trust_anchors: always load keyfile_default

diff --git a/daemon/README.rst b/daemon/README.rst
index a5e0672eb42c49f6e4bfc21c40527ca4f693c324..b2de69ba724b522e625384bae40cddbc61f3b263 100644 (file)
--- a/daemon/README.rst
+++ b/daemon/README.rst
@@ -391,7 +391,7 @@ add the following snippet to your configuration file.
 .. code-block:: lua
 
    -- turns off DNSSEC validation
-   trust_anchors.keyfile_default = nil
+   trust_anchors.remove('.')
 
 The resolver supports DNSSEC including :rfc:`5011` automated DNSSEC TA updates
 and :rfc:`7646` negative trust anchors.  Depending on your distribution, DNSSEC
@@ -436,10 +436,6 @@ policy, or automatically maintained by the resolver itself.
 
    If you want to disable DNSSEC validation for a particular domain but keep it enabled for the rest of DNS tree, use :func:`trust_anchors.set_insecure`.
 
-.. envvar:: trust_anchors.keyfile_default = keyfile_default
-
-   Set by ``keyfile_default`` option during compilation.
-
 .. envvar:: trust_anchors.hold_down_time = 30 * day
 
    :return: int (default: 30 * day)

diff --git a/daemon/cache.test/clear.test.lua b/daemon/cache.test/clear.test.lua
index e7e96fd81c8ae37cdc4bd828bd701799efae9647..ed13186dcd29e7dc0162be0d421da328f6510971 100644 (file)
--- a/daemon/cache.test/clear.test.lua
+++ b/daemon/cache.test/clear.test.lua
@@ -32,7 +32,7 @@ ev = event.after(0, function () return 1 end)
 
 
 -- Import fake root zone; avoid interference with configured keyfile_default.
-trust_anchors.keyfile_default = nil
+trust_anchors.remove('.')
 trust_anchors.add('. IN DS 48409 8 2 3D63A0C25BCE86621DE63636F11B35B908EFE8E9381E0E3E9DEFD89EA952C27D')
 
 local function check_answer(desc, qname, qtype, expected_rcode)

diff --git a/daemon/lua/config.lua.in b/daemon/lua/config.lua
similarity index 75%
rename from daemon/lua/config.lua.in
rename to daemon/lua/config.lua
index 26f756a5c8a495b8bf4cf57f518868c04242d982..66e9c35e88f6bc1854ebebffd48d9b5023a184cf 100644 (file)
--- a/daemon/lua/config.lua.in
+++ b/daemon/lua/config.lua
@@ -31,13 +31,3 @@ end
 if require('ffi').C.kr_zonecut_is_empty(kres.context().root_hints) then
        _hint_root_file()
 end
-
-if not trust_anchors.keysets['\0'] and trust_anchors.keyfile_default then
-       if io.open(trust_anchors.keyfile_default, 'r') then
-               trust_anchors.config(trust_anchors.keyfile_default, @unmanaged@)
-       else
-               panic("cannot open default trust anchor file:'%s'",
-                     trust_anchors.keyfile_default
-               )
-       end
-end

diff --git a/daemon/lua/meson.build b/daemon/lua/meson.build
index d11bf7731a4f94d210f87faa7d0306ce3fc08bc5..b2e51e20aa85614941e0871e6583b173c18d5388 100644 (file)
--- a/daemon/lua/meson.build
+++ b/daemon/lua/meson.build
@@ -15,9 +15,10 @@ trust_anchors = configure_file(
   output: 'trust_anchors.lua',
   configuration: ta_config,
 )
-config_lua = configure_file(
-  input: 'config.lua.in',
-  output: 'config.lua',
+
+sandbox = configure_file(
+  input: 'sandbox.lua.in',
+  output: 'sandbox.lua',
   configuration: ta_config,
 )
 
@@ -27,10 +28,10 @@ run_target(  # run manually to re-generate kres-gen.lua
 )
 
 lua_src = [
-  config_lua,
+  files('config.lua'),
   files('kres.lua'),
   files('kres-gen.lua'),
-  files('sandbox.lua'),
+  sandbox,
   trust_anchors,
   files('zonefile.lua'),
 ]

diff --git a/daemon/lua/sandbox.lua b/daemon/lua/sandbox.lua.in
similarity index 99%
rename from daemon/lua/sandbox.lua
rename to daemon/lua/sandbox.lua.in
index 79ebc4a61bef80d804188ab6e3819220947c0048..99c9da137fc301984200e42ac3cc3c809784a99b 100644 (file)
--- a/daemon/lua/sandbox.lua
+++ b/daemon/lua/sandbox.lua.in
@@ -325,6 +325,9 @@ modules.load('detect_time_jump')
 modules.load('ta_sentinel')
 modules.load('edns_keepalive')
 
+-- Load keyfile_default
+trust_anchors.add_file('@keyfile_default@', @unmanaged@)
+
 -- Interactive command evaluation
 function eval_cmd(line, raw)
        -- Compatibility sandbox code loading

diff --git a/daemon/lua/trust_anchors.lua.in b/daemon/lua/trust_anchors.lua.in
index fb032d5d0d716ce4b6fbd58cb6be9119fb3e2287..efcdae15d379c4b30b9193c5760e1d8ff990881d 100644 (file)
--- a/daemon/lua/trust_anchors.lua.in
+++ b/daemon/lua/trust_anchors.lua.in
@@ -351,7 +351,7 @@ local function add_file(path, unmanaged)
        local keyset_orig = trust_anchors.keysets[owner]
        if keyset_orig then
                warn('[ ta ] warning: overriding previously set trust anchors for ' .. owner_str)
-               if keyset_orig.managed then
+               if keyset_orig.managed and ta_update then
                        ta_update.stop(owner)
                end
        end
@@ -427,7 +427,6 @@ trust_anchors = {
 
        bootstrap_url = 'https://data.iana.org/root-anchors/root-anchors.xml',
        bootstrap_ca = '@etc_dir@/icann-ca.pem',
-       keyfile_default = '@keyfile_default@',
 
        -- Load keys from a file, 5011-managed by default.
        -- If managed and the file doesn't exist, try bootstrapping the root into it.

diff --git a/daemon/lua/trust_anchors.test/bootstrap.test.lua b/daemon/lua/trust_anchors.test/bootstrap.test.lua
index ea35c487eb11972872040a0943fe95c02edf90cd..78f8d9edd6f3616bda5d7204736575a4fc4e768e 100644 (file)
--- a/daemon/lua/trust_anchors.test/bootstrap.test.lua
+++ b/daemon/lua/trust_anchors.test/bootstrap.test.lua
@@ -60,7 +60,7 @@ end
 
 local host = 'https://localhost:8080/'
 -- avoid interference with configured keyfile_default
-trust_anchors.keyfile_default = nil
+trust_anchors.remove('.')
 
 local function test_err_cert()
        trust_anchors.bootstrap_ca = 'x509/wrongca.pem'

diff --git a/daemon/lua/trust_anchors.test/ta.test.lua b/daemon/lua/trust_anchors.test/ta.test.lua
index 6993f8fd744c4956e92ef2472c968d465382a35f..ca68c701d1245dd313107e070b9e0c867c05db70 100644 (file)
--- a/daemon/lua/trust_anchors.test/ta.test.lua
+++ b/daemon/lua/trust_anchors.test/ta.test.lua
@@ -1,4 +1,4 @@
-trust_anchors.keyfile_default = nil
+trust_anchors.remove('.')
 
 local ffi = require('ffi')
 

diff --git a/doc/meson.build b/doc/meson.build
index 8c912829e558d70a79e16a28712a5f790506ea7c..1860427895e84af8085759393c6420e4a7bc3018 100644 (file)
--- a/doc/meson.build
+++ b/doc/meson.build
@@ -4,7 +4,6 @@
 man_config = configuration_data()
 man_config.set('version', meson.project_version())
 man_config.set('date', run_command('../scripts/get-date.sh').stdout())
-man_config.set('keyfile_default', keyfile_default)
 
 man_config.set('man_seealso_systemd', '')
 if systemd_files == 'enabled'
@@ -13,16 +12,6 @@ elif systemd_files == 'nosocket'
   man_config.set('man_seealso_systemd', '\\fIkresd.systemd.nosocket(7)\\fR, ')
 endif
 
-man_config.set('man_managed_keyfile_default', '')
-man_config.set('man_unmanaged_keyfile_default', '')
-if managed_ta
-  man_config.set('man_managed_keyfile_default', '''
-Default: "@0@"'''.format(keyfile_default))
-else
-  man_config.set('man_unmanaged_keyfile_default', '''
-Default: "@0@"'''.format(keyfile_default))
-endif
-
 man_kresd = configure_file(
   input: 'kresd.8.in',
   output: 'kresd.8',

diff --git a/etc/config/config.cluster.in b/etc/config/config.cluster.in
index 709116b04bd3731eacd0b5757e3f431a6035a3df..6984aa0920e80870bdb67b0a45ba6296718283d0 100644 (file)
--- a/etc/config/config.cluster.in
+++ b/etc/config/config.cluster.in
@@ -7,7 +7,7 @@
 @config_defaults@
 
 -- To disable DNSSEC validation, uncomment the following line (not recommended)
--- trust_anchors.keyfile_default = nil
+-- trust_anchors.remove('.')
 
 -- Large cache size, so we don't need to flush ever
 -- This can be larger than available RAM, least frequently accessed

diff --git a/etc/config/config.docker.in b/etc/config/config.docker.in
index 4e284af760a334b2cb73da9d3de85a56badcfcfb..1a54f1638adbf28ffb2fdcfbae0afd0def9542d0 100644 (file)
--- a/etc/config/config.docker.in
+++ b/etc/config/config.docker.in
@@ -6,7 +6,7 @@ net.listen('0.0.0.0')
 net.listen('0.0.0.0', 853, {tls=true})
 
 -- To disable DNSSEC validation, uncomment the following line (not recommended)
--- trust_anchors.keyfile_default = nil
+-- trust_anchors.remove('.')
 
 -- Load Useful modules
 modules = {

diff --git a/etc/config/config.isp.in b/etc/config/config.isp.in
index 30ddbbe00ec81bac2c3a4f357f4162c300a5e0da..4c29db19aa312d373d61dd5e362fcd7b52978098 100644 (file)
--- a/etc/config/config.isp.in
+++ b/etc/config/config.isp.in
@@ -4,7 +4,7 @@
 @config_defaults@
 
 -- To disable DNSSEC validation, uncomment the following line (not recommended)
--- trust_anchors.keyfile_default = nil
+-- trust_anchors.remove('.')
 
 -- Large cache size, so we don't need to flush often
 -- This can be larger than available RAM, least frequently accessed

diff --git a/etc/config/config.personal.in b/etc/config/config.personal.in
index 555edc3590aea005f87458571ea2ef499c4d84b0..6d9844e020fec97b41fcf7f6567b1093be8bf2be 100644 (file)
--- a/etc/config/config.personal.in
+++ b/etc/config/config.personal.in
@@ -3,7 +3,7 @@
 @config_defaults@
 
 -- To disable DNSSEC validation, uncomment the following line (not recommended)
--- trust_anchors.keyfile_default = nil
+-- trust_anchors.remove('.')
 
 -- Load useful modules
 modules = {

diff --git a/etc/config/config.splitview.in b/etc/config/config.splitview.in
index ae009ac77402f761201a8d4d9fdf01419ef2e048..60da665d79c4b8ce7684f9e91b14e8f19d65c3cc 100644 (file)
--- a/etc/config/config.splitview.in
+++ b/etc/config/config.splitview.in
@@ -4,7 +4,7 @@
 @config_defaults@
 
 -- To disable DNSSEC validation, uncomment the following line (not recommended)
--- trust_anchors.keyfile_default = nil
+-- trust_anchors.remove('.')
 
 -- Load Useful modules
 modules = {

diff --git a/modules/policy/noipv6.test.integr/kresd_config.j2 b/modules/policy/noipv6.test.integr/kresd_config.j2
index 4d9a26149edb76e05a0eddda62fbcd429b3f203f..93099f37e2bf94a359640b433d25219f1b8dab9e 100644 (file)
--- a/modules/policy/noipv6.test.integr/kresd_config.j2
+++ b/modules/policy/noipv6.test.integr/kresd_config.j2
@@ -3,7 +3,7 @@ net.ipv6 = false
 policy.add(policy.all(policy.STUB({ '::1:2:3:4', '1.2.3.4' })))
 
 -- make sure DNSSEC is turned off for tests
-trust_anchors.keyfile_default = nil
+trust_anchors.remove('.')
 
 -- Disable RFC5011 TA update
 if ta_update then

diff --git a/modules/policy/noipvx.test.integr/kresd_config.j2 b/modules/policy/noipvx.test.integr/kresd_config.j2
index 6b12bb25dbd7283c669d19800aef3bdad959ab95..ce97967970a42fe29449b7b634790b9800eb64fa 100644 (file)
--- a/modules/policy/noipvx.test.integr/kresd_config.j2
+++ b/modules/policy/noipvx.test.integr/kresd_config.j2
@@ -4,7 +4,7 @@ net.ipv6 = false
 policy.add(policy.all(policy.STUB({ '::1:2:3:4', '1.2.3.4' })))
 
 -- make sure DNSSEC is turned off for tests
-trust_anchors.keyfile_default = nil
+trust_anchors.remove('.')
 
 -- Disable RFC5011 TA update
 if ta_update then

diff --git a/modules/policy/test.integr/kresd_config.j2 b/modules/policy/test.integr/kresd_config.j2
index cb5716aa0673ee27ceaaa5bece9b300f5beb94ce..3225c537918968fdd1b110900ebaa298b2314d63 100644 (file)
--- a/modules/policy/test.integr/kresd_config.j2
+++ b/modules/policy/test.integr/kresd_config.j2
@@ -2,7 +2,7 @@
 policy.add(policy.suffix(policy.REFUSE, {todname('refuse.example.com')}))
 
 -- make sure DNSSEC is turned off for tests
-trust_anchors.keyfile_default = nil
+trust_anchors.remove('.')
 
 -- Disable RFC5011 TA update
 if ta_update then

diff --git a/modules/rebinding/test.integr/kresd_config.j2 b/modules/rebinding/test.integr/kresd_config.j2
index 99919a31b2e4d17cc02e74c01b03ed4b5d79f11b..e044351f9872a21be13c71d0ee9ad41b46ffa2a1 100644 (file)
--- a/modules/rebinding/test.integr/kresd_config.j2
+++ b/modules/rebinding/test.integr/kresd_config.j2
@@ -1,6 +1,6 @@
 {% raw %}
 -- make sure DNSSEC is turned off for tests
-trust_anchors.keyfile_default = nil
+trust_anchors.remove('.')
 
 -- Disable RFC5011 TA update
 if ta_update then

diff --git a/modules/serve_stale/test.integr/kresd_config.j2 b/modules/serve_stale/test.integr/kresd_config.j2
index b0350cbca9d37beefac6cb982da7d27d4db46877..5beff9e3f7c621ed0dc985f08fe825d56ad5ef0e 100644 (file)
--- a/modules/serve_stale/test.integr/kresd_config.j2
+++ b/modules/serve_stale/test.integr/kresd_config.j2
@@ -2,7 +2,7 @@
 modules = { 'serve_stale < cache' }
 
 -- make sure DNSSEC is turned off for tests
-trust_anchors.keyfile_default = nil
+trust_anchors.remove('.')
 
 -- Disable RFC5011 TA update
 if ta_update then

diff --git a/modules/stats/test.integr/kresd_config.j2 b/modules/stats/test.integr/kresd_config.j2
index 1ee2780b86c59b5abf58ded4e2a990b2840d4e0f..a93ece40b3c139e66add0ec1c230a9dbda982c51 100644 (file)
--- a/modules/stats/test.integr/kresd_config.j2
+++ b/modules/stats/test.integr/kresd_config.j2
@@ -52,7 +52,7 @@ policy.add(policy.pattern(reply_result, 'stats.test.'))
 policy.add(policy.all(FWD_TARGET)) -- avoid iteration
 
 -- make sure DNSSEC is turned off for tests
-trust_anchors.keyfile_default = nil
+trust_anchors.remove('.')
 
 -- Disable RFC5011 TA update
 if ta_update then

diff --git a/modules/ta_update/ta_update.test.lua b/modules/ta_update/ta_update.test.lua
index 7e55075ed5351d29089e19029158a4c31448c313..774b9515ee2b68343af412cdf4fd45cb4fdfbca3 100644 (file)
--- a/modules/ta_update/ta_update.test.lua
+++ b/modules/ta_update/ta_update.test.lua
@@ -3,7 +3,7 @@ ta_update.refresh_time = 0.1 * sec
 ta_update.hold_down_time = 0.2 * sec
 
 -- prevent build-time config from interfering with the test
-trust_anchors.keyfile_default = nil
+trust_anchors.remove('.')
 
 -- count . IN DNSKEY queries
 counter = 0

diff --git a/modules/view/addr.test.integr/kresd_config.j2 b/modules/view/addr.test.integr/kresd_config.j2
index d9052875c0e73be7a99da6e619e47e2e0048be6b..08a6be20f115ab735fee72ca10653c71bca3ab43 100644 (file)
--- a/modules/view/addr.test.integr/kresd_config.j2
+++ b/modules/view/addr.test.integr/kresd_config.j2
@@ -6,7 +6,7 @@ view:addr('127.0.0.0/24', policy.suffix(policy.DENY_MSG("addr 127.0.0.0/24 match
 policy.add(policy.all(policy.FORWARD('1.2.3.4')))
 
 -- make sure DNSSEC is turned off for tests
-trust_anchors.keyfile_default = nil
+trust_anchors.remove('.')
 
 -- Disable RFC5011 TA update
 if ta_update then

diff --git a/modules/view/tsig.test.integr/kresd_config.j2 b/modules/view/tsig.test.integr/kresd_config.j2
index e69799be0d3dcb606383cd4e466517d55fa05a8f..c306989f7ec357ecb72d21685a71e4c4ecad6e8d 100644 (file)
--- a/modules/view/tsig.test.integr/kresd_config.j2
+++ b/modules/view/tsig.test.integr/kresd_config.j2
@@ -28,7 +28,7 @@ if detect_time_skew then
 end
 
 -- make sure DNSSEC is turned off for tests
-trust_anchors.keyfile_default = nil
+trust_anchors.remove('.')
 
 _hint_root_file('hints')
 cache.size = 2*MB

diff --git a/tests/pytests/templates/kresd.conf.j2 b/tests/pytests/templates/kresd.conf.j2
index 6e16b107217290e30bad1e544e3581e21170a2c8..72f0ee1a7f9262a97018a77f525d418792e55fd6 100644 (file)
--- a/tests/pytests/templates/kresd.conf.j2
+++ b/tests/pytests/templates/kresd.conf.j2
@@ -43,7 +43,7 @@ policy.add(policy.suffix(policy.PASS, {todname('test.')}))
 {% endif %}
 
 -- make sure DNSSEC is turned off for tests
-trust_anchors.keyfile_default = nil
+trust_anchors.remove('.')
 modules.unload("ta_update")
 modules.unload("ta_signal_query")
 modules.unload("priming")