- disable-edns-do, doc and add option disable-edns-do: no.

diff --git a/doc/example.conf.in b/doc/example.conf.in
index 0980212e123dd32649b49c001e25bb9ef435b05c..44a19fc720a4c63f7f6c00b34383edc1ff0f8090 100644 (file)
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -683,6 +683,11 @@ server:
        # that set CD but cannot validate themselves.
        # ignore-cd-flag: no
 
+       # Disable the DO flag in outgoing requests. It is helpful for upstream
+       # devices that cannot handle DNSSEC information. But do not enable it
+       # otherwise, because it would stop DNSSEC validation.
+       # disable-edns-do: no
+
        # Serve expired responses from cache, with serve-expired-reply-ttl in
        # the response, and then attempt to fetch the data afresh.
        # serve-expired: no

diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 84b903f49ddb479c9e4996a84a5c37c7784b7070..bbc6ddae57f29d63902ffce508210ddae6e3b7b0 100644 (file)
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1302,6 +1302,13 @@ servers that set the CD flag but cannot validate DNSSEC themselves are
 the clients, and then Unbound provides them with DNSSEC protection.
 The default value is "no".
 .TP
+.B disable\-edns\-do: \fI<yes or no>
+Disable the EDNS DO flag in upstream requests. This can be helpful for
+devices that cannot handle DNSSEC information. But it should not be enabled
+otherwise, because that would stop DNSSEC validation. The DNSSEC validation
+would not work for Unbound itself, and also not for downstream users.
+Default is no.
+.TP
 .B serve\-expired: \fI<yes or no>
 If enabled, Unbound attempts to serve old responses from cache with a
 TTL of \fBserve\-expired\-reply\-ttl\fR in the response without waiting for the

diff --git a/util/config_file.c b/util/config_file.c
index 45409634232634626c08365deafc2d9e63fdaaaa..8f7de905e69064b82c6732f4dbced6a1543def92 100644 (file)
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -271,6 +271,7 @@ config_create(void)
        cfg->val_permissive_mode = 0;
        cfg->aggressive_nsec = 1;
        cfg->ignore_cd = 0;
+       cfg->disable_edns_do = 0;
        cfg->serve_expired = 0;
        cfg->serve_expired_ttl = 0;
        cfg->serve_expired_ttl_reset = 0;
@@ -690,6 +691,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
        else S_YNO("val-permissive-mode:", val_permissive_mode)
        else S_YNO("aggressive-nsec:", aggressive_nsec)
        else S_YNO("ignore-cd-flag:", ignore_cd)
+       else S_YNO("disable-edns-do:", disable_edns_do)
        else if(strcmp(opt, "serve-expired:") == 0)
        { IS_YES_OR_NO; cfg->serve_expired = (strcmp(val, "yes") == 0);
          SERVE_EXPIRED = cfg->serve_expired; }
@@ -1149,6 +1151,7 @@ config_get_option(struct config_file* cfg, const char* opt,
        else O_YNO(opt, "val-permissive-mode", val_permissive_mode)
        else O_YNO(opt, "aggressive-nsec", aggressive_nsec)
        else O_YNO(opt, "ignore-cd-flag", ignore_cd)
+       else O_YNO(opt, "disable-edns-do", disable_edns_do)
        else O_YNO(opt, "serve-expired", serve_expired)
        else O_DEC(opt, "serve-expired-ttl", serve_expired_ttl)
        else O_YNO(opt, "serve-expired-ttl-reset", serve_expired_ttl_reset)

diff --git a/util/config_file.h b/util/config_file.h
index 452f3c6a78fb9361645b1c47516204579ec7ba29..d71d7ace56e26d3c69989e219f248b6810ab2d9e 100644 (file)
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -409,6 +409,8 @@ struct config_file {
        int aggressive_nsec;
        /** ignore the CD flag in incoming queries and refuse them bogus data */
        int ignore_cd;
+       /** disable EDNS DO flag in outgoing requests */
+       int disable_edns_do;
        /** serve expired entries and prefetch them */
        int serve_expired;
        /** serve expired entries until TTL after expiration */

diff --git a/util/configlexer.lex b/util/configlexer.lex
index 3fcdfa62e03351bb3706a38b57d47e03a4c74da1..2b3141a4229e7c4710693c7ecff2b0b6b60f3f0b 100644 (file)
--- a/util/configlexer.lex
+++ b/util/configlexer.lex
@@ -403,6 +403,7 @@ val-clean-additional{COLON} { YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
 val-permissive-mode{COLON}     { YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
 aggressive-nsec{COLON}         { YDVAR(1, VAR_AGGRESSIVE_NSEC) }
 ignore-cd-flag{COLON}          { YDVAR(1, VAR_IGNORE_CD_FLAG) }
+disable-edns-do{COLON}         { YDVAR(1, VAR_DISABLE_EDNS_DO) }
 serve-expired{COLON}           { YDVAR(1, VAR_SERVE_EXPIRED) }
 serve-expired-ttl{COLON}       { YDVAR(1, VAR_SERVE_EXPIRED_TTL) }
 serve-expired-ttl-reset{COLON} { YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) }

diff --git a/util/configparser.y b/util/configparser.y
index d8f25a67ebbfded22d1a5f307a859f041ea29332..cbea62b58ecdc28e81cb1e0f6ef903c452910e31 100644 (file)
--- a/util/configparser.y
+++ b/util/configparser.y
@@ -198,7 +198,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_INTERFACE_ACTION VAR_INTERFACE_VIEW VAR_INTERFACE_TAG
 %token VAR_INTERFACE_TAG_ACTION VAR_INTERFACE_TAG_DATA
 %token VAR_PROXY_PROTOCOL_PORT VAR_STATISTICS_INHIBIT_ZERO
-%token VAR_HARDEN_UNKNOWN_ADDITIONAL
+%token VAR_HARDEN_UNKNOWN_ADDITIONAL VAR_DISABLE_EDNS_DO
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -332,7 +332,7 @@ content_server: server_num_threads | server_verbosity | server_port |
        server_tcp_reuse_timeout | server_tcp_auth_query_timeout |
        server_interface_automatic_ports | server_ede |
        server_proxy_protocol_port | server_statistics_inhibit_zero |
-       server_harden_unknown_additional
+       server_harden_unknown_additional | server_disable_edns_do
        ;
 stubstart: VAR_STUB_ZONE
        {
@@ -2060,6 +2060,15 @@ server_ignore_cd_flag: VAR_IGNORE_CD_FLAG STRING_ARG
                free($2);
        }
        ;
+server_disable_edns_do: VAR_DISABLE_EDNS_DO STRING_ARG
+       {
+               OUTYY(("P(server_disable_edns_do:%s)\n", $2));
+               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+                       yyerror("expected yes or no.");
+               else cfg_parser->cfg->disable_edns_do = (strcmp($2, "yes")==0);
+               free($2);
+       }
+       ;
 server_serve_expired: VAR_SERVE_EXPIRED STRING_ARG
        {
                OUTYY(("P(server_serve_expired:%s)\n", $2));