BIND 10 #2038: zonemgr's config_handler doesn't provide strong exception guarantee

[BIND 10 Development]

#2038: zonemgr's config_handler doesn't provide strong exception guarantee
-------------------------------------+-------------------------------------
                   Reporter:         |                 Owner:
  jinmei                             |                Status:  new
                       Type:         |             Milestone:  Next-Sprint-
  defect                             |  Proposed
                   Priority:  high   |            Resolution:
                  Component:         |             Sensitive:  0
  secondary manager                  |           Sub-Project:  DNS
                   Keywords:         |  Estimated Difficulty:  0
            Defect Severity:  N/A    |           Total Hours:  0
Feature Depending on Ticket:         |
        Add Hours to Ticket:  0      |
                  Internal?:  0      |
-------------------------------------+-------------------------------------
Description changed by jinmei:

Old description:

> If I read it correct, zonemgr can partially update its internal
> configuration when it encounters an error in the middle of the update
> handler.  In particular, it can even partially update the
> "secondary_zones" list if there's an error in the middle of the list.
>
> This is generally bad, but now that ddns shares the config info it's
> even more serious: zonemgr and ddns could keep running with
> inconsistent information.  (And I misunderstood another related point:
> I thought cfgmr sent updates to "observer" modules that shows their
> interest in remote configs via add_remote_config, but on a closer look
> I realized cfgmgr doesn't actually distinguish the "real" module and
> "observers", and just broadcasts updates to all registered modules.
> IMO this behavior is also bad and should be fixed, but that's another
> topic).

New description:

 If I read it correct, zonemgr can partially update its internal
 configuration when it encounters an error in the middle of the update
 handler.  In particular, it can even partially update the
 "secondary_zones" list if there's an error in the middle of the list.

 This is generally bad, but now that ddns shares the config info it's
 even more serious: zonemgr and ddns could keep running with
 inconsistent information.  (And I misunderstood another related point:
 I thought cfgmr sent updates to "observer" modules that shows their
 interest in remote configs via add_remote_config only after the "real"
 module validated it, but on a closer look I realized cfgmgr doesn't
 actually distinguish the "real" module and "observers", and just
 broadcasts updates to all registered modules.  IMO this behavior is
 also bad and should be fixed, but that's another topic).

--

-- 
Ticket URL: <https://bind10.isc.org/ticket/2038#comment:1>
BIND 10 Development <http://bind10.isc.org>
BIND 10 Development