mirror of
https://github.com/isc-projects/bind9.git
synced 2026-03-02 05:20:33 -05:00
bbfdcc36c8
Add an option to enable/disable inline-signing inside the
dnssec-policy clause. The existing inline-signing option that is
set in the zone clause takes priority, but if it is omitted, then the
value that is set in dnssec-policy is taken.
The built-in policies use inline-signing.
This means that if you want to use the default policy without
inline-signing you either have to set it explicitly in the zone
clause:
zone "example" {
...
dnssec-policy default;
inline-signing no;
};
Or create a new policy, only overriding the inline-signing option:
dnssec-policy "default-dynamic" {
inline-signing no;
};
zone "example" {
...
dnssec-policy default-dynamic;
};
This also means that if you are going insecure with a dynamic zone,
the built-in "insecure" policy needs to be accompanied with
"inline-signing no;".
|
||
|---|---|---|
| .. | ||
| include | ||
| .gitignore | ||
| bind9.xsl | ||
| builtin.c | ||
| config.c | ||
| control.c | ||
| controlconf.c | ||
| dlz_dlopen_driver.c | ||
| fuzz.c | ||
| geoip.c | ||
| log.c | ||
| logconf.c | ||
| main.c | ||
| Makefile.am | ||
| named.conf.rst | ||
| named.rst | ||
| os.c | ||
| server.c | ||
| statschannel.c | ||
| tkeyconf.c | ||
| transportconf.c | ||
| tsigconf.c | ||
| xsl_p.h | ||
| zoneconf.c | ||