add global soa-edit settings

diff --git a/pdns/common_startup.cc b/pdns/common_startup.cc
index 30976a6b7ee897aa251c82a2d67c93002862e64e..45ab21dc06217a3aa8de96ce96af0afdadb16d48 100644 (file)
--- a/pdns/common_startup.cc
+++ b/pdns/common_startup.cc
@@ -138,6 +138,8 @@ void declareArguments()
   ::arg().set("soa-refresh-default","Default SOA refresh")="10800";
   ::arg().set("soa-retry-default","Default SOA retry")="3600";
   ::arg().set("soa-expire-default","Default SOA expire")="604800";
+  ::arg().set("default-soa-edit","Default SOA-EDIT value")="";
+  ::arg().set("default-soa-edit-signed","Default SOA-EDIT value for signed zones")="";
 
   ::arg().set("trusted-notification-proxy", "IP address of incoming notification proxy")="";
   ::arg().set("slave-renotify", "If we should send out notifications for slaved updates")="no";

diff --git a/pdns/dbdnsseckeeper.cc b/pdns/dbdnsseckeeper.cc
index 4f10bce1241c905c1ec57d124a314c6ae41b2d54..8b119467d3fdeb32b5ed7d76f040536b200f3e48 100644 (file)
--- a/pdns/dbdnsseckeeper.cc
+++ b/pdns/dbdnsseckeeper.cc
@@ -212,6 +212,23 @@ void DNSSECKeeper::getFromMeta(const std::string& zname, const std::string& key,
   }
 }
 
+void DNSSECKeeper::getSoaEdit(const std::string& zname, std::string& value)
+{
+  static const string soaEdit(::arg()["default-soa-edit"]);
+  static const string soaEditSigned(::arg()["default-soa-edit-signed"]);
+
+  getFromMeta(zname, "SOA-EDIT", value);
+
+  if ((!soaEdit.empty() || !soaEditSigned.empty()) && value.empty() && !isPresigned(zname)) {
+    if (!soaEditSigned.empty() && isSecuredZone(zname))
+      value=soaEditSigned;
+    if (value.empty())
+      value=soaEdit;
+  }
+
+  return;
+}
+
 uint64_t DNSSECKeeper::dbdnssecCacheSizes(const std::string& str)
 {
   if(str=="meta-cache-size") {

diff --git a/pdns/dnsseckeeper.hh b/pdns/dnsseckeeper.hh
index 01887501da696e0352561901b21dfea9cb2870a0..375e1b6003de4d8e3593d84c2c1ba7430fbacc37 100644 (file)
--- a/pdns/dnsseckeeper.hh
+++ b/pdns/dnsseckeeper.hh
@@ -106,6 +106,7 @@ public:
   }
   
   void getFromMeta(const std::string& zname, const std::string& key, std::string& value);
+  void getSoaEdit(const std::string& zname, std::string& value);
 private:
 
 

diff --git a/pdns/pdns.conf-dist b/pdns/pdns.conf-dist
index 8c8a737a0459274ed3b890449c7b4cafdb34ffe3..8ba6ce13e90fef3a8dfab340d15f978848beb8c1 100644 (file)
--- a/pdns/pdns.conf-dist
+++ b/pdns/pdns.conf-dist
@@ -84,6 +84,16 @@
 #
 # default-ksk-size=0
 
+#################################
+# default-soa-edit     Default SOA-EDIT value
+#
+# default-soa-edit=
+
+#################################
+# default-soa-edit-signed      Default SOA-EDIT value for signed zones
+#
+# default-soa-edit-signed=
+
 #################################
 # default-soa-mail     mail address to insert in the SOA record if none set in the backend
 #

diff --git a/pdns/pdnssec.cc b/pdns/pdnssec.cc
index 4f4541f680692c47b49b72e5891cb8fc4f5f5c04..39485b966bdb0b2da2a0828a531434c85523c846 100644 (file)
--- a/pdns/pdnssec.cc
+++ b/pdns/pdnssec.cc
@@ -133,6 +133,8 @@ void loadMainConfig(const std::string& configdir)
   ::arg().set("default-ksk-size","Default KSK size (0 means default)")="0";
   ::arg().set("default-zsk-algorithms","Default ZSK algorithms")="rsasha256";
   ::arg().set("default-zsk-size","Default KSK size (0 means default)")="0";
+  ::arg().set("default-soa-edit","Default SOA-EDIT value")="";
+  ::arg().set("default-soa-edit-signed","Default SOA-EDIT value for signed zones")="";
   ::arg().set("max-ent-entries", "Maximum number of empty non-terminals in a zone")="100000";
   ::arg().set("module-dir","Default directory for modules")=PKGLIBDIR;
   ::arg().set("entropy-source", "If set, read entropy from this file")="/dev/urandom";
@@ -665,9 +667,14 @@ int increaseSerial(const string& zone, DNSSECKeeper &dk)
     cout<<"No SOA for zone '"<<zone<<"'"<<endl;
     return -1;
   }
+
+  if (dk.isPresigned(zone)) {
+    cerr<<"Serial increase of presigned zone '"<<zone<<"' is not allowed."<<endl;
+    return -1;
+  }
   
   string soaEditKind;
-  dk.getFromMeta(zone, "SOA-EDIT", soaEditKind);
+  dk.getSoaEdit(zone, soaEditKind);
 
   sd.db->lookup(QType(QType::SOA), zone);
   vector<DNSResourceRecord> rrs;

diff --git a/pdns/rfc2136handler.cc b/pdns/rfc2136handler.cc
index ddba23e98a059c9223bfbdbe7f9ea06122a371d7..8cdad016c2e647363604685ab2cd45cba725df46 100644 (file)
--- a/pdns/rfc2136handler.cc
+++ b/pdns/rfc2136handler.cc
@@ -955,13 +955,13 @@ void PacketHandler::increaseSerial(const string &msgPrefix, const DomainInfo *di
   if (!soaEdit2136Setting.empty()) {
     soaEdit2136 = soaEdit2136Setting[0];
     if (pdns_iequals(soaEdit2136, "SOA-EDIT") || pdns_iequals(soaEdit2136,"SOA-EDIT-INCREASE") ){
-      vector<string> soaEditSetting;
-      B.getDomainMetadata(di->zone, "SOA-EDIT", soaEditSetting);
+      string soaEditSetting;
+      d_dk.getSoaEdit(di->zone, soaEditSetting);
       if (soaEditSetting.empty()) {
         L<<Logger::Error<<msgPrefix<<"Using "<<soaEdit2136<<" for SOA-EDIT-DNSUPDATE increase on DNS update, but SOA-EDIT is not set for domain \""<< di->zone <<"\". Using DEFAULT for SOA-EDIT-DNSUPDATE"<<endl;
         soaEdit2136 = "DEFAULT";
       } else
-        soaEdit = soaEditSetting[0];
+        soaEdit = soaEditSetting;
     }
   }
 

diff --git a/pdns/serialtweaker.cc b/pdns/serialtweaker.cc
index 2e878a718e86a844700b72f6a231fbe74f6901cb..10c1d6b031252810ae177205edb1eeec0c46544e 100644 (file)
--- a/pdns/serialtweaker.cc
+++ b/pdns/serialtweaker.cc
@@ -42,7 +42,7 @@ bool editSOA(DNSSECKeeper& dk, const string& qname, DNSPacket* dp)
   BOOST_FOREACH(DNSResourceRecord& rr, rrs) {
     if(rr.qtype.getCode() == QType::SOA && pdns_iequals(rr.qname,qname)) {
       string kind;
-      dk.getFromMeta(qname, "SOA-EDIT", kind);
+      dk.getSoaEdit(qname, kind);
       return editSOARecord(rr, kind);
     }
   }

diff --git a/pdns/tcpreceiver.cc b/pdns/tcpreceiver.cc
index ddd9cf222133b833860fc3dc836d8e939aeb1529..c4b107428254478c9e2f34f3c5735c219dcdfb91 100644 (file)
--- a/pdns/tcpreceiver.cc
+++ b/pdns/tcpreceiver.cc
@@ -1021,7 +1021,7 @@ int TCPNameserver::doIXFR(shared_ptr<DNSPacket> q, int outsock)
   }
 
   string soaedit;
-  dk.getFromMeta(target, "SOA-EDIT", soaedit);
+  dk.getSoaEdit(target, soaedit);
   if (!rfc1982LessThan(serial, calculateEditSOA(sd, soaedit))) {
     TSIGRecordContent trc;
     string tsigkeyname, tsigsecret;