From: Evan Hunt <each@isc.org>
Date: Tue, 11 Aug 2026 00:04:34 +0000 (-0700)
Subject: Fix crash in named-checkconf -n
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6850bc0cfbe5ab8d76c1b43fd03b59b975a69378;p=thirdparty%2Fbind9.git

Fix crash in named-checkconf -n

The "named-checkconf -n" option always triggered a crash due to
an incorrect REQUIRE. This has been fixed, and a regression test
added to the checkconf system test.
---

diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
index a40a4b703c5..ea38abcd6a4 100644
--- a/bin/check/named-checkconf.c
+++ b/bin/check/named-checkconf.c
@@ -51,7 +51,7 @@ usage(void);
 static void
 usage(void) {
 	fprintf(stderr,
-		"usage: %s [-achijklvz] [-pe [-x]] [-b] [-t directory] "
+		"usage: %s [-achijklnvz] [-pe [-x]] [-b] [-t directory] "
 		"[named.conf]\n",
 		isc_commandline_progname);
 	exit(EXIT_SUCCESS);
diff --git a/bin/check/named-checkconf.rst b/bin/check/named-checkconf.rst
index fb267a13b43..8e65c85e419 100644
--- a/bin/check/named-checkconf.rst
+++ b/bin/check/named-checkconf.rst
@@ -21,7 +21,7 @@ named-checkconf - named configuration file syntax checking tool
 Synopsis
 ~~~~~~~~
 
-:program:`named-checkconf` [**-achjklnvz**] [**-pe** [**-x** ]] [**-b**]
+:program:`named-checkconf` [**-achijklnvz**] [**-pe** [**-x** ]] [**-b**]
 [**-t** directory] {filename}
 
 Description
diff --git a/bin/tests/system/checkconf/disabled.conf b/bin/tests/system/checkconf/disabled.conf
new file mode 100644
index 00000000000..04ce2e7cca5
--- /dev/null
+++ b/bin/tests/system/checkconf/disabled.conf
@@ -0,0 +1,4 @@
+options {
+	# depending on build options, this should require named-checkconf -n
+	dnstap-version none;
+};
diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index ff976d842b6..40e5802d911 100644
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -175,11 +175,24 @@ grep "option 'max-zone-ttl' is deprecated" <checkconf.out$n.1 >/dev/null || ret=
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 # set -i to ignore deprecate warnings
-$CHECKCONF -i deprecated.conf 2>&1 | grep_v "rrset-order: order 'fixed' was disabled at compilation time" >checkconf.out$n.2
+$CHECKCONF -i deprecated.conf >checkconf.out$n.2 2>&1
 grep '^.+$' <checkconf.out$n.2 >/dev/null && ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
+if ! $FEATURETEST --enable-dnstap; then
+  n=$((n + 1))
+  echo_i "checking named-checkconf disabled warnings ($n)"
+  ret=0
+  $CHECKCONF disabled.conf >checkconf.out$n.1 2>&1 && ret=1
+  grep "option 'dnstap-version' was not enabled at compile time" <checkconf.out$n.1 >/dev/null || ret=1
+fi
+# set -n to ignore disabled warnings
+$CHECKCONF -n disabled.conf >checkconf.out$n.2 2>&1
+[ -s checkconf.out$n.2 ] && ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 n=$((n + 1))
 echo_i "checking named-checkconf servestale warnings ($n)"
 ret=0
diff --git a/lib/isccfg/parser.c b/lib/isccfg/parser.c
index ca7e5f24714..6cc2bbb0110 100644
--- a/lib/isccfg/parser.c
+++ b/lib/isccfg/parser.c
@@ -799,7 +799,8 @@ cleanup:
 
 #define REQUIRE_PCTX_FLAGS(flags)                                        \
 	REQUIRE((flags & ~(CFG_PCTX_NODEPRECATED | CFG_PCTX_NOOBSOLETE | \
-			   CFG_PCTX_NOEXPERIMENTAL | CFG_PCTX_BUILTIN)) == 0)
+			   CFG_PCTX_NOEXPERIMENTAL | CFG_PCTX_BUILTIN |  \
+			   CFG_PCTX_ALLCONFIGS)) == 0)
 
 isc_result_t
 cfg_parse_file(const char *filename, const cfg_type_t *type, unsigned int flags,