Commit graph

1714 commits

Author SHA1 Message Date
Evan Hunt
2a184ff865 [master] accept >4g max-{,a}cache-size
3506.	[func]		When setting "max-cache-size" and "max-acache-size",
			the keyword "unlimited" is no longer defined as equal
			to 4 gigabytes (except on 32-bit platforms); it
			means literally unlimited. [RT #32358]

3505.	[bug]		When setting "max-cache-size" and "max-acache-size",
			larger values than 4 gigabytes could not be set
			explicitly, though larger sizes were available
			when setting cache size to 0. This has been
			corrected; the full range is now available.
			[RT #32358]
2013-02-28 09:29:12 -08:00
Evan Hunt
501941f0b6 [master] add geoip support
3504.	[func]		Add support for ACLs based on geographic location,
			using MaxMind GeoIP databases. Based on code
			contributed by Ken Brownfield <kb@slide.com>.
			[RT #30681]
2013-02-27 17:19:39 -08:00
Evan Hunt
40a7e85f3e [master] better zone-statistics syntax
3501.	[func]		zone-statistics now takes three options: full,
			terse, and none. "yes" and "no" are retained as
			synonyms for full and terse, respectively. [RT #29165]
2013-02-27 11:53:58 -08:00
Mark Andrews
609b8d0817 update copyrights 2013-02-27 12:27:58 +11:00
Tinderbox User
f97d56e757 update copyright notice 2013-02-25 23:46:03 +00:00
Evan Hunt
94315060c2 [master] RPZ speedup (phase 2, multiple RPZ's)
3495.	[func]		Support multiple response-policy zones, while
			improving RPZ performance. [RT #32476]
2013-02-25 12:46:51 -08:00
Evan Hunt
55e5c51e66 [master] DNS RRL
3494.	[func]		DNS RRL: Blunt the impact of DNS reflection and
			amplification attacks by rate-limiting substantially-
			identical responses. [RT #28130]
2013-02-25 12:45:56 -08:00
Evan Hunt
df925e6c66 [master] add zone memory context pools
3492.	[bug]		Fixed a regression in zone loading performance
			due to lock contention. [RT #30399]
2013-02-20 21:39:05 -08:00
Tinderbox User
17131a9459 update copyright notice 2013-01-25 23:45:56 +00:00
Evan Hunt
c9611b4573 [master] change "fast" to "map"
3475.	[cleanup]	Changed name of 'map' zone file format (previously
			'fast'). [RT #32458]
2013-01-24 14:20:48 -08:00
Tinderbox User
b95504f9a7 update copyright notice 2013-01-22 23:45:48 +00:00
Evan Hunt
cbd1fa092e [master] DLZ fixes
- handle malformed answers from DLZ better:
 - handle dlz_lookup errors better:
   when the first lookup of a name returns an unexpected failure code,
   we return it to the caller rather than continuing on to look up
   the wildcard. we now only continue processing if the return from
   the first lookup was either ISC_R_SUCCESS or ISC_R_NOTFOUND.

 - improved backward-compatibility for dlz_version:
   added a DLZ_DLOPEN_AGE value indicating how many versions
   back from the current DLZ_DLOPEN_VERSION named will support
2013-01-22 15:13:08 -08:00
Tinderbox User
dc3d68d6fe update copyright notice 2013-01-11 23:46:02 +00:00
Mark Andrews
c8bfcec3c9 silence compiler warning 2013-01-11 17:38:58 +11:00
Tinderbox User
5c6b95ba1b update copyright notice 2013-01-10 23:46:00 +00:00
Mark Andrews
4801931443 3461. [bug] Negative responses could incorrectly have AD=1
set. [RT #32237]
2013-01-10 23:09:08 +11:00
Tinderbox User
6fe42ff85c update copyright notice 2013-01-04 23:45:53 +00:00
Mark Andrews
8bd5bcd2a7 3445. [bug] Warn about zone files with blank owner names
immediately after $ORIGIN directives. [RT #31848]

Conflicts:
	lib/dns/tests/master_test.c
2013-01-04 12:16:55 +11:00
Tinderbox User
9191b6c9e8 update copyright notice 2012-12-20 23:45:48 +00:00
Evan Hunt
3ad3e9c948 [master] reject $ORIGIN before inherited name
3445.	[bug]		Reject zone files with blank owner names immediately
			after $ORIGIN directives. [RT #31848]
2012-12-18 16:17:55 -08:00
Tinderbox User
b16174507d update copyright notice 2012-12-18 23:45:50 +00:00
Mark Andrews
8462dfb880 3443. [bug] The NOQNAME proof was not being returned from cached
insecure responses. [RT #21409]
2012-12-19 09:55:02 +11:00
Mark Andrews
e85702ce5b 3438. [bug] Don't accept unknown data escape in quotes. [RT #32031]
Squashed commit of the following:

commit 7ad3daade513c94a1c92ee7c91c112f161d13ef4
Author: Mark Andrews <marka@isc.org>
Date:   Mon Dec 3 15:03:44 2012 +1100

    look at the second token to determine if a TXT record in of unknown format or not

commit 7df32138462646f6aee84ffa56d02ac24ec8d672
Author: Mark Andrews <marka@isc.org>
Date:   Mon Dec 3 12:42:18 2012 +1100

    '"\#"' was incorrectly being treated as a unknown data escape sequence.
2012-12-08 14:05:32 +11:00
Evan Hunt
abff0f462a [master] pass client info to DLZ findzone method
3434.   [bug]           Pass client info to the DLZ findzone() entry
                        point in addition to lookup().  This makes it
                        possible for a database to answer differently
                        whether it's authoritative for a name depending
                        on the address of the client.  [RT #31775]
2012-12-06 12:59:36 -08:00
Evan Hunt
2b8bed6681 [master] multiple-dlz/dlz-nxdomain
3432.	[func]		Multiple DLZ databases can now be configured.
			DLZ databases are searched in the order configured,
			unless set to "search no", in which case a
			zone can be configured to be retrieved from a
			particular DLZ database by using a "dlz <name>"
			option in the zone statement.  DLZ databases can
			support type "master" and "redirect" zones.
			[RT #27597]
2012-12-06 12:39:52 -08:00
ckb
aecadaf3b1 3418. [func] New XML schema (version 3.0) for the statistics channel
adds query type statistics at the zone level, and
			flattens the XML tree and uses compressed format to
			optimize parsing. Includes new XSL that permits
			charting via the Google Charts API on browsers that
			support javascript in XSL.  The old XML schema has been
			deprecated. [RT #30023]

3417.	[placeholder]
2012-11-14 12:44:15 -06:00
Mark Andrews
bbf31e6b62 More coverity fixes:
3410.   [bug]           Addressed Coverity warnings. [RT #31626]
Squashed commit of the following:

commit 6fec07bbb69ead784063052f2099674f8b52c6b3
Author: Mark Andrews <marka@isc.org>
Date:   Tue Oct 30 18:14:35 2012 +1100

    use strl{cat,cpy}

commit 19a5d3766f3dbc8a2944b21640a8226a89aae7ba
Author: Mark Andrews <marka@isc.org>
Date:   Tue Oct 30 14:38:55 2012 +1100

    address unchecked xmlTextWriter* calls
2012-11-01 10:22:11 +11:00
Evan Hunt
0e37e9e3d7 [master] silence noisy OpenSSL logging
3402.	[bug]		Correct interface numbers for IPv4 and IPv6 interfaces.
2012-10-24 12:58:16 -07:00
Mark Andrews
71dfdcbfae 3392. [func] Keep statistics on REFUSED responses. [RT #31412] 2012-10-16 10:21:22 +11:00
Tinderbox User
15c7a1bf20 update copyright notice 2012-10-06 23:46:11 +00:00
Mark Andrews
611dc88768 3390. [bug] Silence clang compiler warnings. [RT #30417] 2012-10-06 14:20:45 +10:00
Mark Andrews
14889e7b17 add <dns/dsdigest.h> to the list of header files to be installed 2012-10-05 15:10:50 +10:00
Mark Andrews
02bbbc26be lib/dns/include/dns/dsdigest.h 2012-10-03 14:47:30 +10:00
Mark Andrews
058e44186b 3387. [func] Support for a DS digest can be disabled at
runtime with disable-ds-digests. [RT #21581]
2012-10-03 12:38:43 +10:00
Tinderbox User
72de8965c8 update copyright notice 2012-08-21 23:46:02 +00:00
Mark Andrews
8f7e0e25a5 3368. [bug] <dns/iptable.h>, <dns/private.h> and <dns/zone.h>
where not C++ safe.
2012-08-21 16:42:19 +10:00
Tinderbox User
0c156cfa39 update copyright notice 2012-08-17 23:46:06 +00:00
Mark Andrews
1bbd36c4db 3364. [security] Named could die on specially crafted record.
[RT #30416]
2012-08-16 09:42:14 +10:00
Tinderbox User
953692fa1e update copyright notice 2012-07-25 23:46:04 +00:00
ckb
e7857b5ee0 3356. [bug] Cap the TTL of signed RRsets when RRSIGs are
approaching their expiry, so they don't remain
			in caches after expiry. [RT #26429]
2012-07-25 17:06:34 -05:00
Tinderbox User
0b637179cc update copyright notice 2012-07-23 23:46:06 +00:00
Mark Andrews
6eb6af6732 3354. [func] Improve OpenSSL error logging. [RT #29932] 2012-07-23 15:08:21 +10:00
Tinderbox User
a3128c1995 update copyright notice 2012-06-29 23:45:57 +00:00
Mark Andrews
bf8267aa45 reverse bad copyright update 2012-06-29 11:39:47 +10:00
Tinderbox User
247bf37860 update copyright notice 2012-06-29 01:22:18 +00:00
Tinderbox User
da5d53fb14 update copyright notice 2012-06-26 23:45:56 +00:00
Mark Andrews
ad127d839d 3341. [func] New "dnssec-verify" command checks a signed zone
to ensure correctness of signatures and of NSEC/NSEC3
                        chains. [RT #23673]
2012-06-25 13:57:32 +10:00
Mark Andrews
171d2c23f1 remove 'inline' on dns_rbt_serialize_align 2012-06-25 08:14:34 +10:00
Tinderbox User
3b398443f0 update copyright notice 2012-06-21 23:46:36 +00:00
Tinderbox User
620620df3a silence pointer/int conversion warnings using uintptr_t, since we are using stdio file offsets are longs 2012-06-22 07:37:09 +10:00