upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-27 12:13:20 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Add inline-signing warning for upgrading to 9.20

Browse source 
For dynamic zones that do not set inline-signing explicitly, add a
warning that the default value for inline-signing has changed. Dynamic
zones that want to be able to reuse the zone (and not trigger a full
resign) should explicitly configure "inline-signing no;".
This commit is contained in:
Matthijs Mekking 2024-10-16 15:25:57 +02:00
parent fa16eb402e
commit e5c711fd43
4 changed files with 49 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
bin/tests/system/checkconf/good.conf
View file

@ -99,6 +99,7 @@ view "first" {
zone "example1" {
type primary;
file "xxx";
inline-signing no;
update-policy local;
max-ixfr-ratio 20%;
notify-source 10.10.10.10 port 53 dscp 55;
@ -120,6 +121,7 @@ view "second" {
zone "example1" {
type primary;
file "zzz";
inline-signing no;
update-policy local;
zone-statistics yes;
};
@ -163,6 +165,7 @@ view "third" {
zone "dnssec" {
type primary;
file "file";
inline-signing no;
allow-update {
"any";
};

11
bin/tests/system/checkconf/tests.sh
View file

@ -766,6 +766,17 @@ if [ $ret != 0 ]; then
fi
status=$((status + ret))
n=$((n + 1))
echo_i "check that using dnssec-policy generates a warning for dynamic zones wrt inline-signing ($n)"
ret=0
$CHECKCONF warn-kasp-ddns-inline-signing-no.conf >checkconf.out$n 2>/dev/null || ret=1
grep "'inline-signing' default changed to 'yes' in 9\.20\." <checkconf.out$n >/dev/null || ret=1
if [ $ret != 0 ]; then
echo_i "failed"
ret=1
fi
status=$((status + ret))
n=$((n + 1))
echo_i "check obsolete options generate warnings ($n)"
ret=0

26
bin/tests/system/checkconf/warn-kasp-ddns-inline-signing-no.conf Normal file
View file

@ -0,0 +1,26 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
/*
* The dnssec-policy is not defined. Should also be caught if it is inherited.
*/
options {
dnssec-policy default;
};
zone "example.net" {
type primary;
file "example.db";
allow-update { any; };
};

9
lib/bind9/check.c
View file

@ -3468,6 +3468,15 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
: "");
result = ISC_R_FAILURE;
}
if (ddns && res1 != ISC_R_SUCCESS) {
cfg_obj_log(
zconfig, logctx, ISC_LOG_WARNING,
"'inline-signing' default changed "
"to 'yes' in 9.20. Before upgrading, "
"explicitly set 'inline-signing "
"no;' to your dnssec-policy or "
"zone configuration");
}
}
obj = NULL;