From 3b310d6b4f8063149d1abe823b64bc9796a97ab2 Mon Sep 17 00:00:00 2001
From: Martin Basti <mbasti@redhat.com>
Date: Jul 02 2014 16:41:57 +0000
Subject: DNSSEC: Add experimental support for DNSSEC


Ticket: https://fedorahosted.org/freeipa/ticket/4408
Reviewed-By: Petr Spacek <pspacek@redhat.com>

---

diff --git a/install/share/bind.named.conf.template b/install/share/bind.named.conf.template
index 0984feb..6db1712 100644
--- a/install/share/bind.named.conf.template
+++ b/install/share/bind.named.conf.template
@@ -16,6 +16,8 @@ options {
 
 	tkey-gssapi-keytab "/etc/named.keytab";
 	pid-file "/run/named/named.pid";
+
+	dnssec-enable yes;
 };
 
 /* If you want to enable debugging, eg. using the 'rndc trace' command,
diff --git a/install/tools/ipa-upgradeconfig b/install/tools/ipa-upgradeconfig
index 622c92d..2fecc14 100644
--- a/install/tools/ipa-upgradeconfig
+++ b/install/tools/ipa-upgradeconfig
@@ -594,6 +594,26 @@ def named_update_pid_file():
     sysupgrade.set_upgrade_state('named.conf', 'pid-file_updated', True)
     return True
 
+def named_enable_dnssec():
+    """
+    Enable dnssec in named.conf
+    """
+    if not sysupgrade.get_upgrade_state('named.conf', 'dnssec_enabled'):
+        root_logger.info('[Enabling "dnssec-enable" configuration in DNS]')
+        try:
+            bindinstance.named_conf_set_directive('dnssec-enable', 'yes',
+                                                  bindinstance.NAMED_SECTION_OPTIONS,
+                                                  str_val=False)
+        except IOError, e:
+            root_logger.error('Cannot update dnssec-enable configuration in %s: %s',
+                    bindinstance.NAMED_CONF, e)
+            return False
+    else:
+        root_logger.debug('dnssec-enabled in %s' % bindinstance.NAMED_CONF)
+
+    sysupgrade.set_upgrade_state('named.conf', 'dnssec_enabled', True)
+    return True
+
 
 def certificate_renewal_update(ca):
     """
@@ -1129,6 +1149,7 @@ def main():
                           named_enable_serial_autoincrement(),
                           named_update_gssapi_configuration(),
                           named_update_pid_file(),
+                          named_enable_dnssec(),
                          )
 
     if any(named_conf_changes):