remove "bindkeys-file" option

The bindkeys-file option was only used for testing purposes, and
has now been replaced with a "-T bindkeys=<filename>" option for
named.

diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
index 126d248f4d76ff84da50104403012118b1e54913..fa5fd5581c5a0edcd0b55a556a20e57b706368b9 100644 (file)
--- a/bin/named/include/named/globals.h
+++ b/bin/named/include/named/globals.h
@@ -89,9 +89,9 @@ EXTERN unsigned int named_g_debuglevel INIT(0);
  */
 EXTERN cfg_obj_t *named_g_defaultconfig               INIT(NULL);
 EXTERN const cfg_obj_t *named_g_defaultoptions INIT(NULL);
-EXTERN const char *named_g_conffile       INIT(NAMED_SYSCONFDIR "/named.conf");
-EXTERN const char *named_g_defaultbindkeys INIT(NULL);
-EXTERN const char *named_g_keyfile        INIT(NAMED_SYSCONFDIR "/rndc.key");
+EXTERN const char *named_g_conffile    INIT(NAMED_SYSCONFDIR "/named.conf");
+EXTERN const char *named_g_bindkeysfile INIT(NULL);
+EXTERN const char *named_g_keyfile     INIT(NAMED_SYSCONFDIR "/rndc.key");
 
 EXTERN bool named_g_conffileset INIT(false);
 

diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
index a39e8bfb9f76085c9186a076ba185094f3e27e50..da28b0cf5b44ddb24ebd0116912d52bd6c218f4c 100644 (file)
--- a/bin/named/include/named/server.h
+++ b/bin/named/include/named/server.h
@@ -55,7 +55,6 @@ struct named_server {
        char *statsfile;    /*%< Statistics file name */
        char *dumpfile;     /*%< Dump file name */
        char *secrootsfile; /*%< Secroots file name */
-       char *bindkeysfile; /*%< bind.keys file name */
        char *recfile;      /*%< Recursive file name */
        bool  version_set;  /*%< User has set version */
        char *version;      /*%< User-specified version */

diff --git a/bin/named/main.c b/bin/named/main.c
index 3ec1c2f0e12ac21905a86d65bd8ddaf9bd36f05c..ef466ba7a800e2f2159f6c6e9c6f36f822142e36 100644 (file)
--- a/bin/named/main.c
+++ b/bin/named/main.c
@@ -649,7 +649,7 @@ parse_fuzz_arg(void) {
 
 static void
 parse_T_opt(char *option) {
-       const char *p;
+       const char *p = NULL;
        char *last = NULL;
        /*
         * force the server to behave (or misbehave) in
@@ -692,6 +692,8 @@ parse_T_opt(char *option) {
                if (maxudp <= 0) {
                        named_main_earlyfatal("bad maxudp");
                }
+       } else if (!strncmp(option, "bindkeys=", 9)) {
+               named_g_bindkeysfile = option + 9;
        } else if (!strncmp(option, "mkeytimers=", 11)) {
                p = strtok_r(option + 11, "/", &last);
                if (p == NULL) {

diff --git a/bin/named/server.c b/bin/named/server.c
index 5bd1e399292c9943085fd72144d1eb71ba445ae1..54c271550e2e290d4b746e3e2f8d3fc9957df105 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -1138,8 +1138,9 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
                const cfg_obj_t *builtin_keys = NULL;
 
                /*
-                * If bind.keys exists and is populated, it overrides
-                * the trust-anchors clause hard-coded in
+                * If "-T bindkeys=<filename>" was used and
+                * the file has a root key in it, that will
+                * replace the trust-anchors clause hard-coded in
                 * named_g_defaultconfig.
                 */
                if (bindkeys != NULL) {
@@ -1147,7 +1148,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
                                      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
                                      "obtaining root key for view %s "
                                      "from '%s'",
-                                     view->name, named_g_server->bindkeysfile);
+                                     view->name, named_g_bindkeysfile);
 
                        (void)cfg_map_get(bindkeys, "trust-anchors",
                                          &builtin_keys);
@@ -8114,9 +8115,8 @@ configure_kasplist(const cfg_obj_t *config, dns_kasplist_t *kasplist,
 
 static isc_result_t
 apply_configuration(cfg_parser_t *configparser, cfg_obj_t *config,
-                   named_server_t *server, bool first_time) {
-       cfg_obj_t *bindkeys = NULL;
-       cfg_parser_t *bindkeys_parser = NULL;
+                   cfg_obj_t *bindkeys, named_server_t *server,
+                   bool first_time) {
        const cfg_obj_t *maps[3];
        const cfg_obj_t *obj = NULL;
        const cfg_obj_t *options = NULL;
@@ -8251,48 +8251,6 @@ apply_configuration(cfg_parser_t *configparser, cfg_obj_t *config,
        named_g_http_streams_per_conn = cfg_obj_asuint32(obj);
 #endif
 
-       /*
-        * If "dnssec-validation auto" is turned on, the root key
-        * will be used as a default trust anchor. The root key
-        * is built in, but if bindkeys-file is set, then it will
-        * be overridden with the key in that file.
-        */
-       obj = NULL;
-       (void)named_config_get(maps, "bindkeys-file", &obj);
-       if (obj != NULL) {
-               setstring(server, &server->bindkeysfile, cfg_obj_asstring(obj));
-               INSIST(server->bindkeysfile != NULL);
-               if (access(server->bindkeysfile, R_OK) != 0) {
-                       isc_log_write(NAMED_LOGCATEGORY_GENERAL,
-                                     NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-                                     "unable to open '%s'; using built-in "
-                                     "keys instead",
-                                     server->bindkeysfile);
-               } else {
-                       result = cfg_parser_create(isc_g_mctx,
-                                                  &bindkeys_parser);
-                       if (result != ISC_R_SUCCESS) {
-                               goto cleanup_bindkeys_parser;
-                       }
-
-                       result = cfg_parse_file(bindkeys_parser,
-                                               server->bindkeysfile,
-                                               &cfg_type_bindkeys, &bindkeys);
-                       if (result != ISC_R_SUCCESS) {
-                               isc_log_write(NAMED_LOGCATEGORY_GENERAL,
-                                             NAMED_LOGMODULE_SERVER,
-                                             ISC_LOG_INFO,
-                                             "unable to parse '%s' "
-                                             "error '%s'; using "
-                                             "built-in keys instead",
-                                             server->bindkeysfile,
-                                             isc_result_totext(result));
-                       }
-               }
-       } else {
-               setstring(server, &server->bindkeysfile, NULL);
-       }
-
 #if defined(HAVE_GEOIP2)
        /*
         * Release any previously opened GeoIP2 databases.
@@ -8338,7 +8296,7 @@ apply_configuration(cfg_parser_t *configparser, cfg_obj_t *config,
                                      max, named_g_cpus);
                        result = ISC_R_RANGE;
 
-                       goto cleanup_bindkeys_parser;
+                       goto cleanup_tls;
                }
                softquota = max - margin;
        } else {
@@ -8363,7 +8321,7 @@ apply_configuration(cfg_parser_t *configparser, cfg_obj_t *config,
                                    aclctx, isc_g_mctx,
                                    &server->sctx->blackholeacl);
        if (result != ISC_R_SUCCESS) {
-               goto cleanup_bindkeys_parser;
+               goto cleanup_tls;
        }
 
        if (server->sctx->blackholeacl != NULL) {
@@ -9287,14 +9245,7 @@ cleanup_portsets:
        isc_portset_destroy(isc_g_mctx, &v6portset);
        isc_portset_destroy(isc_g_mctx, &v4portset);
 
-cleanup_bindkeys_parser:
-       if (bindkeys_parser != NULL) {
-               if (bindkeys != NULL) {
-                       cfg_obj_destroy(bindkeys_parser, &bindkeys);
-               }
-               cfg_parser_destroy(&bindkeys_parser);
-       }
-
+cleanup_tls:
        /*
         * Detach the TLS client context (whether the one created at the
         * begining of this function, or the previous running one)
@@ -9347,7 +9298,7 @@ static isc_result_t
 load_configuration(named_server_t *server, bool first_time) {
        isc_result_t result;
        cfg_parser_t *parser = NULL;
-       cfg_obj_t *config = NULL;
+       cfg_obj_t *config = NULL, *bindkeys = NULL;
 
        isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
                      ISC_LOG_DEBUG(1), "load_configuration");
@@ -9362,10 +9313,44 @@ load_configuration(named_server_t *server, bool first_time) {
                goto cleanup;
        }
 
-       result = apply_configuration(parser, config, server, first_time);
+       if (named_g_bindkeysfile != NULL) {
+               /*
+                * If "dnssec-validation auto" is turned on, the root key
+                * will be used as a default trust anchor. The root key
+                * is built in, but if -Tbindkeys=<filename> is used,
+                * the key is overridden with the key in that file.
+                */
+               if (access(named_g_bindkeysfile, R_OK) != 0) {
+                       isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+                                     NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+                                     "unable to open '%s'; using built-in "
+                                     "keys instead",
+                                     named_g_bindkeysfile);
+               } else {
+                       cfg_parser_reset(parser);
+                       result = cfg_parse_file(parser, named_g_bindkeysfile,
+                                               &cfg_type_bindkeys, &bindkeys);
+                       if (result != ISC_R_SUCCESS) {
+                               isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+                                             NAMED_LOGMODULE_SERVER,
+                                             ISC_LOG_INFO,
+                                             "unable to parse '%s' "
+                                             "error '%s'; using "
+                                             "built-in keys instead",
+                                             named_g_bindkeysfile,
+                                             isc_result_totext(result));
+                       }
+               }
+       }
+
+       result = apply_configuration(parser, config, bindkeys, server,
+                                    first_time);
 
 cleanup:
-       if (config) {
+       if (bindkeys != NULL) {
+               cfg_obj_destroy(parser, &bindkeys);
+       }
+       if (config != NULL) {
                cfg_obj_destroy(parser, &config);
        }
        cfg_parser_destroy(&parser);
@@ -9986,10 +9971,6 @@ named_server_destroy(named_server_t **serverp) {
        isc_mem_free(server->mctx, server->secrootsfile);
        isc_mem_free(server->mctx, server->recfile);
 
-       if (server->bindkeysfile != NULL) {
-               isc_mem_free(server->mctx, server->bindkeysfile);
-       }
-
        if (server->version != NULL) {
                isc_mem_free(server->mctx, server->version);
        }

diff --git a/bin/tests/system/dnssec/ns4/named.args b/bin/tests/system/dnssec/ns4/named.args
new file mode 100644 (file)
index 0000000..66d7dd9
--- /dev/null
+++ b/bin/tests/system/dnssec/ns4/named.args
@@ -0,0 +1 @@
+-m record -c named.conf -d 99 -D dnssec-ns4 -g -T maxcachesize=2097152 -T bindkeys=managed.conf

diff --git a/bin/tests/system/dnssec/ns4/named.conf.j2 b/bin/tests/system/dnssec/ns4/named.conf.j2
index 7c21e734f2ee7641e32d7c0f03b0978540729399..b4aa86146a5cb882b78da3dd6d60184209f78539 100644 (file)
--- a/bin/tests/system/dnssec/ns4/named.conf.j2
+++ b/bin/tests/system/dnssec/ns4/named.conf.j2
@@ -35,7 +35,6 @@ options {
 
        {% if managed_key %}
                dnssec-validation auto;
-               bindkeys-file "managed.conf";
        {% else %}
                dnssec-validation yes;
        {% endif %}

diff --git a/bin/tests/system/mkeys/ns2/named.args b/bin/tests/system/mkeys/ns2/named.args
index 175e02c098aa62cb0eb954e28933bd836af7cbb1..1387f480b066a1f5d7887932c40e1e5f3efc8424 100644 (file)
--- a/bin/tests/system/mkeys/ns2/named.args
+++ b/bin/tests/system/mkeys/ns2/named.args
@@ -1 +1 @@
--m record -c named.conf -d 99 -D mkeys-ns2 -g -T maxcachesize=2097152 -T mkeytimers=5/10/20 -T tat=1
+-m record -c named.conf -d 99 -D mkeys-ns2 -g -T maxcachesize=2097152 -T mkeytimers=5/10/20 -T tat=1 -T bindkeys=managed.conf

diff --git a/bin/tests/system/mkeys/ns2/named.conf.in b/bin/tests/system/mkeys/ns2/named.conf.in
index feed9239c1a051dd870d69706c2d2ba12443ae95..0596facdd4d0f025e8b2f1b89c48c90c88dabfe5 100644 (file)
--- a/bin/tests/system/mkeys/ns2/named.conf.in
+++ b/bin/tests/system/mkeys/ns2/named.conf.in
@@ -24,7 +24,6 @@ options {
        recursion yes;
        notify no;
        dnssec-validation auto;
-       bindkeys-file "managed.conf";
        servfail-ttl 0;
 };
 

diff --git a/bin/tests/system/mkeys/ns3/named.args b/bin/tests/system/mkeys/ns3/named.args
index 342cbe328b620e9fb9f1eb63066e0b1b1758e9e9..59e443087aaf1a67126420fd7cd54a325f1e7fa3 100644 (file)
--- a/bin/tests/system/mkeys/ns3/named.args
+++ b/bin/tests/system/mkeys/ns3/named.args
@@ -1 +1 @@
--m record -c named.conf -d 99 -D mkeys-ns3 -g -T maxcachesize=2097152 -T mkeytimers=5/10/20
+-m record -c named.conf -d 99 -D mkeys-ns3 -g -T maxcachesize=2097152 -T mkeytimers=5/10/20 -T bindkeys=managed.conf

diff --git a/bin/tests/system/mkeys/ns3/named.conf.in b/bin/tests/system/mkeys/ns3/named.conf.in
index d590a315f80e42a4f952fa9292dda44c91e73b2f..d0b90a9680d68c38f08f530825e9cf32a4ed70e7 100644 (file)
--- a/bin/tests/system/mkeys/ns3/named.conf.in
+++ b/bin/tests/system/mkeys/ns3/named.conf.in
@@ -24,7 +24,6 @@ options {
        recursion yes;
        notify no;
        dnssec-validation auto;
-       bindkeys-file "managed.conf";
        trust-anchor-telemetry no;
 };
 

diff --git a/bin/tests/system/mkeys/ns4/named.args b/bin/tests/system/mkeys/ns4/named.args
new file mode 100644 (file)
index 0000000..13d33da
--- /dev/null
+++ b/bin/tests/system/mkeys/ns4/named.args
@@ -0,0 +1 @@
+-m record -c named.conf -d 99 -D mkeys-ns4 -g -T maxcachesize=2097152 -T bindkeys=managed.conf

diff --git a/bin/tests/system/mkeys/ns4/named.conf.in b/bin/tests/system/mkeys/ns4/named.conf.in
index 1ad75aa0cf204e243696c188dbbb1fd589f037fe..5748e6a581da02c10d43f5718a11367a76762d5d 100644 (file)
--- a/bin/tests/system/mkeys/ns4/named.conf.in
+++ b/bin/tests/system/mkeys/ns4/named.conf.in
@@ -24,7 +24,6 @@ options {
        recursion yes;
        notify no;
        dnssec-validation auto;
-       bindkeys-file "managed.conf";
        managed-keys-directory "nope";
 };
 

diff --git a/bin/tests/system/mkeys/ns5/named.conf.in b/bin/tests/system/mkeys/ns5/named.conf.in
index 866997102d7e1b92f78941330881f4de492ff469..bb10716f7997cc46bc7e5559ef0803738dc96cdf 100644 (file)
--- a/bin/tests/system/mkeys/ns5/named.conf.in
+++ b/bin/tests/system/mkeys/ns5/named.conf.in
@@ -24,7 +24,6 @@ options {
        recursion yes;
        notify no;
        dnssec-validation auto;
-       bindkeys-file "managed.conf";
        servfail-ttl 0;
 };
 

diff --git a/bin/tests/system/mkeys/ns5/named1.args b/bin/tests/system/mkeys/ns5/named1.args
index cd9a2283ed9768521e7eb13a0e8173dc6bccbb79..48724e9f539d09401c2e97626ba3133f13ddd66c 100644 (file)
--- a/bin/tests/system/mkeys/ns5/named1.args
+++ b/bin/tests/system/mkeys/ns5/named1.args
@@ -1 +1 @@
--m record -c named.conf -d 99 -g -T maxcachesize=2097152
+-m record -c named.conf -d 99 -g -T maxcachesize=2097152 -T mkeys=managed.conf

diff --git a/bin/tests/system/mkeys/ns5/named2.args b/bin/tests/system/mkeys/ns5/named2.args
index a25144808799224439752f18f87e97f4e12ec2bb..54cffb80c54f0914acc1f3adf2292e4d7803c63b 100644 (file)
--- a/bin/tests/system/mkeys/ns5/named2.args
+++ b/bin/tests/system/mkeys/ns5/named2.args
@@ -1 +1 @@
--m record -c named.conf -d 99 -g -T maxcachesize=2097152 -T mkeytimers=2/20/40
+-m record -c named.conf -d 99 -g -T maxcachesize=2097152 -T bindkeys=managed.conf -T mkeytimers=2/20/40

diff --git a/bin/tests/system/mkeys/ns7/named.args b/bin/tests/system/mkeys/ns7/named.args
new file mode 100644 (file)
index 0000000..cff7a1b
--- /dev/null
+++ b/bin/tests/system/mkeys/ns7/named.args
@@ -0,0 +1 @@
+-m record -c named.conf -d 99 -D mkeys-ns7 -g -T maxcachesize=2097152 -T bindkeys=managed.conf

diff --git a/bin/tests/system/mkeys/ns7/named.conf.in b/bin/tests/system/mkeys/ns7/named.conf.in
index 7ccf59ef604ec1998e2ef4ab2da57a26e0158e6f..17c8985172b383edb2b8bb9916eff2ff935df9da 100644 (file)
--- a/bin/tests/system/mkeys/ns7/named.conf.in
+++ b/bin/tests/system/mkeys/ns7/named.conf.in
@@ -24,7 +24,6 @@ options {
        recursion yes;
        notify no;
        dnssec-validation auto;
-       bindkeys-file "managed.conf";
 };
 
 key rndc_key {

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 110d34cf08c48a1b07c334d9d9c974d9582b2fc1..8f29cdcba7e9cac20d5483582dbebaf3f3ba11fd 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -1501,14 +1501,6 @@ default is used.
    default is ``named.stats`` in the server's current directory. The
    format of the file is described in :ref:`statsfile`.
 
-.. namedconf:statement:: bindkeys-file
-   :tags: dnssec
-   :short: Specifies the pathname of a file to override the built-in trusted keys provided by :iscman:`named`.
-
-   This is the pathname of a file to override the built-in trusted keys provided
-   by :iscman:`named`. See the discussion of :any:`dnssec-validation` for
-   details. This is intended for server testing.
-
 .. namedconf:statement:: secroots-file
    :tags: dnssec
    :short: Specifies the pathname of the file where the server dumps security roots, when using :option:`rndc secroots`.

diff --git a/doc/misc/options b/doc/misc/options
index c5a5193183cd854fbe1971b5590a7cd1f3f50bdf..39b7d2f4a96212a73c1fc83e737cf4882420596c 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -84,7 +84,6 @@ options {
        attach-cache <string>;
        auth-nxdomain <boolean>;
        automatic-interface-scan <boolean>;
-       bindkeys-file <quoted_string>; // test only
        blackhole { <address_match_element>; ... };
        catalog-zones { zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <server-list> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone-directory <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval <duration> ]; ... };
        check-dup-records ( fail | warn | ignore );

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index f6df82d9952aee31a022f52ced8bfffbcc755b24..4b022cefe28ec258d04f052d70489d2adf99d030 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -1194,7 +1194,8 @@ static cfg_clausedef_t namedconf_or_view_clauses[] = {
 };
 
 /*%
- * Clauses that can occur in the bind.keys file.
+ * Clauses that can occur in a trust anchor file (previously
+ * called bind.keys).
  */
 static cfg_clausedef_t bindkeys_clauses[] = {
        { "managed-keys", &cfg_type_dnsseckeys,
@@ -1218,7 +1219,7 @@ static cfg_clausedef_t options_clauses[] = {
        { "automatic-interface-scan", &cfg_type_boolean, 0 },
        { "avoid-v4-udp-ports", NULL, CFG_CLAUSEFLAG_ANCIENT },
        { "avoid-v6-udp-ports", NULL, CFG_CLAUSEFLAG_ANCIENT },
-       { "bindkeys-file", &cfg_type_qstring, CFG_CLAUSEFLAG_TESTONLY },
+       { "bindkeys-file", &cfg_type_qstring, CFG_CLAUSEFLAG_ANCIENT },
        { "blackhole", &cfg_type_bracketed_aml, 0 },
        { "cookie-algorithm", &cfg_type_cookiealg, 0 },
        { "cookie-secret", &cfg_type_sstring, CFG_CLAUSEFLAG_MULTI },