upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-07-16 19:32:50 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

warn about zones with both dnssec-policy and max-zone-ttl

Browse source 
max-zone-ttl in zone/view/options is a no-op if dnssec-policy
is in use, so generate a warning.
This commit is contained in:
Evan Hunt 2022-07-21 11:07:31 -07:00
parent 1ed5eb38e4
commit fb8f102ffc
3 changed files with 55 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
bin/tests/system/checkconf/tests.sh
View file

@ -585,6 +585,14 @@ grep "not recommended" < checkconf.out$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "check that using both max-zone-ttl and dnssec-policy generates a warning ($n)"
ret=0
$CHECKCONF warn-kasp-max-zone-ttl.conf > checkconf.out$n 2>/dev/null || ret=1
grep "option 'max-zone-ttl' is ignored when used together with 'dnssec-policy'" < checkconf.out$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
status=`expr $status + $ret`
n=$((n+1))
echo_i "check that masterfile-format map generates deprecation warning ($n)"
ret=0

26
bin/tests/system/checkconf/warn-kasp-max-zone-ttl.conf Normal file
View file

@ -0,0 +1,26 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
/*
* The dnssec-policy is not defined. Should also be caught if it is inherited.
*/
options {
dnssec-policy default;
};
zone "example.net" {
type primary;
file "example.db";
max-zone-ttl 600;
};

21
lib/bind9/check.c
View file

@ -2633,6 +2633,27 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
}
}
/*
* Warn about zones with both dnssec-policy and max-zone-ttl
*/
if (has_dnssecpolicy) {
obj = NULL;
(void)cfg_map_get(zoptions, "max-zone-ttl", &obj);
if (obj == NULL && voptions != NULL) {
(void)cfg_map_get(voptions, "max-zone-ttl", &obj);
}
if (obj == NULL && goptions != NULL) {
(void)cfg_map_get(goptions, "max-zone-ttl", &obj);
}
if (obj != NULL) {
cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
"zone '%s': option 'max-zone-ttl' "
"is ignored when used together with "
"'dnssec-policy'",
znamestr);
}
}
/*
* Check validity of the zone options.
*/