Deprecate dnssec-lookaside option

Add the CFG_CLAUSEFLAG_DEPRECATED flag to the option so that people are
discouraged from using DLV.

diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
index 672bc78b4e893b9f65801258c40d6e75063e2250..1224e4e2eec931a016670729daa1599d7c1c9c09 100644 (file)
--- a/bin/named/named.conf.docbook
+++ b/bin/named/named.conf.docbook
@@ -254,7 +254,7 @@ options {
        dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
        dnssec-loadkeys-interval <replaceable>integer</replaceable>;
        dnssec-lookaside ( <replaceable>string</replaceable> trust-anchor
-           <replaceable>string</replaceable> | auto | no );
+           <replaceable>string</replaceable> | auto | no );, deprecated
        dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
        dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
        dnssec-update-mode ( maintain | no-resign );
@@ -615,7 +615,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
            <replaceable>integer</replaceable> <replaceable>quoted_string</replaceable>; ... };
        dnssec-loadkeys-interval <replaceable>integer</replaceable>;
        dnssec-lookaside ( <replaceable>string</replaceable> trust-anchor
-           <replaceable>string</replaceable> | auto | no );
+           <replaceable>string</replaceable> | auto | no );, deprecated
        dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
        dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
        dnssec-update-mode ( maintain | no-resign );

diff --git a/bin/tests/system/checkconf/deprecated.conf b/bin/tests/system/checkconf/deprecated.conf
index d4f30a0b0cea1523b8f232ae35acea2038e7c08d..f080af4087bfff7dcc2c1db0b67e63413292707b 100644 (file)
--- a/bin/tests/system/checkconf/deprecated.conf
+++ b/bin/tests/system/checkconf/deprecated.conf
@@ -11,6 +11,7 @@
 
 options {
        dnssec-validation yes;
+       dnssec-lookaside . trust-anchor dlv.example.com;
 };
 
 trusted-keys {

diff --git a/bin/tests/system/checkconf/dnssec.3 b/bin/tests/system/checkconf/dnssec.3
index a48d9c97a10348c1a1e50ce32be21bd12130bb8d..56c4a52fe69405fdc113f8b53469c2e35f0cf46a 100644 (file)
--- a/bin/tests/system/checkconf/dnssec.3
+++ b/bin/tests/system/checkconf/dnssec.3
@@ -24,7 +24,6 @@ view view3 {
 
 view view4 {
        match-clients { none; };
-       dnssec-lookaside no;
 };
 
 view view5 {

diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
index d627d2a84488840392a0468b80646cc5f4a675e6..b6136d6f3bc38b9c7a205382434a734ee7203b3c 100644 (file)
--- a/bin/tests/system/checkconf/good.conf
+++ b/bin/tests/system/checkconf/good.conf
@@ -107,7 +107,6 @@ view "second" {
                        1.2.3.4;
                };
        };
-       dnssec-lookaside "." trust-anchor "example.org.";
        dnssec-validation auto;
        zone-statistics full;
 };

diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index bd6576e9ad0f907a724b5ffd4956f6b4679a5aca..d41247a903d4936ecefc0082ca6ca83c4744b27f 100644 (file)
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -130,6 +130,7 @@ n=`expr $n + 1`
 echo_i "checking named-checkconf deprecate warnings ($n)"
 ret=0
 $CHECKCONF deprecated.conf > checkconf.out$n.1 2>&1
+grep "option 'dnssec-lookaside' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
 grep "option 'managed-keys' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
 grep "option 'trusted-keys' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -401,10 +402,12 @@ if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`
-echo_i "check that 'dnssec-lookaside . trust-anchor dlv.example.com;' does not generate a warning ($n)"
+echo_i "check that 'dnssec-lookaside . trust-anchor dlv.example.com;' generates only a deprecate warning ($n)"
 ret=0
 $CHECKCONF good-dlv-dlv.example.com.conf > checkconf.out$n 2>/dev/null || ret=1
-[ -s checkconf.out$n ] && ret=1
+lines=$(wc -l < checkconf.out$n)
+if [ $lines != 1 ]; then ret=1; fi
+grep "option 'dnssec-lookaside' is deprecated" < checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index cd75915bd0d5ff8a6df4f406999f3c319456352e..e0fc511712ecaae12b8fc53062c5d3e3d72b3321 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -5103,6 +5103,9 @@ options {
                <userinput>no</userinput>, then dnssec-lookaside
                is not used.
              </para>
+             <para>
+               This option is deprecated and its use is discouraged.
+             </para>
              <para>
                NOTE: The ISC-provided DLV service at
                <literal>dlv.isc.org</literal>, has been shut down.

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index 6f0deec264d3108788ca4017fad49d324c995a34..a1ce3fcad5726310b75d2926410e59447b87abaa 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -195,7 +195,7 @@
     <itemizedlist>
       <listitem>
        <para>
-         The <command>dnssec-enable</command> option has been deprecated and
+         The <command>dnssec-enable</command> option has been obsoleted and
          no longer has any effect. DNSSEC responses are always enabled
          if signatures and other DNSSEC data are present. [GL #866]
        </para>
@@ -206,6 +206,12 @@
          removed.  [GL !1731]
        </para>
       </listitem>
+      <listitem>
+       <para>
+         The <command>dnssec-lookaside</command> option has been deprecated.
+         The feature still works, but it is discouraged to use it. [GL #7]
+       </para>
+      </listitem>
     </itemizedlist>
   </section>
 

diff --git a/doc/arm/options.grammar.xml b/doc/arm/options.grammar.xml
index 850bde3d5c0f5809af81150259d8f3deb6f75bad..6f515c84008b2872ec5d852441bbbb898e41731a 100644 (file)
--- a/doc/arm/options.grammar.xml
+++ b/doc/arm/options.grammar.xml
@@ -91,7 +91,7 @@
        <command>dnssec-dnskey-kskonly</command> <replaceable>boolean</replaceable>;
        <command>dnssec-loadkeys-interval</command> <replaceable>integer</replaceable>;
        <command>dnssec-lookaside</command> ( <replaceable>string</replaceable> trust-anchor
-           <replaceable>string</replaceable> | auto | no );
+           <replaceable>string</replaceable> | auto | no );, deprecated
        <command>dnssec-must-be-secure</command> <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
        <command>dnssec-secure-to-insecure</command> <replaceable>boolean</replaceable>;
        <command>dnssec-update-mode</command> ( maintain | no-resign );

diff --git a/doc/misc/options b/doc/misc/options
index eef44aa0fb7aa9417d96d7eb552a0a8191d8df83..1c61197840753fd60c0e721a9167b15f8f4d2138 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -147,7 +147,7 @@ options {
         dnssec-enable <boolean>; // obsolete
         dnssec-loadkeys-interval <integer>;
         dnssec-lookaside ( <string> trust-anchor
-            <string> | auto | no ); // may occur multiple times
+            <string> | auto | no ); // may occur multiple times, deprecated
         dnssec-must-be-secure <string> <boolean>; // may occur multiple times
         dnssec-secure-to-insecure <boolean>;
         dnssec-update-mode ( maintain | no-resign );
@@ -525,7 +525,7 @@ view <string> [ <class> ] {
             <integer> <quoted_string>; ... }; // may occur multiple times
         dnssec-loadkeys-interval <integer>;
         dnssec-lookaside ( <string> trust-anchor
-            <string> | auto | no ); // may occur multiple times
+            <string> | auto | no ); // may occur multiple times, deprecated
         dnssec-must-be-secure <string> <boolean>; // may occur multiple times
         dnssec-secure-to-insecure <boolean>;
         dnssec-update-mode ( maintain | no-resign );

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 61c8857fe61984282bbd245cc7567ba91a27f80f..f5afd1fecf6dd74c655c1df8489f3406f426b70a 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -1879,7 +1879,8 @@ view_clauses[] = {
 #endif
        { "dnssec-accept-expired", &cfg_type_boolean, 0 },
        { "dnssec-enable", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
-       { "dnssec-lookaside", &cfg_type_lookaside, CFG_CLAUSEFLAG_MULTI },
+       { "dnssec-lookaside", &cfg_type_lookaside,
+         CFG_CLAUSEFLAG_MULTI|CFG_CLAUSEFLAG_DEPRECATED },
        { "dnssec-must-be-secure",  &cfg_type_mustbesecure,
          CFG_CLAUSEFLAG_MULTI },
        { "dnssec-validation", &cfg_type_boolorauto, 0 },