mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

mark max-zone-ttl deprecated in options and zone

Browse Source 
The "max-zone-ttl" option should now be configured as part of
"dnssec-policy". The option with the same name in "zone" and
"options" is hereby flagged as deprecated, and its functionality
will be removed in a future release.
This commit is contained in:
Evan Hunt
2022-07-11 13:38:51 -07:00
parent 6eb359c689
commit 19352dd187
8 changed files with 50 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
bin/tests/system/checkconf/deprecated.conf
View File

@@ -13,6 +13,7 @@
options {
dnssec-validation yes;
max-zone-ttl 600;
};
trusted-keys {
@@ -36,3 +37,9 @@ managed-keys {
RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
R1AkUTV74bU=";
};
zone example.com {
type primary;
file "maxttl-bad.db";
max-zone-ttl 120;
};

1
bin/tests/system/checkconf/tests.sh
View File

@@ -157,6 +157,7 @@ ret=0
$CHECKCONF deprecated.conf > checkconf.out$n.1 2>&1
grep "option 'managed-keys' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
grep "option 'trusted-keys' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
grep "option 'max-zone-ttl' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
# set -i to ignore deprecate warnings

52
doc/arm/reference.rst
View File

@@ -1802,26 +1802,28 @@ default is used.
The default is five minutes. It cannot be longer than :any:`nta-lifetime`, which
cannot be longer than a week.
.. namedconf:statement:: max-zone-ttl
:any:`max-zone-ttl`
This specifies a maximum permissible TTL value in seconds. For
convenience, TTL-style time-unit suffixes may be used to specify the
maximum value. When loading a zone file using a :any:`masterfile-format`
of ``text`` or ``raw``, any record encountered with a TTL higher than
:any:`max-zone-ttl` causes the zone to be rejected.
This should now be configured as part of :namedconf:ref:`dnssec-policy`.
Use of this option in :namedconf:ref:`options`, :namedconf:ref:`view`
and :namedconf:ref:`zone` blocks has no effect on any zone for which
a :namedconf:ref:`dnssec-policy` has also been configured. In zones
without :namedconf:ref:`dnssec-policy`, this option is deprecated,
and will be rendered non-operational in a future release.
:any:`max-zone-ttl` specifies a maximum permissible TTL value in seconds.
For convenience, TTL-style time-unit suffixes may be used to specify the
maximum value. When a zone file is loaded, any record encountered with a
TTL higher than :any:`max-zone-ttl` causes the zone to be rejected.
This is needed in DNSSEC-maintained zones because when rolling to a new
DNSKEY, the old key needs to remain available until RRSIG records
have expired from caches. The :any:`max-zone-ttl` option guarantees that
the largest TTL in the zone is no higher than the set value.
In the :namedconf:ref:`options` and :namedconf:ref:`zone` blocks,
the default value is ``unlimited``. A :any:`max-zone-ttl` of zero is
treated as ``unlimited``.
In the :namedconf:ref:`dnssec-policy` block,
the default value is ``PT24H`` (24 hours). A :any:`max-zone-ttl` of
zero is treated as if the default value were in use.
When used in :namedconf:ref:`options`, :namedconf:ref:`view` and
:namedconf:ref:`zone` blocks, setting :any:`max-zone-ttl` to zero
is equivalent to "unlimited".
.. namedconf:statement:: stale-answer-ttl
@@ -4213,9 +4215,9 @@ Tuning
Note that when a zone file in a format other than ``text`` is loaded,
:iscman:`named` may omit some of the checks which are performed for a file in
``text`` format. For example, :any:`check-names` only applies when loading
zones in ``text`` format, and :any:`max-zone-ttl` only applies to ``text``
and ``raw``. Zone files in binary formats should be generated with the
same check level as that specified in the :iscman:`named` configuration file.
zones in ``text`` format. Zone files in ``raw`` format should be generated
with the same check level as that specified in the :iscman:`named`
configuration file.
When configured in :namedconf:ref:`options`, this statement sets the
:any:`masterfile-format` for all zones, but it can be overridden on a
@@ -5982,10 +5984,20 @@ The following options can be specified in a :any:`dnssec-policy` statement:
This is similar to :any:`signatures-validity`, but for DNSKEY records.
The default is ``P2W`` (2 weeks).
:any:`max-zone-ttl`
.. namedconf:statement:: max-zone-ttl
This specifies the maximum permissible TTL value for the zone. When
a zone file is loaded, any record encountered with a TTL higher than
:any:`max-zone-ttl` causes the zone to be rejected.
This ensures that when rolling to a new DNSKEY, the old key will remain
available until RRSIG records have expired from caches. The
:any:`max-zone-ttl` option guarantees that the largest TTL in the
zone is no higher than a known and predictable value.
The default value ``PT24H`` (24 hours). A value of zero is treated
as if the default value were in use.
Like the :namedconf:ref:`max-zone-ttl` zone option, this specifies the maximum
permissible TTL value, in seconds, for the zone.
.. namedconf:statement:: nsec3param
@@ -6779,6 +6791,8 @@ Zone Options
:any:`max-zone-ttl`
See the description of :any:`max-zone-ttl` in :ref:`options`.
The use of this option in :any:`zone` blocks is deprecated and
will be rendered nonoperational in a future release.
:any:`dnssec-secure-to-insecure`
See the description of :any:`dnssec-secure-to-insecure` in :ref:`boolean_options`.

8
doc/man/named.conf.5in
View File

@@ -247,7 +247,7 @@ options {
max\-transfer\-time\-in <integer>;
max\-transfer\-time\-out <integer>;
max\-udp\-size <integer>;
max\-zone\-ttl ( unlimited | <duration> );
max\-zone\-ttl ( unlimited | <duration> ); // deprecated
memstatistics <boolean>;
memstatistics\-file <quoted_string>;
message\-compression <boolean>;
@@ -534,7 +534,7 @@ view <string> [ <class> ] {
max\-transfer\-time\-in <integer>;
max\-transfer\-time\-out <integer>;
max\-udp\-size <integer>;
max\-zone\-ttl ( unlimited | <duration> );
max\-zone\-ttl ( unlimited | <duration> ); // deprecated
message\-compression <boolean>;
min\-cache\-ttl <duration>;
min\-ncache\-ttl <duration>;
@@ -703,7 +703,7 @@ zone <string> [ <class> ] {
max\-records <integer>;
max\-transfer\-idle\-out <integer>;
max\-transfer\-time\-out <integer>;
max\-zone\-ttl ( unlimited | <duration> );
max\-zone\-ttl ( unlimited | <duration> ); // deprecated
notify ( explicit | master\-only | primary\-only | <boolean> );
notify\-delay <integer>;
notify\-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
@@ -902,7 +902,7 @@ zone <string> [ <class> ] {
masterfile\-format ( raw | text );
masterfile\-style ( full | relative );
max\-records <integer>;
max\-zone\-ttl ( unlimited | <duration> );
max\-zone\-ttl ( unlimited | <duration> ); // deprecated
primaries [ port <integer> ] [ dscp <integer> ] { ( <remote\-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
zone\-statistics ( full | terse | none | <boolean> );
};

4
doc/misc/options
View File

@@ -190,7 +190,7 @@ options {
max-transfer-time-in <integer>;
max-transfer-time-out <integer>;
max-udp-size <integer>;
max-zone-ttl ( unlimited | <duration> );
max-zone-ttl ( unlimited | <duration> ); // deprecated
memstatistics <boolean>;
memstatistics-file <quoted_string>;
message-compression <boolean>;
@@ -477,7 +477,7 @@ view <string> [ <class> ] {
max-transfer-time-in <integer>;
max-transfer-time-out <integer>;
max-udp-size <integer>;
max-zone-ttl ( unlimited | <duration> );
max-zone-ttl ( unlimited | <duration> ); // deprecated
message-compression <boolean>;
min-cache-ttl <duration>;
min-ncache-ttl <duration>;

2
doc/misc/primary.zoneopt
View File

@@ -40,7 +40,7 @@ zone <string> [ <class> ] {
max-records <integer>;
max-transfer-idle-out <integer>;
max-transfer-time-out <integer>;
max-zone-ttl ( unlimited | <duration> );
max-zone-ttl ( unlimited | <duration> ); // deprecated
notify ( explicit | master-only | primary-only | <boolean> );
notify-delay <integer>;
notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];

2
doc/misc/redirect.zoneopt
View File

@@ -7,7 +7,7 @@ zone <string> [ <class> ] {
masterfile-format ( raw | text );
masterfile-style ( full | relative );
max-records <integer>;
max-zone-ttl ( unlimited | <duration> );
max-zone-ttl ( unlimited | <duration> ); // deprecated
primaries [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
zone-statistics ( full | terse | none | <boolean> );
};

2
lib/isccfg/namedconf.c
View File

@@ -2300,7 +2300,7 @@ static cfg_clausedef_t zone_clauses[] = {
{ "max-transfer-time-out", &cfg_type_uint32,
CFG_ZONE_PRIMARY | CFG_ZONE_MIRROR | CFG_ZONE_SECONDARY },
{ "max-zone-ttl", &cfg_type_maxduration,
CFG_ZONE_PRIMARY | CFG_ZONE_REDIRECT },
CFG_ZONE_PRIMARY | CFG_ZONE_REDIRECT | CFG_CLAUSEFLAG_DEPRECATED },
{ "min-refresh-time", &cfg_type_uint32,
CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB },
{ "min-retry-time", &cfg_type_uint32,