mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 14:07:59 +00:00
Code Issues Releases Wiki Activity

Clarify error message about missing inline-signing & dnssec-policy

Browse Source 
(cherry picked from commit 058c1744ba)
This commit is contained in:
Petr Špaček
2022-10-05 14:44:09 +02:00
parent 7de12577ef
commit 6394f5c423
2 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bin/tests/system/checkconf/tests.sh
View File

@@ -491,7 +491,7 @@ n=`expr $n + 1`
echo_i "checking named-checkconf kasp errors ($n)"
ret=0
$CHECKCONF kasp-and-other-dnssec-options.conf > checkconf.out$n 2>&1 && ret=1
grep "'dnssec-policy;' requires dynamic DNS or inline-signing to be configured for the zone" < checkconf.out$n > /dev/null || ret=1
grep "'inline-signing yes;' must also be configured explicitly for zones using dnssec-policy without a configured 'allow-update' or 'update-policy'" < checkconf.out$n > /dev/null || ret=1
grep "'auto-dnssec maintain;' cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
grep "dnskey-sig-validity: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
grep "dnssec-dnskey-kskonly: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1

13
lib/bind9/check.c
View File

@@ -3447,11 +3447,16 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
if (has_dnssecpolicy) {
if (!ddns && !signing) {
cfg_obj_log(kasp, logctx, ISC_LOG_ERROR,
"'dnssec-policy;' requires%s "
"inline-signing to be configured "
"for the zone",
"'inline-signing yes;' must also "
"be configured explicitly for "
"zones using dnssec-policy%s. See "
"https://kb.isc.org/docs/"
"dnssec-policy-requires-dynamic-"
"dns-or-inline-signing",
(ztype == CFG_ZONE_PRIMARY)
? " dynamic DNS or"
? " without a configured "
"'allow-update' or "
"'update-policy'"
: "");
result = ISC_R_FAILURE;
}