From 4cdef214d2b13cb0c709579e12fcfda0478c8c20 Mon Sep 17 00:00:00 2001 From: Aram Sargsyan Date: Thu, 14 Dec 2023 10:40:05 +0000 Subject: [PATCH] Require trust anchors for 'dnnsec-validation yes' Using the 'dnssec-validation yes' option now requires an explicitly confgiured 'trust-anchors' statement (or 'managed-keys' or 'trusted-keys', both deprecated). --- lib/isccfg/check.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/lib/isccfg/check.c b/lib/isccfg/check.c index 464ece61cd..66d24f5ed7 100644 --- a/lib/isccfg/check.c +++ b/lib/isccfg/check.c @@ -5744,8 +5744,21 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions, if (obj == NULL && options != NULL) { (void)cfg_map_get(options, "dnssec-validation", &obj); } - if (obj != NULL && !cfg_obj_isboolean(obj)) { - autovalidation = true; + if (obj != NULL) { + if (!cfg_obj_isboolean(obj)) { + autovalidation = true; + } else if (cfg_obj_asboolean(obj)) { + if (global_ta == NULL && view_ta == NULL && + global_tkeys == NULL && view_tkeys == NULL) + { + cfg_obj_log(obj, logctx, ISC_LOG_ERROR, + "the 'dnssec-validation yes' " + "option requires configured " + "'trust-anchors'; consider using " + "'dnssec-validation auto'."); + result = ISC_R_FAILURE; + } + } } tresult = check_ta_conflicts(global_ta, view_ta, global_tkeys,