deprecate delegation-only and root-delegation only

These options and zone type were created to address the
SiteFinder controversy, in which certain TLD's redirected queries
rather than returning NXDOMAIN. since TLD's are now DNSSEC-signed,
this is no longer likely to be a problem.

The deprecation message for 'type delegation-only' is issued from
the configuration checker rather than the parser. therefore,
isccfg_check_namedconf() has been modified to take a 'nodeprecate'
parameter to suppress the warning when named-checkconf is used with
the command-line option to ignore warnings on deprecated options (-i).

(cherry picked from commit 2399556beef5230f7632db48c09ca8d952903e08)

diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
index 6b3616c0a364a048c99a12762a4075a62b962990..fd7cfa53bf21a8331ad3876bcbd653ad8f818776 100644 (file)
--- a/bin/check/named-checkconf.c
+++ b/bin/check/named-checkconf.c
@@ -726,7 +726,8 @@ main(int argc, char **argv) {
                exit(1);
        }
 
-       result = bind9_check_namedconf(config, loadplugins, logc, mctx);
+       result = bind9_check_namedconf(config, loadplugins, nodeprecate, logc,
+                                      mctx);
        if (result != ISC_R_SUCCESS) {
                exit_status = 1;
        }

diff --git a/bin/named/server.c b/bin/named/server.c
index dd4d017d7dda366efdc1a9ca656a5ade37c88fb1..a26d22fc6deea2529ea97853381fff157a09bd09 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -8552,7 +8552,8 @@ load_configuration(const char *filename, named_server_t *server,
         * checked later when the modules are actually loaded and
         * registered.)
         */
-       CHECK(bind9_check_namedconf(config, false, named_g_lctx, named_g_mctx));
+       CHECK(bind9_check_namedconf(config, false, false, named_g_lctx,
+                                   named_g_mctx));
 
        /* Let's recreate the TLS context cache */
        if (server->tlsctx_server_cache != NULL) {

diff --git a/bin/tests/system/checkconf/deprecated.conf b/bin/tests/system/checkconf/deprecated.conf
index 0ccfed162014b2b39ca8e3b36cffcb9a9d244450..4ff773cb2b677cb73efa6e693a2c91ed6fd17047 100644 (file)
--- a/bin/tests/system/checkconf/deprecated.conf
+++ b/bin/tests/system/checkconf/deprecated.conf
@@ -22,6 +22,8 @@ options {
        use-v6-udp-ports { range 1024 65535; };
        avoid-v4-udp-ports { range 1 1023; };
        avoid-v6-udp-ports { range 1 1023; };
+
+       root-delegation-only exclude { "them"; };
 };
 
 trusted-keys {
@@ -45,3 +47,13 @@ managed-keys {
                RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
                R1AkUTV74bU=";
 };
+
+zone "." {
+       type hint;
+       file "shared.example.db";
+       delegation-only yes;
+};
+
+zone com {
+       type delegation-only;
+};

diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index a6beedaf437d35fa6e1e96ad488065662388a849..b89925e3ed6c38b472dc281952dc1a0513f4b9cf 100644 (file)
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -168,6 +168,9 @@ grep "option 'use-v4-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null |
 grep "option 'use-v6-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
 grep "option 'avoid-v4-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
 grep "option 'avoid-v6-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+grep "option 'delegation-only' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+grep "option 'root-delegation-only' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+grep "'type delegation-only' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
 grep "token 'port' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 95b911c103e74c8840e88be157a5f36a60ab9704..9d4b0f0e0377a4c0e291cf65557628d9bf7b41cf 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -1624,7 +1624,7 @@ default is used.
    IPv4 and AAAA when responding to queries that arrived via IPv6.
 
 .. namedconf:statement:: root-delegation-only
-   :tags: query
+   :tags: deprecated
    :short: Turns on enforcement of delegation-only in top-level domains (TLDs) and root zones with an optional exclude list.
 
    This turns on enforcement of delegation-only in top-level domains (TLDs)
@@ -1660,6 +1660,9 @@ default is used.
           root-delegation-only exclude { "de"; "lv"; "us"; "museum"; };
       };
 
+   This option is deprecated, and will be rendered non-operational in a
+   future release.
+
 .. namedconf:statement:: disable-algorithms
    :tags: dnssec
    :short: Disables DNSSEC algorithms from a specified zone.
@@ -6953,19 +6956,22 @@ Zone Types
    zones are reloaded along with other zones.
 
 .. namedconf:statement:: type delegation-only
-   :tags: query
+   :tags: deprecated
    :short: Enforces the delegation-only status of infrastructure zones (COM, NET, ORG, etc.).
 
-   This zone type is used to enforce the delegation-only status of infrastructure
-   zones (e.g., COM, NET, ORG). Any answer that is received without an
-   explicit or implicit delegation in the authority section is treated
-   as NXDOMAIN. This does not apply to the zone apex, and should not be
-   applied to leaf zones.
+   This zone type is used to enforce the delegation-only status of
+   infrastructure zones (e.g., COM, NET, ORG). Any answer that is received
+   without an explicit or implicit delegation in the authority section is
+   treated as NXDOMAIN. This does not apply to the zone apex, and should
+   not be applied to leaf zones.
 
    :any:`delegation-only` has no effect on answers received from forwarders.
 
    See caveats in :any:`root-delegation-only`.
 
+   This zone type is deprecated, and will be rendered non-operational in a
+   future release.
+
 .. namedconf:statement:: in-view
    :tags: view, zone
    :short: Specifies the view in which a given zone is defined.
@@ -7094,7 +7100,7 @@ Zone Options
    See the description of :any:`dialup` in :ref:`boolean_options`.
 
 .. namedconf:statement:: delegation-only
-   :tags: zone
+   :tags: deprecated
    :short: Indicates that a forward, hint, or stub zone is to be treated as a delegation-only type zone.
 
    This flag only applies to forward, hint, and stub zones. If set to
@@ -7103,6 +7109,9 @@ Zone Options
 
    See caveats in :any:`root-delegation-only`.
 
+   This option is deprecated, and will be rendered non-operational in a
+   future release.
+
 .. namedconf:statement:: file
    :tags: zone
    :short: Specifies the zone's filename.

diff --git a/doc/misc/forward.zoneopt b/doc/misc/forward.zoneopt
index 148b74c5844028fb6abe152ca2dd22f1005f40af..069f2cedcd774534d3060e9af7b1ea159fb33c2a 100644 (file)
--- a/doc/misc/forward.zoneopt
+++ b/doc/misc/forward.zoneopt
@@ -1,6 +1,6 @@
 zone <string> [ <class> ] {
        type forward;
-       delegation-only <boolean>;
+       delegation-only <boolean>; // deprecated
        forward ( first | only );
        forwarders [ port <integer> ]  { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
 };

diff --git a/doc/misc/hint.zoneopt b/doc/misc/hint.zoneopt
index d7ec16c7399f69118ed7f8acfa1dcfb771e552e0..d14c3efec146bd624d00dd3da3b3687692e88f5a 100644 (file)
--- a/doc/misc/hint.zoneopt
+++ b/doc/misc/hint.zoneopt
@@ -1,6 +1,6 @@
 zone <string> [ <class> ] {
        type hint;
        check-names ( fail | warn | ignore );
-       delegation-only <boolean>;
+       delegation-only <boolean>; // deprecated
        file <quoted_string>;
 };

diff --git a/doc/misc/options b/doc/misc/options
index 0613ce883fcf9999e70f097063123067fba894b7..3a3f7af1d0cda48f8e24b0322efafa4a3efac733 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -258,7 +258,7 @@ options {
        response-padding { <address_match_element>; ... } block-size <integer>;
        response-policy { zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [ break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ min-ns-dots <integer> ] [ nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text> } ];
        reuseport <boolean>;
-       root-delegation-only [ exclude { <string>; ... } ];
+       root-delegation-only [ exclude { <string>; ... } ]; // deprecated
        root-key-sentinel <boolean>;
        rrset-order { [ class <string> ] [ type <string> ] [ name <quoted_string> ] <string> <string>; ... };
        secroots-file <quoted_string>;
@@ -537,7 +537,7 @@ view <string> [ <class> ] {
        resolver-retry-interval <integer>;
        response-padding { <address_match_element>; ... } block-size <integer>;
        response-policy { zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ]; ... } [ add-soa <boolean> ] [ break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ min-ns-dots <integer> ] [ nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text> } ];
-       root-delegation-only [ exclude { <string>; ... } ];
+       root-delegation-only [ exclude { <string>; ... } ]; // deprecated
        root-key-sentinel <boolean>;
        rrset-order { [ class <string> ] [ type <string> ] [ name <quoted_string> ] <string> <string>; ... };
        send-cookie <boolean>;

diff --git a/doc/misc/stub.zoneopt b/doc/misc/stub.zoneopt
index e6419047544dca15a09be7e699ce32f737c7c1fc..c7bcbeef09b449dc0c5bcaee427eb719deff61d2 100644 (file)
--- a/doc/misc/stub.zoneopt
+++ b/doc/misc/stub.zoneopt
@@ -4,7 +4,7 @@ zone <string> [ <class> ] {
        allow-query-on { <address_match_element>; ... };
        check-names ( fail | warn | ignore );
        database <string>;
-       delegation-only <boolean>;
+       delegation-only <boolean>; // deprecated
        dialup ( notify | notify-passive | passive | refresh | <boolean> );
        file <quoted_string>;
        forward ( first | only );

diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index 593a980e42b0171231f8740f4c009a391da18cf7..695090e02b8b708adfce0a1151317e69f28ef6f8 100644 (file)
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -2828,7 +2828,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
               const cfg_obj_t *config, isc_symtab_t *symtab,
               isc_symtab_t *files, isc_symtab_t *keydirs, isc_symtab_t *inview,
               const char *viewname, dns_rdataclass_t defclass,
-              cfg_aclconfctx_t *actx, isc_log_t *logctx, isc_mem_t *mctx) {
+              bool nodeprecate, cfg_aclconfctx_t *actx, isc_log_t *logctx,
+              isc_mem_t *mctx) {
        const char *znamestr;
        const char *typestr = NULL;
        const char *target = NULL;
@@ -2914,6 +2915,11 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
                        ztype = CFG_ZONE_HINT;
                } else if (strcasecmp(typestr, "delegation-only") == 0) {
                        ztype = CFG_ZONE_DELEGATION;
+                       if (!nodeprecate) {
+                               cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
+                                           "'type delegation-only' is "
+                                           "deprecated");
+                       }
                } else if (strcasecmp(typestr, "redirect") == 0) {
                        ztype = CFG_ZONE_REDIRECT;
                } else {
@@ -5136,7 +5142,8 @@ static isc_result_t
 check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
               const char *viewname, dns_rdataclass_t vclass,
               isc_symtab_t *files, isc_symtab_t *keydirs, bool check_plugins,
-              isc_symtab_t *inview, isc_log_t *logctx, isc_mem_t *mctx) {
+              bool nodeprecate, isc_symtab_t *inview, isc_log_t *logctx,
+              isc_mem_t *mctx) {
        const cfg_obj_t *zones = NULL;
        const cfg_obj_t *view_tkeys = NULL, *global_tkeys = NULL;
        const cfg_obj_t *view_mkeys = NULL, *global_mkeys = NULL;
@@ -5194,7 +5201,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 
                tresult = check_zoneconf(zone, voptions, config, symtab, files,
                                         keydirs, inview, viewname, vclass,
-                                        actx, logctx, mctx);
+                                        nodeprecate, actx, logctx, mctx);
                if (tresult != ISC_R_SUCCESS) {
                        result = ISC_R_FAILURE;
                }
@@ -5797,7 +5804,7 @@ bind9_check_controls(const cfg_obj_t *config, isc_log_t *logctx,
 
 isc_result_t
 bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
-                     isc_log_t *logctx, isc_mem_t *mctx) {
+                     bool nodeprecate, isc_log_t *logctx, isc_mem_t *mctx) {
        const cfg_obj_t *options = NULL;
        const cfg_obj_t *views = NULL;
        const cfg_obj_t *acls = NULL;
@@ -5889,8 +5896,8 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
 
        if (views == NULL) {
                tresult = check_viewconf(config, NULL, NULL, dns_rdataclass_in,
-                                        files, keydirs, check_plugins, inview,
-                                        logctx, mctx);
+                                        files, keydirs, check_plugins,
+                                        nodeprecate, inview, logctx, mctx);
                if (result == ISC_R_SUCCESS && tresult != ISC_R_SUCCESS) {
                        result = ISC_R_FAILURE;
                }
@@ -5982,7 +5989,8 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
                if (tresult == ISC_R_SUCCESS) {
                        tresult = check_viewconf(config, voptions, key, vclass,
                                                 files, keydirs, check_plugins,
-                                                inview, logctx, mctx);
+                                                nodeprecate, inview, logctx,
+                                                mctx);
                }
                if (tresult != ISC_R_SUCCESS) {
                        result = ISC_R_FAILURE;

diff --git a/lib/bind9/include/bind9/check.h b/lib/bind9/include/bind9/check.h
index 26d60fcadfb6b14fd75e463e5d83a0e24ecd92ed..240170ee32f757fd91adbfc80c3daaa5b2dd65bc 100644 (file)
--- a/lib/bind9/include/bind9/check.h
+++ b/lib/bind9/include/bind9/check.h
@@ -36,7 +36,7 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
-                     isc_log_t *logctx, isc_mem_t *mctx);
+                     bool nodeprecate, isc_log_t *logctx, isc_mem_t *mctx);
 /*%<
  * Check the syntactic validity of a configuration parse tree generated from
  * a named.conf file.
@@ -44,6 +44,8 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
  * If 'check_plugins' is true, load plugins and check the validity of their
  * parameters as well.
  *
+ * If 'nodeprecate' is true, do not warn about deprecated configuration.
+ *
  * Requires:
  *\li  config is a valid parse tree
  *

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index e579bf55fea3574c8e348bbcf8b3a8ead674b791..c28afddd5b70cac7b59f6f09a1e64bb5772a5769 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -2143,7 +2143,8 @@ static cfg_clausedef_t view_clauses[] = {
        { "response-padding", &cfg_type_resppadding, 0 },
        { "response-policy", &cfg_type_rpz, 0 },
        { "rfc2308-type1", NULL, CFG_CLAUSEFLAG_ANCIENT },
-       { "root-delegation-only", &cfg_type_optional_exclude, 0 },
+       { "root-delegation-only", &cfg_type_optional_exclude,
+         CFG_CLAUSEFLAG_DEPRECATED },
        { "root-key-sentinel", &cfg_type_boolean, 0 },
        { "rrset-order", &cfg_type_rrsetorder, 0 },
        { "send-cookie", &cfg_type_boolean, 0 },
@@ -2388,7 +2389,8 @@ static cfg_clausedef_t zone_only_clauses[] = {
          CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
                  CFG_ZONE_STUB },
        { "delegation-only", &cfg_type_boolean,
-         CFG_ZONE_HINT | CFG_ZONE_STUB | CFG_ZONE_FORWARD },
+         CFG_ZONE_HINT | CFG_ZONE_STUB | CFG_ZONE_FORWARD |
+                 CFG_CLAUSEFLAG_DEPRECATED },
        { "dlz", &cfg_type_astring,
          CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_REDIRECT },
        { "file", &cfg_type_qstring,