Deprecate auto-dnssec

Deprecate auto-dnssec, add specific log warning to migrate to
dnssec-policy.

Cherry-picking triggered a lot of conflicts, so the changes
were manually picked.

(manually picked from commit f9845dd1)

diff --git a/bin/tests/system/checkconf/dnssec.4 b/bin/tests/system/checkconf/dnssec.4
new file mode 100644 (file)
index 0000000..53e5d91
--- /dev/null
+++ b/bin/tests/system/checkconf/dnssec.4
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "test" {
+       type primary;
+       file "test.db";
+       auto-dnssec maintain;
+};

diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index b406489da2c9bb79cf54524686aefb781e761af4..a92fb41dcdf32af71cacfe91a5b67ac0ff052ff8 100644 (file)
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -126,10 +126,15 @@ grep "'dnssec-enable' is obsolete and should be removed" < checkconf.out$n.1 > /
 # dnssec.2: auto-dnssec warning
 $CHECKCONF dnssec.2 > checkconf.out$n.2 2>&1
 grep 'auto-dnssec may only be ' < checkconf.out$n.2 > /dev/null || ret=1
-# dnssec.3: should have no warnings
+# dnssec.3: should have no warnings (other than deprecation warning)
 $CHECKCONF dnssec.3 > checkconf.out$n.3 2>&1
-grep '.*' < checkconf.out$n.3 > /dev/null && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+grep "option 'auto-dnssec' is deprecated" < checkconf.out$n.3 > /dev/null || ret=1
+lines=$(wc -l < "checkconf.out$n.3")
+if [ $lines != 1 ]; then ret=1; fi
+# dnssec.4: should have specific deprecation warning
+$CHECKCONF dnssec.4 > checkconf.out$n.4 2>&1
+grep "'auto-dnssec' option is deprecated and will be removed in BIND 9\.19" < checkconf.out$n.4 > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 n=`expr $n + 1`

diff --git a/doc/misc/master.zoneopt b/doc/misc/master.zoneopt
index 7286685c76131ce1db1ef6e564a75a299d98e83e..953e3a2829fc05a1ff9beb754d1e0296465eb000 100644 (file)
--- a/doc/misc/master.zoneopt
+++ b/doc/misc/master.zoneopt
@@ -7,7 +7,7 @@ zone <string> [ <class> ] {
        also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
        alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-       auto-dnssec ( allow | maintain | off );
+       auto-dnssec ( allow | maintain | off ); // deprecated
        check-dup-records ( fail | warn | ignore );
        check-integrity <boolean>;
        check-mx ( fail | warn | ignore );

diff --git a/doc/misc/options b/doc/misc/options
index f1a336d1c7adc80accf2452a32c9dfc22da2e85e..0994525160fbf36900cf9d34fdc83adcbecc9ae2 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -104,7 +104,7 @@ options {
         answer-cookie <boolean>;
         attach-cache <string>;
         auth-nxdomain <boolean>; // default changed
-        auto-dnssec ( allow | maintain | off );
+        auto-dnssec ( allow | maintain | off ); // deprecated
         automatic-interface-scan <boolean>;
         avoid-v4-udp-ports { <portrange>; ... };
         avoid-v6-udp-ports { <portrange>; ... };
@@ -510,7 +510,7 @@ view <string> [ <class> ] {
             * ) ] [ dscp <integer> ];
         attach-cache <string>;
         auth-nxdomain <boolean>; // default changed
-        auto-dnssec ( allow | maintain | off );
+        auto-dnssec ( allow | maintain | off ); // deprecated
         cache-file <quoted_string>; // deprecated
         catalog-zones { zone <string> [ default-masters [ port <integer> ]
             [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port
@@ -809,7 +809,7 @@ view <string> [ <class> ] {
                     <integer> | * ) ] [ dscp <integer> ];
                 alt-transfer-source-v6 ( <ipv6_address> | * ) [ port (
                     <integer> | * ) ] [ dscp <integer> ];
-                auto-dnssec ( allow | maintain | off );
+                auto-dnssec ( allow | maintain | off ); // deprecated
                 check-dup-records ( fail | warn | ignore );
                 check-integrity <boolean>;
                 check-mx ( fail | warn | ignore );
@@ -930,7 +930,7 @@ zone <string> [ <class> ] {
             ] [ dscp <integer> ];
         alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
             * ) ] [ dscp <integer> ];
-        auto-dnssec ( allow | maintain | off );
+        auto-dnssec ( allow | maintain | off ); // deprecated
         check-dup-records ( fail | warn | ignore );
         check-integrity <boolean>;
         check-mx ( fail | warn | ignore );

diff --git a/doc/misc/options.active b/doc/misc/options.active
index 0b5fc04b54a557275f3332aa214607da5f315a1d..068545fa293c1cb4cf692c3f2e7ece2d7d1f25c4 100644 (file)
--- a/doc/misc/options.active
+++ b/doc/misc/options.active
@@ -96,7 +96,7 @@ options {
         answer-cookie <boolean>;
         attach-cache <string>;
         auth-nxdomain <boolean>; // default changed
-        auto-dnssec ( allow | maintain | off );
+        auto-dnssec ( allow | maintain | off ); // deprecated
         automatic-interface-scan <boolean>;
         avoid-v4-udp-ports { <portrange>; ... };
         avoid-v6-udp-ports { <portrange>; ... };
@@ -459,7 +459,7 @@ view <string> [ <class> ] {
             * ) ] [ dscp <integer> ];
         attach-cache <string>;
         auth-nxdomain <boolean>; // default changed
-        auto-dnssec ( allow | maintain | off );
+        auto-dnssec ( allow | maintain | off ); // deprecated
         cache-file <quoted_string>; // deprecated
         catalog-zones { zone <string> [ default-masters [ port <integer> ]
             [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port
@@ -734,7 +734,7 @@ view <string> [ <class> ] {
                     <integer> | * ) ] [ dscp <integer> ];
                 alt-transfer-source-v6 ( <ipv6_address> | * ) [ port (
                     <integer> | * ) ] [ dscp <integer> ];
-                auto-dnssec ( allow | maintain | off );
+                auto-dnssec ( allow | maintain | off ); // deprecated
                 check-dup-records ( fail | warn | ignore );
                 check-integrity <boolean>;
                 check-mx ( fail | warn | ignore );
@@ -847,7 +847,7 @@ zone <string> [ <class> ] {
             ] [ dscp <integer> ];
         alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
             * ) ] [ dscp <integer> ];
-        auto-dnssec ( allow | maintain | off );
+        auto-dnssec ( allow | maintain | off ); // deprecated
         check-dup-records ( fail | warn | ignore );
         check-integrity <boolean>;
         check-mx ( fail | warn | ignore );

diff --git a/doc/misc/slave.zoneopt b/doc/misc/slave.zoneopt
index 8cb7c3143f5349a332f2f5cc6ec68b6e1b076979..c46202dc5819f99f2fec284623cbaa7557b6ad72 100644 (file)
--- a/doc/misc/slave.zoneopt
+++ b/doc/misc/slave.zoneopt
@@ -8,7 +8,7 @@ zone <string> [ <class> ] {
        also-notify [ port <integer> ] [ dscp <integer> ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
        alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ] [ dscp <integer> ];
-       auto-dnssec ( allow | maintain | off );
+       auto-dnssec ( allow | maintain | off ); // deprecated
        check-names ( fail | warn | ignore );
        database <string>;
        dialup ( notify | notify-passive | passive | refresh | <boolean> );

diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index 31fb04d87c001a2acb4d328c13d83d511e4ced7b..8a646f13b0a848ce091a0c67d860e6d06d635e94 100644 (file)
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -2956,6 +2956,10 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
                res3 = cfg_map_get(zoptions, "auto-dnssec", &obj);
                if (res3 == ISC_R_SUCCESS) {
                        arg = cfg_obj_asstring(obj);
+                       cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
+                                   "'auto-dnssec' option is deprecated and "
+                                   "will be removed in BIND 9.19. Please "
+                                   "migrate to dnssec-policy");
                }
                if (strcasecmp(arg, "off") != 0) {
                        if (!ddns && !signing && !has_dnssecpolicy) {

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 11acb8ba54add2e0a4478f44acba8dfa1006ec84..d7303bcf213bdba3ac0f3f0ad6024c3ab127b03f 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -2195,7 +2195,7 @@ static cfg_clausedef_t zone_clauses[] = {
        { "alt-transfer-source-v6", &cfg_type_sockaddr6wild,
          CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR },
        { "auto-dnssec", &cfg_type_autodnssec,
-         CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY },
+         CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_DEPRECATED },
        { "check-dup-records", &cfg_type_checkmode, CFG_ZONE_PRIMARY },
        { "check-integrity", &cfg_type_boolean, CFG_ZONE_PRIMARY },
        { "check-mx", &cfg_type_checkmode, CFG_ZONE_PRIMARY },