Merge branch '3554-improve-dnssec-policy-inline-signing-err-msg-v9_18' into 'v9_18'

Clarify new configuration incompabitility: dnssec-policy vs. inline-signing [v9_18]

See merge request isc-projects/bind9!6871

bin/tests/system/checkconf/tests.sh

@@ -491,7 +491,7 @@ n=`expr $n + 1`
 echo_i "checking named-checkconf kasp errors ($n)"
 ret=0
 $CHECKCONF kasp-and-other-dnssec-options.conf > checkconf.out$n 2>&1 && ret=1
-grep "'dnssec-policy;' requires dynamic DNS or inline-signing to be configured for the zone" < checkconf.out$n > /dev/null || ret=1
+grep "'inline-signing yes;' must also be configured explicitly for zones using dnssec-policy without a configured 'allow-update' or 'update-policy'" < checkconf.out$n > /dev/null || ret=1
 grep "'auto-dnssec maintain;' cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
 grep "dnskey-sig-validity: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
 grep "dnssec-dnskey-kskonly: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1

doc/notes/notes-current.rst

@@ -20,6 +20,18 @@ Security Fixes
 Known Issues
 ~~~~~~~~~~~~
 
+- Upgrading from BIND 9.16.32, 9.18.6, or older, may require a manual
+  configuration change. The following configurations are affected:
+
+  - :any:`type primary` zones configured with :any:`dnssec-policy` but without
+    either :any:`allow-update` or :any:`update-policy`
+  - :any:`type secondary` zones configured with :any:`dnssec-policy`
+
+  In these cases please add :namedconf:ref:`inline-signing yes;
+  <inline-signing>` to individual zone configuration(s). Without applying this
+  change :iscman:`named` will fail to start. For more details see
+  https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
+
 - BIND 9.18 does not support dynamic updates forwarding (see
   :any:`allow-update-forwarding`) in conjuction with zone transfers
   over TLS (XoT). :gl:`#3512`

lib/bind9/check.c

@@ -3447,11 +3447,16 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		if (has_dnssecpolicy) {
 			if (!ddns && !signing) {
 				cfg_obj_log(kasp, logctx, ISC_LOG_ERROR,
-					    "'dnssec-policy;' requires%s "
-					    "inline-signing to be configured "
-					    "for the zone",
+					    "'inline-signing yes;' must also "
+					    "be configured explicitly for "
+					    "zones using dnssec-policy%s. See "
+					    "https://kb.isc.org/docs/"
+					    "dnssec-policy-requires-dynamic-"
+					    "dns-or-inline-signing",
 					    (ztype == CFG_ZONE_PRIMARY)
-						    ? " dynamic DNS or"
+						    ? " without a configured "
+						      "'allow-update' or "
+						      "'update-policy'"
 						    : "");
 				result = ISC_R_FAILURE;
 			}