1581. [func] Disable DNSSEC support by default. To enable

                        DNSSEC specify "enable-dnssec yes;" in named.conf.

diff --git a/CHANGES b/CHANGES
index 9eccc846e97fcff36fad5f53beb9218582d3b5d6..7183d3c9a41dac89b18de9dafb17027cb8557058 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+1581.  [func]          Disable DNSSEC support by default.  To enable
+                       DNSSEC specify "enable-dnssec yes;" in named.conf.
+
 1580.  [placeholder]   rt3746a
 
 1579.  [placeholder]   rt3746a

diff --git a/bin/named/config.c b/bin/named/config.c
index 4df61508614e00bdb4e6ad1d1c942f8ed7dec363..6ef209a4241f8b4616018488e9b846c6aa0c5b8f 100644 (file)
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: config.c,v 1.42 2003/04/17 12:11:39 marka Exp $ */
+/* $Id: config.c,v 1.43 2004/02/17 03:40:19 marka Exp $ */
 
 #include <config.h>
 
@@ -123,6 +123,7 @@ options {\n\
        check-names master ignore;\n\
        check-names slave ignore;\n\
        check-names response ignore;\n\
+       enable-dnssec no; /* Make yes for 9.4. */ \n\
 \n\
        /* zone */\n\
        allow-query {any;};\n\

diff --git a/bin/named/query.c b/bin/named/query.c
index c571b271c95650de1ba41cbf828c14d33afd4df3..838af2ec90fb277dec74e1332917f9c098286e29 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.253 2004/02/03 00:59:03 marka Exp $ */
+/* $Id: query.c,v 1.254 2004/02/17 03:40:20 marka Exp $ */
 
 #include <config.h>
 
@@ -3342,6 +3342,14 @@ ns_query_start(ns_client_t *client) {
         */
        client->next = query_next_callback;
 
+       /*
+        * Behave as if we don't support DNSSEC if not enabled.
+        */
+       if (!client->view->enablednssec) {
+               message->flags &= ~DNS_MESSAGEFLAG_CD;
+               client->extflags &= ~DNS_MESSAGEEXTFLAG_DO;
+       }
+
        if ((message->flags & DNS_MESSAGEFLAG_RD) != 0)
                client->query.attributes |= NS_QUERYATTR_WANTRECURSION;
        
@@ -3477,7 +3485,8 @@ ns_query_start(ns_client_t *client) {
         * Set AD.  We must clear it if we add non-validated data to a
         * response.
         */
-       message->flags |= DNS_MESSAGEFLAG_AD;
+       if (client->view->enablednssec)
+               message->flags |= DNS_MESSAGEFLAG_AD;
 
        qclient = NULL;
        ns_client_attach(client, &qclient);

diff --git a/bin/named/server.c b/bin/named/server.c
index ebb1076eec788a7934ebb44328d85206f25e7874..d55bd9866d705f2636b07da41be66a007d778cbf 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: server.c,v 1.411 2004/01/27 02:13:22 marka Exp $ */
+/* $Id: server.c,v 1.412 2004/02/17 03:40:20 marka Exp $ */
 
 #include <config.h>
 
@@ -1061,13 +1061,19 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
        result = ns_config_get(maps, "provide-ixfr", &obj);
        INSIST(result == ISC_R_SUCCESS);
        view->provideixfr = cfg_obj_asboolean(obj);
+                       
+       obj = NULL;
+       result = ns_config_get(maps, "enable-dnssec", &obj);
+       INSIST(result == ISC_R_SUCCESS);
+       view->enablednssec = cfg_obj_asboolean(obj);
 
        /*
         * For now, there is only one kind of trusted keys, the
         * "security roots".
         */
-       CHECK(configure_view_dnsseckeys(vconfig, config, mctx,
-                                 &view->secroots));
+       if (view->enablednssec)
+               CHECK(configure_view_dnsseckeys(vconfig, config, mctx,
+                                               &view->secroots));
 
        obj = NULL;
        result = ns_config_get(maps, "max-cache-ttl", &obj);
@@ -1122,7 +1128,7 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
                }
        } else
                dns_view_setrootdelonly(view, ISC_FALSE);
-                       
+
        result = ISC_R_SUCCESS;
 
  cleanup:

diff --git a/bin/tests/system/dnssec/ns1/named.conf b/bin/tests/system/dnssec/ns1/named.conf
index 02efa2858019c4f1a817eff7242e6b7ae92c1c54..463fb77bb7c163704105a03e6fe1d6a5a589405b 100644 (file)
--- a/bin/tests/system/dnssec/ns1/named.conf
+++ b/bin/tests/system/dnssec/ns1/named.conf
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.16 2001/01/09 21:42:47 bwelling Exp $ */
+/* $Id: named.conf,v 1.17 2004/02/17 03:40:20 marka Exp $ */
 
 // NS1
 
@@ -29,6 +29,7 @@ options {
        listen-on-v6 { none; };
        recursion no;
        notify yes;
+       enable-dnssec yes;
 };
 
 zone "." {

diff --git a/bin/tests/system/dnssec/ns2/named.conf b/bin/tests/system/dnssec/ns2/named.conf
index 8b7d80a43648cdcdd6f788d3fc223141e144ba66..6f464e6c2cfe14d02337a3d5064252ea41f4b883 100644 (file)
--- a/bin/tests/system/dnssec/ns2/named.conf
+++ b/bin/tests/system/dnssec/ns2/named.conf
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.19 2002/02/20 03:33:54 marka Exp $ */
+/* $Id: named.conf,v 1.20 2004/02/17 03:40:21 marka Exp $ */
 
 // NS2
 
@@ -29,6 +29,7 @@ options {
        listen-on-v6 { none; };
        recursion no;
        notify yes;
+       enable-dnssec yes;
 };
 
 zone "." {

diff --git a/bin/tests/system/dnssec/ns3/named.conf b/bin/tests/system/dnssec/ns3/named.conf
index 2fbcb17a4c2f70d28bd383a35a266aee7770ddba..5deba648ecda803bdb650dbc642672edeff63ffa 100644 (file)
--- a/bin/tests/system/dnssec/ns3/named.conf
+++ b/bin/tests/system/dnssec/ns3/named.conf
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.21 2002/02/20 03:33:58 marka Exp $ */
+/* $Id: named.conf,v 1.22 2004/02/17 03:40:21 marka Exp $ */
 
 // NS3
 
@@ -29,6 +29,7 @@ options {
        listen-on-v6 { none; };
        recursion no;
        notify yes;
+       enable-dnssec yes;
 };
 
 zone "." {

diff --git a/bin/tests/system/dnssec/ns4/named.conf b/bin/tests/system/dnssec/ns4/named.conf
index c0b0d5a66a8c6828049c91343df3da166d3e115a..2f3a7e331b8f4ecfa0e933b7a1e5740a71ff9531 100644 (file)
--- a/bin/tests/system/dnssec/ns4/named.conf
+++ b/bin/tests/system/dnssec/ns4/named.conf
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.18 2001/01/11 20:41:37 gson Exp $ */
+/* $Id: named.conf,v 1.19 2004/02/17 03:40:21 marka Exp $ */
 
 // NS4
 
@@ -28,6 +28,7 @@ options {
        listen-on { 10.53.0.4; };
        listen-on-v6 { none; };
        recursion yes;
+       enable-dnssec yes;
 };
 
 zone "." {

diff --git a/bin/tests/system/dnssec/ns5/named.conf b/bin/tests/system/dnssec/ns5/named.conf
index a0abc3b8a79d70064cfc90e596d9c0741911458e..b068b895c40422ff764d39a91f49bd1f7ad3a70d 100644 (file)
--- a/bin/tests/system/dnssec/ns5/named.conf
+++ b/bin/tests/system/dnssec/ns5/named.conf
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.16 2001/01/11 20:41:39 gson Exp $ */
+/* $Id: named.conf,v 1.17 2004/02/17 03:40:21 marka Exp $ */
 
 // NS5
 
@@ -28,6 +28,7 @@ options {
        listen-on { 10.53.0.5; };
        listen-on-v6 { none; };
        recursion yes;
+       enable-dnssec yes;
 };
 
 zone "." {

diff --git a/bin/tests/system/dnssec/ns6/named.conf b/bin/tests/system/dnssec/ns6/named.conf
index 53087c09555e14f86366b9a184660aa125fc3cc9..b1b8fb858d2bfe4e06fb31f2989807da6714718b 100644 (file)
--- a/bin/tests/system/dnssec/ns6/named.conf
+++ b/bin/tests/system/dnssec/ns6/named.conf
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.2 2004/01/15 04:09:17 marka Exp $ */
+/* $Id: named.conf,v 1.3 2004/02/17 03:40:22 marka Exp $ */
 
 // NS6
 
@@ -30,6 +30,7 @@ options {
        recursion yes;
        notify yes;
        disable-algorithms . { DSA; };
+       enable-dnssec yes;
 };
 
 zone "." {

diff --git a/bin/tests/system/lwresd/ns1/named.conf b/bin/tests/system/lwresd/ns1/named.conf
index f9c5b9d8dc37da608f7c671ea620c5aa51de83fc..f35a313c5af99b04698d1e82e7a6405314260a5f 100644 (file)
--- a/bin/tests/system/lwresd/ns1/named.conf
+++ b/bin/tests/system/lwresd/ns1/named.conf
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.11 2001/01/09 21:43:45 bwelling Exp $ */
+/* $Id: named.conf,v 1.12 2004/02/17 03:40:22 marka Exp $ */
 
 options {
        query-source address 10.53.0.1;
@@ -27,6 +27,7 @@ options {
        listen-on-v6 { none; };
        recursion no;
        notify no;
+       enable-dnssec yes;
 };
 
 zone "." {

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 419272fa02e6c0b2e7391ea4780dd34203285413..afa2063eb7964575e25ceead0d82f4693cf8754c 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -2,7 +2,7 @@
 <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
                "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd">
 
-<!-- File: $Id: Bv9ARM-book.xml,v 1.232 2004/01/14 02:06:49 marka Exp $ -->
+<!-- File: $Id: Bv9ARM-book.xml,v 1.233 2004/02/17 03:40:22 marka Exp $ -->
 
 <book>
 <title>BIND 9 Administrator Reference Manual</title>
@@ -2744,6 +2744,7 @@ statement in the <filename>named.conf</filename> file:</para>
     <optional> rfc2308-type1 <replaceable>yes_or_no</replaceable>; </optional>
     <optional> use-id-pool <replaceable>yes_or_no</replaceable>; </optional>
     <optional> maintain-ixfr-base <replaceable>yes_or_no</replaceable>; </optional>
+    <optional> enable-dnssec <replaceable>yes_or_no</replaceable>; </optional>
     <optional> forward ( <replaceable>only</replaceable> | <replaceable>first</replaceable> ); </optional>
     <optional> forwarders { <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> ; <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> ; ... </optional> }; </optional>
     <optional> dual-stack-servers <optional>port <replaceable>ip_port</replaceable></optional> { ( <replaceable>domain_name</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> | <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> ) ; ... }; </optional>
@@ -3324,6 +3325,14 @@ when the serial number on the master is less than what named currently
 has.  The default is <userinput>no</userinput>.
 </para></listitem></varlistentry>
 
+<varlistentry><term><command>enable-dnssec</command></term>
+<listitem>
+<para>
+Enable DNSSEC support in named.  Unless set to <userinput>yes</userinput>
+named behaves as if it does not support DNSSEC.
+The default is <userinput>no</userinput>.
+</para></listitem></varlistentry>
+
 </variablelist>
 
 </sect3>

diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
index 6ef9b036697c4ad14fad09eceaacf51219b6c9d7..e1dae7f1eb43999cdabbc1149277f704b1eff356 100644 (file)
--- a/lib/dns/include/dns/view.h
+++ b/lib/dns/include/dns/view.h
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: view.h,v 1.87 2003/09/30 05:56:17 marka Exp $ */
+/* $Id: view.h,v 1.88 2004/02/17 03:40:23 marka Exp $ */
 
 #ifndef DNS_VIEW_H
 #define DNS_VIEW_H 1
@@ -107,6 +107,7 @@ struct dns_view {
        isc_boolean_t                   additionalfromcache;
        isc_boolean_t                   additionalfromauth;
        isc_boolean_t                   minimalresponses;
+       isc_boolean_t                   enablednssec;
        dns_transfer_format_t           transfer_format;
        dns_acl_t *                     queryacl;
        dns_acl_t *                     recursionacl;

diff --git a/lib/dns/view.c b/lib/dns/view.c
index 11e61bfcabaa1aee3edd129d9aea1b9e471cce37..7004e3cbf3bfad3d6919d3a8b4cfeb982c8bde4f 100644 (file)
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: view.c,v 1.123 2003/10/03 02:19:31 marka Exp $ */
+/* $Id: view.c,v 1.124 2004/02/17 03:40:23 marka Exp $ */
 
 #include <config.h>
 
@@ -155,6 +155,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
        view->auth_nxdomain = ISC_FALSE; /* Was true in BIND 8 */
        view->additionalfromcache = ISC_TRUE;
        view->additionalfromauth = ISC_TRUE;
+       view->enablednssec = ISC_TRUE;
        view->minimalresponses = ISC_FALSE;
        view->transfer_format = dns_one_answer;
        view->queryacl = NULL;

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index e9bb2f14b6eceb0df75592a78f19107c4f0a630a..7f105cac5b732b594dc7cbdede8fc399c72fac4a 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: namedconf.c,v 1.25 2004/01/14 02:06:51 marka Exp $ */
+/* $Id: namedconf.c,v 1.26 2004/02/17 03:40:23 marka Exp $ */
 
 #include <config.h>
 
@@ -678,6 +678,7 @@ view_clauses[] = {
        { "root-delegation-only",  &cfg_type_optional_exclude, 0 },
        { "disable-algorithms", &cfg_type_disablealgorithm,
          CFG_CLAUSEFLAG_MULTI },
+       { "enable-dnssec", &cfg_type_boolean, 0 },
        { NULL, NULL, 0 }
 };