don't create managed-keys zone unless dnssec-validation is "auto"

previously, a managed-keys zone was created for every view
regardless of whether rfc5011 was in use; when it was not in
use, the zone would be left empty. this made for some confusing
log messages.

we now only set up the managed-keys zone if dnssec-validation is
set to the default value of "auto".

certain system test servers have had their dnssec-validation settings
changed to auto because the tests depended on the existence of the
zone.

diff --git a/bin/named/server.c b/bin/named/server.c
index 84cc98419a5cca002f10d81746ddc2a7c3041b92..ca25b073bac8dadc7bec5467fb6bdc491707d1d7 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -1200,7 +1200,9 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
                }
        }
 
-       CHECK(add_keydata_zone(view, directory, named_g_mctx));
+       if (auto_root) {
+               CHECK(add_keydata_zone(view, directory, named_g_mctx));
+       }
 
 cleanup:
        return (result);

diff --git a/bin/tests/system/journal/ns1/named.conf.in b/bin/tests/system/journal/ns1/named.conf.in
index 1f6e983340407fd7b9d8356eae8e375d8e1c98fb..c3e2843b97af1ae2e6062773d763e11f98c92972 100644 (file)
--- a/bin/tests/system/journal/ns1/named.conf.in
+++ b/bin/tests/system/journal/ns1/named.conf.in
@@ -20,7 +20,7 @@ options {
        pid-file "named.pid";
        listen-on { 10.53.0.1; };
        listen-on-v6 { none; };
-       dnssec-validation yes;
+       dnssec-validation auto;
        minimal-responses no;
        recursion no;
        notify yes;

diff --git a/bin/tests/system/journal/ns2/named.conf.in b/bin/tests/system/journal/ns2/named.conf.in
index 4c07c920db5e40529b52d76253ddab1e61e398d9..4d58c284681b82a5956ef64005257eb0b17e315e 100644 (file)
--- a/bin/tests/system/journal/ns2/named.conf.in
+++ b/bin/tests/system/journal/ns2/named.conf.in
@@ -20,7 +20,7 @@ options {
        pid-file "named.pid";
        listen-on { 10.53.0.2; };
        listen-on-v6 { none; };
-       dnssec-validation yes;
+       dnssec-validation auto;
        minimal-responses no;
        recursion no;
        notify yes;

diff --git a/bin/tests/system/mkeys/ns3/named.conf.in b/bin/tests/system/mkeys/ns3/named.conf.in
index 7ad8419a93c8c5d24689d104da0d73cea579ab75..e6e19f54c34435adcf56d2f7b9a709e4ba787a2e 100644 (file)
--- a/bin/tests/system/mkeys/ns3/named.conf.in
+++ b/bin/tests/system/mkeys/ns3/named.conf.in
@@ -23,7 +23,7 @@ options {
        listen-on-v6 { none; };
        recursion yes;
        notify no;
-       dnssec-validation yes;
+       dnssec-validation auto;
        bindkeys-file "managed.conf";
        trust-anchor-telemetry no;
 };

diff --git a/bin/tests/system/mkeys/ns6/named.conf.in b/bin/tests/system/mkeys/ns6/named.conf.in
index ff8137a6f2b48b30c4cfc229689f44f450b2fb96..50892fa3bbec68eb1c3e7f96123dfcfc12f98b35 100644 (file)
--- a/bin/tests/system/mkeys/ns6/named.conf.in
+++ b/bin/tests/system/mkeys/ns6/named.conf.in
@@ -23,7 +23,7 @@ options {
        listen-on-v6 { none; };
        recursion yes;
        notify no;
-       dnssec-validation yes;
+       dnssec-validation auto;
        trust-anchor-telemetry no;
 };
 

diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
index e678153cd99a68a4e2974ab31e8b255c88247d89..17b007e850ffb2454f3fbc4e5dc2b11b1b32bc01 100644 (file)
--- a/bin/tests/system/rndc/tests.sh
+++ b/bin/tests/system/rndc/tests.sh
@@ -429,7 +429,7 @@ n=$((n+1))
 echo_i "testing automatic zones are reported ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf status > rndc.out.1.test$n || ret=1
-grep "number of zones: 201 (198 automatic)" rndc.out.1.test$n > /dev/null || ret=1
+grep "number of zones: 199 (198 automatic)" rndc.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))