Rec: warn on DNSSEC (N)TAs config without DNSSEC

diff --git a/pdns/pdns_recursor.cc b/pdns/pdns_recursor.cc
index c719bfe6466af099058e6fc7990a4256932264e8..87d3713d9836d01619a743142c1dfd7855205fbe 100644 (file)
--- a/pdns/pdns_recursor.cc
+++ b/pdns/pdns_recursor.cc
@@ -2607,6 +2607,24 @@ int serviceMain(int argc, char*argv[])
     exit(99);
   }
 
+  // keep this ABOVE loadRecursorLuaConfig!
+  if(::arg()["dnssec"]=="off")
+    g_dnssecmode=DNSSECMode::Off;
+  else if(::arg()["dnssec"]=="process-no-validate")
+    g_dnssecmode=DNSSECMode::ProcessNoValidate;
+  else if(::arg()["dnssec"]=="process")
+    g_dnssecmode=DNSSECMode::Process;
+  else if(::arg()["dnssec"]=="validate")
+    g_dnssecmode=DNSSECMode::ValidateAll;
+  else if(::arg()["dnssec"]=="log-fail")
+    g_dnssecmode=DNSSECMode::ValidateForLog;
+  else {
+    L<<Logger::Error<<"Unknown DNSSEC mode "<<::arg()["dnssec"]<<endl;
+    exit(1);
+  }
+
+  g_dnssecLogBogus = ::arg().mustDo("dnssec-log-bogus");
+
   loadRecursorLuaConfig(::arg()["lua-config-file"]);
 
   parseACLs();
@@ -2639,23 +2657,6 @@ int serviceMain(int argc, char*argv[])
   setupDelegationOnly();
   g_outgoingEDNSBufsize=::arg().asNum("edns-outgoing-bufsize");
 
-  if(::arg()["dnssec"]=="off")
-    g_dnssecmode=DNSSECMode::Off;
-  else if(::arg()["dnssec"]=="process-no-validate")
-    g_dnssecmode=DNSSECMode::ProcessNoValidate;
-  else if(::arg()["dnssec"]=="process")
-    g_dnssecmode=DNSSECMode::Process;
-  else if(::arg()["dnssec"]=="validate")
-    g_dnssecmode=DNSSECMode::ValidateAll;
-  else if(::arg()["dnssec"]=="log-fail")
-    g_dnssecmode=DNSSECMode::ValidateForLog;
-  else {
-    L<<Logger::Error<<"Unknown DNSSEC mode "<<::arg()["dnssec"]<<endl;
-    exit(1);
-  }
-
-  g_dnssecLogBogus = ::arg().mustDo("dnssec-log-bogus");
-
   if(::arg()["trace"]=="fail") {
     SyncRes::setDefaultLogMode(SyncRes::Store);
   }

diff --git a/pdns/rec-lua-conf.cc b/pdns/rec-lua-conf.cc
index 26dfae684fb66bf61571f428fb4b70af2b014876..a499b8699bcefabd9bd1e8b8f6e21e13aad743c5 100644 (file)
--- a/pdns/rec-lua-conf.cc
+++ b/pdns/rec-lua-conf.cc
@@ -15,6 +15,7 @@
 #include "base64.hh"
 #include "remote_logger.hh"
 #include "validate.hh"
+#include "validate-recursor.hh"
 #include "root-dnssec.hh"
 
 GlobalStateHolder<LuaConfigItems> g_luaconfs; 
@@ -233,12 +234,14 @@ void loadRecursorLuaConfig(const std::string& fname)
                    });
 
   Lua.writeFunction("addDS", [&lci](const std::string& who, const std::string& what) {
+      warnIfDNSSECDisabled("Warning: adding Trust Anchor for DNSSEC (addDS), but dnssec is set to 'off'!");
       DNSName zone(who);
       auto ds = unique_ptr<DSRecordContent>(dynamic_cast<DSRecordContent*>(DSRecordContent::make(what)));
       lci.dsAnchors[zone].insert(*ds);
   });
 
   Lua.writeFunction("clearDS", [&lci](boost::optional<string> who) {
+      warnIfDNSSECDisabled("Warning: removing Trust Anchor for DNSSEC (clearDS), but dnssec is set to 'off'!");
       if(who)
         lci.dsAnchors.erase(DNSName(*who));
       else
@@ -246,6 +249,7 @@ void loadRecursorLuaConfig(const std::string& fname)
     });
 
   Lua.writeFunction("addNTA", [&lci](const std::string& who, const boost::optional<std::string> why) {
+      warnIfDNSSECDisabled("Warning: adding Negative Trust Anchor for DNSSEC (addNTA), but dnssec is set to 'off'!");
       if(why)
         lci.negAnchors[DNSName(who)] = static_cast<string>(*why);
       else
@@ -253,6 +257,7 @@ void loadRecursorLuaConfig(const std::string& fname)
     });
 
   Lua.writeFunction("clearNTA", [&lci](boost::optional<string> who) {
+      warnIfDNSSECDisabled("Warning: removing Negative Trust Anchor for DNSSEC (clearNTA), but dnssec is set to 'off'!");
       if(who)
         lci.negAnchors.erase(DNSName(*who));
       else

diff --git a/pdns/validate-recursor.cc b/pdns/validate-recursor.cc
index 5819cfe7a91b16aa25795b721312d0b11d1ae386..aef9379c5d565079373bce0781349e1a19dbaf98 100644 (file)
--- a/pdns/validate-recursor.cc
+++ b/pdns/validate-recursor.cc
@@ -26,6 +26,11 @@ public:
   int d_queries{0};
 };
 
+void warnIfDNSSECDisabled(const string& msg) {
+  if(g_dnssecmode == DNSSECMode::Off)
+    L<<Logger::Warning<<msg<<endl;
+}
+
 inline vState increaseDNSSECStateCounter(const vState& state)
 {
   g_stats.dnssecResults[state]++;

diff --git a/pdns/validate-recursor.hh b/pdns/validate-recursor.hh
index 5604ac53386a950c84ff2fb462013b47b5fb616e..2fa9850828cd2400ca720e25cf323897942d7704 100644 (file)
--- a/pdns/validate-recursor.hh
+++ b/pdns/validate-recursor.hh
@@ -23,6 +23,7 @@
 #include "dnsparser.hh"
 #include "namespaces.hh"
 #include "validate.hh"
+#include "logger.hh"
 
 vState validateRecords(const vector<DNSRecord>& recs);
 
@@ -36,3 +37,5 @@ vState validateRecords(const vector<DNSRecord>& recs);
 enum class DNSSECMode { Off, Process, ProcessNoValidate, ValidateForLog, ValidateAll };
 extern DNSSECMode g_dnssecmode;
 extern bool g_dnssecLogBogus;
+
+void warnIfDNSSECDisabled(const string& msg);