serverless-glueless

diff --git a/scripts/named-conf b/scripts/named-conf
index 054ba0f96920e0e69c82eec619c5c3294e79696f..26b5ea7fca274cf959433b3915fb52d864913f17 100755 (executable)
--- a/scripts/named-conf
+++ b/scripts/named-conf
@@ -92,8 +92,8 @@ $slave_dir= 'slave';
 $slave_prefix= '';
 $slave_suffix= '';
 
 $slave_prefix= '';
 $slave_suffix= '';
 

-use vars qw(@self_ns @self_soa @self_addr @forbid_addr);
-@self_ns= @self_soa= @self_addr= @forbid_addr= ();
+use vars qw(@self_ns @self_soa @self_addr @forbid_addr @conv_glueless);
+@self_ns= @self_soa= @self_addr= @forbid_addr= @conv_glueless= ();

 
 use vars qw(%zone_cfg @zone_cfg_list);
 %zone_cfg= ();
 
 use vars qw(%zone_cfg @zone_cfg_list);
 %zone_cfg= ();


@@ -146,6 +146,8 @@ sub read_config ($) {
            @self= split /\s+/, $2;
            @self_ns= @self if $1 ne '-soa';
            @self_soa= @self if $1 ne '-ns';
            @self= split /\s+/, $2;
            @self_ns= @self if $1 ne '-soa';
            @self_soa= @self if $1 ne '-ns';

+       } elsif (m/^serverless\-glueless\s+(\S.*\S)/) {
+           @conv_glueless= split /\s+/, $1;

        } elsif (m/^self\-addr\s+([0-9. \t]+)/) {
            @self_addr= split /\s+/, $1;
        } elsif (m/^forbid\-addr(?:\s+([0-9. \t]+))?/) {
        } elsif (m/^self\-addr\s+([0-9. \t]+)/) {
            @self_addr= split /\s+/, $1;
        } elsif (m/^forbid\-addr(?:\s+([0-9. \t]+))?/) {


@@ -400,7 +402,8 @@ sub zone_check_nsrrset ($$$$) {
        if (!@glue) {
            zone_warning("glueless NS $s,".($needglue<=1 ? " (eg)" : ""),
                         $ww)
        if (!@glue) {
            zone_warning("glueless NS $s,".($needglue<=1 ? " (eg)" : ""),
                         $ww)

-               unless $glueless_ok || !$needglue;
+               unless $glueless_ok || !$needglue ||
+                      grep { has_suffix_of($s,".$_"); } @conv_glueless;

            next;
        }
        $glue= join ' ', sort @glue;
            next;
        }
        $glue= join ' ', sort @glue;


@@ -415,6 +418,12 @@ sub zone_server_addr ($$$$$) {
     my ($addr,$name,$ww,$wwq,$is_soa) = @_;
     $addr_is_ok{$addr}= "$name ($wwq)"
        if $is_soa || $cfg->{'s'} =~ m/u/;
     my ($addr,$name,$ww,$wwq,$is_soa) = @_;
     $addr_is_ok{$addr}= "$name ($wwq)"
        if $is_soa || $cfg->{'s'} =~ m/u/;

+    foreach $cg (@conv_glueless) {
+       next unless has_suffix_of(".$s",".$cg");
+       zone_warning("nameserver [$addr] $name in serverless-glueless".
+                    " namespace area $cg",
+                    $ww);
+    }

     zone_warning("configured as stealth but we [$addr] $name are published",
                 $ww)
        if $cfg->{'s'} =~ m/u/ && grep { $_ eq $addr } @self_addr;
     zone_warning("configured as stealth but we [$addr] $name are published",
                 $ww)
        if $cfg->{'s'} =~ m/u/ && grep { $_ eq $addr } @self_addr;


@@ -621,6 +630,13 @@ sub debug_trace ($) {
     print "D $_[0]\n";
 }
 
     print "D $_[0]\n";
 }
 

+sub has_suffix_of ($$) {
+    my ($whole,$suffix);
+    return 0 if length $while < length $suffix;
+    return 0 if substr($whole, length($whole) - length($suffix)) ne $suffix;
+    return 1;
+}
+

 sub lookup ($$$) {
     my ($domain,$type,$okrcodes) = @_;
     my ($c,$h,@result);
 sub lookup ($$$) {
     my ($domain,$type,$okrcodes) = @_;
     my ($c,$h,@result);

diff --git a/scripts/named-conf.8 b/scripts/named-conf.8
index d7887085775bd7f63a04bdc4b8c7e5ef5575404a..2316c9de9fe479189344ebe621902d343cea1d3b 100644 (file)
--- a/scripts/named-conf.8
+++ b/scripts/named-conf.8
@@ -134,6 +134,20 @@ option is specified.
 Specifies the list of addresses that are forbidden as any nameserver
 for any zone.  The default is no such addresses.
 .TP
 Specifies the list of addresses that are forbidden as any nameserver
 for any zone.  The default is no such addresses.
 .TP

+\fBserverless\-glueless\fP \fIdomain ...\fP
+Specifies a list of domains under which we do not expect to find any
+nameservers; for these zones it is OK to find glueless referrals.
+Each domain listed names a complete subtree of the DNS, starting at
+the named point.  The default is
+.BR "in\-addr.arpa ip6.arpa ip6.int" .
+
+To avoid indefinitely long or even circularly glueless referrals
+(which delay or prevent lookups) it is necessary for all sites to
+effectively implement similar conventions; currently the author
+believes that only the reverse lookup namespaces are conventionally
+devoid of nameservers, and therefore fine to provide glueless
+referrals for.
+.TP

 \fBoutput\fP \fIformat\fP \fIfilename\fP [\fIformat\fP \fIfilename ...\fP]
 Arranges that each
 .I filename
 \fBoutput\fP \fIformat\fP \fIfilename\fP [\fIformat\fP \fIfilename ...\fP]
 Arranges that each
 .I filename