From: Evan Hunt Date: Fri, 26 Oct 2012 23:14:59 +0000 (-0700) Subject: [master] allow dnssec options in inline-signing slaves X-Git-Tag: v9.10.0a1~760^2~1 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=f46168b87966f679a22aaf494c555f0de821aff9;p=thirdparty%2Fbind9.git [master] allow dnssec options in inline-signing slaves 3408. [bug] Some DNSSEC-related options (update-check-ksk, dnssec-loadkeys-interval, dnssec-dnskey-kskonly) are now legal in slave zones as long as inline-signing is in use. [RT #31078] --- diff --git a/CHANGES b/CHANGES index adf09b6efc1..b83eee78048 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,8 @@ +3408. [bug] Some DNSSEC-related options (update-check-ksk, + dnssec-loadkeys-interval, dnssec-dnskey-kskonly) + are now legal in slave zones as long as + inline-signing is in use. [RT #31078] + 3407. [placeholder] 3406. [bug] mem.c: Fix compilation errors when building with diff --git a/bin/tests/system/checkconf/bad-dnssec.conf b/bin/tests/system/checkconf/bad-dnssec.conf new file mode 100644 index 00000000000..bfa29dbace5 --- /dev/null +++ b/bin/tests/system/checkconf/bad-dnssec.conf @@ -0,0 +1,34 @@ +/* + * Copyright (C) 2012 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +zone not-inline { + type slave; + masters { 127.0.0.1; }; + inline-signing no; + dnssec-dnskey-kskonly yes; + update-check-ksk yes; + dnssec-loadkeys-interval 10; + +}; + +zone inline { + type slave; + masters { 127.0.0.1; }; + inline-signing yes; + dnssec-dnskey-kskonly yes; + update-check-ksk yes; + dnssec-loadkeys-interval 10; +}; diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh index e506da55953..a544fa71ce8 100644 --- a/bin/tests/system/checkconf/tests.sh +++ b/bin/tests/system/checkconf/tests.sh @@ -93,5 +93,16 @@ done if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` +echo "I: checking options allowed in inline-signing slaves" +ret=0 +n=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "dnssec-dnskey-kskonly.*requires inline" | wc -l` +[ $n -eq 1 ] || ret=1 +n=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "dnssec-loadkeys-interval.*requires inline" | wc -l` +[ $n -eq 1 ] || ret=1 +n=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "update-check-ksk.*requires inline" | wc -l` +[ $n -eq 1 ] || ret=1 +if [ $ret != 0 ]; then echo "I:failed"; fi +status=`expr $status + $ret` + echo "I:exit status: $status" exit $status diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index f8b3426cac0..52fd53823cd 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -10501,6 +10501,9 @@ view "external" { allow-query-on { address_match_list }; allow-transfer { address_match_list }; allow-update { address_match_list }; + update-check-ksk yes_or_no; + dnssec-dnskey-kskonly yes_or_no; + dnssec-loadkeys-interval number; update-policy local | { update_policy_rule ... }; also-notify { ip_addr port ip_port ; ip_addr port ip_port ; ... }; @@ -10553,8 +10556,8 @@ zone zone_name class allow-query-on { address_match_list }; allow-transfer { address_match_list }; allow-update-forwarding { address_match_list }; - update-check-ksk yes_or_no; dnssec-update-mode ( maintain | no-resign ); + update-check-ksk yes_or_no; dnssec-dnskey-kskonly yes_or_no; dnssec-loadkeys-interval number; dnssec-secure-to-insecure yes_or_no ; @@ -10595,11 +10598,18 @@ zone zone_name class notify-source (ip4_addr | *) port ip_port ; notify-source-v6 (ip6_addr | *) port ip_port ; zone-statistics yes_or_no ; + sig-validity-interval number number ; + sig-signing-nodes number ; + sig-signing-signatures number ; + sig-signing-type number ; database string ; min-refresh-time number ; max-refresh-time number ; min-retry-time number ; max-retry-time number ; + key-directory path_name; + auto-dnssec allow|maintain|off; + inline-signing yes_or_no; multi-master yes_or_no ; zero-no-soa-ttl yes_or_no ; }; diff --git a/lib/bind9/check.c b/lib/bind9/check.c index 55c240348f6..87d6de2d669 100644 --- a/lib/bind9/check.c +++ b/lib/bind9/check.c @@ -1459,9 +1459,9 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, { "check-srv-cname", MASTERZONE }, { "masterfile-format", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE | REDIRECTZONE }, - { "update-check-ksk", MASTERZONE }, - { "dnssec-dnskey-kskonly", MASTERZONE }, - { "dnssec-loadkeys-interval", MASTERZONE }, + { "update-check-ksk", MASTERZONE | SLAVEZONE }, + { "dnssec-dnskey-kskonly", MASTERZONE | SLAVEZONE }, + { "dnssec-loadkeys-interval", MASTERZONE | SLAVEZONE }, { "auto-dnssec", MASTERZONE | SLAVEZONE }, { "try-tcp-refresh", SLAVEZONE | STREDIRECTZONE }, { "server-addresses", STATICSTUBZONE }, @@ -1475,7 +1475,6 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, { "passive", SLAVEZONE | STUBZONE | STREDIRECTZONE }, }; - znamestr = cfg_obj_asstring(cfg_tuple_get(zconfig, "name")); zoptions = cfg_tuple_get(zconfig, "options"); @@ -1714,6 +1713,33 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions, 0xff00U, 0xffffU); result = ISC_R_FAILURE; } + + obj = NULL; + res1 = cfg_map_get(zoptions, "dnssec-dnskey-kskonly", &obj); + if (res1 == ISC_R_SUCCESS && ztype == SLAVEZONE && !signing) { + cfg_obj_log(obj, logctx, ISC_LOG_ERROR, + "dnssec-dnskey-kskonly: requires " + "inline-signing when used in slave zone"); + result = ISC_R_FAILURE; + } + + obj = NULL; + res1 = cfg_map_get(zoptions, "dnssec-loadkeys-interval", &obj); + if (res1 == ISC_R_SUCCESS && ztype == SLAVEZONE && !signing) { + cfg_obj_log(obj, logctx, ISC_LOG_ERROR, + "dnssec-loadkeys-interval: requires " + "inline-signing when used in slave zone"); + result = ISC_R_FAILURE; + } + + obj = NULL; + res1 = cfg_map_get(zoptions, "update-check-ksk", &obj); + if (res1 == ISC_R_SUCCESS && ztype == SLAVEZONE && !signing) { + cfg_obj_log(obj, logctx, ISC_LOG_ERROR, + "update-check-ksk: requires " + "inline-signing when used in slave zone"); + result = ISC_R_FAILURE; + } } /*