Obsolete dnssec-update-mode

We no longer support 'no-resign' and thus the configuration option
becomes obsolete. Remove the corresponding dnssec system test cases.

diff --git a/bin/named/config.c b/bin/named/config.c
index 451d9309764bd227a1f69d6bb3697c776cf18e43..861c46c03d1ee27efa581557fd1e8806310232ea 100644 (file)
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -216,7 +216,6 @@ options {\n\
        check-wildcard yes;\n\
        dialup no;\n\
        dnssec-loadkeys-interval 60;\n\
-       dnssec-update-mode maintain;\n\
 #      forward <none>\n\
 #      forwarders <none>\n\
 #      inline-signing no;\n\

diff --git a/bin/named/server.c b/bin/named/server.c
index c8e5b76f756dba89ada2e4a2e99454725e5a1375..4ee711c9f2232067a4075840fc3e864ae631d0cf 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -15127,10 +15127,8 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
        }
 
        /* Next resign event */
-       if (secure &&
-           (zonetype == dns_zone_primary ||
-            (zonetype == dns_zone_secondary && hasraw)) &&
-           ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_NORESIGN) == 0))
+       if (secure && (zonetype == dns_zone_primary ||
+                      (zonetype == dns_zone_secondary && hasraw)))
        {
                dns_name_t *name;
                dns_fixedname_t fixed;

diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index 8b584d4e1fc36fc319c156c08a43c694b7634e82..c12693517f7baaa9a92b12fc9c9d334a7f1c6025 100644 (file)
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -1748,20 +1748,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
                dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNORESRVCNAME,
                                   ignore);
 
-               obj = NULL;
-               result = cfg_map_get(zoptions, "dnssec-update-mode", &obj);
-               if (result == ISC_R_SUCCESS) {
-                       const char *arg = cfg_obj_asstring(obj);
-                       if (strcasecmp(arg, "no-resign") == 0) {
-                               dns_zone_setkeyopt(zone, DNS_ZONEKEY_NORESIGN,
-                                                  true);
-                       } else if (strcasecmp(arg, "maintain") == 0) {
-                               /* Default */
-                       } else {
-                               UNREACHABLE();
-                       }
-               }
-
                obj = NULL;
                result = named_config_get(maps, "serial-update-method", &obj);
                INSIST(result == ISC_R_SUCCESS && obj != NULL);

diff --git a/bin/tests/system/checkconf/kasp-and-other-dnssec-options.conf b/bin/tests/system/checkconf/kasp-and-other-dnssec-options.conf
index 2208ac0e196f7f922f7541734fb8003b5310a803..6e2f8c760699cdbec2f3179f736d30e5753c99d2 100644 (file)
--- a/bin/tests/system/checkconf/kasp-and-other-dnssec-options.conf
+++ b/bin/tests/system/checkconf/kasp-and-other-dnssec-options.conf
@@ -17,6 +17,5 @@ zone "nsec3.net" {
        type primary;
        file "nsec3.db";
        dnssec-policy "test";
-       dnssec-update-mode maintain;
        inline-signing no;
 };

diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index 7167df8dccbea6de8958fef41bddc40899c68b05..f21746f0e1f39a0941a72d6afba77026782d17ef 100644 (file)
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -484,8 +484,6 @@ echo_i "checking named-checkconf kasp errors ($n)"
 ret=0
 $CHECKCONF kasp-and-other-dnssec-options.conf > checkconf.out$n 2>&1 && ret=1
 grep "'inline-signing yes;' must also be configured explicitly for zones using dnssec-policy without a configured 'allow-update' or 'update-policy'" < checkconf.out$n > /dev/null || ret=1
-grep "dnssec-update-mode: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-grep "dnssec-update-mode: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 

diff --git a/bin/tests/system/dnssec/clean.sh b/bin/tests/system/dnssec/clean.sh
index 0aca8342678bbd7f55bbbabb5d06d171094ad6f0..c245688c79e96e33b81e9a0794ddc5f541b45742 100644 (file)
--- a/bin/tests/system/dnssec/clean.sh
+++ b/bin/tests/system/dnssec/clean.sh
@@ -31,7 +31,6 @@ rm -f ./dnssectools.out*
 rm -f ./dsfromkey.out.*
 rm -f ./keygen.err
 rm -f ./named.secroots.test*
-rm -f ./nosign.before
 rm -f ./ns*/*.nta
 rm -f ./ns*/managed-keys.bind ./ns*/managed-keys.bind.jnl ./ns*/*.mkeys*
 rm -f ./ns*/named.lock
@@ -68,7 +67,7 @@ rm -f ./ns3/dnskey-unsupported.example.db
 rm -f ./ns3/dnskey-unsupported.example.db.tmp
 rm -f ./ns3/dynamic.example.db ./ns3/dynamic.example.db.signed.jnl
 rm -f ./ns3/expired.example.db ./ns3/update-nsec3.example.db
-rm -f ./ns3/expiring.example.db ./ns3/nosign.example.db
+rm -f ./ns3/expiring.example.db
 rm -f ./ns3/future.example.db ./ns3/trusted-future.key
 rm -f ./ns3/inline.example.db.signed
 rm -f ./ns3/kskonly.example.db

diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in
index 85105085b780fc818b03455774c71dec51bb0c74..ee4b766d9fd6973fe88363eec7146b738a25e4f4 100644 (file)
--- a/bin/tests/system/dnssec/ns3/named.conf.in
+++ b/bin/tests/system/dnssec/ns3/named.conf.in
@@ -301,13 +301,6 @@ zone "expiring.example" {
        file "expiring.example.db.signed";
 };
 
-zone "nosign.example" {
-       type primary;
-       allow-update { any; };
-       dnssec-update-mode no-resign;
-       file "nosign.example.db.signed";
-};
-
 zone "upper.example" {
        type primary;
        file "upper.example.db.signed";

diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
index cf19cfc6e95f1ac2b593dd2c318b3d66c20b3513..89fbe25b7fa777ab3eb2d4e45138a76e15d3d065 100644 (file)
--- a/bin/tests/system/dnssec/ns3/sign.sh
+++ b/bin/tests/system/dnssec/ns3/sign.sh
@@ -545,23 +545,6 @@ zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone"
 cp "$infile" "$zonefile"
 "$SIGNER" -P -S -o "$zone" "$zonefile" > /dev/null
 
-#
-# Zone with signatures about to expire, and dynamic, but configured
-# not to resign with 'auto-resign no;'
-#
-zone="nosign.example."
-infile="nosign.example.db.in"
-zonefile="nosign.example.db"
-signedfile="nosign.example.db.signed"
-kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-cp "$infile" "$zonefile"
-"$SIGNER" -S -e "now+1mi" -o "$zone" "$zonefile" > /dev/null
-# preserve a normalized copy of the NS RRSIG for comparison later
-$CHECKZONE -D nosign.example nosign.example.db.signed 2>/dev/null | \
-        awk '$4 == "RRSIG" && $5 == "NS" {$2 = ""; print}' | \
-        sed 's/[       ][      ]*/ /g'> ../nosign.before
-
 #
 # An inline signing zone
 #

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index 38dd7e4544781e3f130fcf35283737413eabc515..5c1cbe616ca2cfe9fe67c757c0a4bc703e725185 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -2969,48 +2969,6 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-echo_i "testing new records are signed with 'no-resign' ($n)"
-ret=0
-(
-echo zone nosign.example
-echo server 10.53.0.3 "$PORT"
-echo update add new.nosign.example 300 in txt "hi there"
-echo send
-) | $NSUPDATE
-sleep 1
-dig_with_answeropts +nottlid txt new.nosign.example @10.53.0.3 \
-        > dig.out.ns3.test$n 2>&1
-grep RRSIG dig.out.ns3.test$n > /dev/null 2>&1 || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "testing expiring records aren't resigned with 'no-resign' ($n)"
-ret=0
-dig_with_answeropts +nottlid nosign.example ns @10.53.0.3 | \
-        grep RRSIG | sed 's/[  ][      ]*/ /g' > dig.out.ns3.test$n 2>&1
-# the NS RRSIG should not be changed
-diff nosign.before dig.out.ns3.test$n > /dev/null|| ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
-echo_i "testing updates fail with no private key ($n)"
-ret=0
-rm -f ns3/Knosign.example.*.private
-(
-echo zone nosign.example
-echo server 10.53.0.3 "$PORT"
-echo update add fail.nosign.example 300 in txt "reject me"
-echo send
-) | $NSUPDATE > /dev/null 2>&1 && ret=1
-dig_with_answeropts +nottlid fail.nosign.example txt @10.53.0.3 \
-        > dig.out.ns3.test$n 2>&1
-[ -s dig.out.ns3.test$n ] && ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
 echo_i "testing legacy upper case signer name validation ($n)"
 ret=0
 $DIG +tcp +noadd +noauth +dnssec -p "$PORT" soa upper.example @10.53.0.4 \

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 51db685f5753fb7504f42d5f01344e16ecfd74e4..883e47564668028a9cc9d3d9a78afe7b3d7d1439 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -1784,26 +1784,9 @@ default is used.
    The default is ``none``.
 
 .. namedconf:statement:: dnssec-update-mode
-   :tags: dnssec
-   :short: Controls the scheduled maintenance of DNSSEC signatures.
-
-   If this option is set to its default value of ``maintain`` in a zone
-   of :any:`type primary` which is DNSSEC-signed and configured to allow
-   dynamic updates (see :ref:`dynamic_update_policies`), and if :iscman:`named` has access
-   to the private signing key(s) for the zone, then :iscman:`named`
-   automatically signs all new or changed records and maintains signatures
-   for the zone by regenerating RRSIG records whenever they approach
-   their expiration date.
-
-   If the option is changed to ``no-resign``, then :iscman:`named` signs
-   all new or changed records, but scheduled maintenance of signatures
-   is disabled.
+   :tags: obsolete
 
-   With either of these settings, :iscman:`named` rejects updates to a
-   DNSSEC-signed zone when the signing keys are inactive or unavailable
-   to :iscman:`named`. (A planned third option, ``external``, will disable all
-   automatic signing and allow DNSSEC data to be submitted into a zone
-   via dynamic update; this is not yet implemented.)
+   This option no longer has any effect.
 
 .. namedconf:statement:: nta-lifetime
    :tags: dnssec

diff --git a/doc/misc/options b/doc/misc/options
index 815bac3b37d527a8845c147d3f5f6148983c5561..ed5082403b6bd90e8d95f3b058ef42ebab7f9044 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -120,7 +120,7 @@ options {
        dnssec-must-be-secure <string> <boolean>; // may occur multiple times
        dnssec-policy <string>;
        dnssec-secure-to-insecure <boolean>; // obsolete
-       dnssec-update-mode ( maintain | no-resign );
+       dnssec-update-mode ( maintain | no-resign ); // obsolete
        dnssec-validation ( yes | no | auto );
        dnstap { ( all | auth | client | forwarder | resolver | update ) [ ( query | response ) ]; ... }; // not configured
        dnstap-identity ( <quoted_string> | none | hostname ); // not configured
@@ -418,7 +418,7 @@ view <string> [ <class> ] {
        dnssec-must-be-secure <string> <boolean>; // may occur multiple times
        dnssec-policy <string>;
        dnssec-secure-to-insecure <boolean>; // obsolete
-       dnssec-update-mode ( maintain | no-resign );
+       dnssec-update-mode ( maintain | no-resign ); // obsolete
        dnssec-validation ( yes | no | auto );
        dnstap { ( all | auth | client | forwarder | resolver | update ) [ ( query | response ) ]; ... }; // not configured
        dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port <integer> ] | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ); ... };

diff --git a/doc/misc/primary.zoneopt b/doc/misc/primary.zoneopt
index a844114683af2b9c6938b7ca69c8825a47c9bc36..a7be8839e7989d7ccd53920ac1690c57e74cec63 100644 (file)
--- a/doc/misc/primary.zoneopt
+++ b/doc/misc/primary.zoneopt
@@ -24,7 +24,7 @@ zone <string> [ <class> ] {
        dnssec-loadkeys-interval <integer>;
        dnssec-policy <string>;
        dnssec-secure-to-insecure <boolean>; // obsolete
-       dnssec-update-mode ( maintain | no-resign );
+       dnssec-update-mode ( maintain | no-resign ); // obsolete
        file <quoted_string>;
        forward ( first | only );
        forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };

diff --git a/doc/misc/secondary.zoneopt b/doc/misc/secondary.zoneopt
index 7c50a79d9731527d0dc3c07f5373ee3f75d5d5e5..2f7c1b049f3ac63adc712e141a88df67b1f9f6b0 100644 (file)
--- a/doc/misc/secondary.zoneopt
+++ b/doc/misc/secondary.zoneopt
@@ -15,7 +15,7 @@ zone <string> [ <class> ] {
        dnssec-dnskey-kskonly <boolean>; // obsolete
        dnssec-loadkeys-interval <integer>;
        dnssec-policy <string>;
-       dnssec-update-mode ( maintain | no-resign );
+       dnssec-update-mode ( maintain | no-resign ); // obsolete
        file <quoted_string>;
        forward ( first | only );
        forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };

diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
index 7041523702bc15bccd14b4b68c14bf5e1977a19d..933eec608d720db2ff26a6fe9c325b35b4ca7fc6 100644 (file)
--- a/lib/dns/include/dns/zone.h
+++ b/lib/dns/include/dns/zone.h
@@ -113,7 +113,6 @@ typedef enum {
        DNS_ZONEKEY_MAINTAIN = 0x00000002U, /*%< publish/sign on schedule */
        DNS_ZONEKEY_CREATE = 0x00000004U,   /*%< make keys when needed */
        DNS_ZONEKEY_FULLSIGN = 0x00000008U, /*%< roll to new keys immediately */
-       DNS_ZONEKEY_NORESIGN = 0x00000010U, /*%< no automatic resigning */
        DNS_ZONEKEY___MAX = UINT64_MAX, /* trick to make the ENUM 64-bit wide */
 } dns_zonekey_t;
 

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 5f284829d038abac15644d04e5f93b18a2fc98d2..3aa931ae2f18a797f9e7c51554c0ead0a2dc4f4f 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -5182,9 +5182,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
                }
 
                is_dynamic = dns_zone_isdynamic(zone, false);
-               if (zone->type == dns_zone_primary &&
-                   !DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_NORESIGN) &&
-                   is_dynamic && dns_db_issecure(db))
+               if (zone->type == dns_zone_primary && is_dynamic &&
+                   dns_db_issecure(db))
                {
                        dns_name_t *name;
                        dns_fixedname_t fixed;
@@ -6749,12 +6748,9 @@ zone_resigninc(dns_zone_t *zone) {
        zonediff_init(&zonediff, &_sig_diff);
 
        /*
-        * Zone is frozen or automatic resigning is disabled.
-        * Pause for 5 minutes.
+        * Zone is frozen. Pause for 5 minutes.
         */
-       if (zone->update_disabled ||
-           DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_NORESIGN))
-       {
+       if (zone->update_disabled) {
                result = ISC_R_FAILURE;
                goto failure;
        }

diff --git a/lib/isccfg/check.c b/lib/isccfg/check.c
index d703ec06a5cb4e449f03a8086871d98d142e24bf..af53af5aa90db6e4801538da888a8c7e38f0eddb 100644 (file)
--- a/lib/isccfg/check.c
+++ b/lib/isccfg/check.c
@@ -3413,15 +3413,6 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
                                    "zone");
                        result = ISC_R_FAILURE;
                }
-
-               obj = NULL;
-               res1 = cfg_map_get(zoptions, "dnssec-update-mode", &obj);
-               if (res1 == ISC_R_SUCCESS && has_dnssecpolicy) {
-                       cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-                                   "dnssec-update-mode: cannot be configured "
-                                   "if dnssec-policy is also set");
-                       result = ISC_R_FAILURE;
-               }
        }
 
        /*

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index b1be17a6d545dcb9585a73b30b183489b9a0bf62..64517d33b1f8e93ba07d5b823bade74da740a521 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -2283,7 +2283,7 @@ static cfg_clausedef_t zone_clauses[] = {
        { "dnssec-secure-to-insecure", &cfg_type_boolean,
          CFG_ZONE_PRIMARY | CFG_CLAUSEFLAG_OBSOLETE },
        { "dnssec-update-mode", &cfg_type_dnssecupdatemode,
-         CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
+         CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE },
        { "forward", &cfg_type_forwardtype,
          CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_STUB |
                  CFG_ZONE_STATICSTUB | CFG_ZONE_FORWARD },