From d5ebc757a6e38c9275ee298b05a526f6e9469be2 Mon Sep 17 00:00:00 2001 From: Evan Hunt Date: Wed, 4 May 2016 14:28:36 -0700 Subject: [PATCH] [v9_9] log message when using ISC DLV 4352. [cleanup] The ISC DNSSEC Lookaside Validation (DLV) service is scheduled to be disabled in 2017. A warning is now logged when named is configured to use it, either explicitly or via "dnssec-lookaside auto;" [RT #42207] --- CHANGES | 6 ++++++ bin/named/server.c | 22 +++++++++++++++++++--- bin/tests/system/dlvauto/tests.sh | 10 ++++++++-- doc/arm/notes.xml | 9 +++++++++ 4 files changed, 42 insertions(+), 5 deletions(-) diff --git a/CHANGES b/CHANGES index aa28010043..cf5f1de407 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,9 @@ +4352. [cleanup] The ISC DNSSEC Lookaside Validation (DLV) service + is scheduled to be disabled in 2017. A warning is + now logged when named is configured to use it, + either explicitly or via "dnssec-lookaside auto;" + [RT #42207] + 4351. [bug] 'dig +noignore' didn't work. [RT #42273] 4348. [cleanup] Refactor dnssec-coverage and dnssec-checkds diff --git a/bin/named/server.c b/bin/named/server.c index e6a1651f22..9872855f9f 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -2096,6 +2096,7 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, const cfg_obj_t *alternates; const cfg_obj_t *zonelist; const cfg_obj_t *dlz; + const cfg_obj_t *dlvobj = NULL; unsigned int dlzargc; char **dlzargv; const cfg_obj_t *disabled; @@ -3288,7 +3289,6 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, result = ns_config_get(optionmaps, "dnssec-lookaside", &obj); if (result == ISC_R_SUCCESS) { /* If set to "auto", use the version from the defaults */ - const cfg_obj_t *dlvobj; const char *dom; dlvobj = cfg_listelt_value(cfg_list_first(obj)); dom = cfg_obj_asstring(cfg_tuple_get(dlvobj, "domain")); @@ -3306,18 +3306,34 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig, } if (result == ISC_R_SUCCESS) { + dns_name_t *dlv, *iscdlv; + dns_fixedname_t f; + dns_fixedname_init(&f); + + iscdlv = dns_fixedname_name(&f); + CHECK(dns_name_fromstring(iscdlv, "dlv.isc.org", 0, NULL)); + for (element = cfg_list_first(obj); element != NULL; element = cfg_list_next(element)) { - dns_name_t *dlv; - obj = cfg_listelt_value(element); obj = cfg_tuple_get(obj, "trust-anchor"); + dlv = dns_fixedname_name(&view->dlv_fixed); CHECK(dns_name_fromstring(dlv, cfg_obj_asstring(obj), DNS_NAME_DOWNCASE, NULL)); view->dlv = dns_fixedname_name(&view->dlv_fixed); + + if (dns_name_equal(view->dlv, iscdlv)) { + if (auto_dlv) + obj = dlvobj; + cfg_obj_log(obj, ns_g_lctx, ISC_LOG_WARNING, + "WARNING: the DLV server at " + "'dlv.isc.org' is expected to " + "cease operation by the end " + "of 2017"); + } } } else view->dlv = NULL; diff --git a/bin/tests/system/dlvauto/tests.sh b/bin/tests/system/dlvauto/tests.sh index a6866980df..59b486a8ca 100644 --- a/bin/tests/system/dlvauto/tests.sh +++ b/bin/tests/system/dlvauto/tests.sh @@ -12,8 +12,6 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: tests.sh,v 1.3 2011/03/03 16:16:46 each Exp $ - SYSTEMTESTTOP=.. . $SYSTEMTESTTOP/conf.sh @@ -22,9 +20,17 @@ DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300" status=0 n=1 +echo "I:checking that a warning was logged about the ISC DLV service ($n)" +ret=0 +warnings=`grep "WARNING: the DLV server at 'dlv.isc.org'" ns2/named.run` +[ -z "$warnings" ] && ret=1 +if [ $ret != 0 ]; then echo "I:failed"; fi +status=`expr $status + $ret` + # # When this was initialy reported there was a REQUIRE failure on restarting. # +n=`expr $n + 1` echo "I:checking dnssec-lookaside "'"auto"'"; with views of multiple classes ($n)" if [ -s ns2/named.pid ] then diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml index 01b779e455..3c9730bda9 100644 --- a/doc/arm/notes.xml +++ b/doc/arm/notes.xml @@ -121,6 +121,15 @@
Feature Changes + + + The ISC DNSSEC Lookaside Validation (DLV) service is scheduled + to be disabled in 2017. A warning is now logged when + named is configured to use this service, + either explicitly or via . + [RT #42207] + + Updated the compiled-in addresses for H.ROOT-SERVERS.NET