[master] allow dnssec options in inline-signing slaves

3408.	[bug]		Some DNSSEC-related options (update-check-ksk,
			dnssec-loadkeys-interval, dnssec-dnskey-kskonly)
			are now legal in slave zones as long as
			inline-signing is in use. [RT #31078]

diff --git a/CHANGES b/CHANGES
index adf09b6efc1f12c53bd16dd864d0c762455fab58..b83eee78048038c9911b74142ac4f11ed58b354e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+3408.  [bug]           Some DNSSEC-related options (update-check-ksk,
+                       dnssec-loadkeys-interval, dnssec-dnskey-kskonly)
+                       are now legal in slave zones as long as
+                       inline-signing is in use. [RT #31078]
+
 3407.  [placeholder]
 
 3406.  [bug]           mem.c: Fix compilation errors when building with

diff --git a/bin/tests/system/checkconf/bad-dnssec.conf b/bin/tests/system/checkconf/bad-dnssec.conf
new file mode 100644 (file)
index 0000000..bfa29db
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-dnssec.conf
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+zone not-inline {
+        type slave;
+        masters { 127.0.0.1; };
+        inline-signing no;
+        dnssec-dnskey-kskonly yes;
+        update-check-ksk yes;
+        dnssec-loadkeys-interval 10;
+
+};
+
+zone inline {
+        type slave;
+        masters { 127.0.0.1; };
+        inline-signing yes;
+        dnssec-dnskey-kskonly yes;
+        update-check-ksk yes;
+        dnssec-loadkeys-interval 10;
+};

diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index e506da5595321aa2f72312269c0ac5d9a4086615..a544fa71ce864bd434c617953dd057213b3a7841 100644 (file)
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -93,5 +93,16 @@ done
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+echo "I: checking options allowed in inline-signing slaves"
+ret=0
+n=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "dnssec-dnskey-kskonly.*requires inline" | wc -l`
+[ $n -eq 1 ] || ret=1
+n=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "dnssec-loadkeys-interval.*requires inline" | wc -l`
+[ $n -eq 1 ] || ret=1
+n=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "update-check-ksk.*requires inline" | wc -l`
+[ $n -eq 1 ] || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index f8b3426cac0bdb7a663d0bf8064467dec0b616dd..52fd53823cd6cd89f936ec035fd8f24e130cc743 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -10501,6 +10501,9 @@ view "external" {
     <optional> allow-query-on { <replaceable>address_match_list</replaceable> }; </optional>
     <optional> allow-transfer { <replaceable>address_match_list</replaceable> }; </optional>
     <optional> allow-update { <replaceable>address_match_list</replaceable> }; </optional>
+    <optional> update-check-ksk <replaceable>yes_or_no</replaceable>; </optional>
+    <optional> dnssec-dnskey-kskonly <replaceable>yes_or_no</replaceable>; </optional>
+    <optional> dnssec-loadkeys-interval <replaceable>number</replaceable>; </optional>
     <optional> update-policy <replaceable>local</replaceable> | { <replaceable>update_policy_rule</replaceable> <optional>...</optional> }; </optional>
     <optional> also-notify { <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> ;
                   <optional> <replaceable>ip_addr</replaceable> <optional>port <replaceable>ip_port</replaceable></optional> ; ... </optional> }; </optional>
@@ -10553,8 +10556,8 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea
     <optional> allow-query-on { <replaceable>address_match_list</replaceable> }; </optional>
     <optional> allow-transfer { <replaceable>address_match_list</replaceable> }; </optional>
     <optional> allow-update-forwarding { <replaceable>address_match_list</replaceable> }; </optional>
-    <optional> update-check-ksk <replaceable>yes_or_no</replaceable>; </optional>
     <optional> dnssec-update-mode ( <replaceable>maintain</replaceable> | <replaceable>no-resign</replaceable> ); </optional>
+    <optional> update-check-ksk <replaceable>yes_or_no</replaceable>; </optional>
     <optional> dnssec-dnskey-kskonly <replaceable>yes_or_no</replaceable>; </optional>
     <optional> dnssec-loadkeys-interval <replaceable>number</replaceable>; </optional>
     <optional> dnssec-secure-to-insecure <replaceable>yes_or_no</replaceable> ; </optional>
@@ -10595,11 +10598,18 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea
     <optional> notify-source (<replaceable>ip4_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional>
     <optional> notify-source-v6 (<replaceable>ip6_addr</replaceable> | <constant>*</constant>) <optional>port <replaceable>ip_port</replaceable></optional> ; </optional>
     <optional> zone-statistics <replaceable>yes_or_no</replaceable> ; </optional>
+    <optional> sig-validity-interval <replaceable>number</replaceable> <optional><replaceable>number</replaceable></optional> ; </optional>
+    <optional> sig-signing-nodes <replaceable>number</replaceable> ; </optional>
+    <optional> sig-signing-signatures <replaceable>number</replaceable> ; </optional>
+    <optional> sig-signing-type <replaceable>number</replaceable> ; </optional>
     <optional> database <replaceable>string</replaceable> ; </optional>
     <optional> min-refresh-time <replaceable>number</replaceable> ; </optional>
     <optional> max-refresh-time <replaceable>number</replaceable> ; </optional>
     <optional> min-retry-time <replaceable>number</replaceable> ; </optional>
     <optional> max-retry-time <replaceable>number</replaceable> ; </optional>
+    <optional> key-directory <replaceable>path_name</replaceable>; </optional>
+    <optional> auto-dnssec <constant>allow</constant>|<constant>maintain</constant>|<constant>off</constant>; </optional>
+    <optional> inline-signing <replaceable>yes_or_no</replaceable>; </optional>
     <optional> multi-master <replaceable>yes_or_no</replaceable> ; </optional>
     <optional> zero-no-soa-ttl <replaceable>yes_or_no</replaceable> ; </optional>
 };

diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index 55c240348f669f57f2724bafbb1559e8f1b94177..87d6de2d669f577d340ec5935407867da40029ca 100644 (file)
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -1459,9 +1459,9 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
        { "check-srv-cname", MASTERZONE },
        { "masterfile-format", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE |
          REDIRECTZONE },
-       { "update-check-ksk", MASTERZONE },
-       { "dnssec-dnskey-kskonly", MASTERZONE },
-       { "dnssec-loadkeys-interval", MASTERZONE },
+       { "update-check-ksk", MASTERZONE | SLAVEZONE },
+       { "dnssec-dnskey-kskonly", MASTERZONE | SLAVEZONE },
+       { "dnssec-loadkeys-interval", MASTERZONE | SLAVEZONE },
        { "auto-dnssec", MASTERZONE | SLAVEZONE },
        { "try-tcp-refresh", SLAVEZONE | STREDIRECTZONE },
        { "server-addresses", STATICSTUBZONE },
@@ -1475,7 +1475,6 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
        { "passive", SLAVEZONE | STUBZONE | STREDIRECTZONE },
        };
 
-
        znamestr = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
 
        zoptions = cfg_tuple_get(zconfig, "options");
@@ -1714,6 +1713,33 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
                                            0xff00U, 0xffffU);
                        result = ISC_R_FAILURE;
                }
+
+               obj = NULL;
+               res1 = cfg_map_get(zoptions, "dnssec-dnskey-kskonly", &obj);
+               if (res1 == ISC_R_SUCCESS && ztype == SLAVEZONE && !signing) {
+                       cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+                                   "dnssec-dnskey-kskonly: requires "
+                                   "inline-signing when used in slave zone");
+                       result = ISC_R_FAILURE;
+               }
+
+               obj = NULL;
+               res1 = cfg_map_get(zoptions, "dnssec-loadkeys-interval", &obj);
+               if (res1 == ISC_R_SUCCESS && ztype == SLAVEZONE && !signing) {
+                       cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+                                   "dnssec-loadkeys-interval: requires "
+                                   "inline-signing when used in slave zone");
+                       result = ISC_R_FAILURE;
+               }
+
+               obj = NULL;
+               res1 = cfg_map_get(zoptions, "update-check-ksk", &obj);
+               if (res1 == ISC_R_SUCCESS && ztype == SLAVEZONE && !signing) {
+                       cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+                                   "update-check-ksk: requires "
+                                   "inline-signing when used in slave zone");
+                       result = ISC_R_FAILURE;
+               }
        }
 
        /*