio, KEYFILEIO_MAGIC)

/*%

 * Ensure 'a' is at least 'min' but not more than 'max'.

 */

#define RANGE(a, min, max) (((a) < (min)) ? (min) : ((a) < (max) ? (a) : (max)))

#define NSEC3REMOVE(x) (((x) & DNS_NSEC3FLAG_REMOVE) != 0)

/*%

 * Key flags

 */

#define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) != 0)

#define KSK(x)    ((dst_key_flags(x) & DNS_KEYFLAG_KSK) != 0)

#define ID(x)   dst_key_id(x)

#define ALG(x)    dst_key_alg(x)

/*%

 * KASP flags

 */

#define KASP_LOCK(k)                  \

  if ((k) != NULL) {            \

    LOCK((&((k)->lock))); \

  }

#define KASP_UNLOCK(k)                  \

  if ((k) != NULL) {              \

    UNLOCK((&((k)->lock))); \

  }

/*

 * Default values.

 */

#define DNS_DEFAULT_IDLEIN  3600       /*%< 1 hour */

#define DNS_DEFAULT_IDLEOUT 3600       /*%< 1 hour */

#define MAX_XFER_TIME     (2 * 3600) /*%< Documented default is 2 hours */

#define RESIGN_DELAY      3600       /*%< 1 hour */

#ifndef DNS_MAX_EXPIRE

#define DNS_MAX_EXPIRE 14515200 /*%< 24 weeks */

#endif        /* ifndef DNS_MAX_EXPIRE */

#ifndef DNS_DUMP_DELAY

#define DNS_DUMP_DELAY 900 /*%< 15 minutes */

#endif         /* ifndef DNS_DUMP_DELAY */

typedef struct dns_notify dns_notify_t;

typedef struct dns_checkds dns_checkds_t;

typedef struct dns_stub dns_stub_t;

typedef struct dns_load dns_load_t;

typedef struct dns_forward dns_forward_t;

typedef ISC_LIST(dns_forward_t) dns_forwardlist_t;

typedef struct dns_keymgmt dns_keymgmt_t;

typedef struct dns_signing dns_signing_t;

typedef ISC_LIST(dns_signing_t) dns_signinglist_t;

typedef struct dns_nsec3chain dns_nsec3chain_t;

typedef ISC_LIST(dns_nsec3chain_t) dns_nsec3chainlist_t;

typedef struct dns_nsfetch dns_nsfetch_t;

typedef struct dns_keyfetch dns_keyfetch_t;

typedef struct dns_asyncload dns_asyncload_t;

typedef struct dns_include dns_include_t;

#define DNS_ZONE_CHECKLOCK

#ifdef DNS_ZONE_CHECKLOCK

#define LOCK_ZONE(z)                  \

  do {                          \

    LOCK(&(z)->lock);     \

    INSIST(!(z)->locked); \

    (z)->locked = true;   \

  } while (0)

#define UNLOCK_ZONE(z)               \

  do {                         \

    (z)->locked = false; \

    UNLOCK(&(z)->lock);  \

  } while (0)

#define LOCKED_ZONE(z) ((z)->locked)

#define TRYLOCK_ZONE(result, z)                         \

  do {                                            \

    result = isc_mutex_trylock(&(z)->lock); \

    if (result == ISC_R_SUCCESS) {          \

      INSIST(!(z)->locked);           \

      (z)->locked = true;             \

    }                                       \

  } while (0)

#else /* ifdef DNS_ZONE_CHECKLOCK */

#define LOCK_ZONE(z)   LOCK(&(z)->lock)

#define UNLOCK_ZONE(z) UNLOCK(&(z)->lock)

#define LOCKED_ZONE(z) true

#define TRYLOCK_ZONE(result, z)                         \

  do {                                            \

    result = isc_mutex_trylock(&(z)->lock); \

  } while (0)

#endif /* ifdef DNS_ZONE_CHECKLOCK */

#define ZONEDB_INITLOCK(l)    isc_rwlock_init((l))

#define ZONEDB_DESTROYLOCK(l) isc_rwlock_destroy(l)

#define ZONEDB_LOCK(l, t)     RWLOCK((l), (t))

#define ZONEDB_UNLOCK(l, t)   RWUNLOCK((l), (t))

#define RETERR(x)                            \

  do {                                 \

    result = (x);                \

    if (result != ISC_R_SUCCESS) \

      goto failure;        \

  } while (0)

#ifdef ENABLE_AFL

extern bool dns_fuzzing_resolver;

#endif /* ifdef ENABLE_AFL */

/*%

 *  Hold key file IO locks.

 */

typedef struct dns_keyfileio {

  unsigned int magic;

  isc_mutex_t lock;

  isc_refcount_t references;

  dns_name_t *name;

  dns_fixedname_t fname;

} dns_keyfileio_t;

struct dns_keymgmt {

  unsigned int magic;

  isc_rwlock_t lock;

  isc_mem_t *mctx;

  isc_hashmap_t *table;

};

/*

 * Initial size of the keymgmt hash table.

 */

#define DNS_KEYMGMT_HASH_BITS 12

struct dns_zone {

  /* Unlocked */

  unsigned int magic;

  isc_mutex_t lock;

#ifdef DNS_ZONE_CHECKLOCK

  bool locked;

#endif /* ifdef DNS_ZONE_CHECKLOCK */

  isc_mem_t *mctx;

  isc_refcount_t references;

  isc_rwlock_t dblock;

  dns_db_t *db; /* Locked by dblock */

  unsigned int tid;

  /* Locked */

  dns_zonemgr_t *zmgr;

  ISC_LINK(dns_zone_t) link; /* Used by zmgr. */

  isc_loop_t *loop;

  isc_timer_t *timer;

  isc_refcount_t irefs;

  dns_name_t origin;

  char *masterfile;

  const FILE *stream;        /* loading from a stream? */

  ISC_LIST(dns_include_t) includes;    /* Include files */

  ISC_LIST(dns_include_t) newincludes; /* Loading */

  unsigned int nincludes;

  dns_masterformat_t masterformat;

  const dns_master_style_t *masterstyle;

  char *journal;

  int32_t journalsize;

  dns_rdataclass_t rdclass;

  dns_zonetype_t type;

  atomic_uint_fast64_t flags;

  atomic_uint_fast64_t options;

  unsigned int db_argc;

  char **db_argv;

  isc_time_t expiretime;

  isc_time_t refreshtime;

  isc_time_t dumptime;

  isc_time_t loadtime;

  isc_time_t notifytime;

  isc_time_t resigntime;

  isc_time_t keywarntime;

  isc_time_t signingtime;

  isc_time_t nsec3chaintime;

  isc_time_t refreshkeytime;

  isc_time_t xfrintime;

  uint32_t refreshkeyinterval;

  uint32_t refreshkeycount;

  uint32_t refresh;

  uint32_t retry;

  uint32_t expire;

  uint32_t minimum;

  isc_stdtime_t key_expiry;

  isc_stdtime_t log_key_expired_timer;

  char *keydirectory;

  dns_keyfileio_t *kfio;

  dns_keystorelist_t *keystores;

  uint32_t maxrefresh;

  uint32_t minrefresh;

  uint32_t maxretry;

  uint32_t minretry;

  uint32_t maxrecords;

  dns_remote_t primaries;

  dns_remote_t parentals;

  dns_dnsseckeylist_t checkds_ok;

  dns_checkdstype_t checkdstype;

  uint32_t nsfetchcount;

  uint32_t parent_nscount;

  dns_remote_t notify;

  dns_notifytype_t notifytype;

  isc_sockaddr_t notifyfrom;

  isc_sockaddr_t notifysrc4;

  isc_sockaddr_t notifysrc6;

  isc_sockaddr_t parentalsrc4;

  isc_sockaddr_t parentalsrc6;

  isc_sockaddr_t xfrsource4;

  isc_sockaddr_t xfrsource6;

  isc_sockaddr_t sourceaddr;

  dns_xfrin_t *xfr;     /* loop locked */

  dns_tsigkey_t *tsigkey;     /* key used for xfr */

  dns_transport_t *transport; /* transport used for xfr */

  /* Access Control Lists */

  dns_acl_t *update_acl;

  dns_acl_t *forward_acl;

  dns_acl_t *notify_acl;

  dns_acl_t *query_acl;

  dns_acl_t *queryon_acl;

  dns_acl_t *xfr_acl;

  bool update_disabled;

  bool zero_no_soa_ttl;

  dns_severity_t check_names;

  ISC_LIST(dns_notify_t) notifies;

  ISC_LIST(dns_checkds_t) checkds_requests;

  dns_request_t *request;

  dns_loadctx_t *loadctx;

  dns_dumpctx_t *dumpctx;

  uint32_t maxxfrin;

  uint32_t maxxfrout;

  uint32_t idlein;

  uint32_t idleout;

  dns_ssutable_t *ssutable;

  uint32_t sigvalidityinterval;

  uint32_t keyvalidityinterval;

  uint32_t sigresigninginterval;

  dns_view_t *view;

  dns_view_t *prev_view;

  dns_kasp_t *kasp;

  dns_kasp_t *defaultkasp;

  dns_checkmxfunc_t checkmx;

  dns_checksrvfunc_t checksrv;

  dns_checknsfunc_t checkns;

  /*%

   * Zones in certain states such as "waiting for zone transfer"

   * or "zone transfer in progress" are kept on per-state linked lists

   * in the zone manager using the 'statelink' field.  The 'statelist'

   * field points at the list the zone is currently on.  It the zone

   * is not on any such list, statelist is NULL.

   */

  ISC_LINK(dns_zone_t) statelink;

  dns_zonelist_t *statelist;

  /*%

   * Statistics counters about zone management.

   */

  isc_stats_t *stats;

  /*%

   * Optional per-zone statistics counters.  Counted outside of this

   * module.

   */

  dns_zonestat_level_t statlevel;

  bool requeststats_on;

  isc_stats_t *requeststats;

  dns_stats_t *rcvquerystats;

  dns_stats_t *dnssecsignstats;

  uint32_t notifydelay;

  dns_isselffunc_t isself;

  void *isselfarg;

  char *strnamerd;

  char *strname;

  char *strrdclass;

  char *strviewname;

  /*%

   * Serial number for deferred journal compaction.

   */

  uint32_t compact_serial;

  /*%

   * Keys that are signing the zone for the first time.

   */

  dns_signinglist_t signing;

  dns_nsec3chainlist_t nsec3chain;

  /*%

   * List of outstanding NSEC3PARAM change requests.

   */

  ISC_LIST(struct np3) setnsec3param_queue;

  /*%

   * Signing / re-signing quantum stopping parameters.

   */

  uint32_t signatures;

  uint32_t nodes;

  dns_rdatatype_t privatetype;

  /*%

   * Autosigning/key-maintenance options

   */

  atomic_uint_fast64_t keyopts;

  /*%

   * True if added by "rndc addzone"

   */

  bool added;

  /*%

   * True if added by automatically by named.

   */

  bool automatic;

  /*%

   * response policy data to be relayed to the database

   */

  dns_rpz_zones_t *rpzs;

  dns_rpz_num_t rpz_num;

  /*%

   * catalog zone data

   */

  dns_catz_zones_t *catzs;

  /*%

   * parent catalog zone

   */

  dns_catz_zone_t *parentcatz;

  /*%

   * Serial number update method.

   */

  dns_updatemethod_t updatemethod;

  /*%

   * whether ixfr is requested

   */

  bool requestixfr;

  uint32_t ixfr_ratio;

  /*%

   * whether EDNS EXPIRE is requested

   */

  bool requestexpire;

  /*%

   * Outstanding forwarded UPDATE requests.

   */

  dns_forwardlist_t forwards;

  dns_zone_t *raw;

  dns_zone_t *secure;

  bool sourceserialset;

  uint32_t sourceserial;

  /*%

   * soa and maximum zone ttl

   */

  dns_ttl_t soattl;

  dns_ttl_t maxttl;

  /*

   * Inline zone signing state.

   */

  dns_diff_t rss_diff;

  dns_dbversion_t *rss_newver;

  dns_dbversion_t *rss_oldver;

  dns_db_t *rss_db;

  dns_zone_t *rss_raw;

  struct rss *rss;

  dns_update_state_t *rss_state;

  isc_stats_t *gluecachestats;

};

#define zonediff_init(z, d)                \

  do {                               \

    dns__zonediff_t *_z = (z); \

    (_z)->diff = (d);          \

    (_z)->offline = false;     \

  } while (0)

#define DNS_ZONE_FLAG(z, f)    ((atomic_load_relaxed(&(z)->flags) & (f)) != 0)

#define DNS_ZONE_SETFLAG(z, f) atomic_fetch_or(&(z)->flags, (f))

#define DNS_ZONE_CLRFLAG(z, f) atomic_fetch_and(&(z)->flags, ~(f))

typedef enum {

  DNS_ZONEFLG_REFRESH = 0x00000001U,     /*%< refresh check in progress */

  DNS_ZONEFLG_NEEDDUMP = 0x00000002U,    /*%< zone need consolidation */

  DNS_ZONEFLG_USEVC = 0x00000004U,       /*%< use tcp for refresh query */

  DNS_ZONEFLG_DUMPING = 0x00000008U,     /*%< a dump is in progress */

  DNS_ZONEFLG_HASINCLUDE = 0x00000010U,  /*%< $INCLUDE in zone file */

  DNS_ZONEFLG_LOADED = 0x00000020U,      /*%< database has loaded */

  DNS_ZONEFLG_EXITING = 0x00000040U,     /*%< zone is being destroyed */

  DNS_ZONEFLG_EXPIRED = 0x00000080U,     /*%< zone has expired */

  DNS_ZONEFLG_NEEDREFRESH = 0x00000100U, /*%< refresh check needed */

  DNS_ZONEFLG_UPTODATE = 0x00000200U,    /*%< zone contents are

            * up-to-date */

  DNS_ZONEFLG_NEEDNOTIFY = 0x00000400U,  /*%< need to send out notify

            * messages */

  DNS_ZONEFLG_FIXJOURNAL = 0x00000800U,  /*%< journal file had

            * recoverable error,

            * needs rewriting */

  DNS_ZONEFLG_NOPRIMARIES = 0x00001000U, /*%< an attempt to refresh a

            * zone with no primaries

            * occurred */

  DNS_ZONEFLG_LOADING = 0x00002000U,     /*%< load from disk in progress*/

  DNS_ZONEFLG_HAVETIMERS = 0x00004000U,  /*%< timer values have been set

            * from SOA (if not set, we

            * are still using

            * default timer values) */

  DNS_ZONEFLG_FORCEXFER = 0x00008000U,   /*%< Force a zone xfer */

  DNS_ZONEFLG_NOREFRESH = 0x00010000U,

  DNS_ZONEFLG_DIALNOTIFY = 0x00020000U,

  DNS_ZONEFLG_DIALREFRESH = 0x00040000U,

  DNS_ZONEFLG_SHUTDOWN = 0x00080000U,

  DNS_ZONEFLG_NOIXFR = 0x00100000U, /*%< IXFR failed, force AXFR */

  DNS_ZONEFLG_FLUSH = 0x00200000U,

  DNS_ZONEFLG_NOEDNS = 0x00400000U,

  DNS_ZONEFLG_USEALTXFRSRC = 0x00800000U, /*%< Obsoleted. */

  DNS_ZONEFLG_SOABEFOREAXFR = 0x01000000U,

  DNS_ZONEFLG_NEEDCOMPACT = 0x02000000U,

  DNS_ZONEFLG_REFRESHING = 0x04000000U, /*%< Refreshing keydata */

  DNS_ZONEFLG_THAW = 0x08000000U,

  DNS_ZONEFLG_LOADPENDING = 0x10000000U, /*%< Loading scheduled */

  DNS_ZONEFLG_NODELAY = 0x20000000U,

  DNS_ZONEFLG_SENDSECURE = 0x40000000U,

  DNS_ZONEFLG_NEEDSTARTUPNOTIFY = 0x80000000U, /*%< need to send out

                  * notify due to the zone

                  * just being loaded for

                  * the first time. */

  DNS_ZONEFLG_FIRSTREFRESH = 0x100000000U, /*%< First refresh pending */

  DNS_ZONEFLG___MAX = UINT64_MAX, /* trick to make the ENUM 64-bit wide */

} dns_zoneflg_t;

#define DNS_ZONE_OPTION(z, o)  ((atomic_load_relaxed(&(z)->options) & (o)) != 0)

#define DNS_ZONE_SETOPTION(z, o) atomic_fetch_or(&(z)->options, (o))

#define DNS_ZONE_CLROPTION(z, o) atomic_fetch_and(&(z)->options, ~(o))

#define DNS_ZONEKEY_OPTION(z, o) \

  ((atomic_load_relaxed(&(z)->keyopts) & (o)) != 0)

#define DNS_ZONEKEY_SETOPTION(z, o) atomic_fetch_or(&(z)->keyopts, (o))

#define DNS_ZONEKEY_CLROPTION(z, o) atomic_fetch_and(&(z)->keyopts, ~(o))

/* Flags for zone_load() */

typedef enum {

  DNS_ZONELOADFLAG_NOSTAT = 0x00000001U, /* Do not stat() master files */

  DNS_ZONELOADFLAG_THAW = 0x00000002U,   /* Thaw the zone on successful

            * load. */

} dns_zoneloadflag_t;

#define UNREACH_CACHE_SIZE 10U

#define UNREACH_HOLD_TIME  600 /* 10 minutes */

#define CHECK(op)                            \

  do {                                 \

    result = (op);               \

    if (result != ISC_R_SUCCESS) \

      goto failure;        \

  } while (0)

struct dns_unreachable {

  isc_sockaddr_t remote;

  isc_sockaddr_t local;

  atomic_uint_fast32_t expire;

  atomic_uint_fast32_t last;

  uint32_t count;

};

struct dns_zonemgr {

  unsigned int magic;

  isc_mem_t *mctx;

  isc_refcount_t refs;

  isc_loopmgr_t *loopmgr;

  isc_nm_t *netmgr;

  uint32_t workers;

  isc_mem_t **mctxpool;

  isc_ratelimiter_t *checkdsrl;

  isc_ratelimiter_t *notifyrl;

  isc_ratelimiter_t *refreshrl;

  isc_ratelimiter_t *startupnotifyrl;

  isc_ratelimiter_t *startuprefreshrl;

  isc_rwlock_t rwlock;

  isc_rwlock_t urlock;

  /* Locked by rwlock. */

  dns_zonelist_t zones;

  dns_zonelist_t waiting_for_xfrin;

  dns_zonelist_t xfrin_in_progress;

  /* Configuration data. */

  uint32_t transfersin;

  uint32_t transfersperns;

  unsigned int checkdsrate;

  unsigned int notifyrate;

  unsigned int startupnotifyrate;

  unsigned int serialqueryrate;

  unsigned int startupserialqueryrate;

  /* Locked by urlock. */

  /* LRU cache */

  struct dns_unreachable unreachable[UNREACH_CACHE_SIZE];

  dns_keymgmt_t *keymgmt;

  isc_tlsctx_cache_t *tlsctx_cache;

  isc_rwlock_t tlsctx_cache_rwlock;

};

/*%

 * Hold notify state.

 */

struct dns_notify {

  unsigned int magic;

  unsigned int flags;

  isc_mem_t *mctx;

  dns_zone_t *zone;

  dns_adbfind_t *find;

  dns_request_t *request;

  dns_name_t ns;

  isc_sockaddr_t src;

  isc_sockaddr_t dst;

  dns_tsigkey_t *key;

  dns_transport_t *transport;

  ISC_LINK(dns_notify_t) link;

  isc_rlevent_t *rlevent;

};

typedef enum dns_notify_flags {

  DNS_NOTIFY_NOSOA = 1 << 0,

  DNS_NOTIFY_STARTUP = 1 << 1,

  DNS_NOTIFY_TCP = 1 << 2,

} dns_notify_flags_t;

/*%

 * Hold checkds state.

 */

struct dns_checkds {

  unsigned int magic;

  dns_notify_flags_t flags;

  isc_mem_t *mctx;

  dns_zone_t *zone;

  dns_adbfind_t *find;

  dns_request_t *request;

  dns_name_t ns;

  isc_sockaddr_t src;

  isc_sockaddr_t dst;

  dns_tsigkey_t *key;

  dns_transport_t *transport;

  ISC_LINK(dns_checkds_t) link;

  isc_rlevent_t *rlevent;

};

/*%

 *  dns_stub holds state while performing a 'stub' transfer.

 *  'db' is the zone's 'db' or a new one if this is the initial

 *  transfer.

 */

struct dns_stub {

  unsigned int magic;

  isc_mem_t *mctx;

  dns_zone_t *zone;

  dns_db_t *db;

  dns_dbversion_t *version;

  atomic_uint_fast32_t pending_requests;

};

/*%

 *  Hold load state.

 */

struct dns_load {

  dns_zone_t *zone;

  dns_db_t *db;

  isc_time_t loadtime;

  dns_rdatacallbacks_t callbacks;

};

/*%

 *  Hold forward state.

 */

struct dns_forward {

  unsigned int magic;

  isc_mem_t *mctx;

  dns_zone_t *zone;

  isc_buffer_t *msgbuf;

  dns_request_t *request;

  uint32_t which;

  isc_sockaddr_t addr;

  dns_transport_t *transport;

  dns_updatecallback_t callback;

  void *callback_arg;

  unsigned int options;

  ISC_LINK(dns_forward_t) link;

};

/*%

 *  Hold state for when we are signing a zone with a new

 *  DNSKEY as result of an update.

 */

struct dns_signing {

  unsigned int magic;

  dns_db_t *db;

  dns_dbiterator_t *dbiterator;

  dns_secalg_t algorithm;

  uint16_t keyid;

  bool deleteit;

  bool done;

  ISC_LINK(dns_signing_t) link;

};

struct dns_nsec3chain {

  unsigned int magic;

  dns_db_t *db;

  dns_dbiterator_t *dbiterator;

  dns_rdata_nsec3param_t nsec3param;

  unsigned char salt[255];

  bool done;

  bool seen_nsec;

  bool delete_nsec;

  bool save_delete_nsec;

  ISC_LINK(dns_nsec3chain_t) link;

};

/*%<

 * 'dbiterator' contains a iterator for the database.  If we are creating

 * a NSEC3 chain only the non-NSEC3 nodes will be iterated.  If we are

 * removing a NSEC3 chain then both NSEC3 and non-NSEC3 nodes will be

 * iterated.

 *

 * 'nsec3param' contains the parameters of the NSEC3 chain being created

 * or removed.

 *

 * 'salt' is buffer space and is referenced via 'nsec3param.salt'.

 *

 * 'seen_nsec' will be set to true if, while iterating the zone to create a

 * NSEC3 chain, a NSEC record is seen.

 *

 * 'delete_nsec' will be set to true if, at the completion of the creation

 * of a NSEC3 chain, 'seen_nsec' is true.  If 'delete_nsec' is true then we

 * are in the process of deleting the NSEC chain.

 *

 * 'save_delete_nsec' is used to store the initial state of 'delete_nsec'

 * so it can be recovered in the event of a error.

 */

struct dns_keyfetch {

  isc_mem_t *mctx;

  dns_fixedname_t name;

  dns_rdataset_t keydataset;

  dns_rdataset_t dnskeyset;

  dns_rdataset_t dnskeysigset;

  dns_zone_t *zone;

  dns_db_t *db;

  dns_fetch_t *fetch;

};

struct dns_nsfetch {

  isc_mem_t *mctx;

  dns_fixedname_t name;

  dns_name_t pname;

  dns_rdataset_t nsrrset;

  dns_rdataset_t nssigset;

  dns_zone_t *zone;

  dns_fetch_t *fetch;

};

/*%

 * Hold state for an asynchronous load

 */

struct dns_asyncload {

  dns_zone_t *zone;

  unsigned int flags;

  dns_zt_callback_t *loaded;

  void *loaded_arg;

};

/*%

 * Reference to an include file encountered during loading

 */

struct dns_include {

  char *name;

  isc_time_t filetime;

  ISC_LINK(dns_include_t) link;

};

/*

 * These can be overridden by the -T mkeytimers option on the command

 * line, so that we can test with shorter periods than specified in

 * RFC 5011.

 */

#define HOUR  3600

#define DAY   (24 * HOUR)

#define MONTH (30 * DAY)

unsigned int dns_zone_mkey_hour = HOUR;

unsigned int dns_zone_mkey_day = DAY;

unsigned int dns_zone_mkey_month = MONTH;

#define SEND_BUFFER_SIZE 2048

static void

zone_timer_set(dns_zone_t *zone, isc_time_t *next, isc_time_t *now);

typedef struct zone_settimer {

  dns_zone_t *zone;

  isc_time_t now;

} zone_settimer_t;

static void

zone_settimer(dns_zone_t *, isc_time_t *);

static void

cancel_refresh(dns_zone_t *);

static void

zone_debuglog(dns_zone_t *zone, const char *, int debuglevel, const char *msg,

        ...) ISC_FORMAT_PRINTF(4, 5);

static void

notify_log(dns_zone_t *zone, int level, const char *fmt, ...)

  ISC_FORMAT_PRINTF(3, 4);

static void

dnssec_log(dns_zone_t *zone, int level, const char *fmt, ...)

  ISC_FORMAT_PRINTF(3, 4);

static void

queue_xfrin(dns_zone_t *zone);

static isc_result_t

update_one_rr(dns_db_t *db, dns_dbversion_t *ver, dns_diff_t *diff,

        dns_diffop_t op, dns_name_t *name, dns_ttl_t ttl,

        dns_rdata_t *rdata);

static void

zone_unload(dns_zone_t *zone);

static void

zone_expire(dns_zone_t *zone);

static void

zone_refresh(dns_zone_t *zone);

static void

zone_iattach(dns_zone_t *source, dns_zone_t **target);

static void

zone_idetach(dns_zone_t **zonep);

static isc_result_t

zone_replacedb(dns_zone_t *zone, dns_db_t *db, bool dump);

static void

zone_attachdb(dns_zone_t *zone, dns_db_t *db);

static void

zone_detachdb(dns_zone_t *zone);

static void

zone_catz_enable(dns_zone_t *zone, dns_catz_zones_t *catzs);

static void

zone_catz_disable(dns_zone_t *zone);

static isc_result_t

default_journal(dns_zone_t *zone);

static void

zone_xfrdone(dns_zone_t *zone, uint32_t *expireopt, isc_result_t result);

static isc_result_t

zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,

        isc_result_t result);

static void

zone_needdump(dns_zone_t *zone, unsigned int delay);

static void

zone_shutdown(void *arg);

static void

zone_loaddone(void *arg, isc_result_t result);

static isc_result_t

zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime);

static void

zone_namerd_tostr(dns_zone_t *zone, char *buf, size_t length);

static void

zone_name_tostr(dns_zone_t *zone, char *buf, size_t length);

static void

zone_rdclass_tostr(dns_zone_t *zone, char *buf, size_t length);

static void

zone_viewname_tostr(dns_zone_t *zone, char *buf, size_t length);

static isc_result_t

zone_send_secureserial(dns_zone_t *zone, uint32_t serial);

static void

refresh_callback(void *arg);

static void

stub_callback(void *arg);

static void

queue_soa_query(dns_zone_t *zone);

static void

soa_query(void *arg);

static void

ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub);

static int

message_count(dns_message_t *msg, dns_section_t section, dns_rdatatype_t type);

static void

checkds_cancel(dns_zone_t *zone);

static void

checkds_find_address(dns_checkds_t *checkds);

static void

checkds_send(dns_zone_t *zone);

static void

checkds_createmessage(dns_zone_t *zone, dns_message_t **messagep);

static void

checkds_done(void *arg);

static void

checkds_send_tons(dns_checkds_t *checkds);

static void

checkds_send_toaddr(void *arg);

static void

nsfetch_levelup(dns_nsfetch_t *nsfetch);

static void

notify_cancel(dns_zone_t *zone);

static void

notify_find_address(dns_notify_t *notify);

static void

notify_send(dns_notify_t *notify);

static isc_result_t

notify_createmessage(dns_zone_t *zone, unsigned int flags,

         dns_message_t **messagep);

static void

notify_done(void *arg);

static void

notify_send_toaddr(void *arg);

static isc_result_t

zone_dump(dns_zone_t *, bool);

static void

got_transfer_quota(void *arg);

static isc_result_t

zmgr_start_xfrin_ifquota(dns_zonemgr_t *zmgr, dns_zone_t *zone);

static void

zmgr_resume_xfrs(dns_zonemgr_t *zmgr, bool multi);

static void

zonemgr_free(dns_zonemgr_t *zmgr);

static void

rss_post(void *arg);

static isc_result_t

zone_get_from_db(dns_zone_t *zone, dns_db_t *db, unsigned int *nscount,

     unsigned int *soacount, uint32_t *soattl, uint32_t *serial,

     uint32_t *refresh, uint32_t *retry, uint32_t *expire,

     uint32_t *minimum, unsigned int *errors);

static void

zone_freedbargs(dns_zone_t *zone);

static void

forward_callback(void *arg);

static void

zone_saveunique(dns_zone_t *zone, const char *path, const char *templat);

static void

zone_maintenance(dns_zone_t *zone);

static void

zone_notify(dns_zone_t *zone, isc_time_t *now);

static void

dump_done(void *arg, isc_result_t result);

static isc_result_t

zone_signwithkey(dns_zone_t *zone, dns_secalg_t algorithm, uint16_t keyid,

     bool deleteit);

static isc_result_t

delete_nsec(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node,

      dns_name_t *name, dns_diff_t *diff);

static void

zone_rekey(dns_zone_t *zone);

static isc_result_t

zone_send_securedb(dns_zone_t *zone, dns_db_t *db);

static dns_ttl_t

zone_nsecttl(dns_zone_t *zone);

static void

setrl(isc_ratelimiter_t *rl, unsigned int *rate, unsigned int value);

static void

zone_journal_compact(dns_zone_t *zone, dns_db_t *db, uint32_t serial);

static isc_result_t

zone_journal_rollforward(dns_zone_t *zone, dns_db_t *db, bool *needdump,

       bool *fixjournal);

static void

setnsec3param(void *arg);

static void

zmgr_tlsctx_attach(dns_zonemgr_t *zmgr, isc_tlsctx_cache_t **ptlsctx_cache);

/*%<

 *  Attach to TLS client context cache used for zone transfers via

 *  encrypted transports (e.g. XoT).

 *

 * The obtained reference needs to be detached by a call to

 * 'isc_tlsctx_cache_detach()' when not needed anymore.

 *

 * Requires:

 *\li 'zmgr' is a valid zone manager.

 *\li 'ptlsctx_cache' is not 'NULL' and points to 'NULL'.

 */

#define ENTER zone_debuglog(zone, __func__, 1, "enter")

static const unsigned int dbargc_default = 1;

static const char *dbargv_default[] = { ZONEDB_DEFAULT };

#define DNS_ZONE_JITTER_ADD(a, b, c)                                         \

  do {                                                                 \

    isc_interval_t _i;                                           \

    uint32_t _j;                                                 \

    _j = (b) - isc_random_uniform((b) / 4);                      \

    isc_interval_set(&_i, _j, 0);                                \

    if (isc_time_add((a), &_i, (c)) != ISC_R_SUCCESS) {          \

      dns_zone_log(zone, ISC_LOG_WARNING,                  \

             "epoch approaching: upgrade required: " \

             "now + %s failed",                      \

             #b);                                    \

      isc_interval_set(&_i, _j / 2, 0);                    \

      (void)isc_time_add((a), &_i, (c));                   \

    }                                                            \

  } while (0)

#define DNS_ZONE_TIME_ADD(a, b, c)                                           \

  do {                                                                 \

    isc_interval_t _i;                                           \

    isc_interval_set(&_i, (b), 0);                               \

    if (isc_time_add((a), &_i, (c)) != ISC_R_SUCCESS) {          \

      dns_zone_log(zone, ISC_LOG_WARNING,                  \

             "epoch approaching: upgrade required: " \

             "now + %s failed",                      \

             #b);                                    \

      isc_interval_set(&_i, (b) / 2, 0);                   \

      (void)isc_time_add((a), &_i, (c));                   \

    }                                                            \

  } while (0)

typedef struct nsec3param nsec3param_t;

struct nsec3param {

  dns_rdata_nsec3param_t rdata;

  unsigned char data[DNS_NSEC3PARAM_BUFFERSIZE + 1];

  unsigned int length;

  bool nsec;

  bool replace;

  bool resalt;

  bool lookup;

  ISC_LINK(nsec3param_t) link;

};

typedef ISC_LIST(nsec3param_t) nsec3paramlist_t;

struct np3 {

  dns_zone_t *zone;

  nsec3param_t params;

  ISC_LINK(struct np3) link;

};

struct setserial {

  dns_zone_t *zone;

  uint32_t serial;

};

struct stub_cb_args {

  dns_stub_t *stub;

  dns_tsigkey_t *tsig_key;

  uint16_t udpsize;

  int timeout;

  bool reqnsid;

};

struct stub_glue_request {

  dns_request_t *request;

  dns_name_t name;

  struct stub_cb_args *args;

  bool ipv4;

};

/*%

 * Increment resolver-related statistics counters.  Zone must be locked.

 */

static void

inc_stats(dns_zone_t *zone, isc_statscounter_t counter) {

  if (zone->stats != NULL) {

    isc_stats_increment(zone->stats, counter);

  }

}

/***

 ***  Public functions.

 ***/

void

dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx, unsigned int tid) {

  isc_time_t now;

  dns_zone_t *zone = NULL;

  REQUIRE(zonep != NULL && *zonep == NULL);

  REQUIRE(mctx != NULL);