BIND 10 trac1371, updated. fb33c8d379f9e75b82edafff45d4dc13fda62630 [1371] updated the man page about recently added configurations
BIND 10 source code commits
bind10-changes at lists.isc.org
Sun Nov 20 19:10:56 UTC 2011
The branch, trac1371 has been updated
via fb33c8d379f9e75b82edafff45d4dc13fda62630 (commit)
via 4f02b45248227dd98904b61bbcd2e6cff36b5fd6 (commit)
from 54d9d7c1597df3bcdf47d07db040f63f7008c6a7 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit fb33c8d379f9e75b82edafff45d4dc13fda62630
Author: JINMEI Tatuya <jinmei at isc.org>
Date: Sun Nov 20 11:10:22 2011 -0800
[1371] updated the man page about recently added configurations
commit 4f02b45248227dd98904b61bbcd2e6cff36b5fd6
Author: JINMEI Tatuya <jinmei at isc.org>
Date: Sun Nov 20 10:52:24 2011 -0800
[1371] updated the bind10 guide about xfrout (IXFR support, ACL configuration)
-----------------------------------------------------------------------
Summary of changes:
doc/guide/bind10-guide.xml | 66 ++++++++++++++++++++++++++++++++++++----
src/bin/xfrout/b10-xfrout.xml | 25 +++++++++++++++
2 files changed, 84 insertions(+), 7 deletions(-)
-----------------------------------------------------------------------
diff --git a/doc/guide/bind10-guide.xml b/doc/guide/bind10-guide.xml
index 21bb671..711b144 100644
--- a/doc/guide/bind10-guide.xml
+++ b/doc/guide/bind10-guide.xml
@@ -1369,20 +1369,72 @@ what if a NOTIFY is sent?
The <command>b10-xfrout</command> process is started by
<command>bind10</command>.
When the <command>b10-auth</command> authoritative DNS server
- receives an AXFR request, <command>b10-xfrout</command>
- sends the zone.
- This is used to provide master DNS service to share zones
+ receives an AXFR or IXFR request, <command>b10-auth</command>
+ internally forwards the request to <command>b10-xfrout</command>,
+ which handles the rest of request processing.
+ This is used to provide primary DNS service to share zones
to secondary name servers.
The <command>b10-xfrout</command> is also used to send
- NOTIFY messages to slaves.
+ NOTIFY messages to secondary servers.
</para>
+ <para>
+ A global or per zone <option>transfer_acl</option> configuration
+ can be used to control accessibility of the outbound zone
+ transfer service.
+ By default, <command>b10-xfrout</command> allows any clients to
+ perform zone transfers for any zones:
+ </para>
+
+ <screen>> <userinput>config show Xfrout/transfer_acl</userinput>
+Xfrout/transfer_acl[0] {"action": "ACCEPT"} any (default)</screen>
+
+ <para>
+ You can change this to, for example, rejecting all transfer
+ requests by default while allowing requests for the transfer
+ of zone "example.com" from 192.0.2.1 and 2001:db8::1 as follows:
+ </para>
+
+ <screen>> <userinput>config set Xfrout/transfer_acl[0] {"action": "REJECT"}</userinput>
+> <userinput>config add Xfrout/zone_config</userinput>
+> <userinput>config set Xfrout/zone_config[0]/origin "example.com"</userinput>
+> <userinput>config set Xfrout/zone_config[0]/transfer_acl [{"action": "ACCEPT", "from": "192.0.2.1"},</userinput>
+<userinput> {"action": "ACCEPT", "from": "2001:db8::1"}]</userinput>
+> <userinput>config commit</userinput></screen>
+
<note><simpara>
- The current development release of BIND 10 only supports
- AXFR. (IXFR is not supported.)
- Access control is not yet provided.
+ In the above example the lines
+ for <option>transfer_acl</option> were divided for
+ readability. In the actual input it must be in a single line.
</simpara></note>
+ <para>
+ If you want to require TSIG in access control, a separate TSIG
+ "key ring" must be configured specifically
+ for <command>b10-xfrout</command> as well as a system wide
+ key ring, both containing a consistent set of keys.
+ For example, to change the previous example to allowing requests
+ from 192.0.2.1 signed by a TSIG with a key name of
+ "key.example", you'll need to do this:
+ </para>
+
+ <screen>> <userinput>config set tsig_keys/keys ["key.example:<base64-key>"]</userinput>
+> <userinput>config set Xfrout/tsig_keys/keys ["key.example:<base64-key>"]</userinput>
+> <userinput>config set Xfrout/zone_config[0]/transfer_acl [{"action": "ACCEPT", "from": "192.0.2.1", "key": "key.example"}]</userinput>
+> <userinput>config commit</userinput></screen>
+
+ <para>
+ The first line of configuration defines a system wide key ring.
+ This is necessary because the <command>b10-auth</command> server
+ also checks TSIGs and it uses the system wide configuration.
+ </para>
+
+ <note><simpara>
+ In a future version, <command>b10-xfrout</command> will also
+ use the system wide TSIG configuration.
+ The way to specify zone specific configuration (ACLs, etc) is
+ likely to be changed, too.
+ </simpara></note>
<!--
TODO:
diff --git a/src/bin/xfrout/b10-xfrout.xml b/src/bin/xfrout/b10-xfrout.xml
index 9889b80..4f6a7fa 100644
--- a/src/bin/xfrout/b10-xfrout.xml
+++ b/src/bin/xfrout/b10-xfrout.xml
@@ -98,6 +98,31 @@
that can run concurrently. The default is 10.
</para>
<para>
+ <varname>tsig_key_ring</varname>
+ A list of TSIG keys (each of which is in the form of
+ name:base64-key[:algorithm]) used for access control on transfer
+ requests.
+ The default is an empty list.
+ </para>
+ <para>
+ <varname>transfer_acl</varname>
+ A list of ACL elements that apply to all transfer requests by
+ default (unless overridden in zone_config). See the BIND 10
+ guide for configuration examples.
+ The default is an element that allows any transfer requests.
+ </para>
+ <para>
+ <varname>zone_config</varname>
+ A list of JSON objects (i.e. maps) that define per zone
+ configuration concerning <command>b10-xfrout</command>.
+ The supported names of each object are "origin" (the origin
+ name of the zone), "class" (the RR class of the zone, optional,
+ default to "IN"), and "acl_element" (ACL only applicable to
+ transfer requests for that zone).
+ See the BIND 10 guide for configuration examples.
+ The default is an empty list, that is, no zone specific configuration.
+ </para>
+ <para>
<varname>log_name</varname>
<!-- TODO -->
</para>
More information about the bind10-changes
mailing list