deprecate delegation-only and root-delegation only

These options and zone type were created to address the
SiteFinder controversy, in which certain TLD's redirected queries
rather than returning NXDOMAIN. since TLD's are now DNSSEC-signed,
this is no longer likely to be a problem.

The deprecation message for 'type delegation-only' is issued from
the configuration checker rather than the parser. therefore,
isccfg_check_namedconf() has been modified to take a 'nodeprecate'
parameter to suppress the warning when named-checkconf is used with
the command-line option to ignore warnings on deprecated options (-i).

diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
index a24435f03eba27526304517f8167478786e26966..798adca5816182c22c7c3bb03c0976ea62bcbcce 100644 (file)
--- a/bin/check/named-checkconf.c
+++ b/bin/check/named-checkconf.c
@@ -733,7 +733,8 @@ main(int argc, char **argv) {
                exit(1);
        }
 
-       result = isccfg_check_namedconf(config, loadplugins, logc, mctx);
+       result = isccfg_check_namedconf(config, loadplugins, nodeprecate, logc,
+                                       mctx);
        if (result != ISC_R_SUCCESS) {
                exit_status = 1;
        }

diff --git a/bin/named/server.c b/bin/named/server.c
index f40a641e32391eea4569a054259570bb564ec423..518f494eb2b899bba8a5eaf696e69d31b12c51e8 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -8428,7 +8428,7 @@ load_configuration(const char *filename, named_server_t *server,
         * checked later when the modules are actually loaded and
         * registered.)
         */
-       result = isccfg_check_namedconf(config, false, named_g_lctx,
+       result = isccfg_check_namedconf(config, false, false, named_g_lctx,
                                        named_g_mctx);
        if (result != ISC_R_SUCCESS) {
                goto cleanup_config;

diff --git a/bin/tests/system/checkconf/deprecated.conf b/bin/tests/system/checkconf/deprecated.conf
index a21e2cde14994698e0d848af86f3b88b1b2768f8..55d0f79e0b960a7c21c050bcbe7ad3d4a4d3e834 100644 (file)
--- a/bin/tests/system/checkconf/deprecated.conf
+++ b/bin/tests/system/checkconf/deprecated.conf
@@ -23,6 +23,8 @@ options {
        use-v6-udp-ports { range 1024 65535; };
        avoid-v4-udp-ports { range 1 1023; };
        avoid-v6-udp-ports { range 1 1023; };
+
+       root-delegation-only exclude { "them"; };
 };
 
 trusted-keys {
@@ -48,7 +50,17 @@ managed-keys {
 };
 
 zone example.com {
-        type primary;
+       type primary;
        file "maxttl-bad.db";
        max-zone-ttl 120;
 };
+
+zone "." {
+       type hint;
+       file "shared.example.db";
+       delegation-only yes;
+};
+
+zone com {
+       type delegation-only;
+};

diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index f65d60331401ae29a5c08d9515951c466c0603da..d67ab61ab95552ec520bde5360ab22cd77dc5159 100644 (file)
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -169,6 +169,9 @@ grep "option 'use-v4-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null |
 grep "option 'use-v6-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
 grep "option 'avoid-v4-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
 grep "option 'avoid-v6-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+grep "option 'delegation-only' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+grep "option 'root-delegation-only' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
+grep "'type delegation-only' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
 grep "token 'port' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 4ae2389719a30afbc4df971bd3f48f097dfad9b3..02c578bcbf769df9e46b366c8d48246f09274ddb 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -1599,7 +1599,7 @@ default is used.
    IPv4 and AAAA when responding to queries that arrived via IPv6.
 
 .. namedconf:statement:: root-delegation-only
-   :tags: query
+   :tags: deprecated
    :short: Turns on enforcement of delegation-only in top-level domains (TLDs) and root zones with an optional exclude list.
 
    This turns on enforcement of delegation-only in top-level domains (TLDs)
@@ -1635,6 +1635,9 @@ default is used.
           root-delegation-only exclude { "de"; "lv"; "us"; "museum"; };
       };
 
+   This option is deprecated, and will be rendered non-operational in a
+   future release.
+
 .. namedconf:statement:: disable-algorithms
    :tags: dnssec
    :short: Disables DNSSEC algorithms from a specified zone.
@@ -6870,19 +6873,22 @@ Zone Types
    zones are reloaded along with other zones.
 
 .. namedconf:statement:: type delegation-only
-   :tags: query
+   :tags: deprecated
    :short: Enforces the delegation-only status of infrastructure zones (COM, NET, ORG, etc.).
 
-   This zone type is used to enforce the delegation-only status of infrastructure
-   zones (e.g., COM, NET, ORG). Any answer that is received without an
-   explicit or implicit delegation in the authority section is treated
-   as NXDOMAIN. This does not apply to the zone apex, and should not be
-   applied to leaf zones.
+   This zone type is used to enforce the delegation-only status of
+   infrastructure zones (e.g., COM, NET, ORG). Any answer that is received
+   without an explicit or implicit delegation in the authority section is
+   treated as NXDOMAIN. This does not apply to the zone apex, and should
+   not be applied to leaf zones.
 
    :any:`delegation-only` has no effect on answers received from forwarders.
 
    See caveats in :any:`root-delegation-only`.
 
+   This zone type is deprecated, and will be rendered non-operational in a
+   future release.
+
 .. namedconf:statement:: in-view
    :tags: view, zone
    :short: Specifies the view in which a given zone is defined.
@@ -7011,7 +7017,7 @@ Zone Options
    See the description of :any:`dialup` in :ref:`boolean_options`.
 
 .. namedconf:statement:: delegation-only
-   :tags: zone
+   :tags: deprecated
    :short: Indicates that a forward, hint, or stub zone is to be treated as a delegation-only type zone.
 
    This flag only applies to forward, hint, and stub zones. If set to
@@ -7020,6 +7026,9 @@ Zone Options
 
    See caveats in :any:`root-delegation-only`.
 
+   This option is deprecated, and will be rendered non-operational in a
+   future release.
+
 .. namedconf:statement:: file
    :tags: zone
    :short: Specifies the zone's filename.

diff --git a/doc/misc/forward.zoneopt b/doc/misc/forward.zoneopt
index 6c5f38b013c534860bb65b9eeb1de8dbab963783..a66d31e542370dedacdfcfb5a4c1dec4f2b3426b 100644 (file)
--- a/doc/misc/forward.zoneopt
+++ b/doc/misc/forward.zoneopt
@@ -1,6 +1,6 @@
 zone <string> [ <class> ] {
        type forward;
-       delegation-only <boolean>;
+       delegation-only <boolean>; // deprecated
        forward ( first | only );
        forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };
 };

diff --git a/doc/misc/hint.zoneopt b/doc/misc/hint.zoneopt
index d7ec16c7399f69118ed7f8acfa1dcfb771e552e0..d14c3efec146bd624d00dd3da3b3687692e88f5a 100644 (file)
--- a/doc/misc/hint.zoneopt
+++ b/doc/misc/hint.zoneopt
@@ -1,6 +1,6 @@
 zone <string> [ <class> ] {
        type hint;
        check-names ( fail | warn | ignore );
-       delegation-only <boolean>;
+       delegation-only <boolean>; // deprecated
        file <quoted_string>;
 };

diff --git a/doc/misc/options b/doc/misc/options
index 8fd53159dd0dbd967a7c98eb348dd46b66136e21..714e22521487ebae7aabd02e74082871280e8ab2 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -250,7 +250,7 @@ options {
        response-padding { <address_match_element>; ... } block-size <integer>;
        response-policy { zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ ede <string> ]; ... } [ add-soa <boolean> ] [ break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ min-ns-dots <integer> ] [ nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text> } ];
        reuseport <boolean>;
-       root-delegation-only [ exclude { <string>; ... } ];
+       root-delegation-only [ exclude { <string>; ... } ]; // deprecated
        root-key-sentinel <boolean>;
        rrset-order { [ class <string> ] [ type <string> ] [ name <quoted_string> ] <string> <string>; ... };
        secroots-file <quoted_string>;
@@ -524,7 +524,7 @@ view <string> [ <class> ] {
        resolver-retry-interval <integer>;
        response-padding { <address_match_element>; ... } block-size <integer>;
        response-policy { zone <string> [ add-soa <boolean> ] [ log <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ policy ( cname | disabled | drop | given | no-op | nodata | nxdomain | passthru | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ ede <string> ]; ... } [ add-soa <boolean> ] [ break-dnssec <boolean> ] [ max-policy-ttl <duration> ] [ min-update-interval <duration> ] [ min-ns-dots <integer> ] [ nsip-wait-recurse <boolean> ] [ nsdname-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ] [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text> } ];
-       root-delegation-only [ exclude { <string>; ... } ];
+       root-delegation-only [ exclude { <string>; ... } ]; // deprecated
        root-key-sentinel <boolean>;
        rrset-order { [ class <string> ] [ type <string> ] [ name <quoted_string> ] <string> <string>; ... };
        send-cookie <boolean>;

diff --git a/doc/misc/stub.zoneopt b/doc/misc/stub.zoneopt
index ab1e49e1897ae90e8d40dbcba426d75e49584781..414fd901b8d1f0f061cb2f7c3cdc1634f7ba6c9f 100644 (file)
--- a/doc/misc/stub.zoneopt
+++ b/doc/misc/stub.zoneopt
@@ -4,7 +4,7 @@ zone <string> [ <class> ] {
        allow-query-on { <address_match_element>; ... };
        check-names ( fail | warn | ignore );
        database <string>;
-       delegation-only <boolean>;
+       delegation-only <boolean>; // deprecated
        dialup ( notify | notify-passive | passive | refresh | <boolean> );
        file <quoted_string>;
        forward ( first | only );

diff --git a/lib/isccfg/check.c b/lib/isccfg/check.c
index 1846ee5df7375cf26bef92e837001f76ccef863f..0469eaf9697076420a88969c41b15ec96a686117 100644 (file)
--- a/lib/isccfg/check.c
+++ b/lib/isccfg/check.c
@@ -2886,7 +2886,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
               const cfg_obj_t *config, isc_symtab_t *symtab,
               isc_symtab_t *files, isc_symtab_t *keydirs, isc_symtab_t *inview,
               const char *viewname, dns_rdataclass_t defclass,
-              cfg_aclconfctx_t *actx, isc_log_t *logctx, isc_mem_t *mctx) {
+              bool nodeprecate, cfg_aclconfctx_t *actx, isc_log_t *logctx,
+              isc_mem_t *mctx) {
        const char *znamestr;
        const char *typestr = NULL;
        const char *target = NULL;
@@ -2972,6 +2973,11 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
                        ztype = CFG_ZONE_HINT;
                } else if (strcasecmp(typestr, "delegation-only") == 0) {
                        ztype = CFG_ZONE_DELEGATION;
+                       if (!nodeprecate) {
+                               cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
+                                           "'type delegation-only' is "
+                                           "deprecated");
+                       }
                } else if (strcasecmp(typestr, "redirect") == 0) {
                        ztype = CFG_ZONE_REDIRECT;
                } else {
@@ -5230,7 +5236,8 @@ static isc_result_t
 check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
               const char *viewname, dns_rdataclass_t vclass,
               isc_symtab_t *files, isc_symtab_t *keydirs, bool check_plugins,
-              isc_symtab_t *inview, isc_log_t *logctx, isc_mem_t *mctx) {
+              bool nodeprecate, isc_symtab_t *inview, isc_log_t *logctx,
+              isc_mem_t *mctx) {
        const cfg_obj_t *zones = NULL;
        const cfg_obj_t *view_tkeys = NULL, *global_tkeys = NULL;
        const cfg_obj_t *view_mkeys = NULL, *global_mkeys = NULL;
@@ -5288,7 +5295,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 
                tresult = check_zoneconf(zone, voptions, config, symtab, files,
                                         keydirs, inview, viewname, vclass,
-                                        actx, logctx, mctx);
+                                        nodeprecate, actx, logctx, mctx);
                if (tresult != ISC_R_SUCCESS) {
                        result = ISC_R_FAILURE;
                }
@@ -5901,7 +5908,7 @@ check_controls(const cfg_obj_t *config, isc_log_t *logctx, isc_mem_t *mctx) {
 
 isc_result_t
 isccfg_check_namedconf(const cfg_obj_t *config, bool check_plugins,
-                      isc_log_t *logctx, isc_mem_t *mctx) {
+                      bool nodeprecate, isc_log_t *logctx, isc_mem_t *mctx) {
        const cfg_obj_t *options = NULL;
        const cfg_obj_t *views = NULL;
        const cfg_obj_t *acls = NULL;
@@ -5990,8 +5997,8 @@ isccfg_check_namedconf(const cfg_obj_t *config, bool check_plugins,
 
        if (views == NULL) {
                tresult = check_viewconf(config, NULL, NULL, dns_rdataclass_in,
-                                        files, keydirs, check_plugins, inview,
-                                        logctx, mctx);
+                                        files, keydirs, check_plugins,
+                                        nodeprecate, inview, logctx, mctx);
                if (result == ISC_R_SUCCESS && tresult != ISC_R_SUCCESS) {
                        result = ISC_R_FAILURE;
                }
@@ -6083,7 +6090,8 @@ isccfg_check_namedconf(const cfg_obj_t *config, bool check_plugins,
                if (tresult == ISC_R_SUCCESS) {
                        tresult = check_viewconf(config, voptions, key, vclass,
                                                 files, keydirs, check_plugins,
-                                                inview, logctx, mctx);
+                                                nodeprecate, inview, logctx,
+                                                mctx);
                }
                if (tresult != ISC_R_SUCCESS) {
                        result = ISC_R_FAILURE;

diff --git a/lib/isccfg/include/isccfg/check.h b/lib/isccfg/include/isccfg/check.h
index b96e9f50e50d947a4247e59fdd75ad1b7b2f0c4b..c1cccfef3b6b93dcfbc6782802811b95e9d8f410 100644 (file)
--- a/lib/isccfg/include/isccfg/check.h
+++ b/lib/isccfg/include/isccfg/check.h
@@ -36,7 +36,7 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 isccfg_check_namedconf(const cfg_obj_t *config, bool check_plugins,
-                      isc_log_t *logctx, isc_mem_t *mctx);
+                      bool nodeprecate, isc_log_t *logctx, isc_mem_t *mctx);
 /*%<
  * Check the syntactic validity of a configuration parse tree generated from
  * a named.conf file.
@@ -44,6 +44,8 @@ isccfg_check_namedconf(const cfg_obj_t *config, bool check_plugins,
  * If 'check_plugins' is true, load plugins and check the validity of their
  * parameters as well.
  *
+ * If 'nodeprecate' is true, do not warn about deprecated configuration.
+ *
  * Requires:
  *\li  config is a valid parse tree
  *

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 13eeed858092940502bdbb68b986679895469ee5..d1c1b4208ce283c48426a44df13a631e6a758288 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -2126,7 +2126,8 @@ static cfg_clausedef_t view_clauses[] = {
        { "response-padding", &cfg_type_resppadding, 0 },
        { "response-policy", &cfg_type_rpz, 0 },
        { "rfc2308-type1", NULL, CFG_CLAUSEFLAG_ANCIENT },
-       { "root-delegation-only", &cfg_type_optional_exclude, 0 },
+       { "root-delegation-only", &cfg_type_optional_exclude,
+         CFG_CLAUSEFLAG_DEPRECATED },
        { "root-key-sentinel", &cfg_type_boolean, 0 },
        { "rrset-order", &cfg_type_rrsetorder, 0 },
        { "send-cookie", &cfg_type_boolean, 0 },
@@ -2374,7 +2375,8 @@ static cfg_clausedef_t zone_only_clauses[] = {
          CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
                  CFG_ZONE_STUB },
        { "delegation-only", &cfg_type_boolean,
-         CFG_ZONE_HINT | CFG_ZONE_STUB | CFG_ZONE_FORWARD },
+         CFG_ZONE_HINT | CFG_ZONE_STUB | CFG_ZONE_FORWARD |
+                 CFG_CLAUSEFLAG_DEPRECATED },
        { "dlz", &cfg_type_astring,
          CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_REDIRECT },
        { "file", &cfg_type_qstring,