mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-01 15:05:23 +00:00
Code Issues Releases Wiki Activity

3209. [func] Add "dnssec-lookaside 'off'". [RT #24858]

Browse Source
This commit is contained in:
Mark Andrews
2011-11-07 00:14:11 +00:00
parent 2e8694f4db
commit ac43690858
9 changed files with 101 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGES
View File

@@ -1,3 +1,5 @@
3209. [func] Add "dnssec-lookaside 'off'". [RT #24858]
3208. [bug] 'dig -y' handle unknown tsig alorithm better.
[RT #25522]

7
bin/named/named.conf.docbook
View File

@@ -17,7 +17,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
<!-- $Id: named.conf.docbook,v 1.53 2011/09/06 22:29:32 smann Exp $ -->
<!-- $Id: named.conf.docbook,v 1.54 2011/11/07 00:14:10 marka Exp $ -->
<refentry>
<refentryinfo>
<date>Aug 13, 2004</date>
@@ -285,8 +285,7 @@ options {
disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>; ... };
dnssec-enable <replaceable>boolean</replaceable>;
dnssec-validation <replaceable>boolean</replaceable>;
dnssec-lookaside <replaceable>string</replaceable> trust-anchor <replaceable>string</replaceable>;
dnssec-lookaside ( <replaceable>auto</replaceable> | <replaceable>domain</replaceable> trust-anchor <replaceable>domain</replaceable> );
dnssec-lookaside ( <replaceable>auto</replaceable> | <replaceable>off</replaceable> | <replaceable>domain</replaceable> trust-anchor <replaceable>domain</replaceable> );
dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
dnssec-accept-expired <replaceable>boolean</replaceable>;
@@ -474,7 +473,7 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>; ... };
dnssec-enable <replaceable>boolean</replaceable>;
dnssec-validation <replaceable>boolean</replaceable>;
dnssec-lookaside <replaceable>string</replaceable> trust-anchor <replaceable>string</replaceable>;
dnssec-lookaside ( <replaceable>auto</replaceable> | <replaceable>off</replaceable> | <replaceable>domain</replaceable> trust-anchor <replaceable>domain</replaceable> );
dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
dnssec-accept-expired <replaceable>boolean</replaceable>;

16
bin/named/server.c
View File

@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: server.c,v 1.628 2011/11/03 23:46:26 tbox Exp $ */
/* $Id: server.c,v 1.629 2011/11/07 00:14:10 marka Exp $ */
/*! \file */
@@ -2604,16 +2604,21 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
if (result == ISC_R_SUCCESS) {
/* If set to "auto", use the version from the defaults */
const cfg_obj_t *dlvobj;
const char *dom;
dlvobj = cfg_listelt_value(cfg_list_first(obj));
if (!strcmp(cfg_obj_asstring(cfg_tuple_get(dlvobj, "domain")),
"auto") &&
cfg_obj_isvoid(cfg_tuple_get(dlvobj, "trust-anchor"))) {
dom = cfg_obj_asstring(cfg_tuple_get(dlvobj, "domain"));
if (cfg_obj_isvoid(cfg_tuple_get(dlvobj, "trust-anchor"))) {
/* If "no", skip; if "auto", use global default */
if (!strcasecmp(dom, "no"))
result = ISC_R_NOTFOUND;
else if (!strcasecmp(dom, "auto")) {
auto_dlv = ISC_TRUE;
obj = NULL;
result = cfg_map_get(ns_g_defaults,
"dnssec-lookaside", &obj);
}
}
}
if (result == ISC_R_SUCCESS) {
for (element = cfg_list_first(obj);
@@ -2850,7 +2855,8 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
CHECK(dns_zone_create(&zone, mctx));
CHECK(dns_zone_setorigin(zone, name));
dns_zone_setview(zone, view);
CHECK(dns_zonemgr_managezone(ns_g_server->zonemgr, zone));
CHECK(dns_zonemgr_managezone(ns_g_server->zonemgr,
zone));
dns_zone_setclass(zone, view->rdclass);
dns_zone_settype(zone, dns_zone_master);
dns_zone_setstats(zone, ns_g_server->zonestats);

7
bin/tests/system/checkconf/dnssec.2
View File

@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: dnssec.2,v 1.4 2011/05/08 07:12:47 marka Exp $ */
/* $Id: dnssec.2,v 1.5 2011/11/07 00:14:11 marka Exp $ */
options {
dnssec-enable no;
@@ -29,3 +29,8 @@ view view2 {
match-clients { none; };
dnssec-validation auto;
};
view view3 {
match-clients { none; };
auto-dnssec maintain;
};

17
bin/tests/system/checkconf/dnssec.3
View File

@@ -14,7 +14,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: dnssec.3,v 1.4 2011/05/08 07:12:48 marka Exp $ */
/* $Id: dnssec.3,v 1.5 2011/11/07 00:14:11 marka Exp $ */
options {
dnssec-validation no;
@@ -29,3 +29,18 @@ view view2 {
match-clients { none; };
dnssec-enable yes;
};
view view3 {
match-clients { none; };
dnssec-lookaside auto;
};
view view4 {
match-clients { none; };
dnssec-lookaside no;
};
view view5 {
match-clients { none; };
auto-dnssec off;
};

3
bin/tests/system/checkconf/tests.sh
View File

@@ -12,7 +12,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
# $Id: tests.sh,v 1.7 2011/05/07 23:47:28 tbox Exp $
# $Id: tests.sh,v 1.8 2011/11/07 00:14:11 marka Exp $
SYSTEMTESTTOP=..
. $SYSTEMTESTTOP/conf.sh
@@ -43,6 +43,7 @@ status=`expr $status + $ret`
echo "I: checking named-checkconf dnssec warnings"
ret=0
$CHECKCONF dnssec.1 2>&1 | grep 'validation yes.*enable no' > /dev/null || ret=1
$CHECKCONF dnssec.2 2>&1 | grep 'auto-dnssec may only be ' > /dev/null || ret=1
$CHECKCONF dnssec.2 2>&1 | grep 'validation auto.*enable no' > /dev/null || ret=1
$CHECKCONF dnssec.2 2>&1 | grep 'validation yes.*enable no' > /dev/null || ret=1
# this one should have no warnings

8
doc/arm/Bv9ARM-book.xml
View File

@@ -18,7 +18,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
<!-- File: $Id: Bv9ARM-book.xml,v 1.514 2011/11/04 02:25:17 tbox Exp $ -->
<!-- File: $Id: Bv9ARM-book.xml,v 1.515 2011/11/07 00:14:11 marka Exp $ -->
<book xmlns:xi="http://www.w3.org/2001/XInclude">
<title>BIND 9 Administrator Reference Manual</title>
@@ -5155,6 +5155,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
<optional> dnssec-enable <replaceable>yes_or_no</replaceable>; </optional>
<optional> dnssec-validation (<replaceable>yes_or_no</replaceable> | <constant>auto</constant>); </optional>
<optional> dnssec-lookaside ( <replaceable>auto</replaceable> |
<replaceable>off</replaceable> |
<replaceable>domain</replaceable> trust-anchor <replaceable>domain</replaceable> ); </optional>
<optional> dnssec-must-be-secure <replaceable>domain yes_or_no</replaceable>; </optional>
<optional> dnssec-accept-expired <replaceable>yes_or_no</replaceable>; </optional>
@@ -5835,6 +5836,11 @@ options {
values for the DLV domain and trust anchor will be
used, along with a built-in key for validation.
</para>
<para>
If <command>dnssec-lookaside</command> is set to
<userinput>off</userinput>, then dnssec-lookaside
is not used.
</para>
<para>
The default DLV key is stored in the file
<filename>bind.keys</filename>;

58
lib/bind9/check.c
View File

@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: check.c,v 1.137 2011/10/29 00:15:56 each Exp $ */
/* $Id: check.c,v 1.138 2011/11/07 00:14:11 marka Exp $ */
/*! \file */
@@ -671,8 +671,17 @@ typedef struct {
unsigned int max;
} intervaltable;
typedef enum {
optlevel_config,
optlevel_options,
optlevel_view,
optlevel_zone
} optlevel_t;
static isc_result_t
check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
optlevel_t optlevel)
{
isc_result_t result = ISC_R_SUCCESS;
isc_result_t tresult;
unsigned int i;
@@ -844,19 +853,23 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
element = cfg_list_next(element))
{
const char *dlv;
const cfg_obj_t *anchor;
const cfg_obj_t *dlvobj, *anchor;
obj = cfg_listelt_value(element);
dlv = cfg_obj_asstring(cfg_tuple_get(obj, "domain"));
anchor = cfg_tuple_get(obj, "trust-anchor");
dlvobj = cfg_tuple_get(obj, "domain");
dlv = cfg_obj_asstring(dlvobj);
/*
* If domain is "auto" and trust anchor is missing,
* skip remaining tests
* If domain is "auto" or "no" and trust anchor
* is missing, skip remaining tests
*/
if (!strcmp(dlv, "auto") && cfg_obj_isvoid(anchor))
if (cfg_obj_isvoid(anchor)) {
if (!strcasecmp(dlv, "no") ||
!strcasecmp(dlv, "auto"))
continue;
}
isc_buffer_init(&b, dlv, strlen(dlv));
isc_buffer_add(&b, strlen(dlv));
@@ -908,8 +921,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
} else {
cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
"dnssec-lookaside requires "
"either 'auto' or a domain and "
"trust anchor");
"either 'auto' or 'no', or a "
"domain and trust anchor");
if (result == ISC_R_SUCCESS)
result = ISC_R_FAILURE;
}
@@ -919,6 +932,21 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
isc_symtab_destroy(&symtab);
}
/*
* Check auto-dnssec at the view/options level
*/
obj = NULL;
(void)cfg_map_get(options, "auto-dnssec", &obj);
if (obj != NULL) {
const char *arg = cfg_obj_asstring(obj);
if (optlevel != optlevel_zone && strcasecmp(arg, "off") != 0) {
cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
"auto-dnssec may only be activated at the "
"zone level");
result = ISC_R_FAILURE;
}
}
/*
* Check dnssec-must-be-secure.
*/
@@ -1664,7 +1692,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
/*
* Check various options.
*/
tresult = check_options(zoptions, logctx, mctx);
tresult = check_options(zoptions, logctx, mctx, optlevel_zone);
if (tresult != ISC_R_SUCCESS)
result = tresult;
@@ -2297,13 +2325,16 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
result = tresult;
}
}
/*
* Check options.
*/
if (voptions != NULL)
tresult = check_options(voptions, logctx, mctx);
tresult = check_options(voptions, logctx, mctx,
optlevel_view);
else
tresult = check_options(config, logctx, mctx);
tresult = check_options(config, logctx, mctx,
optlevel_config);
if (tresult != ISC_R_SUCCESS)
result = tresult;
@@ -2594,7 +2625,8 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
(void)cfg_map_get(config, "options", &options);
if (options != NULL &&
check_options(options, logctx, mctx) != ISC_R_SUCCESS)
check_options(options, logctx, mctx,
optlevel_options) != ISC_R_SUCCESS)
result = ISC_R_FAILURE;
if (bind9_check_logging(config, logctx, mctx) != ISC_R_SUCCESS)

6
lib/isccfg/namedconf.c
View File

@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: namedconf.c,v 1.142 2011/10/13 01:32:34 vjs Exp $ */
/* $Id: namedconf.c,v 1.143 2011/11/07 00:14:11 marka Exp $ */
/*! \file */
@@ -1158,7 +1158,7 @@ print_lookaside(cfg_printer_t *pctx, const cfg_obj_t *obj)
static void
doc_lookaside(cfg_printer_t *pctx, const cfg_type_t *type) {
UNUSED(type);
cfg_print_cstr(pctx, "( <string> trust-anchor <string> | auto )");
cfg_print_cstr(pctx, "( <string> trust-anchor <string> | auto | no )");
}
static keyword_type_t trustanchor_kw = { "trust-anchor", &cfg_type_astring };
@@ -1362,6 +1362,7 @@ zone_clauses[] = {
{ "also-notify", &cfg_type_namesockaddrkeylist, 0 },
{ "alt-transfer-source", &cfg_type_sockaddr4wild, 0 },
{ "alt-transfer-source-v6", &cfg_type_sockaddr6wild, 0 },
{ "auto-dnssec", &cfg_type_autodnssec, 0 },
{ "check-dup-records", &cfg_type_checkmode, 0 },
{ "check-integrity", &cfg_type_boolean, 0 },
{ "check-mx", &cfg_type_checkmode, 0 },
@@ -1436,7 +1437,6 @@ zone_only_clauses[] = {
*/
{ "check-names", &cfg_type_checkmode, 0 },
{ "ixfr-from-differences", &cfg_type_boolean, 0 },
{ "auto-dnssec", &cfg_type_autodnssec, 0 },
{ "server-addresses", &cfg_type_bracketed_sockaddrlist, 0 },
{ "server-names", &cfg_type_namelist, 0 },
{ NULL, NULL, 0 }