add global soa-edit settings

diff --git a/pdns/common_startup.cc b/pdns/common_startup.cc
index 89d45d4713113c4c5eda12564a0cf3f74038c177..54142fce202d2d6c899b49070d1d1bc601164c5a 100644 (file)
--- a/pdns/common_startup.cc
+++ b/pdns/common_startup.cc
@@ -144,6 +144,8 @@ void declareArguments()
   ::arg().set("soa-refresh-default","Default SOA refresh")="10800";
   ::arg().set("soa-retry-default","Default SOA retry")="3600";
   ::arg().set("soa-expire-default","Default SOA expire")="604800";
+  ::arg().set("default-soa-edit","Default SOA-EDIT value")="";
+  ::arg().set("default-soa-edit-signed","Default SOA-EDIT value for signed zones")="";
 
   ::arg().set("trusted-notification-proxy", "IP address of incoming notification proxy")="";
   ::arg().set("slave-renotify", "If we should send out notifications for slaved updates")="no";

diff --git a/pdns/dbdnsseckeeper.cc b/pdns/dbdnsseckeeper.cc
index 1ea6e6172f213b745f11697e307d5e7501b7aff1..d56f27108a5b873a4e8dc8463b99b4fcae0b0cb0 100644 (file)
--- a/pdns/dbdnsseckeeper.cc
+++ b/pdns/dbdnsseckeeper.cc
@@ -215,6 +215,23 @@ void DNSSECKeeper::getFromMeta(const DNSName& zname, const std::string& key, std
   }
 }
 
+void DNSSECKeeper::getSoaEdit(const DNSName& zname, std::string& value)
+{
+  static const string soaEdit(::arg()["default-soa-edit"]);
+  static const string soaEditSigned(::arg()["default-soa-edit-signed"]);
+
+  getFromMeta(zname, "SOA-EDIT", value);
+
+  if ((!soaEdit.empty() || !soaEditSigned.empty()) && value.empty() && !isPresigned(zname)) {
+    if (!soaEditSigned.empty() && isSecuredZone(zname))
+      value=soaEditSigned;
+    if (value.empty())
+      value=soaEdit;
+  }
+
+  return;
+}
+
 uint64_t DNSSECKeeper::dbdnssecCacheSizes(const std::string& str)
 {
   if(str=="meta-cache-size") {

diff --git a/pdns/dnsseckeeper.hh b/pdns/dnsseckeeper.hh
index b5bb66c883bdfd4203a8771c0a0570b3b057d910..7225fbbacf887f8f8cd93f91aeb120358e8af98e 100644 (file)
--- a/pdns/dnsseckeeper.hh
+++ b/pdns/dnsseckeeper.hh
@@ -109,6 +109,7 @@ public:
   }
   
   void getFromMeta(const DNSName& zname, const std::string& key, std::string& value);
+  void getSoaEdit(const DNSName& zname, std::string& value);
 private:
 
 

diff --git a/pdns/pdns.conf-dist b/pdns/pdns.conf-dist
index 4640c1573ed17011ecdece99a31fbc9d2e18354b..962b705bb4c44df50e3cbf896edddcecf8c1f310 100644 (file)
--- a/pdns/pdns.conf-dist
+++ b/pdns/pdns.conf-dist
@@ -84,6 +84,16 @@
 #
 # default-ksk-size=0
 
+#################################
+# default-soa-edit     Default SOA-EDIT value
+#
+# default-soa-edit=
+
+#################################
+# default-soa-edit-signed      Default SOA-EDIT value for signed zones
+#
+# default-soa-edit-signed=
+
 #################################
 # default-soa-mail     mail address to insert in the SOA record if none set in the backend
 #

diff --git a/pdns/pdnssec.cc b/pdns/pdnssec.cc
index 5d07969fdc66208113d20ee97839bdad190bc387..b13b97832afdb9eeeb6f6a48b095793999eec081 100644 (file)
--- a/pdns/pdnssec.cc
+++ b/pdns/pdnssec.cc
@@ -141,6 +141,8 @@ void loadMainConfig(const std::string& configdir)
   ::arg().set("default-ksk-size","Default KSK size (0 means default)")="0";
   ::arg().set("default-zsk-algorithms","Default ZSK algorithms")="rsasha256";
   ::arg().set("default-zsk-size","Default ZSK size (0 means default)")="0";
+  ::arg().set("default-soa-edit","Default SOA-EDIT value")="";
+  ::arg().set("default-soa-edit-signed","Default SOA-EDIT value for signed zones")="";
   ::arg().set("max-ent-entries", "Maximum number of empty non-terminals in a zone")="100000";
   ::arg().set("module-dir","Default directory for modules")=PKGLIBDIR;
   ::arg().set("entropy-source", "If set, read entropy from this file")="/dev/urandom";
@@ -686,9 +688,14 @@ int increaseSerial(const DNSName& zone, DNSSECKeeper &dk)
     cout<<"No SOA for zone '"<<zone.toString()<<"'"<<endl;
     return -1;
   }
+
+  if (dk.isPresigned(zone)) {
+    cerr<<"Serial increase of presigned zone '"<<zone<<"' is not allowed."<<endl;
+    return -1;
+  }
   
   string soaEditKind;
-  dk.getFromMeta(zone, "SOA-EDIT", soaEditKind);
+  dk.getSoaEdit(zone, soaEditKind);
 
   sd.db->lookup(QType(QType::SOA), zone);
   vector<DNSResourceRecord> rrs;

diff --git a/pdns/rfc2136handler.cc b/pdns/rfc2136handler.cc
index 093b8f46bbffb7b8d14096db28ba5dee9d99c119..0214c9f2a6eff6d689185b475d39ae9b9e6465fb 100644 (file)
--- a/pdns/rfc2136handler.cc
+++ b/pdns/rfc2136handler.cc
@@ -971,13 +971,13 @@ void PacketHandler::increaseSerial(const string &msgPrefix, const DomainInfo *di
   if (!soaEdit2136Setting.empty()) {
     soaEdit2136 = soaEdit2136Setting[0];
     if (pdns_iequals(soaEdit2136, "SOA-EDIT") || pdns_iequals(soaEdit2136,"SOA-EDIT-INCREASE") ){
-      vector<string> soaEditSetting;
-      B.getDomainMetadata(di->zone, "SOA-EDIT", soaEditSetting);
+      string soaEditSetting;
+      d_dk.getSoaEdit(di->zone, soaEditSetting);
       if (soaEditSetting.empty()) {
         L<<Logger::Error<<msgPrefix<<"Using "<<soaEdit2136<<" for SOA-EDIT-DNSUPDATE increase on DNS update, but SOA-EDIT is not set for domain \""<< di->zone.toString() <<"\". Using DEFAULT for SOA-EDIT-DNSUPDATE"<<endl;
         soaEdit2136 = "DEFAULT";
       } else
-        soaEdit = soaEditSetting[0];
+        soaEdit = soaEditSetting;
     }
   }
 

diff --git a/pdns/serialtweaker.cc b/pdns/serialtweaker.cc
index 4e30e8d32840bb501ff4b52b1d5177944b8fe0da..758f9b9f2391b1a06152353be62cf5ebdbdfa56e 100644 (file)
--- a/pdns/serialtweaker.cc
+++ b/pdns/serialtweaker.cc
@@ -45,7 +45,7 @@ bool editSOA(DNSSECKeeper& dk, const DNSName& qname, DNSPacket* dp)
   BOOST_FOREACH(DNSResourceRecord& rr, rrs) {
     if(rr.qtype.getCode() == QType::SOA && rr.qname == qname) {
       string kind;
-      dk.getFromMeta(qname, "SOA-EDIT", kind);
+      dk.getSoaEdit(qname, kind);
       return editSOARecord(rr, kind);
     }
   }

diff --git a/pdns/tcpreceiver.cc b/pdns/tcpreceiver.cc
index 3d95cf0e6f229ed03b4b0eb45cf2455383257fb5..68fbdd186beec56ca19ce7884c44f3769c02bf00 100644 (file)
--- a/pdns/tcpreceiver.cc
+++ b/pdns/tcpreceiver.cc
@@ -1065,7 +1065,7 @@ int TCPNameserver::doIXFR(shared_ptr<DNSPacket> q, int outsock)
   }
 
   string soaedit;
-  dk.getFromMeta(target, "SOA-EDIT", soaedit);
+  dk.getSoaEdit(target, soaedit);
   if (!rfc1982LessThan(serial, calculateEditSOA(sd, soaedit))) {
     TSIGRecordContent trc;
     DNSName tsigkeyname;