- Fix #1535: [FR] refuse validator configuration without any trust anchor.

Better documentation and warning message.

doc/example.conf.in

@@ -672,6 +672,7 @@ server:
 	# most modules have to be listed at the beginning of the line,
 	# except cachedb(just before iterator), and python (at the beginning,
 	# or, just before the iterator).
+	# Note that validator needs configured trust-anchors to be of any use.
 	# module-config: "validator iterator"
 
 	# File with trusted keys, kept up-to-date using RFC5011 probes,

doc/unbound.conf.rst

@@ -2171,11 +2171,12 @@ These options are part of the ``server:`` section.
         The ordering of the modules is significant, the order decides the order
         of processing.
 
-    Setting this to just "iterator" will result in a non-validating server.
-    Setting this to "validator iterator" will turn on DNSSEC validation.
+    Setting this to just ``"iterator"`` results in a non-validating server.
+    Setting this to ``"validator iterator"`` (default) enables the DNSSEC
+    validator module but not DNSSEC validation.
 
     .. note::
-        You must also set trust-anchors for validation to be useful.
+        To turn on DNSSEC validation you must configure trust-anchors.
 
     Adding ``respip`` to the front will cause RPZ processing to be done on all
     queries.

validator/validator.c

@@ -231,6 +231,7 @@ val_init(struct module_env* env, int id)
 {
 	struct val_env* val_env = (struct val_env*)calloc(1,
 		sizeof(struct val_env));
+	struct trust_anchor* anchor = NULL;
 	if(!val_env) {
 		log_err("malloc failure");
 		return 0;
@@ -247,16 +248,21 @@ val_init(struct module_env* env, int id)
 		log_err("validator: could not apply configuration settings.");
 		return 0;
 	}
-	if(env->cfg->disable_edns_do) {
-		struct trust_anchor* anchor = anchors_find_any_noninsecure(
-			env->anchors);
-		if(anchor) {
+
+	anchor = anchors_find_any_noninsecure(env->anchors);
+	if(anchor) {
+		if(env->cfg->disable_edns_do) {
 			char b[LDNS_MAX_DOMAINLEN];
 			dname_str(anchor->name, b);
 			log_warn("validator: disable-edns-do is enabled, but there is a trust anchor for '%s'. Since DNSSEC could not work, the disable-edns-do setting is turned off. Continuing without it.", b);
-			lock_basic_unlock(&anchor->lock);
 			env->cfg->disable_edns_do = 0;
 		}
+		lock_basic_unlock(&anchor->lock);
+	} else {
+		log_warn("validator: no configured DNSSEC trust anchors. "
+			"DNSSEC validation is effectively DISABLED. Either "
+			"configure a trust anchor or remove the validator "
+			"from module-config.");
 	}
 
 	return 1;