flag "random-device" as ancient

the "random-device" option was made non-functional in 9.13. this commit
removes it from the configuration parser; setting it is now an error.

diff --git a/bin/tests/system/checkconf/bad-random-device.conf b/bin/tests/system/checkconf/bad-random-device.conf
new file mode 100644 (file)
index 0000000..bc1451d
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-random-device.conf
@@ -0,0 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+        random-device "/dev/urandom";
+};

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 3d9b2a6c6fbeac8b5e1899e10b7b0f6d5c70bbdd..60000ebb262363b62845af4e02426a3fb196e423 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -1647,31 +1647,6 @@ default is used.
    classify outgoing DNS traffic, on operating systems that support DSCP.
    Valid values are 0 through 63. It is not configured by default.
 
-.. namedconf:statement:: random-device
-   :tags: server, security
-   :short: Specifies a source of entropy to be used by the server.
-
-   This specifies a source of entropy to be used by the server; it is a
-   device or file from which to read entropy. If it is a file,
-   operations requiring entropy will fail when the file has been
-   exhausted.
-
-   Entropy is needed for cryptographic operations such as TKEY
-   transactions, dynamic update of signed zones, and generation of TSIG
-   session keys. It is also used for seeding and stirring the
-   pseudo-random number generator which is used for less critical
-   functions requiring randomness, such as generation of DNS message
-   transaction IDs.
-
-   If :any:`random-device` is not specified, or if it is set to ``none``,
-   entropy is read from the random number generation function
-   supplied by the cryptographic library with which BIND was linked
-   (i.e. OpenSSL or a PKCS#11 provider).
-
-   The :any:`random-device` option takes effect during the initial
-   configuration load at server startup time and is ignored on
-   subsequent reloads.
-
 .. namedconf:statement:: preferred-glue
    :tags: query
    :short: Controls the order of glue records in an A or AAAA response.

diff --git a/doc/man/named.conf.5in b/doc/man/named.conf.5in
index 9f448cf68d653e3a02b5238312289f821e126eb9..bfc32254c1c13751a5fff1702766d8a35f1ccade 100644 (file)
--- a/doc/man/named.conf.5in
+++ b/doc/man/named.conf.5in
@@ -282,7 +282,6 @@ options {
        query\-source ( ( [ address ] ( <ipv4_address> | * ) [ port ( <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ] port ( <integer> | * ) ) ) [ dscp <integer> ];
        query\-source\-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port ( <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ] port ( <integer> | * ) ) ) [ dscp <integer> ];
        querylog <boolean>;
-       random\-device ( <quoted_string> | none );
        rate\-limit {
                all\-per\-second <integer>;
                errors\-per\-second <integer>;

diff --git a/doc/misc/options b/doc/misc/options
index 5de8c20b60f58e542446a78eea5243ac4e5e07a2..b11fe07b464cdac770d4f580b966d26e5523b988 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -225,7 +225,6 @@ options {
        query-source ( ( [ address ] ( <ipv4_address> | * ) [ port ( <integer> | * ) ] ) | ( [ [ address ] ( <ipv4_address> | * ) ] port ( <integer> | * ) ) ) [ dscp <integer> ];
        query-source-v6 ( ( [ address ] ( <ipv6_address> | * ) [ port ( <integer> | * ) ] ) | ( [ [ address ] ( <ipv6_address> | * ) ] port ( <integer> | * ) ) ) [ dscp <integer> ];
        querylog <boolean>;
-       random-device ( <quoted_string> | none );
        rate-limit {
                all-per-second <integer>;
                errors-per-second <integer>;

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index d8a88d46fd6a6757e789c1273ed12aee87821943..d359d37bad6a05e02fcf3e6f74210023a9286493 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -1305,7 +1305,7 @@ static cfg_clausedef_t options_clauses[] = {
        { "https-port", &cfg_type_uint32, CFG_CLAUSEFLAG_NOTCONFIGURED },
 #endif
        { "querylog", &cfg_type_boolean, 0 },
-       { "random-device", &cfg_type_qstringornone, 0 },
+       { "random-device", &cfg_type_qstringornone, CFG_CLAUSEFLAG_ANCIENT },
        { "recursing-file", &cfg_type_qstring, 0 },
        { "recursive-clients", &cfg_type_uint32, 0 },
        { "reuseport", &cfg_type_boolean, 0 },