diff --git a/bin/named/server.c b/bin/named/server.c index 9052672e2b..57a023798b 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -4067,14 +4067,38 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, view->acceptexpired = cfg_obj_asboolean(obj); obj = NULL; - result = named_config_get(maps, "dnssec-validation", &obj); + result = named_config_get(maps, "dnssec-enable", &obj); INSIST(result == ISC_R_SUCCESS); - if (cfg_obj_isboolean(obj)) { - view->enablevalidation = cfg_obj_asboolean(obj); - } else { - /* If dnssec-validation is not boolean, it must be "auto" */ - view->enablevalidation = true; - auto_root = true; + view->enablednssec = cfg_obj_asboolean(obj); + + obj = NULL; + /* 'optionmaps', not 'maps': don't check named_g_defaults yet */ + (void)named_config_get(optionmaps, "dnssec-validation", &obj); + if (obj == NULL) { + /* + * If dnssec-enable is yes, then we default to + * VALIDATION_DEFAULT as set in config.c. Otherwise + * we default to "no". + */ + if (view->enablednssec) { + (void)cfg_map_get(named_g_defaults, + "dnssec-validation", &obj); + INSIST(obj != NULL); + } else { + view->enablevalidation = false; + } + } + if (obj != NULL) { + if (cfg_obj_isboolean(obj)) { + view->enablevalidation = cfg_obj_asboolean(obj); + } else { + /* + * If dnssec-validation is set but not boolean, + * then it must be "auto" + */ + view->enablevalidation = true; + auto_root = true; + } } obj = NULL; @@ -5090,11 +5114,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, view->prefetch_eligible = view->prefetch_trigger + 6; } - obj = NULL; - result = named_config_get(maps, "dnssec-enable", &obj); - INSIST(result == ISC_R_SUCCESS); - view->enablednssec = cfg_obj_asboolean(obj); - obj = NULL; result = named_config_get(optionmaps, "dnssec-lookaside", &obj); if (result == ISC_R_SUCCESS) { diff --git a/bin/rndc/rndc.docbook b/bin/rndc/rndc.docbook index 2ab4d6d2db..047e5c0199 100644 --- a/bin/rndc/rndc.docbook +++ b/bin/rndc/rndc.docbook @@ -1070,11 +1070,14 @@ Enable, disable, or check the current status of - DNSSEC validation. - Note dnssec-enable also needs to be - set to yes or - auto to be effective. - It defaults to enabled. + DNSSEC validation. By default, validation is enabled. + (Note that dnssec-enable must also be + yes (the default value) for signatures + to be returned along with validated data. If validation is + enabled while dnssec-enable is set to + no, the server will validate internally, + but will not supply clients with the necessary records to allow + validity to be confirmed.) diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index c012ce88c7..02d933c7f6 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -2201,43 +2201,54 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;}; -
Configuring Servers - +
Configuring Servers for DNSSEC To enable named to respond appropriately - to DNS requests from DNSSEC aware clients, - dnssec-enable must be set to yes. - This is the default setting. + to DNS requests from DNSSEC-aware clients, + dnssec-enable must be set to + yes. This is the default setting. - - To enable named to validate answers from - other servers, the dnssec-enable option - must be set to yes, and the + To enable named to validate answers + received from other servers, the dnssec-validation option must be set to either yes or auto. - When dnssec-validation is set to auto, a trust anchor for the DNS root zone will automatically be used. This trust anchor is provided as part of BIND and is kept up to date using RFC 5011 key management. - If dnssec-validation is set to - yes, then - DNSSEC validation only occurs if - at least one trust anchor has been explicitly configured - in named.conf, + + + When dnssec-validation is set to + yes, DNSSEC validation will only occur + if at least one trust anchor has been explicitly configured + in named.conf using a trusted-keys or managed-keys statement. - If dnssec-validation is set to - no, then DNSSEC validation will - not occur. + + + When dnssec-validation is set to + no, DNSSEC validation will not occur. + + The default is auto unless BIND is built with configure --disable-auto-validation, in which case the default is yes. + + If dnssec-enable is set to + no, then the default for + dnssec-validation is also changed to + no. If + dnssec-validation is set to + yes, the server will + perform DNSSEC validation internally, but will not return + signatures when queried - but it will not be turned on + automatically. + trusted-keys are copies of DNSKEY RRs @@ -6600,34 +6611,54 @@ options { dnssec-validation - Enable DNSSEC validation in named. - Note dnssec-enable also needs to be - set to yes to be effective. + This enables DNSSEC validation in named. + Note that dnssec-enable also needs to + be set to yes for signatures to be + returned to the client along with validated answers. + + + If set to auto, + DNSSEC validation is enabled, and a default trust anchor + for the DNS root zone is used. + + + If set to yes, DNSSEC validation is + enabled, but a trust anchor must be manually configured + using a trusted-keys + or managed-keys statement; if there + is no configured trust anchor, validation will not take + place. + + If set to no, DNSSEC validation is disabled. - - If set to auto, DNSSEC validation - is enabled, and a default trust anchor for the DNS root - zone is used. If set to yes, - DNSSEC validation is enabled, but a trust anchor must be - manually configured using a trusted-keys - or managed-keys statement. The default - is yes. + + The default is auto, unless + BIND is built with + configure --disable-auto-validation, + in which case the default is yes. + If dnssec-enable is set to + no, then the default for + dnssec-validation is also + no. Validation can still be turned on + if desired - this results in a server that performs DNSSEC + validation but does not return signatures when queried - + but it will not be turned on automatically. The default root trust anchor is stored in the file bind.keys. named will load that key at startup if dnssec-validation is - set to auto. A copy of the file is + set to auto. A copy of the file is installed along with BIND 9, and is current as of the release date. If the root key expires, a new copy of bind.keys can be downloaded from https://www.isc.org/bind-keys. - To prevent problems if bind.keys is + (To prevent problems if bind.keys is not found, the current trust anchor is also compiled in to named. Relying on this is not recommended, however, as it requires named @@ -6635,8 +6666,8 @@ options { - named only - loads the root key from bind.keys. + named loads only + the root key from bind.keys. The file cannot be used to store keys for other zones. The root key in bind.keys is ignored if dnssec-validation auto is not in