From: Evan Hunt <each@isc.org>
Date: Sat, 14 May 2022 03:55:23 +0000 (-0700)
Subject: don't create managed-keys zone unless dnssec-validation is "auto"
X-Git-Tag: v9.19.2~11^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3e0d9bd6d2f5aadeeda6a02a46a0b6f9624e5b49;p=thirdparty%2Fbind9.git

don't create managed-keys zone unless dnssec-validation is "auto"

previously, a managed-keys zone was created for every view
regardless of whether rfc5011 was in use; when it was not in
use, the zone would be left empty. this made for some confusing
log messages.

we now only set up the managed-keys zone if dnssec-validation is
set to the default value of "auto".

certain system test servers have had their dnssec-validation settings
changed to auto because the tests depended on the existence of the
zone.
---

diff --git a/bin/named/server.c b/bin/named/server.c
index 84cc98419a5..ca25b073bac 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -1200,7 +1200,9 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 		}
 	}
 
-	CHECK(add_keydata_zone(view, directory, named_g_mctx));
+	if (auto_root) {
+		CHECK(add_keydata_zone(view, directory, named_g_mctx));
+	}
 
 cleanup:
 	return (result);
diff --git a/bin/tests/system/journal/ns1/named.conf.in b/bin/tests/system/journal/ns1/named.conf.in
index 1f6e9833404..c3e2843b97a 100644
--- a/bin/tests/system/journal/ns1/named.conf.in
+++ b/bin/tests/system/journal/ns1/named.conf.in
@@ -20,7 +20,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
-	dnssec-validation yes;
+	dnssec-validation auto;
 	minimal-responses no;
 	recursion no;
 	notify yes;
diff --git a/bin/tests/system/journal/ns2/named.conf.in b/bin/tests/system/journal/ns2/named.conf.in
index 4c07c920db5..4d58c284681 100644
--- a/bin/tests/system/journal/ns2/named.conf.in
+++ b/bin/tests/system/journal/ns2/named.conf.in
@@ -20,7 +20,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
-	dnssec-validation yes;
+	dnssec-validation auto;
 	minimal-responses no;
 	recursion no;
 	notify yes;
diff --git a/bin/tests/system/mkeys/ns3/named.conf.in b/bin/tests/system/mkeys/ns3/named.conf.in
index 7ad8419a93c..e6e19f54c34 100644
--- a/bin/tests/system/mkeys/ns3/named.conf.in
+++ b/bin/tests/system/mkeys/ns3/named.conf.in
@@ -23,7 +23,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify no;
-	dnssec-validation yes;
+	dnssec-validation auto;
 	bindkeys-file "managed.conf";
 	trust-anchor-telemetry no;
 };
diff --git a/bin/tests/system/mkeys/ns6/named.conf.in b/bin/tests/system/mkeys/ns6/named.conf.in
index ff8137a6f2b..50892fa3bbe 100644
--- a/bin/tests/system/mkeys/ns6/named.conf.in
+++ b/bin/tests/system/mkeys/ns6/named.conf.in
@@ -23,7 +23,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	notify no;
-	dnssec-validation yes;
+	dnssec-validation auto;
 	trust-anchor-telemetry no;
 };
 
diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
index e678153cd99..17b007e850f 100644
--- a/bin/tests/system/rndc/tests.sh
+++ b/bin/tests/system/rndc/tests.sh
@@ -429,7 +429,7 @@ n=$((n+1))
 echo_i "testing automatic zones are reported ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf status > rndc.out.1.test$n || ret=1
-grep "number of zones: 201 (198 automatic)" rndc.out.1.test$n > /dev/null || ret=1
+grep "number of zones: 199 (198 automatic)" rndc.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))