1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppoCopyright (C) 1999, 2000 Internet Software Consortium.

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppoSee COPYRIGHT in the source root or http://isc.org/copyright.html for terms.

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo

28b1e50e4eed7be353f9778497714aab53ef2a0dSriharsha Basavapatna Zones

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo $Id: zone,v 1.8 2000/08/09 04:37:29 tale Exp $

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppoOverview

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo Zones are the unit of delegation in the DNS and may go from holding

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo RR's only at the zone top to holding the complete hierachy (private

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo roots zones). Zones have an associated database which is the

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo container for the RR sets that make up the zone.

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo Zone have certain properties associated with them.

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * name

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * class

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * master / slave / stub / hint / cache / forward

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * serial number

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * signed / unsigned

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * update periods (refresh / retry) (slave / stub)

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * last update time (slave / stub)

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * access restrictions

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * transfer restrictions (master / slave)

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * update restictions (master / slave)

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * expire period (slave / stub)

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * children => bottom

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * glue

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * rrsets / data

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * transfer "in" in progress

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * transfers "out" in progress

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * "current" check in progress

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * our masters

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * primary master name (required to auto generate our masters)

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * master file name

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * database name

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * database type

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * initially only master_file (BIND 4 & 8)

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * expanded axfr + ixfr

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * transaction logs

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * notification lists

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * NS's

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * static additional sites (stealth servers)

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * dynamically learned sites (soa queries)

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo Zones have two types of versions associated with them.

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo Type 1.

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo The image of the "current" zone when a AXFR out is in progress.

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo There may be several of these at once but they cease to need

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo to exist once the AXFR's on this version has completed. These

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo are maintained by the various database access methods.

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo Type 2.

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo These are virtual versions of the zone and are required to

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo support IXFR requests. While the entire contents of the old

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo version does not need to be kept, a change log needs to be

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo kept. An index into this log would be useful in speeding

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo up replies. These versions have an explict expiry date.

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo "How long are we going to keep them operationally?"

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo While there are expriry dates based on last update /

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo change time + expire. In practice holding the deltas

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo for a few refresh periods should be enough. If the network

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo and servers are up one is enough.

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo "How are we going to generate them from a master file?"

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo UPDATE should not be the only answer to this question.

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo We need a tool that takes the current zone & new zone.

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo Verifies the new zone, generates a delta and feeds this

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo at named. It could well be part of ndc but does not have

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo to be.

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo

28b1e50e4eed7be353f9778497714aab53ef2a0dSriharsha Basavapatna

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo Zones need to have certain operations performed on them. The need to

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo be:

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * loaded

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * unloaded

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * dumped

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * updated (UPDATE / IXFR)

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * copied out in full (AXFR) or as partial deltas (IXFR)

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * read from

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * validated

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * generate a delta between two given versions.

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * signed / resigned

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * maintenance

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo validate current soa

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo remove old deltas / consolidation

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo purge stale rrsets (cache)

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo * notification

1ae0874509b6811fdde1dfd46f0d93fd09867a3fheppo responding to

generating

While not strictly a nameserver function, bad delegation and bad

slave setups are continual and ongoing sources of problems in the

DNS. Periodic checks to ensure parent and child servers agree on

the list of nameservers and that slaves are tracking the changes

made in the master server's zone will allow problems in

configurations to be identified earlier providing for a more stable

DNS.

Compatability:

Zones are required to be configuration file compatable with

BIND 8.x.

Types:

typedef enum {

dns_zone_none = 0,

dns_zone_master,

dns_zone_slave,

dns_zone_stub,

dns_zone_hint,

dns_zone_cache,

dns_zone_forward

} dns_zonetypes_t;

typedef struct dns_ixfr dns_ixfr_t;

struct dns_ixfr {

unsigned int magic; /* IXFR */

isc_uint32_t serial;

time_t expire;

unsigned int offset;

ISC_LINK(dns_ixfr_t) link;

};

struct dns_zone {

unsigned int magic; /* ZONE */

dns_name_t name;

dns_rdataclass_t class;

dns_zonetypes_t type;

dns_bt_t top;

isc_uint32_t version;

isc_uint32_t serial;

isc_uint32_t refresh;

isc_uint32_t retry;

isc_uint32_t serial;

char *masterfile;

dns_acl_t *access;

dns_acl_t *transfer;

struct {

dns_acl_t *acl;

dns_scl_t *scl; /* tsig based acl */

} update;

char *database;

ISC_LIST(dns_ixfr_t) ixfr;

...

};

Operations:

Loading:

Functions:

void

dns_zone_init(dns_zone_t *zone, dns_rdataclass_t class, isc_mem_t *mxtc);

void

dns_zone_invalidate(dns_zone_t *zone);

void

dns_ixfr_init(dns_ixfr_t *ixfr, unsigned long serial, time_t expire);

void

dns_ixfr_invalidate(dns_ixfr_t *ixfr);

dns_zone_axfrout(dns_zone_t *zone);

Initiate outgoing zone transfer.

dns_zone_axfrin(dns_zone_t *zone, isc_sockaddr_t *addr);

Initiate transfer of the zone from the given server or the

masters masters listed in the zone structure.

dns_zone_maintenance(dns_zone_t *zone);

Perform any maintenance operations required on the zone

* initiate up to date checks

* expire zones

* initiate ixfr version expire consolidation

dns_zone_locateprimary(dns_zone_t *zone);

Working from the root zone locate the primary master for the zone.

Used if masters are not given in named.conf.

dns_zone_locateservers(dns_zone_t *zone);

Working from the root zone locate the servers for the zone.

Primary master moved to first in list if in NS set. Remove self

from list.

Used if masters are not given in named.conf.

dns_zone_notify(dns_zone_t *);

Queue notify messages.

dns_zone_checkparents(dns_zone_t *);

check that the parent nameservers NS lists for this zone agree with

the NS list this zone, check glue A records. Warn if not identical.

This operation is performed on master zones.

dns_zone_checkchildren(dns_zone_t *);

check that the child zones NS lists agree with the NS lists in this

zone, check glue records. Warn if not identical.

dns_zone_checkservers(dns_zone_t *);

check that all the listed servers for the zone agree on NS list and

serial number. NOTE only errors which continue over several refresh

periods to be reported.

dns_zone_dump(dns_zone_t *, FILE *fp);

Write the contents of the zone to the file associated with fp.

dns_zone_validate(dns_zone_t *);

Validate the zone contents using DNSSEC.

dns_zone_tordatalist(dns_zone_t *zone, dns_rdatalist_t *list)

dns_zone_addmaster(dns_zone_t *zone, isc_sockaddr_t *addr);

Add addr to the set of masters for the zone.

dns_zone_clearmasters(dns_zone_t *zone);

Clear the master set.

dns_zone_setreadacl(dns_zone_t *, dns_acl_t *)

dns_zone_setxfracl(dns_zone_t *, dns_acl_t *)

dns_zone_addnotify(dns_zone_t *, isc_sockaddr_t *addr, isc_boolean_t perm);

dns_zone_clearnotify(dns_zone_t *)

dns_zone_load(dns_zone_t *);

dns_zone_consolidate(dns_zone_t *);

Consolidate on disk copy of zone.