Google

Edit File: rebuilddnsconfig

#!/usr/local/cpanel/3rdparty/bin/perl

#                                      Copyright 2024 WebPros International, LLC
#                                                           All rights reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited.

use strict;
use warnings;

use Cpanel::DNSLib                  ();
use Cpanel::OS                      ();
use Cpanel::FileUtils::Move         ();
use Cpanel::FileUtils::Copy         ();
use Cpanel::Path                    ();
use Cpanel::StringFunc::Count       ();
use Cpanel::StringFunc::Match       ();
use Cpanel::SafetyBits              ();
use Cpanel::NameServer::Conf        ();
use Cpanel::NameServer::Utils::BIND ();
use Cpanel::Validate::Domain::Tiny  ();
use Cpanel::DNSLib                  ();
use Cpanel::SafeDir::MK             ();

use Getopt::Std;
$Getopt::Std::STANDARD_HELP_VERSION = 1;

######[ declare some globals ]#####################################################################

# default location of zone files used for rebuilding named.conf
my $def_basedir;

# default location of named.conf
my $def_namedconf;

# default log directory for named
my $def_logdir;

# default location of pidfile
my $def_pidfile = '/var/run/named/named.pid';

# Verbose variable, if set to "1" actions are reported to STDOUT.
my $cpverbose = 0;

# We sent this to fixrndc, if it sends it back that means we've got a loop
my $selfcalled = 0;

my %options = ();
getopts( 'sfv', \%options );
if ( defined( $options{'v'} ) ) { $cpverbose  = 1; }
if ( defined( $options{'s'} ) ) { $selfcalled = 1; }

if ( $selfcalled == 1 ) {
    print "Loop detected, exiting.\n";
    exit;
}

######[ set defaults based on distro/OS ]##########################################################

$def_basedir   = Cpanel::OS::dns_named_basedir();    # /var/named
$def_namedconf = Cpanel::OS::dns_named_conf();       # /etc/named.conf
$def_logdir    = Cpanel::OS::dns_named_log();        # /var/log/named
my $perms_hr = Cpanel::OS::var_named_permissions();

######[ ensure base directory structure is created ]###############################################

my ( $chrootdir, $binduser, $bindgroup ) = Cpanel::NameServer::Utils::BIND::find_chrootbinddir();
my $binduid = getpwnam($binduser)  || die "$binduser not in passwd file";
my $bindgid = getgrnam($bindgroup) || die "$bindgroup not configured on the system";

# Set up directory structure
if ( !-d $def_basedir ) {
    if ( -e _ ) {
        Cpanel::FileUtils::Move::safemv( $def_basedir, $def_basedir . '.cpback' );
    }
    Cpanel::SafeDir::MK::safemkdir( $def_basedir, $perms_hr->{'mode'} );
}
else {
    chmod( $perms_hr->{'mode'}, $def_basedir ) or warn "Can't chmod $def_basedir to $perms_hr->{'mode'}: $!";
}
Cpanel::SafetyBits::safe_chown( $perms_hr->{'ownership'}->@*, $def_basedir );

# I would have added the above to iterator but for the differing owner on c9
my @dirs2create = ( "$def_basedir/data", $def_logdir, '/var/run/named' );
my @chrootdirs  = map { $chrootdir . $_ } qw{/etc /var /var/named /var/named/data /var/run /var/run/named};
push @dirs2create, @chrootdirs if $chrootdir;
foreach my $dir (@dirs2create) {
    Cpanel::SafeDir::MK::safemkdir_or_die( $dir, 0755 ) if !-e $dir;
    Cpanel::SafetyBits::safe_chown( $binduid, $bindgid, $dir );
}

my @rfc1912_files = qw{localdomain.zone named.broadcast named.ip6.local named.local named.zero named.rfc1912.zones};
if ( grep { !-e $_ } map { $def_basedir . "/$_" } @rfc1912_files ) {

# RFC1912
    Cpanel::FileUtils::Copy::safecopy( '/usr/local/cpanel/scripts/named.rfc1912.zones', "$def_basedir/named.rfc1912.zones" );
    system 'tar', 'xvf', '/usr/local/cpanel/scripts/rfc1912_zones.tar', '-C', $def_basedir;    # uses new .tar without the ./named/ directory so we can use it for both
    if ($chrootdir) {
        system 'tar', 'xvf', '/usr/local/cpanel/scripts/rfc1912_zones.tar', '-C', $chrootdir . '/var/named';
    }
}

######[ create a brand new named.conf from a default template if needed ]##########################

if ( !-e $def_namedconf || -z _ ) {    # no named.conf or zero bytes

print "Installing default Bind configuration\n" if $cpverbose;

#>>>>>[ Write default configuration w/ proper basedir ]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

if ( open my $conf_fh, '>', $def_namedconf ) {
        foreach (&getdefault_nameddotconf) {
            s/###BASE_DIR###/$def_basedir/g;
            s/###PID_FILE###/$def_pidfile/g;
            print {$conf_fh} $_;
        }
        close $conf_fh;
    }

clearcache();

# Reset ownership
    Cpanel::SafetyBits::safe_recchown( 'named', 'named', $def_basedir );

# Force
    $options{'f'} = 1;
}
else {
    # As of BIND 9.16
    # The keyword additional_from_cache_line will cause a warning
    # As of BIND 9.18
    # The keyword additional_from_cache_line will cause an error
    # Strip that out if it exists and we are on BIND 9.16+

my $named_ref = Cpanel::NameServer::Utils::BIND::named_version();
    if ( $named_ref->{success} && ( "$named_ref->{major}.$named_ref->{minor}" >= 9.16 ) ) {
        require Path::Tiny;

my $file         = Path::Tiny::path($def_namedconf);
        my @lines        = $file->lines();
        my @output_lines = grep { $_ !~ m/additional-from-cache/ } @lines;
        $file->spew(@output_lines);
    }
}

my $dnslib = Cpanel::DNSLib->new();

my $needpid = 0;

######[> Ensure all .db's have an entry in named.conf and vice versa >]############################

# suck up all zones of the named.conf and zone dir in memory for fast parsing, heavy on mem side but better than thrashing hdd

my $ndc_fh;

my $namedconf_obj = Cpanel::NameServer::Conf->new();

# start with a freshly rebuild conf file when force is specified (also happens when named.conf was empty)
if ( $options{'f'} && $namedconf_obj->type() ne 'bind' ) {
    $namedconf_obj->rebuild_conf();
}
my %current_zone_entries = map { $_ => 1 } @{ $namedconf_obj->fetchzones() };

opendir my $zone_dh, $def_basedir or die "Unable to read zone file directory $def_basedir: $!";
my @zonedir_contents = readdir($zone_dh);
closedir $zone_dh;

my %current_zone_files = ();
foreach my $zonefile (@zonedir_contents) {
    if ( $zonefile =~ /^([\w\-.]+)\.db$/ && Cpanel::Validate::Domain::Tiny::validdomainname($1) ) {
        $current_zone_files{$1} = 1;
    }
}

my %bad_zones = %current_zone_entries;
delete @bad_zones{ keys %current_zone_files };
delete $bad_zones{'.'};

my %missing_zones = %current_zone_files;
delete @missing_zones{ keys %current_zone_entries };

# make sure all zones.db files have entry in named.conf
# Add missing files to named.conf
if ( scalar keys %missing_zones ) {
    print "Adding zones " . join( ' ', keys %missing_zones ) . "\n" if $cpverbose;
    $namedconf_obj->addzones( keys %missing_zones );
}

# make sure all entries in named.conf have zone files
if ( scalar keys %bad_zones ) {
    print 'Removing zones ' . join( ' ', keys %bad_zones ) . " from configuration, zonefiles missing\n" if $cpverbose;
    $namedconf_obj->removezones( keys %bad_zones );
}

$namedconf_obj->finish();

######[> Handle chroot setups >]###################################################################

# This logic is required due to how bind-chroot symlinks /etc/named.conf to the chroot location
# And how File::Copy will not follow the symlinks, but will recreate them instead
if ( -l $def_namedconf ) {
    my $target = readlink $def_namedconf;
    print "Symlink detected: $target\n";

if ( open( $ndc_fh, '<', $target ) ) {
        unlink $def_namedconf;
        print "Restoring $def_namedconf from $target before proceeding\n";
        Cpanel::FileUtils::Copy::safecopy( $target, $def_namedconf );
    }
    else {
        print "Failed to read symlinked $def_namedconf [$target]. Cannot continue.\n";
        exit 1;
    }
}
else {
    open( $ndc_fh, "<", $def_namedconf );
}

open( my $ndf_fh, ">", $def_namedconf . '.rebuilddnsconfig' );

if ( !$ndc_fh ) {
    open( $ndc_fh, "<", $def_namedconf );
}

my $inc               = 0;
my $firstline         = 0;
my $numbrace          = 0;
my $zonemarker        = 0;
my $cppcomment        = 0;
my $currzone          = '';
my $skip_next_opening = 0;
my $zonedir           = Cpanel::DNSLib::find_zonedir();

while (<$ndc_fh>) {

# Rudamentary comment exclusion.
    if ($cppcomment) {
        if (m/\*\//) {
            $cppcomment = 0;
        }
        print $ndf_fh $_;
        next;
    }
    if (m/^\s*\#/) {
        print $ndf_fh $_;
        next;
    }
    if (m/^\s*\/\//) {
        print $ndf_fh $_;
        next;
    }
    if (m/^\s*\/\*/) {
        $cppcomment = 1;
        print $ndf_fh $_;
        next;
    }
    if ( $skip_next_opening && m/^\s*\{\s*$/ ) {
        $skip_next_opening = 0;
        $numbrace++;
        next;
    }
    next if m/bind.conf.wp/;
    next if ( m/\s*include\s+/ && m/rndc.key/ );
    if ( $needpid && m/pid-file/ ) {
        next;
    }

if (m/\s*zone\s+["']([^"']+)/) {
        $zonemarker = 1;
        $currzone   = $1;
    }
    elsif (m/\s*include\s+["']([^"']+)/) {
        my $file      = $1;
        my $filemtime = ( stat($file) )[9];
        if ( -f _ ) {
            copytochroot( $file, $filemtime );
        }
    }

if ($zonemarker) {
        $numbrace += Cpanel::StringFunc::Count::get_curly_brace_count($_);

if ( $numbrace == 0 ) {
            $zonemarker = 0;
        }

if (m/(.*[\s\t\;\{])file\s+(["'])([^"']+)(.*)/) {
            my $postfile    = $4;
            my $file        = $3;
            my $prefile     = $2;
            my $space       = $1;
            my $relativedir = '';
            my $fileold     = $file;

if ( !Cpanel::StringFunc::Match::beginmatch( $file, '/' ) ) {
                if ( $file =~ m/^([^\/]+)/ ) {
                    $relativedir = $1;
                }
            }

my $filename = $file;
            if ( $file =~ m/([^\/]+)$/ ) {
                $filename = $1;
            }

my $filenew = $zonedir . '/' . $filename;

if ( $file eq $filenew ) {
                print $ndf_fh $_;
            }
            elsif ( !Cpanel::StringFunc::Match::beginmatch( $file, '/' ) ) {
                $file = $filenew;
                print "Updating $fileold to $filenew\n";

#print $ndf_fh "${space}file ${prefile}${filenew}${postfile}";
            }
            else {
                if ( !Cpanel::StringFunc::Match::beginmatch( $file, '/dev/' ) ) {
                    $filenew = $zonedir . '/' . $filename;
                    print "Updating $file to $filenew\n";

#print $ndf_fh "${space}file ${prefile}${filenew}${postfile}";
                }
                else {
                    $filenew = $file;
                    print $ndf_fh $_;
                }
            }

my $absfilename = '';

if ( $relativedir ne '' ) {
                $absfilename = Cpanel::Path::relative2abspath( $relativedir, $zonedir ) . '/' . $filename;
            }
            if ( $absfilename ne '' && -e $absfilename ) {
                $file = $absfilename;
            }

my ( $fileinode,    $filemtime )    = stat($file);
            my ( $filenewinode, $filenewmtime ) = stat($filenew);

if ( !$filemtime ) {
                print "!! $file does not exist, unable to locate.\n";
                print "!! Run /usr/local/cpanel/scripts/cleandns to remove zone without corresponding files.\n";
                print "!! Or locate the proper zone file and place in $zonedir and rerun\n";
                print "!! This script with the following options: /script/fixndc -fv\n";
                next;
            }

if ( !$filenewmtime ) {
                print "Moving $file to $filenew ...\n";
                Cpanel::FileUtils::Move::safemv( $file, $filenew );
            }
            elsif ( $fileinode != $filenewinode && ( $filenewmtime > time() || $filemtime > $filenewmtime ) ) {    # timewarp safe
                Cpanel::FileUtils::Copy::safecopy( $file, $filenew );
                Cpanel::SafetyBits::safe_chown( $binduser, $bindgroup, $filenew );
            }

copytochroot( $filenew, $filemtime );
            next;
        }
    }

# Match for zone and file declaration on one line.
    if ( m/.*[\s\t\;\{]file\s+["'][^"']+/ && m/[\s\;]*zone/ ) {
        m/(.*[\s\t\;\{])file\s+["']([^"']+)(.*)/;
        my $file        = $2;
        my $space       = $1;
        my $space2      = $3;
        my $relativedir = '';

my $currzone = '';
        my $delim    = '"';
        if (m/\s*zone\s+(["'])([\w\-\.]+)["']/) {
            $zonemarker = 1;
            $currzone   = $2;
            $delim      = $1;
        }
        m/zone\s+(.*)/;
        $numbrace += Cpanel::StringFunc::Count::get_curly_brace_count($1);
        if ( $numbrace <= 0 ) {
            $zonemarker = 0;
        }

if ( !Cpanel::StringFunc::Match::beginmatch( $file, '/' ) ) {
            if ( $file =~ m/^([^\/]+)/ ) {
                $relativedir = $1;
            }
        }
        my $filename = $file;
        if ( $file =~ m/([^\/]+)$/ ) {
            $filename = $1;
        }
        my $filenew = $zonedir . '/' . $filename;

if ( $file eq $filenew ) {
            print $ndf_fh $_;
        }
        elsif ( !Cpanel::StringFunc::Match::beginmatch( $file, '/' ) ) {
            $file = $filenew;
            print "Updating $file to $filenew\n";

#print $ndf_fh "${space}file ${delim}${filenew}${space2}";
        }
        else {
            if ( !Cpanel::StringFunc::Match::beginmatch( $file, '/dev/' ) ) {
                $filenew = $zonedir . '/' . $filename;
                print "Updating $file to $filenew\n";

#print $ndf_fh "${space}file ${delim}${filenew}${space2}";
            }
            else {
                $filenew = $file;
                print $ndf_fh $_;
            }
        }

my $absfilename = '';
        if ($relativedir) {
            $absfilename = Cpanel::Path::relative2abspath( $relativedir, $zonedir ) . '/' . $filename;
        }
        if ( $absfilename ne '' && -e $absfilename ) {
            $file = $absfilename;
        }

my $mtime = 0;
        if ( -e $file ) {
            $mtime = ( stat(_) )[9];
            if ( !-e $filenew ) {
                print "Moving $file to $filenew ...\n";
                Cpanel::FileUtils::Move::safemv( $file, $filenew );
            }
            elsif (( stat($file) )[1] != ( stat($filenew) )[1]
                && ( ( stat($filenew) )[9] > time() || $mtime > ( stat($filenew) )[9] ) ) {    # timewarp safe
                Cpanel::FileUtils::Copy::safecopy( $file, $filenew );
                Cpanel::SafetyBits::safe_chown( $binduser, $bindgroup, $filenew );
            }
        }
        else {
            print "!! $file does not exist, unable to locate.\n";
            print "!! Run /usr/local/cpanel/scripts/cleandns to remove zone without corresponding files.\n";
            print "!! Or locate the proper zone file and place in $zonedir and rerun\n";
            print "!! This script with the following options: /script/fixndc -fv\n";
            $filenew = '';
        }

if ( $filenew ne '' ) {
            copytochroot( $filenew, $mtime );
        }
    }

if ( !$inc ) {
        print $ndf_fh $_;
    }
    else {
        if ($firstline) {
            $firstline = 0;
            next;
        }
        $numbrace += Cpanel::StringFunc::Count::get_curly_brace_count($_);
        if ( $numbrace == 0 ) {
            $inc = 0;
        }
    }

if ( $needpid && m/^\s*options\s*/ ) {
        if ( !m/\{/ ) {

#print $ndf_fh "{\n\tpid-file \"/var/run/named/pid\"\;\n";
            $skip_next_opening = 1;
        }
        else {

#print $ndf_fh "\tpid-file \"/var/run/named/pid\"\;\n";
        }
        next;
    }
}

close $ndc_fh;
close $ndf_fh;

Cpanel::FileUtils::Copy::safecopy( $def_namedconf, $def_namedconf . '.prerebuilddnsconfig' );

clearcache();

Cpanel::SafetyBits::safe_chown( $binduser, $bindgroup, $def_namedconf );

if ( $chrootdir ne '' ) {
    print "Updated $def_namedconf in chroot directory\n" if $cpverbose;
    if ( -e $chrootdir . $def_namedconf ) {
        if ( ( stat($def_namedconf) )[1] != ( stat( $chrootdir . $def_namedconf ) )[1] ) {
            Cpanel::FileUtils::Copy::safecopy( $def_namedconf, $chrootdir . $def_namedconf );
            Cpanel::SafetyBits::safe_chown( $binduser, $bindgroup, $chrootdir . $def_namedconf );
        }
    }
    else {
        Cpanel::FileUtils::Copy::safecopy( $def_namedconf, $chrootdir . $def_namedconf );
        Cpanel::SafetyBits::safe_chown( $binduser, $bindgroup, $chrootdir . $def_namedconf );
    }
}

# Reset ownership of named.conf
print "Changing ownership of $def_namedconf: $binduser:$bindgroup\n" if $cpverbose;
Cpanel::SafetyBits::safe_chown( $binduser, $bindgroup, $def_namedconf );

if ( !-e '/var/cpanel/usensd' ) {
    print "Restarting Bind\n" if $cpverbose;
    system('/usr/local/cpanel/scripts/restartsrv_named');
}
else {

# This will also regenerate the zone database
    print "Restarting NSD\n" if $cpverbose;
    system('/usr/local/cpanel/scripts/restartsrv_nsd');
}

######[ call fixrndc to ensure working rndckey config ]############################################

if ( !-e '/var/cpanel/usensd' ) {

print "Running `/usr/local/cpanel/scripts/fixrndc -f` to check rndc key\n" if $cpverbose;
    my $opts = $cpverbose ? '-fvs' : '-fs';
    exec( '/usr/local/cpanel/scripts/fixrndc', $opts );
}

exit(0);

################################################################################
# sub copytochroot
################################################################################

sub copytochroot {
    my $filenew = shift;

# mtime of original file
    my $mtime = shift || 0;
    if ( $chrootdir ne '' ) {
        my $chrootfile = $chrootdir . $filenew;
        print "Copying $filenew to $chrootfile\n" if $cpverbose;
        my ( $fsinode, $fsmode, $fsuid, $fsgid, $fsmtime ) = ( stat($filenew) )[ 1, 2, 4, 5, 9 ];
        my $fsperms = $fsmode & 07777;
        if ( -e $chrootfile ) {
            my ( $chrootinode, $chrootmode, $chrootuid, $chrootgid, $chrootmtime ) = ( stat(_) )[ 1, 2, 4, 5, 9 ];
            my $chrootperms = $chrootmode & 07777;
            if ($mtime) {
                my $now = time();
                if ( $fsinode != $chrootinode
                    && ( $mtime > $chrootmtime || $mtime > $now || $chrootmtime > $now || $chrootuid != $binduid || $chrootgid != $bindgid || $chrootperms != $fsperms ) ) {    #timewarp safe
                    if ( Cpanel::FileUtils::Copy::safecopy( $filenew, $chrootfile ) ) {
                        print "Copied $filenew to chroot environment.\n" if $cpverbose;
                        Cpanel::SafetyBits::safe_chown( $binduser, $bindgroup, $chrootfile );
                        Cpanel::SafetyBits::safe_chmod( $fsperms, $chrootfile );
                        return 1;
                    }
                    else {
                        warn "Problem copying $filenew to $chrootdir";
                        return 0;
                    }
                }
                else {
                    print "$filenew already exists in chroot environment.\n" if $cpverbose;
                    return 1;
                }
            }
            else {
                if ( $fsinode != $chrootinode ) {
                    if ( Cpanel::FileUtils::Copy::safecopy( $filenew, $chrootfile ) ) {
                        Cpanel::SafetyBits::safe_chown( $binduser, $bindgroup, $chrootfile );
                        Cpanel::SafetyBits::safe_chmod( $fsperms, $chrootfile );
                        print "Copied $filenew to chroot environment.\n" if $cpverbose;
                        return 1;
                    }
                    else {
                        warn "Problem copying $filenew to $chrootdir";
                        return 0;
                    }
                }
                else {
                    if ( $chrootuid != $binduid || $chrootgid != $bindgid || $chrootperms != $fsperms ) {
                        Cpanel::SafetyBits::safe_chown( $binduser, $bindgroup, $chrootfile );
                        Cpanel::SafetyBits::safe_chmod( $fsperms, $chrootfile );
                    }
                    print "$filenew already exists in chroot environment.\n" if $cpverbose;
                    return 1;
                }
            }
            warn "Problem copying $filenew to chroot environment. This should not happen.";
            return 0;
        }
        elsif ( Cpanel::FileUtils::Copy::safecopy( $filenew, $chrootfile ) ) {
            print "Copied $filenew to chroot environment.\n" if $cpverbose;
            Cpanel::SafetyBits::safe_chown( $binduser, $bindgroup, $chrootfile );
            return 1;
        }
        else {
            warn "Problem copying $filenew to chroot environment.\n";
            return 0;
        }
    }
    return 0;
}

sub clearcache {
    if ( -e $def_namedconf . '.cache' ) {
        unlink( $def_namedconf . '.cache' );
    }

return;
}

######[ Default named.conf template ]##############################################################

sub getdefault_nameddotconf {
    my $bind_ipv6_line = '';
    if ( -f '/etc/cpanel/ipv6/range_allocation_data' ) {
        $bind_ipv6_line = "\n\    // Enable IPv6\n    listen-on-v6 { any; };   /* updated by cPanel */";
    }

my $additional_from_cache_line = "additional-from-cache no;";

# As of BIND 9.18
    # The keyword additional_from_cache_line will cause an error

my $named_ref = Cpanel::NameServer::Utils::BIND::named_version();
    if ( $named_ref->{success} && ( "$named_ref->{major}.$named_ref->{minor}" >= 9.18 ) ) {
        $additional_from_cache_line = "";
    }

return <<"EOC";
options {
    /* make named use port 53 for the source of all queries, to allow
         * firewalls to block all ports except 53:
         */

// query-source    port 53;
    $bind_ipv6_line
    recursion no;

/* We no longer enable this by default as the dns posion exploit
        has forced many providers to open up their firewalls a bit */

// Put files that named is allowed to write in the data/ directory:
    directory                "###BASE_DIR###"; // the default
    pid-file                 "###PID_FILE###";
    dump-file                "data/cache_dump.db";
    statistics-file          "data/named_stats.txt";
   /* memstatistics-file     "data/named_mem_stats.txt"; */
    allow-transfer    { "none"; };
};

logging {
        channel default_log {
                file "/var/log/named/named.log" versions 5 size 128M;
                print-time yes;
                print-severity yes;
                print-category yes;
                severity warning;
        };
        category default { default_log; };
        category general { default_log; };
};

// All BIND 9 zones are in a "view", which allow different zones to be served
// to different types of client addresses, and for options to be set for groups
// of zones.
//
// By default, if named.conf contains no "view" clauses, all zones are in the
// "default" view, which matches all clients.
//
// If named.conf contains any "view" clause, then all zones MUST be in a view;
// so it is recommended to start off using views to avoid having to restructure
// your configuration files in the future.

view "localhost_resolver" {
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
 * If all you want is a caching-only nameserver, then you need only define this view:
 */
    match-clients         { 127.0.0.0/24; };
    match-destinations    { localhost; };
    recursion yes;

// The root hint zone has been removed from the default named.conf.
    // You may add it again by uncommenting the following block:
    /*
    zone "." IN {
        type hint;
        file "###BASE_DIR###/named.ca";
    };
    */

/* these are zones that contain definitions for all the localhost
     * names and addresses, as recommended in RFC1912 - these names should
     * ONLY be served to localhost clients:
     */
    include "###BASE_DIR###/named.rfc1912.zones";
};

view "internal" {
/* This view will contain zones you want to serve only to "internal" clients
   that connect via your directly attached LAN interfaces - "localnets" .
 */
    match-clients        { localnets; };
    match-destinations    { localnets; };
    recursion yes;

// include "###BASE_DIR###/named.rfc1912.zones";
    // you should not serve your rfc1912 names to non-localhost clients.

// These are your "authoritative" internal zones, and would probably
    // also be included in the "localhost_resolver" view above :
};

view    "external" {
/* This view will contain zones you want to serve only to "external" clients
 * that have addresses that are not on your directly attached LAN interface subnets:
 */
    recursion no;
    $additional_from_cache_line
    // you'd probably want to deny recursion to external clients, so you don't
    // end up providing free DNS service to all takers

// These are your "authoritative" external zones, and would probably
    // contain entries for just your web and mail servers:

// BEGIN external zone entries

};
EOC

}

###################################################################################################