chg: usr: Enable minimal ANY answers by default

ANY queries are widely abused by attackers doing reflection attacks as
they return the largest answers.  Enable minimal ANY answers by default
to reduce the attack surface of the DNS servers.

Closes #5723

Merge branch '5723-change-minimal_any-default-to-yes' into 'main'

See merge request isc-projects/bind9!11505

bin/include/defaultconfig.h

@@ -154,7 +154,7 @@ options {\n\
 	message-compression yes;\n\
 	min-ncache-ttl 0; /* 0 hours */\n\
 	min-cache-ttl 0; /* 0 seconds */\n\
-	minimal-any false;\n\
+	minimal-any yes;\n\
 	minimal-responses no-auth-recursive;\n\
 	notify-source *;\n\
 	notify-source-v6 *;\n\

bin/tests/system/digdelv/ns2/named.conf.j2

@@ -21,6 +21,7 @@ options {
 	listen-on-v6 { fd92:7065:b8e:ffff::2; };
 	recursion no;
 	dnssec-validation no;
+	minimal-any no;
 };
 
 zone "." {

bin/tests/system/digdelv/ns3/named.conf.j2

@@ -20,6 +20,7 @@ options {
 	recursion yes;
 	dnssec-validation no;
 	server-id "ns3";
+	minimal-any no;
 };
 
 zone "." {

bin/tests/system/dnssec/ns1/named.conf.j2

@@ -21,6 +21,8 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
+	minimal-any no;
+	minimal-responses no;
 	recursion no;
 	notify yes;
 	dnssec-validation yes;

bin/tests/system/dnssec/ns2/named.conf.j2

@@ -22,11 +22,12 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	allow-transfer { any; };
+	minimal-any no;
+	minimal-responses no;
 	recursion no;
 	notify yes;
 	dnssec-validation yes;
 	notify-delay 1;
-	minimal-responses no;
 };
 
 key rndc_key {

bin/tests/system/dnssec/ns3/named.conf.j2

@@ -24,11 +24,12 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	allow-transfer { any; };
+	minimal-any no;
+	minimal-responses no;
 	recursion no;
 	notify yes;
 	dnssec-validation yes;
 	session-keyfile "session.key";
-	minimal-responses no;
 };
 
 key rndc_key {

bin/tests/system/dnssec/ns4/named.conf.j2

@@ -26,8 +26,9 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
-	recursion yes;
+	minimal-any no;
 	minimal-responses no;
+	recursion yes;
 
 	{% if accept_expired %}
 		dnssec-accept-expired yes;

bin/tests/system/dnssec/ns5/named.conf.j2

@@ -24,6 +24,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.5; 127.0.0.1; };
 	listen-on-v6 { none; };
+	minimal-any no;
 	recursion yes;
 	minimal-responses no;
 	servfail-ttl 0;

bin/tests/system/dnssec/ns6/named.conf.j2

@@ -21,6 +21,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.6; };
 	listen-on-v6 { none; };
+	minimal-any no;
 	recursion yes;
 	notify yes;
 	disable-algorithms . { @ALTERNATIVE_ALGORITHM@; };

bin/tests/system/dnssec/ns9/named.conf.j2

@@ -23,6 +23,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.9; };
 	listen-on-v6 { none; };
+	minimal-any no;
 	recursion yes;
 	dnssec-validation yes;
 	forward only;

bin/tests/system/resolver/ns1/named.conf.j2

@@ -32,6 +32,7 @@ options {
 	attach-cache "globalcache";
 	max-recursion-queries 100;
 	request-zoneversion yes;
+	minimal-any no;
 };
 
 

bin/tests/system/resolver/ns11/named.conf.j2

@@ -21,4 +21,5 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	dnssec-validation no;
+	minimal-any no;
 };

bin/tests/system/resolver/ns4/named.conf.j2

@@ -23,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	recursion no;
 	dnssec-validation no;
+	minimal-any no;
 };
 
 zone "." {

bin/tests/system/resolver/ns5/named.conf.j2

@@ -28,6 +28,7 @@ options {
 	responselog yes;
 	request-nsid yes;
 	request-zoneversion yes;
+	minimal-any no;
 };
 
 // Don't break tests which depend on ans10 by requesting

bin/tests/system/resolver/ns6/named.conf.j2

@@ -27,6 +27,7 @@ options {
 	statistics-file "named.stats";
 	max-udp-size 4096;
 	responselog no;
+	minimal-any no;
 };
 
 zone "." {

bin/tests/system/resolver/ns7/named.conf.j2

@@ -32,6 +32,7 @@ options {
 	prefetch 0;
 	querylog yes;
 	edns-udp-size 4096;
+	minimal-any no;
 };
 
 

bin/tests/system/resolver/ns9/named.conf.j2

@@ -23,6 +23,7 @@ options {
 	dnssec-validation no;
 	dual-stack-servers { fd92:7065:b8e:ffff::7; };
 	qname-minimization off;
+	minimal-any no;
 };
 
 

bin/tests/system/rpz/ns1/named.conf.j2

@@ -22,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	notify no;
+	minimal-any no;
 	minimal-responses no;
 	dnssec-validation no;
 };

bin/tests/system/rpz/ns10/named.conf.j2

@@ -22,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	notify no;
+	minimal-any no;
 	minimal-responses no;
 	recursion yes;
 	dnssec-validation yes;

bin/tests/system/rpz/ns2/named.conf.j2

@@ -22,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	notify no;
+	minimal-any no;
 	minimal-responses no;
 	recursion yes;
 	dnssec-validation yes;

bin/tests/system/rpz/ns3/named.conf.j2

@@ -29,6 +29,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	notify yes;
+	minimal-any no;
 	minimal-responses no;
 	recursion yes;
 	dnssec-validation no;

bin/tests/system/rpz/ns4/named.conf.j2

@@ -22,6 +22,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	notify no;
+	minimal-any no;
 	minimal-responses no;
 	recursion yes;
 	dnssec-validation yes;

bin/tests/system/rpz/ns5/named.conf.j2

@@ -29,6 +29,7 @@ options {
 	ixfr-from-differences yes;
 	notify-delay 0;
 	notify yes;
+	minimal-any no;
 	minimal-responses no;
 	recursion yes;
 	dnssec-validation yes;

bin/tests/system/rpz/ns6/named.conf.j2

@@ -24,6 +24,7 @@ options {
 	allow-transfer { any; };
 	forward only;
 	forwarders { 10.53.0.3; };
+	minimal-any no;
 	minimal-responses no;
 	recursion yes;
 	dnssec-validation yes;

bin/tests/system/rpz/ns7/named.conf.j2

@@ -22,6 +22,7 @@ options {
 	listen-on { 10.53.0.7; };
 	listen-on-v6 { none; };
 	allow-transfer { any; };
+	minimal-any no;
 	minimal-responses no;
 	recursion yes;
 	dnssec-validation yes;

bin/tests/system/rpz/ns8/named.conf.j2

@@ -27,6 +27,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	notify yes;
+	minimal-any no;
 	minimal-responses no;
 	recursion yes;
 	dnssec-validation no;

bin/tests/system/rpz/ns9/named.conf.j2

@@ -27,6 +27,7 @@ options {
 	listen-on-v6 { none; };
 	allow-transfer { any; };
 	notify yes;
+	minimal-any no;
 	minimal-responses no;
 	recursion yes;
 	dnssec-validation no;

bin/tests/system/rpzextra/ns2/named.conf.j2

@@ -30,6 +30,7 @@ options {
 	notify no;
 	dnssec-validation no;
 	allow-query { any; };
+	minimal-any no;
 };
 
 zone "allowed" {

bin/tests/system/rpzextra/ns3/named.conf.j2

@@ -30,6 +30,7 @@ options {
 	notify no;
 	dnssec-validation no;
 	allow-query { any; };
+	minimal-any no;
 	recursion yes;
 	allow-recursion { any; };
 	empty-zones-enable false;

doc/arm/reference.rst

@@ -2093,7 +2093,7 @@ Boolean Options
    necessarily the smallest available RRset.) Additionally,
    :any:`minimal-responses` is turned on for these queries, so no
    unnecessary records are added to the authority or additional
-   sections. The default is ``no``.
+   sections. The default is ``yes``.
 
 .. namedconf:statement:: notify
    :tags: transfer