From 28158e5698a87d60bbc575b50115db6119c2bf18 Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Tue, 3 Oct 2017 00:57:54 -0700 Subject: [PATCH] [v9_9] de-DLV 4749. [func] The ISC DLV service has been shut down, and all DLV records have been removed from dlv.isc.org. - Removed references to ISC DLV in documentation - Removed DLV key from bind.keys [RT #46155] --- CHANGES | 6 + bin/named/bind.keys.h | 86 ++++---------- bin/named/config.c | 7 +- bin/named/server.c | 108 ++++-------------- bin/python/dnssec-checkds.docbook | 3 - bin/tests/system/checkconf/dnssec.3 | 6 +- bin/tests/system/checkconf/good.conf | 3 +- bin/tests/system/conf.sh.in | 2 +- bin/tests/system/dlvauto/clean.sh | 27 ----- .../system/dlvauto/ns1/dlv.isc.org.db.in | 25 ---- bin/tests/system/dlvauto/ns1/named.conf | 45 -------- bin/tests/system/dlvauto/ns1/root.db.in | 28 ----- bin/tests/system/dlvauto/ns1/sign.sh | 52 --------- bin/tests/system/dlvauto/ns2/named.conf | 61 ---------- bin/tests/system/dlvauto/prereq.sh | 20 ---- bin/tests/system/dlvauto/setup.sh | 24 ---- bin/tests/system/dlvauto/tests.sh | 66 ----------- bind.keys | 43 ++----- doc/arm/Bv9ARM-book.xml | 99 ++++++++-------- doc/arm/notes.xml | 9 ++ lib/bind9/check.c | 62 +++++++--- util/copyrights | 9 -- 22 files changed, 178 insertions(+), 613 deletions(-) delete mode 100644 bin/tests/system/dlvauto/clean.sh delete mode 100644 bin/tests/system/dlvauto/ns1/dlv.isc.org.db.in delete mode 100644 bin/tests/system/dlvauto/ns1/named.conf delete mode 100644 bin/tests/system/dlvauto/ns1/root.db.in delete mode 100644 bin/tests/system/dlvauto/ns1/sign.sh delete mode 100644 bin/tests/system/dlvauto/ns2/named.conf delete mode 100644 bin/tests/system/dlvauto/prereq.sh delete mode 100644 bin/tests/system/dlvauto/setup.sh delete mode 100644 bin/tests/system/dlvauto/tests.sh diff --git a/CHANGES b/CHANGES index b459fe50fd..86532c3897 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,9 @@ +4749. [func] The ISC DLV service has been shut down, and all + DLV records have been removed from dlv.isc.org. + - Removed references to ISC DLV in documentation + - Removed DLV key from bind.keys + [RT #46155] + 4748. [cleanup] Sprintf to snprintf coversions. [RT #46132] 4746. [cleanup] Add configured prefixes to configure summary diff --git a/bin/named/bind.keys.h b/bin/named/bind.keys.h index 50d298cffc..0c4b4771c0 100644 --- a/bin/named/bind.keys.h +++ b/bin/named/bind.keys.h @@ -1,46 +1,27 @@ #define TRUSTED_KEYS "\ # The bind.keys file is used to override the built-in DNSSEC trust anchors\n\ -# which are included as part of BIND 9. As of the current release, the only\n\ -# trust anchors it contains are those for the DNS root zone (\".\"), and for\n\ -# the ISC DNSSEC Lookaside Validation zone (\"dlv.isc.org\"). Trust anchors\n\ -# for any other zones MUST be configured elsewhere; if they are configured\n\ -# here, they will not be recognized or used by named.\n\ +# which are included as part of BIND 9. The only trust anchors it contains\n\ +# are for the DNS root zone (\".\"). Trust anchors for any other zones MUST\n\ +# be configured elsewhere; if they are configured here, they will not be\n\ +# recognized or used by named.\n\ #\n\ # The built-in trust anchors are provided for convenience of configuration.\n\ # They are not activated within named.conf unless specifically switched on.\n\ -# To use the built-in root key, set \"dnssec-validation auto;\" in\n\ -# named.conf options. To use the built-in DLV key, set\n\ -# \"dnssec-lookaside auto;\". Without these options being set,\n\ -# the keys in this file are ignored.\n\ +# To use the built-in key, use \"dnssec-validation auto;\" in the\n\ +# named.conf options. Without this option being set, the keys in this\n\ +# file are ignored.\n\ #\n\ # This file is NOT expected to be user-configured.\n\ #\n\ -# These keys are current as of Feburary 2017. If any key fails to\n\ +# These keys are current as of October 2017. If any key fails to\n\ # initialize correctly, it may have expired. In that event you should\n\ # replace this file with a current version. The latest version of\n\ # bind.keys can always be obtained from ISC at https://www.isc.org/bind-keys.\n\ +#\n\ +# See https://data.iana.org/root-anchors/root-anchors.xml\n\ +# for current trust anchor information for the root zone.\n\ \n\ trusted-keys {\n\ - # ISC DLV: See https://www.isc.org/solutions/dlv for details.\n\ - #\n\ - # NOTE: The ISC DLV zone is being phased out as of February 2017;\n\ - # the key will remain in place but the zone will be otherwise empty.\n\ - # Configuring \"dnssec-lookaside auto;\" to activate this key is\n\ - # harmless, but is no longer useful and is not recommended.\n\ - dlv.isc.org. 257 3 5 \"BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2\n\ - brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+\n\ - 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5\n\ - ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk\n\ - Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM\n\ - QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt\n\ - TDN0YUuWrBNh\";\n\ -\n\ - # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml\n\ - # for current trust anchor information.\n\ - #\n\ - # These keys are activated by setting \"dnssec-validation auto;\"\n\ - # in named.conf.\n\ - #\n\ # This key (19036) is to be phased out starting in 2017. It will\n\ # remain in the root zone for some time after its successor key\n\ # has been added. It will remain this file until it is removed from\n\ @@ -53,7 +34,7 @@ trusted-keys {\n\ Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq\n\ QxA+Uk1ihz0=\";\n\ \n\ - # This key (20326) is to be published in the root zone in 2017.\n\ + # This key (20326) was published in the root zone in 2017.\n\ # Servers which were already using the old key (19036) should\n\ # roll seamlessly to this new one via RFC 5011 rollover. Servers\n\ # being set up for the first time can use the contents of this\n\ @@ -72,47 +53,28 @@ trusted-keys {\n\ #define MANAGED_KEYS "\ # The bind.keys file is used to override the built-in DNSSEC trust anchors\n\ -# which are included as part of BIND 9. As of the current release, the only\n\ -# trust anchors it contains are those for the DNS root zone (\".\"), and for\n\ -# the ISC DNSSEC Lookaside Validation zone (\"dlv.isc.org\"). Trust anchors\n\ -# for any other zones MUST be configured elsewhere; if they are configured\n\ -# here, they will not be recognized or used by named.\n\ +# which are included as part of BIND 9. The only trust anchors it contains\n\ +# are for the DNS root zone (\".\"). Trust anchors for any other zones MUST\n\ +# be configured elsewhere; if they are configured here, they will not be\n\ +# recognized or used by named.\n\ #\n\ # The built-in trust anchors are provided for convenience of configuration.\n\ # They are not activated within named.conf unless specifically switched on.\n\ -# To use the built-in root key, set \"dnssec-validation auto;\" in\n\ -# named.conf options. To use the built-in DLV key, set\n\ -# \"dnssec-lookaside auto;\". Without these options being set,\n\ -# the keys in this file are ignored.\n\ +# To use the built-in key, use \"dnssec-validation auto;\" in the\n\ +# named.conf options. Without this option being set, the keys in this\n\ +# file are ignored.\n\ #\n\ # This file is NOT expected to be user-configured.\n\ #\n\ -# These keys are current as of Feburary 2017. If any key fails to\n\ +# These keys are current as of October 2017. If any key fails to\n\ # initialize correctly, it may have expired. In that event you should\n\ # replace this file with a current version. The latest version of\n\ # bind.keys can always be obtained from ISC at https://www.isc.org/bind-keys.\n\ +#\n\ +# See https://data.iana.org/root-anchors/root-anchors.xml\n\ +# for current trust anchor information for the root zone.\n\ \n\ managed-keys {\n\ - # ISC DLV: See https://www.isc.org/solutions/dlv for details.\n\ - #\n\ - # NOTE: The ISC DLV zone is being phased out as of February 2017;\n\ - # the key will remain in place but the zone will be otherwise empty.\n\ - # Configuring \"dnssec-lookaside auto;\" to activate this key is\n\ - # harmless, but is no longer useful and is not recommended.\n\ - dlv.isc.org. initial-key 257 3 5 \"BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2\n\ - brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+\n\ - 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5\n\ - ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk\n\ - Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM\n\ - QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt\n\ - TDN0YUuWrBNh\";\n\ -\n\ - # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml\n\ - # for current trust anchor information.\n\ - #\n\ - # These keys are activated by setting \"dnssec-validation auto;\"\n\ - # in named.conf.\n\ - #\n\ # This key (19036) is to be phased out starting in 2017. It will\n\ # remain in the root zone for some time after its successor key\n\ # has been added. It will remain this file until it is removed from\n\ @@ -125,7 +87,7 @@ managed-keys {\n\ Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq\n\ QxA+Uk1ihz0=\";\n\ \n\ - # This key (20326) is to be published in the root zone in 2017.\n\ + # This key (20326) was published in the root zone in 2017.\n\ # Servers which were already using the old key (19036) should\n\ # roll seamlessly to this new one via RFC 5011 rollover. Servers\n\ # being set up for the first time can use the contents of this\n\ diff --git a/bin/named/config.c b/bin/named/config.c index 67a8b1590c..8077a77c60 100644 --- a/bin/named/config.c +++ b/bin/named/config.c @@ -110,9 +110,6 @@ options {\n\ # treat-cr-as-space ;\n\ # use-id-pool ;\n\ # use-ixfr ;\n\ -\n\ - /* DLV */\n\ - dnssec-lookaside . trust-anchor dlv.isc.org;\n\ \n\ /* view */\n\ acache-cleaning-interval 60;\n\ @@ -261,8 +258,8 @@ view \"_bind\" chaos {\n\ };\n\ " "#\n\ -# Default trusted key(s) for builtin DLV support\n\ -# (used if \"dnssec-lookaside auto;\" is set and\n\ +# Default trusted key(s), used if \n\ +# \"dnssec-validation auto;\" is set and\n\ # sysconfdir/bind.keys doesn't exist).\n\ #\n\ # BEGIN MANAGED KEYS\n" diff --git a/bin/named/server.c b/bin/named/server.c index 18de0adf65..4e78b0e74b 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -788,8 +788,7 @@ keyloaded(dns_view_t *view, dns_name_t *name) { static isc_result_t configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig, const cfg_obj_t *config, const cfg_obj_t *bindkeys, - isc_boolean_t auto_dlv, isc_boolean_t auto_root, - isc_mem_t *mctx) + isc_boolean_t auto_root, isc_mem_t *mctx) { isc_result_t result = ISC_R_SUCCESS; const cfg_obj_t *view_keys = NULL; @@ -840,65 +839,6 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig, return (ISC_R_UNEXPECTED); } - if (auto_dlv && view->rdclass == dns_rdataclass_in) { - const cfg_obj_t *builtin_keys = NULL; - const cfg_obj_t *builtin_managed_keys = NULL; - - /* - * If bind.keys exists and is populated, it overrides - * the managed-keys clause hard-coded in ns_g_config. - */ - if (bindkeys != NULL) { - isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY, - NS_LOGMODULE_SERVER, ISC_LOG_INFO, - "obtaining DLV key for view %s " - "from '%s'", - view->name, ns_g_server->bindkeysfile); - - (void)cfg_map_get(bindkeys, "trusted-keys", - &builtin_keys); - (void)cfg_map_get(bindkeys, "managed-keys", - &builtin_managed_keys); - if ((builtin_keys == NULL) && - (builtin_managed_keys == NULL)) - isc_log_write(ns_g_lctx, - DNS_LOGCATEGORY_SECURITY, - NS_LOGMODULE_SERVER, - ISC_LOG_WARNING, - "dnssec-lookaside auto: " - "WARNING: key for dlv.isc.org " - "not found"); - } - - if ((builtin_keys == NULL) && - (builtin_managed_keys == NULL)) - { - isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY, - NS_LOGMODULE_SERVER, ISC_LOG_INFO, - "using built-in DLV key for view %s", - view->name); - - (void)cfg_map_get(ns_g_config, "trusted-keys", - &builtin_keys); - (void)cfg_map_get(ns_g_config, "managed-keys", - &builtin_managed_keys); - } - - if (builtin_keys != NULL) - CHECK(load_view_keys(builtin_keys, vconfig, view, - ISC_FALSE, view->dlv, mctx)); - if (builtin_managed_keys != NULL) - CHECK(load_view_keys(builtin_managed_keys, vconfig, - view, ISC_TRUE, view->dlv, mctx)); - if (!keyloaded(view, view->dlv)) { - isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY, - NS_LOGMODULE_SERVER, ISC_LOG_ERROR, - "DLV key not loaded"); - result = ISC_R_FAILURE; - goto cleanup; - } - } - if (auto_root && view->rdclass == dns_rdataclass_in) { const cfg_obj_t *builtin_keys = NULL; const cfg_obj_t *builtin_managed_keys = NULL; @@ -2229,7 +2169,6 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, const cfg_obj_t *disablelist = NULL; isc_stats_t *resstats = NULL; dns_stats_t *resquerystats = NULL; - isc_boolean_t auto_dlv = ISC_FALSE; isc_boolean_t auto_root = ISC_FALSE; ns_cache_t *nsc; isc_boolean_t zero_no_soattl; @@ -3374,19 +3313,21 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, obj = NULL; result = ns_config_get(optionmaps, "dnssec-lookaside", &obj); if (result == ISC_R_SUCCESS) { - /* If set to "auto", use the version from the defaults */ + /* "auto" is deprecated, log a warning if seen */ const char *dom; dlvobj = cfg_listelt_value(cfg_list_first(obj)); dom = cfg_obj_asstring(cfg_tuple_get(dlvobj, "domain")); if (cfg_obj_isvoid(cfg_tuple_get(dlvobj, "trust-anchor"))) { - /* If "no", skip; if "auto", use global default */ - if (!strcasecmp(dom, "no")) + /* If "no", skip; if "auto", log warning */ + if (!strcasecmp(dom, "no")) { + result = ISC_R_NOTFOUND; + } else if (!strcasecmp(dom, "auto")) { + cfg_obj_log(obj, ns_g_lctx, ISC_LOG_WARNING, + "WARNING: the DLV server at " + "'dlv.isc.org' is no longer " + "in service; dnssec-lookaside " + "ignored"); result = ISC_R_NOTFOUND; - else if (!strcasecmp(dom, "auto")) { - auto_dlv = ISC_TRUE; - obj = NULL; - result = cfg_map_get(ns_g_defaults, - "dnssec-lookaside", &obj); } } } @@ -3396,6 +3337,7 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, dns_fixedname_t f; dns_fixedname_init(&f); + /* Also log a warning if manually configured to dlv.isc.org */ iscdlv = dns_fixedname_name(&f); CHECK(dns_name_fromstring(iscdlv, "dlv.isc.org", 0, NULL)); @@ -3409,27 +3351,27 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, dlv = dns_fixedname_name(&view->dlv_fixed); CHECK(dns_name_fromstring(dlv, cfg_obj_asstring(obj), DNS_NAME_DOWNCASE, NULL)); - view->dlv = dns_fixedname_name(&view->dlv_fixed); - - if (dns_name_equal(view->dlv, iscdlv)) { - if (auto_dlv) - obj = dlvobj; + if (dns_name_equal(dlv, iscdlv)) { cfg_obj_log(obj, ns_g_lctx, ISC_LOG_WARNING, "WARNING: the DLV server at " - "'dlv.isc.org' is expected to " - "cease operation by the end " - "of January 2017"); + "'dlv.isc.org' is no longer " + "in service; dnssec-lookaside " + "ignored"); + view->dlv = NULL; + } else { + view->dlv = dlv; } } - } else + } else { view->dlv = NULL; + } /* * For now, there is only one kind of trusted keys, the * "security roots". */ CHECK(configure_view_dnsseckeys(view, vconfig, config, bindkeys, - auto_dlv, auto_root, mctx)); + auto_root, mctx)); dns_resolver_resetmustbesecure(view->resolver); obj = NULL; result = ns_config_get(maps, "dnssec-must-be-secure", &obj); @@ -5206,9 +5148,9 @@ load_configuration(const char *filename, ns_server_t *server, maps[i] = NULL; /* - * If bind.keys exists, load it. If "dnssec-lookaside auto" - * is turned on, the keys found there will be used as default - * trust anchors. + * If bind.keys exists, load it. If "dnssec-validation auto" + * is turned on, the root key found there will be used as a + * default trust anchor. */ obj = NULL; result = ns_config_get(maps, "bindkeys-file", &obj); diff --git a/bin/python/dnssec-checkds.docbook b/bin/python/dnssec-checkds.docbook index fbde7794ad..a5ef011918 100644 --- a/bin/python/dnssec-checkds.docbook +++ b/bin/python/dnssec-checkds.docbook @@ -95,9 +95,6 @@ Check for a DLV record in the specified lookaside domain, instead of checking for a DS record in the zone's parent. - For example, to check for DLV records for "example.com" - in ISC's DLV zone, use: - dnssec-checkds -l dlv.isc.org example.com diff --git a/bin/tests/system/checkconf/dnssec.3 b/bin/tests/system/checkconf/dnssec.3 index 17679bdb8c..7121fe0f77 100644 --- a/bin/tests/system/checkconf/dnssec.3 +++ b/bin/tests/system/checkconf/dnssec.3 @@ -14,8 +14,6 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec.3,v 1.5 2011/11/07 00:14:11 marka Exp $ */ - options { dnssec-validation no; }; @@ -31,8 +29,8 @@ view view2 { }; view view3 { - match-clients { none; }; - dnssec-lookaside auto; + match-clients { none; }; + dnssec-validation auto; }; view view4 { diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf index 5d66c9a836..55b9a8fc21 100644 --- a/bin/tests/system/checkconf/good.conf +++ b/bin/tests/system/checkconf/good.conf @@ -76,7 +76,6 @@ view "first" { file "xxx"; update-policy local; }; - dnssec-lookaside auto; dnssec-validation auto; zone-statistics terse; }; @@ -104,7 +103,7 @@ view "second" { 1.2.3.4; }; }; - dnssec-lookaside "." trust-anchor "dlv.isc.org."; + dnssec-lookaside "." trust-anchor "example.org."; dnssec-validation auto; zone-statistics full; }; diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in index 9495d5d62b..cb62722648 100644 --- a/bin/tests/system/conf.sh.in +++ b/bin/tests/system/conf.sh.in @@ -66,7 +66,7 @@ SAMPLEUPDATE=$TOP/lib/export/samples/sample-update # v6synth SUBDIRS="acl additional allow_query addzone autosign builtin cacheclean case chain checkconf @CHECKDS@ checknames checkzone - @COVERAGE@ database digdelv dlv dlvauto dlz dlzexternal + @COVERAGE@ database digdelv dlv dlz dlzexternal dns64 dnssec ecdsa eddsa emptyzones fetchlimit filter-aaaa formerr forward glue gost inline integrity ixfr legacy limits logfileconfig lwresd masterfile masterformat metadata diff --git a/bin/tests/system/dlvauto/clean.sh b/bin/tests/system/dlvauto/clean.sh deleted file mode 100644 index 27aa4021a7..0000000000 --- a/bin/tests/system/dlvauto/clean.sh +++ /dev/null @@ -1,27 +0,0 @@ -# Copyright (C) 2011, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") -# -# Permission to use, copy, modify, and/or distribute this software for any -# purpose with or without fee is hereby granted, provided that the above -# copyright notice and this permission notice appear in all copies. -# -# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH -# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, -# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -# PERFORMANCE OF THIS SOFTWARE. - -rm -f ns1/K* -rm -f ns1/*.signed -rm -f ns1/*.db -rm -f ns1/bind.keys -rm -f ns1/*.mkeys.jnl -rm -f ns1/*.mkeys -rm -f */named.run -rm -f */named.memstats -rm -f ns1/dsset-*. -rm -f ns2/*.mkeys -rm -f ns2/*.mkeys.jnl -rm -f dig.out.ns?.test* -rm -f ns2/named.secroots diff --git a/bin/tests/system/dlvauto/ns1/dlv.isc.org.db.in b/bin/tests/system/dlvauto/ns1/dlv.isc.org.db.in deleted file mode 100644 index d3aa56e854..0000000000 --- a/bin/tests/system/dlvauto/ns1/dlv.isc.org.db.in +++ /dev/null @@ -1,25 +0,0 @@ -; Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC") -; -; Permission to use, copy, modify, and/or distribute this software for any -; purpose with or without fee is hereby granted, provided that the above -; copyright notice and this permission notice appear in all copies. -; -; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH -; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, -; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -; PERFORMANCE OF THIS SOFTWARE. - -; $Id: dlv.isc.org.db.in,v 1.2 2011/03/01 22:44:04 marka Exp $ - -$TTL 300 -@ IN SOA a.root-servers.nil. hostmaster.isc.org. ( - 2000042100 ; serial - 600 ; refresh - 600 ; retry - 1200 ; expire - 600 ; minimum - ) -@ NS a.root-servers.nil. diff --git a/bin/tests/system/dlvauto/ns1/named.conf b/bin/tests/system/dlvauto/ns1/named.conf deleted file mode 100644 index 9d33ac90d2..0000000000 --- a/bin/tests/system/dlvauto/ns1/named.conf +++ /dev/null @@ -1,45 +0,0 @@ -/* - * Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC") - * - * Permission to use, copy, modify, and/or distribute this software for any - * purpose with or without fee is hereby granted, provided that the above - * copyright notice and this permission notice appear in all copies. - * - * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH - * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY - * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, - * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM - * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE - * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - * PERFORMANCE OF THIS SOFTWARE. - */ - -/* $Id: named.conf,v 1.2 2011/03/01 22:44:04 marka Exp $ */ - -// NS1 - -controls { /* empty */ }; - -options { - query-source address 10.53.0.1; - notify-source 10.53.0.1; - transfer-source 10.53.0.1; - port 5300; - pid-file "named.pid"; - listen-on { 10.53.0.1; }; - listen-on-v6 { none; }; - recursion no; - notify yes; - dnssec-enable yes; - dnssec-validation yes; -}; - -zone "." { - type master; - file "root.db"; -}; - -zone "dlv.isc.org" { - type master; - file "dlv.isc.org.db.signed"; -}; diff --git a/bin/tests/system/dlvauto/ns1/root.db.in b/bin/tests/system/dlvauto/ns1/root.db.in deleted file mode 100644 index f87c1440f3..0000000000 --- a/bin/tests/system/dlvauto/ns1/root.db.in +++ /dev/null @@ -1,28 +0,0 @@ -; Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC") -; -; Permission to use, copy, modify, and/or distribute this software for any -; purpose with or without fee is hereby granted, provided that the above -; copyright notice and this permission notice appear in all copies. -; -; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH -; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, -; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -; PERFORMANCE OF THIS SOFTWARE. - -; $Id: root.db.in,v 1.2 2011/03/01 22:44:04 marka Exp $ - -$TTL 300 -. IN SOA gson.nominum.com. a.root.servers.nil. ( - 2000042100 ; serial - 600 ; refresh - 600 ; retry - 1200 ; expire - 600 ; minimum - ) -. NS a.root-servers.nil. -a.root-servers.nil. A 10.53.0.1 - -dlv.isc.org. NS a.root-servers.nil. diff --git a/bin/tests/system/dlvauto/ns1/sign.sh b/bin/tests/system/dlvauto/ns1/sign.sh deleted file mode 100644 index a9f1cb3af4..0000000000 --- a/bin/tests/system/dlvauto/ns1/sign.sh +++ /dev/null @@ -1,52 +0,0 @@ -#!/bin/sh -e -# -# Copyright (C) 2011, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") -# -# Permission to use, copy, modify, and/or distribute this software for any -# purpose with or without fee is hereby granted, provided that the above -# copyright notice and this permission notice appear in all copies. -# -# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH -# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, -# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -# PERFORMANCE OF THIS SOFTWARE. - -SYSTEMTESTTOP=../.. -. $SYSTEMTESTTOP/conf.sh - -zone=dlv.isc.org -infile=dlv.isc.org.db.in -zonefile=dlv.isc.org.db - -dlvkey=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone` -cat $infile $dlvkey.key > $zonefile -$SIGNER -P -g -r $RANDFILE -o $zone $zonefile > /dev/null - -zone=. -infile=root.db.in -zonefile=root.db - -rootkey=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone` -cat $infile $rootkey.key > $zonefile -$SIGNER -P -g -r $RANDFILE -o $zone $zonefile > /dev/null - -# Create bind.keys file for the use of the resolving server -echo "managed-keys {" > bind.keys -cat $dlvkey.key | grep -v '^; ' | $PERL -n -e ' -local ($dn, $class, $type, $flags, $proto, $alg, @rest) = split; -local $key = join("", @rest); -print <> bind.keys -cat $rootkey.key | grep -v '^; ' | $PERL -n -e ' -local ($dn, $class, $type, $flags, $proto, $alg, @rest) = split; -local $key = join("", @rest); -print <> bind.keys -echo "};" >> bind.keys diff --git a/bin/tests/system/dlvauto/ns2/named.conf b/bin/tests/system/dlvauto/ns2/named.conf deleted file mode 100644 index a7b86d0160..0000000000 --- a/bin/tests/system/dlvauto/ns2/named.conf +++ /dev/null @@ -1,61 +0,0 @@ -/* - * Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC") - * - * Permission to use, copy, modify, and/or distribute this software for any - * purpose with or without fee is hereby granted, provided that the above - * copyright notice and this permission notice appear in all copies. - * - * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH - * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY - * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, - * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM - * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE - * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - * PERFORMANCE OF THIS SOFTWARE. - */ - -/* $Id: named.conf,v 1.3 2011/03/03 16:16:47 each Exp $ */ - -// NS2 - -controls { /* empty */ }; - -options { - query-source address 10.53.0.2; - notify-source 10.53.0.2; - transfer-source 10.53.0.2; - port 5300; - pid-file "named.pid"; - listen-on { 10.53.0.2; }; - listen-on-v6 { none; }; - notify no; - dnssec-enable yes; - dnssec-validation yes; - bindkeys-file "../ns1/bind.keys"; - dnssec-lookaside "auto"; -}; - -key rndc_key { - secret "1234abcd8765"; - algorithm hmac-md5; -}; - -controls { - inet 10.53.0.2 port 9953 allow { any; } keys { rndc_key; }; -}; - -view "in" { - recursion yes; - zone "." { - type hint; - file "../../common/root.hint"; - }; -}; - -view "ch" ch { - match-clients { 127.0.0.1; }; -}; - -view "unused" { - match-clients { none; }; -}; diff --git a/bin/tests/system/dlvauto/prereq.sh b/bin/tests/system/dlvauto/prereq.sh deleted file mode 100644 index 582c6ba6a7..0000000000 --- a/bin/tests/system/dlvauto/prereq.sh +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/sh -# -# Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC") -# -# Permission to use, copy, modify, and/or distribute this software for any -# purpose with or without fee is hereby granted, provided that the above -# copyright notice and this permission notice appear in all copies. -# -# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH -# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, -# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -# PERFORMANCE OF THIS SOFTWARE. - -SYSTEMTESTTOP=.. -. $SYSTEMTESTTOP/conf.sh - -exec $SHELL ../testcrypto.sh diff --git a/bin/tests/system/dlvauto/setup.sh b/bin/tests/system/dlvauto/setup.sh deleted file mode 100644 index de8e6cc9e9..0000000000 --- a/bin/tests/system/dlvauto/setup.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/sh -e -# -# Copyright (C) 2011, 2012, 2014 Internet Systems Consortium, Inc. ("ISC") -# -# Permission to use, copy, modify, and/or distribute this software for any -# purpose with or without fee is hereby granted, provided that the above -# copyright notice and this permission notice appear in all copies. -# -# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH -# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, -# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -# PERFORMANCE OF THIS SOFTWARE. - -SYSTEMTESTTOP=.. -. $SYSTEMTESTTOP/conf.sh - -$SHELL clean.sh - -test -r $RANDFILE || $GENRANDOM 400 $RANDFILE - -cd ns1 && $SHELL sign.sh diff --git a/bin/tests/system/dlvauto/tests.sh b/bin/tests/system/dlvauto/tests.sh deleted file mode 100644 index 258cca3bb4..0000000000 --- a/bin/tests/system/dlvauto/tests.sh +++ /dev/null @@ -1,66 +0,0 @@ -# Copyright (C) 2011, 2012, 2014, 2016 Internet Systems Consortium, Inc. ("ISC") -# -# Permission to use, copy, modify, and/or distribute this software for any -# purpose with or without fee is hereby granted, provided that the above -# copyright notice and this permission notice appear in all copies. -# -# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH -# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, -# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM -# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE -# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR -# PERFORMANCE OF THIS SOFTWARE. - -SYSTEMTESTTOP=.. -. $SYSTEMTESTTOP/conf.sh - -DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300" - -status=0 -n=1 - -echo "I:checking that a warning was logged about the ISC DLV service ($n)" -ret=0 -warnings=`grep "WARNING: the DLV server at 'dlv.isc.org'" ns2/named.run` -[ -z "$warnings" ] && ret=1 -if [ $ret != 0 ]; then echo "I:failed"; fi -status=`expr $status + $ret` - -# -# When this was initialy reported there was a REQUIRE failure on restarting. -# -n=`expr $n + 1` -echo "I:checking dnssec-lookaside "'"auto"'"; with views of multiple classes ($n)" -if [ -s ns2/named.pid ] -then - ret=0 - $PERL $SYSTEMTESTTOP/stop.pl . ns2 || ret=1 - sleep 1 - (cd ns2; $NAMED -g -d 100 -c named.conf >> named.run 2>&1 & ) - sleep 2 - $DIG $DIGOPTS soa . @10.53.0.2 > dig.out.ns2.test$n || ret=1 - grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1 - if [ $ret != 0 ]; then echo "I:failed"; fi - status=`expr $status + $ret` -else - echo "I:failed" - status=1 -fi - -n=`expr $n + 1` -echo "I:checking that only the DLV key was imported from bind.keys ($n)" -ret=0 -$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 secroots 2>&1 | sed 's/^/I:ns2 /' -linecount=`grep "\./RSAMD5/.* ; managed" ns2/named.secroots | wc -l` -[ "$linecount" -eq 0 ] || ret=1 -linecount=`grep "dlv.isc.org/RSAMD5/.* ; managed" ns2/named.secroots | wc -l` -[ "$linecount" -eq 2 ] || ret=1 -linecount=`cat ns2/named.secroots | wc -l` -[ "$linecount" -eq 13 ] || ret=1 -n=`expr $n + 1` -if [ $ret != 0 ]; then echo "I:failed"; fi -status=`expr $status + $ret` - -echo "I:exit status: $status" -[ $status -eq 0 ] || exit 1 diff --git a/bind.keys b/bind.keys index db22d4bc03..5e5a32ba9c 100644 --- a/bind.keys +++ b/bind.keys @@ -1,45 +1,26 @@ # The bind.keys file is used to override the built-in DNSSEC trust anchors -# which are included as part of BIND 9. As of the current release, the only -# trust anchors it contains are those for the DNS root zone ("."), and for -# the ISC DNSSEC Lookaside Validation zone ("dlv.isc.org"). Trust anchors -# for any other zones MUST be configured elsewhere; if they are configured -# here, they will not be recognized or used by named. +# which are included as part of BIND 9. The only trust anchors it contains +# are for the DNS root zone ("."). Trust anchors for any other zones MUST +# be configured elsewhere; if they are configured here, they will not be +# recognized or used by named. # # The built-in trust anchors are provided for convenience of configuration. # They are not activated within named.conf unless specifically switched on. -# To use the built-in root key, set "dnssec-validation auto;" in -# named.conf options. To use the built-in DLV key, set -# "dnssec-lookaside auto;". Without these options being set, -# the keys in this file are ignored. +# To use the built-in key, use "dnssec-validation auto;" in the +# named.conf options. Without this option being set, the keys in this +# file are ignored. # # This file is NOT expected to be user-configured. # -# These keys are current as of Feburary 2017. If any key fails to +# These keys are current as of October 2017. If any key fails to # initialize correctly, it may have expired. In that event you should # replace this file with a current version. The latest version of # bind.keys can always be obtained from ISC at https://www.isc.org/bind-keys. +# +# See https://data.iana.org/root-anchors/root-anchors.xml +# for current trust anchor information for the root zone. managed-keys { - # ISC DLV: See https://www.isc.org/solutions/dlv for details. - # - # NOTE: The ISC DLV zone is being phased out as of February 2017; - # the key will remain in place but the zone will be otherwise empty. - # Configuring "dnssec-lookaside auto;" to activate this key is - # harmless, but is no longer useful and is not recommended. - dlv.isc.org. initial-key 257 3 5 "BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2 - brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+ - 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5 - ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk - Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM - QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt - TDN0YUuWrBNh"; - - # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml - # for current trust anchor information. - # - # These keys are activated by setting "dnssec-validation auto;" - # in named.conf. - # # This key (19036) is to be phased out starting in 2017. It will # remain in the root zone for some time after its successor key # has been added. It will remain this file until it is removed from @@ -52,7 +33,7 @@ managed-keys { Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0="; - # This key (20326) is to be published in the root zone in 2017. + # This key (20326) was published in the root zone in 2017. # Servers which were already using the old key (19036) should # roll seamlessly to this new one via RFC 5011 rollover. Servers # being set up for the first time can use the contents of this diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 2ab2c3ca1d..c21172b698 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -4856,9 +4856,8 @@ badresp:1,adberr:0,findfail:0,valfail:0] The pathname of a file to override the built-in trusted keys provided by named. - See the discussion of dnssec-lookaside - and dnssec-validation for details. - If not specified, the default is + See the discussion of dnssec-validation + for details. If not specified, the default is /etc/bind.keys. @@ -5047,40 +5046,18 @@ options { record validates a DNSKEY (similarly to the way a DS record does) the DNSKEY RRset is deemed to be trusted. - - If dnssec-lookaside is set to - auto, then built-in default - values for the DLV domain and trust anchor will be - used, along with a built-in key for validation. - If dnssec-lookaside is set to no, then dnssec-lookaside is not used. - The default DLV key is stored in the file - bind.keys; - named will load that key at - startup if dnssec-lookaside is set to - auto. A copy of the file is - installed along with BIND 9, and is - current as of the release date. If the DLV key expires, a - new copy of bind.keys can be downloaded - from https://www.isc.org/solutions/dlv/. - - - (To prevent problems if bind.keys is - not found, the current key is also compiled in to - named. Relying on this is not - recommended, however, as it requires named - to be recompiled with a new key when the DLV key expires.) - - - NOTE: named only loads certain specific - keys from bind.keys: those for the - DLV zone and for the DNS root zone. The file cannot be - used to store keys for other zones. + NOTE: The ISC-provided DLV service at + dlv.isc.org, has been shut down. + The dnssec-lookaside auto; + configuration option, which set named + up to use ISC DLV with minimal configuration, has + accordingly been removed. @@ -5097,7 +5074,7 @@ options { be accepted. The specified domain must be under a trusted-keys or managed-keys statement, or - dnssec-lookaside must be active. + dnssec-validation auto must be active. @@ -6144,16 +6121,44 @@ options { Note dnssec-enable also needs to be set to yes to be effective. If set to no, DNSSEC validation - is disabled. If set to auto, - DNSSEC validation is enabled, and a default - trust-anchor for the DNS root zone is used. If set to - yes, DNSSEC validation is enabled, - but a trust anchor must be manually configured using - a trusted-keys or - managed-keys statement. The default + is disabled. + + + If set to auto, DNSSEC validation + is enabled, and a default trust anchor for the DNS root + zone is used. If set to yes, + DNSSEC validation is enabled, but a trust anchor must be + manually configured using a trusted-keys + or managed-keys statement. The default is yes. + + The default root trust anchor is stored in the file + bind.keys. + named will load that key at + startup if dnssec-validation is + set to auto. A copy of the file is + installed along with BIND 9, and is current as of the + release date. If the root key expires, a new copy of + bind.keys can be downloaded + from https://www.isc.org/bind-keys. + + + To prevent problems if bind.keys is + not found, the current trust anchor is also compiled in + to named. Relying on this is not + recommended, however, as it requires named + to be recompiled with a new key when the root key expires.) + + + named only + loads the root key from bind.keys. + The file cannot be used to store keys for other zones. + The root key in bind.keys is ignored + if dnssec-validation auto is not in + use. + Whenever the resolver sends out queries to an EDNS-compliant server, it always sets the DO bit @@ -10129,15 +10134,13 @@ ns.domain.com.rpz-nsdname CNAME . If the dnssec-validation option is set to auto, named will automatically initialize a managed key for the - root zone. Similarly, if the dnssec-lookaside - option is set to auto, - named will automatically initialize - a managed key for the zone dlv.isc.org. - (Note: The ISC DLV service is expected to cease operation by - the end of 2017.) In both cases, the key that is used to - initialize the key maintenance process is built into - named, and can be overridden from - bindkeys-file. + root zone. The key that is used to initialize the key + maintenance process is stored in bind.keys; + the location of this file can be overridden with the + bindkeys-file option. As a fallback + in the event no bind.keys can be + found, the initializing key is also compiled directly + into named. diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml index 4b1131cfd8..dd0d929984 100644 --- a/doc/arm/notes.xml +++ b/doc/arm/notes.xml @@ -126,6 +126,15 @@
Feature Changes + + + The ISC DNSSEC Lookaside Validation (DLV) service has been shut + down; all DLV records in the dlv.isc.org zone have been removed. + References to the service have been removed from BIND documentation. + The DLV key has been removed from bind.keys. + [RT #46155] + + Threads in named are now set to human-readable diff --git a/lib/bind9/check.c b/lib/bind9/check.c index 3339258f1a..346764e103 100644 --- a/lib/bind9/check.c +++ b/lib/bind9/check.c @@ -49,6 +49,20 @@ #include +#define INITNAME(A,B) { \ + DNS_NAME_MAGIC, \ + A, sizeof(A), sizeof(B), \ + DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE, \ + B, NULL, { (void *)-1, (void *)-1}, \ + {NULL, NULL} \ +} + +static unsigned char dlviscorg_ndata[] = "\003dlv\003isc\003org"; +static unsigned char dlviscorg_offsets[] = { 0, 4, 8, 12 }; + +static const dns_name_t dlviscorg = + INITNAME(dlviscorg_ndata, dlviscorg_offsets); + static isc_result_t fileexist(const cfg_obj_t *obj, isc_symtab_t *symtab, isc_boolean_t writeable, isc_log_t *logctxlogc); @@ -1005,9 +1019,16 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx, * is missing, skip remaining tests */ if (cfg_obj_isvoid(anchor)) { - if (!strcasecmp(dlv, "no") || - !strcasecmp(dlv, "auto")) + if (!strcasecmp(dlv, "no")) { continue; + } + if (!strcasecmp(dlv, "auto")) { + cfg_obj_log(obj, logctx, + ISC_LOG_WARNING, + "dnssec-lookaside 'auto' " + "is no longer supported"); + continue; + } } tresult = dns_name_fromstring(name, dlv, 0, NULL); @@ -1020,7 +1041,7 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx, if (symtab != NULL) { tresult = nameexist(obj, dlv, 1, symtab, "dnssec-lookaside '%s': " - "already exists previous " + "already exists; previous " "definition: %s:%u", logctx, mctx); if (tresult != ISC_R_SUCCESS && @@ -1040,23 +1061,30 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx, result = ISC_R_FAILURE; } - if (!cfg_obj_isvoid(anchor)) { - dlv = cfg_obj_asstring(anchor); - tresult = check_name(dlv); - if (tresult != ISC_R_SUCCESS) { - cfg_obj_log(obj, logctx, ISC_LOG_ERROR, - "bad domain name '%s'", - dlv); - if (result == ISC_R_SUCCESS) - result = tresult; - } - } else { + if (cfg_obj_isvoid(anchor)) { cfg_obj_log(obj, logctx, ISC_LOG_ERROR, - "dnssec-lookaside requires " - "either 'auto' or 'no', or a " - "domain and trust anchor"); + "dnssec-lookaside requires " + "either or 'no' or a " + "domain and trust anchor"); if (result == ISC_R_SUCCESS) result = ISC_R_FAILURE; + continue; + } + + dlv = cfg_obj_asstring(anchor); + tresult = dns_name_fromstring(name, dlv, 0, NULL); + if (tresult != ISC_R_SUCCESS) { + cfg_obj_log(anchor, logctx, ISC_LOG_ERROR, + "bad domain name '%s'", dlv); + if (result == ISC_R_SUCCESS) + result = tresult; + continue; + } + if (dns_name_equal(&dlviscorg, name)) { + cfg_obj_log(anchor, logctx, ISC_LOG_WARNING, + "dlv.isc.org has been shut down: " + "dnssec-lookaside ignored"); + continue; } } diff --git a/util/copyrights b/util/copyrights index 51115f34dd..5334cf2456 100644 --- a/util/copyrights +++ b/util/copyrights @@ -1080,15 +1080,6 @@ ./bin/tests/system/dlv/prereq.sh SH 2014 ./bin/tests/system/dlv/setup.sh SH 2004,2007,2009,2011,2012,2014 ./bin/tests/system/dlv/tests.sh SH 2004,2007,2010,2011,2012,2016 -./bin/tests/system/dlvauto/clean.sh SH 2011,2012,2014 -./bin/tests/system/dlvauto/ns1/dlv.isc.org.db.in ZONE 2011 -./bin/tests/system/dlvauto/ns1/named.conf CONF-C 2011 -./bin/tests/system/dlvauto/ns1/root.db.in ZONE 2011 -./bin/tests/system/dlvauto/ns1/sign.sh SH 2011,2012,2014 -./bin/tests/system/dlvauto/ns2/named.conf CONF-C 2011 -./bin/tests/system/dlvauto/prereq.sh SH 2014 -./bin/tests/system/dlvauto/setup.sh SH 2011,2012,2014 -./bin/tests/system/dlvauto/tests.sh SH 2011,2012,2014,2016 ./bin/tests/system/dlz/.gitignore X 2012 ./bin/tests/system/dlz/clean.sh SH 2010,2012 ./bin/tests/system/dlz/ns1/dns-root/com/broken/dns.d/@/DNAME=10=example.net.= TXT.BRIEF 2015