upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-02-26 11:32:01 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions
26645 commits 18 branches 854 tags 440 MiB
Commit graph

8425 commits

Author SHA1 Message Date
Tinderbox User
ffac31097d update copyright notice / whitespace 2018-01-30 23:45:59 +00:00
Mark Andrews
a2c693ab3b handle different eol coventions 2018-01-31 10:05:40 +11:00
Mark Andrews
d26f90241d 4880. [bug] Named wasn't returning the target of a cross zone 
CNAME between to served zones when recursion was
                        desired and available (RD=1, RA=1). Don't return
                        the CNAME target otherwise to prevent accidental
                        cache poisoning. [RT #47078]
 2018-01-30 13:10:06 +11:00
Tinderbox User
a96d7083bc update copyright notice / whitespace 2018-01-29 23:45:56 +00:00
Mark Andrews
8d1b3f5e6a dns_dnssec_findmatchingkeys warning test requires crytpo to be supported 2018-01-29 16:35:56 +11:00
Mark Andrews
6e08af82ed 4878. [bug] List 'ply' as a requirement for the 'isc' python 
package. [RT #47065]
 2018-01-29 13:21:33 +11:00
Tinderbox User
a7bc00e413 regen master 2018-01-26 01:10:11 +00:00
Tinderbox User
5399337474 update copyright notice / whitespace 2018-01-25 23:46:24 +00:00
Evan Hunt
cbd46e23cb [master] clarify dnssec-cds man page 2018-01-25 10:21:24 -08:00
Tinderbox User
6b83f7aa82 regen master 2018-01-23 00:38:08 +00:00
Tinderbox User
3fda67b596 update copyright notice / whitespace 2018-01-22 23:46:02 +00:00
Evan Hunt
129c4414cb [master] automatically generate named.conf grammars for the ARM 
4873.	[doc]		Grammars for named.conf included in the ARM are now
			automatically generated by the configuration parser
			itself.  As a side effect of the work needed to
			separate zone type grammars from each other, this
			also makes checking of zone statements in
			named-checkconf more correct and consistent.
			[RT #36957]
 2018-01-22 11:06:32 -08:00
Mukund Sivaraman
8a4ce20172 Don't permit loading meta RR types such as TKEY from master files (#47009) 2018-01-22 14:26:04 +05:30
Tinderbox User
630d1a9ba0 regen master 2018-01-20 01:10:44 +00:00
Tinderbox User
19b7c0494e update copyright notice / whitespace 2018-01-19 23:45:58 +00:00
Evan Hunt
80788e72d0 [master] remove HMAC support from dnssec-keygen 
4868.	[func]		dnssec-keygen can no longer generate HMAC keys.
			Use tsig-keygen instead. [RT #46404]
 2018-01-18 17:29:28 -08:00
Tinderbox User
f10a1c0acf regen master 2018-01-19 01:08:25 +00:00
Tinderbox User
5e9585c8ad update copyright notice / whitespace 2018-01-18 23:46:05 +00:00
Evan Hunt
cf8f4241e7 [master] normalize rndc on/off commands 
4867.	[cleanup]	Normalize rndc on/off commands (validation,
			querylog, serve-stale) so they all accept the
			same synonyms for on/off (yes/no, true/false,
			enable/disable). Thanks to Tony Finch. [RT #47022]
 2018-01-18 10:50:13 -08:00
Tinderbox User
8b8c2990d6 update copyright notice / whitespace 2018-01-17 23:45:56 +00:00
Francis Dupont
1f33a98962 Applied #46125 fix (hardcoded "pkcs11") 2018-01-17 15:19:31 +01:00
Tinderbox User
ed9fea3a6e update copyright notice / whitespace 2018-01-15 23:46:16 +00:00
Michał Kępień
ae51a676c9 [master] Ensure all master definitions in a catalog zone contain an IP address 
4864.	[bug]		named acting as a slave for a catalog zone crashed if
			the latter contained a master definition without an IP
			address. [RT #45999]
 2018-01-15 20:50:09 +01:00
Tinderbox User
6d1f45ed81 update copyright notice / whitespace 2018-01-13 23:46:00 +00:00
Mark Andrews
69c4c987f6 ret was not being set to 1 on dig error. [RT #46990] 2018-01-13 13:14:42 +11:00
Tinderbox User
47f617f8b2 update copyright notice / whitespace 2018-01-08 23:45:54 +00:00
Mark Andrews
3a4ea455ed add ns5/ 2018-01-08 16:28:04 +11:00
Mark Andrews
02d3f1e855 write nextpart to disk so that it is available when tests fail 2018-01-08 16:20:38 +11:00
Mark Andrews
eed2f6cef0 4857. [bug] Maintain attach/detach semantics for event->db, 
event->node, event->rdataset and event->sigrdataset
                        in query.c. [RT #46891]
 2018-01-04 10:48:18 +11:00
Tinderbox User
a280a7871d update copyright notice / whitespace 2018-01-03 23:45:29 +00:00
Mark Andrews
0b27aa0712 4856. [bug] 'rndc zonestatus' reported the wrong underlying type 
for a inline slave zone. [RT #46875]
 2018-01-04 10:10:05 +11:00
Mark Andrews
4674127443 wait for status: line to be readable, before checking status 2018-01-03 13:54:26 +11:00
Mark Andrews
9bec7facfb 4850. [bug] Named failed to restart with multiple added zones in 
lmdb database. [RT #46889]
 2017-12-27 16:24:33 +11:00
Mark Andrews
f5d429e7c3 save why ydump.py failed 2017-12-22 16:02:39 +11:00
Mark Andrews
f933be6d45 silence clang static analysis 2017-12-22 13:08:39 +11:00
Mark Andrews
be5a0eaa7a add POST(argc); 2017-12-22 08:48:38 +11:00
Mark Andrews
d11ada1376 add POST(argv); and POST(argc); 2017-12-22 08:43:49 +11:00
Tinderbox User
dcc059e2c9 update copyright notice / whitespace 2017-12-20 23:45:50 +00:00
Mark Andrews
2d7f89b9c7 4849. [bug] Duplicate zones could appear in the .nzf file if 
addzone failed. [RT #46435]
 2017-12-20 17:13:58 +11:00
Tinderbox User
5637645847 update copyright notice / whitespace 2017-12-15 23:45:36 +00:00
Evan Hunt
6b2e5cd28c [master] fixed ixfr-from-difference error in previous commit 2017-12-15 10:01:07 -08:00
Evan Hunt
79c2400d91 [master] allow primary/secondary as synonyms for master/slave 
4848.	[func]		Zone types "primary" and "secondary" can now be used
			as synonyms for "master" and "slave" in named.conf.
			[RT #46713]
 2017-12-15 01:47:05 -08:00
Tinderbox User
a6e307c5f1 update copyright notice / whitespace 2017-12-13 23:45:37 +00:00
Mark Andrews
9bad78cbc2 test for key != NULL on error path 2017-12-13 15:11:22 +11:00
Mark Andrews
4d1bbe308d 4847. [bug] dnssec-dnskey-kskonly was not being honoured for 
CDS and CDNSKEY. [RT #46755]
 2017-12-13 12:40:36 +11:00
Mark Andrews
c67180f09b 4846. [test] Adjust timing values in runtime system test. Address 
named.pid removal races in runtime system test.
                        [RT #46800]
 2017-12-13 10:20:09 +11:00
Mark Andrews
940449fc72 4845. [bug] Dig (non iOS) should exit on malformed names. 
[RT #46806]
 2017-12-12 13:43:55 +11:00
Mark Andrews
e5c2cfdbf9 increment test number 2017-12-08 14:48:31 +11:00
Mark Andrews
8444b4856a 4843. [bug] dnssec-signzone free hashlist on exit. [RT #46791] 2017-12-07 19:29:21 +11:00
Mark Andrews
9d5a0abe81 4841. [bug] Address -fsanitize=undefined warnings. [RT #46786] 2017-12-06 21:00:14 +11:00
Mark Andrews
a89f416017 remove autosign/ns3/inacksk3.example.db 2017-12-06 20:39:42 +11:00
Mark Andrews
32d09cd7e0 4840. [test] Add tests to cover fallback to using ZSK on inactive 
KSK. [RT #46787]
 2017-12-06 20:26:43 +11:00
Curtis Blackburn
c7f663ca80 clarify "stage 1" and "stage 2" in autosign test 2017-12-05 09:59:21 -08:00
Mark Andrews
ecafa2ae50 set the DNSKEY deletion time to now+5 once we got all the zones into their initial state 2017-12-05 21:38:28 +11:00
Mark Andrews
00f5ea91cf 4839. [bug] zone.c:zone_sign was not properly determining 
if there were active KSK and ZSK keys for
                        a algorithm when update-check-ksk is true
                        (default) leaving records unsigned with one or
                        more DNSKEY algorithms. [RT #46774]
 2017-12-05 16:09:47 +11:00
Evan Hunt
f30019645c [master] fix test descriptions 2017-12-04 15:46:56 -08:00
Mark Andrews
6fa2a0691e 4838. [bug] zone.c:add_sigs was not properly determining 
if there were active KSK and ZSK keys for
                        a algorithm when update-check-ksk is true
                        (default) leaving records unsigned with one or
                        more DNSKEY algorithms. [RT #46754]
 2017-12-05 09:25:09 +11:00
Tinderbox User
a855b8d231 update copyright notice / whitespace 2017-12-03 23:45:35 +00:00
Mark Andrews
196e01da5f 4837. [bug] dns_update_signatures{inc} (add_sigs) was not 
properly determining if there were active KSK and
                        ZSK keys for a algorithm when update-check-ksk is
                        true (default) leaving records unsigned. [RT #46743]
 2017-12-04 10:03:51 +11:00
Ondřej Surý
1b0ca5d5bb [master] Fix minor memory leak in rndc [RT #46739] 2017-12-01 14:48:32 +01:00
Evan Hunt
61c843815e [master] copyrights/whitespace 2017-11-30 14:51:50 -08:00
Evan Hunt
f29ca5db28 [master] fix incorrect comment 2017-11-30 13:35:20 -08:00
Evan Hunt
e197a2bd15 [master] fix "allow-transfer" inheritance and clean up ACL configuration 
4836.	[bug]		Zones created using "rndc addzone" could
			temporarily fail to inherit an "allow-transfer"
			ACL that had been configured in the options
			statement. [RT #46603]
 2017-11-30 12:37:08 -08:00
Ondřej Surý
a4a148cf9a [master] Type the shifted values to isc_uint32_t so the top bit is unsigned (found by UBSAN) [RT #46740] 2017-11-30 18:23:35 +01:00
Michał Kępień
2c20fc0d13 [master] Fix LMDB support on OpenBSD; clean up and refactor LMDB-related code 
4835.	[cleanup]	Clean up and refactor LMDB-related code. [RT #46718]

4834.	[port]		Fix LMDB support on OpenBSD. [RT #46718]
 2017-11-30 14:34:04 +01:00
Mark Andrews
5f308740df allow 10 seconds when checking mtime 2017-11-28 16:32:07 +11:00
Ray Bellis
d92d70ac5d fix warning under Xcode for iOS 2017-11-27 10:16:55 +00:00
Michał Kępień
00ff44c7c2 [master] Stabilize nsupdate system test [RT #46673] 2017-11-27 10:10:42 +01:00
Michał Kępień
2f13e0ef98 [master] Minor mkeys system test tweaks [RT #46649] 2017-11-27 10:04:11 +01:00
Michał Kępień
40a90fbf89 [master] Do not use thread-local storage for storing LMDB reader locktable slots 
4828.	[bug]		Do not use thread-local storage for storing LMDB reader
			locktable slots. [RT #46556]
 2017-11-27 09:48:10 +01:00
Michał Kępień
a573b93b46 [master] Disable parallel make inside bin/confgen/ and bin/named/ 
4826.	[cleanup]	Prevent potential build failures in bin/confgen/ and
			bin/named/ when using parallel make. [RT #46648]
 2017-11-23 11:44:33 +01:00
Ray Bellis
8993ecd06a 4824. [port] Add iOS hooks to dig. [RT #42011] 2017-11-23 16:58:12 +11:00
Mark Andrews
78e1d7cdde style 2017-11-23 16:09:27 +11:00
Tinderbox User
858228febe update copyright notice / whitespace 2017-11-21 23:45:29 +00:00
Michał Kępień
6035d557c4 [master] Refactor reclimit system test 
4823.	[test]		Refactor reclimit system test to improve its
			reliability and speed. [RT #46632]
 2017-11-21 10:32:45 +01:00
Michał Kępień
7a0188774f [master] Stabilize logfileconfig system test 
4818.	[test]		The logfileconfig system test could intermittently
			report false negatives on some platforms. [RT #46615]
 2017-11-16 08:06:57 +01:00
Mark Andrews
e2f9dcfd86 more DNS_NAME_INITABSOLUTE cases 2017-11-14 00:21:50 +11:00
Mark Andrews
3def40b01b 4816. [bug] Don't use a common array for storing EDNS options 
in DiG as it could fill up. [RT #45611]
 2017-11-13 16:10:35 +11:00
Mark Andrews
9eb5aa40aa set SAMPLEUPDATE under windows; test if SAMPLEUPDATE exists and only run tests if it does 2017-11-11 09:23:44 +11:00
Mark Andrews
f581ac4726 allow more time for journal to sync 2017-11-10 18:18:04 +11:00
Michał Kępień
312c84c73a [master] Minor improvements to code handling managed keys 
4812.	[bug]		Minor improvements to stability and consistency of code
			handling managed keys. [RT #46468]
 2017-11-09 15:18:39 +01:00
Michał Kępień
27bf48327c [master] Do not NOTIFY back the master view from slave views in notify system test 
This prevents a Linux kernel bug discussed in RT #32355 from being
triggered and thus makes "checking notify to multiple views using tsig"
stable.
 2017-11-08 09:21:16 +01:00
Mark Andrews
c652213857 4810. [test] The chain system test failed if the IPv6 interfaces 
were not configured. [RT #46508]
 2017-11-08 10:17:03 +11:00
Tinderbox User
0e29543a3d regen master 2017-11-07 21:42:32 +00:00
Evan Hunt
23b81977fe [master] minor doc fixes 2017-11-07 13:23:41 -08:00
Mukund Sivaraman
7e1df5182c [master] isc_rng_randombytes() 
4807.	[cleanup]	isc_rng_randombytes() returns a specified number of
			bytes from the PRNG; this is now used instead of
			calling isc_rng_random() multiple times. [RT #46230]
 2017-11-06 10:44:37 -08:00
Evan Hunt
9bb007fd2d [master] "zoneload" logging category 
4806.	[func]		Log messages related to loading of zones are now
			directed to the "zoneload" logging category.
			[RT #41640]
 2017-11-01 22:48:12 -07:00
Tinderbox User
40298d8bee regen master 2017-11-02 01:09:26 +00:00
Evan Hunt
4359be18f4 [master] update secroots doc in rndc man page 2017-11-01 15:37:12 -07:00
Tinderbox User
9b3fc207df regen master 2017-11-01 01:09:07 +00:00
Mark Andrews
ff30290b48 4804. [port] win32: access() does not work on directories as 
required by POSIX.  Supply a alternative in
                        isc_file_isdirwritable. [RT #46394]
 2017-11-01 09:29:24 +11:00
Evan Hunt
7bbb034952 [master] doc was incorrect about SIG(0) 2017-10-31 13:09:58 -07:00
Evan Hunt
a51352c4a4 [master] typo 2017-10-31 13:02:41 -07:00
Michał Kępień
37039792cb [master] Replace FNR with NR in the awk script used by nextpart() 
awk on Solaris does not support the FNR variable.  As nextpart() only
reads from one file, replace FNR with NR.
 2017-10-31 14:57:52 +01:00
Michał Kępień
41b1a98545 [master] Copy nextpart() from conf.sh.in to conf.sh.win32 2017-10-31 12:03:04 +01:00
Tinderbox User
85bd975d3d update copyright notice / whitespace 2017-10-30 23:45:50 +00:00
Michał Kępień
facf811847 [master] Refactor mkeys system test 
4802.	[test]		Refactor mkeys system test to make it quicker and more
			reliable. [RT #45293]
 2017-10-30 09:41:24 +01:00
Evan Hunt
45d4d62a0c [master] copyrights 2017-10-29 16:44:55 -07:00
Mark Andrews
40e1e659b6 add missing test number increment 2017-10-30 08:50:00 +11:00
Mark Andrews
f5e1b555c5 4801. [func] 'dnssec-lookaside auto;' and 'dnssec-lookaside . 
trust-anchor dlv.isc.org;' now elicit warnings rather
                        than being fatal configuration errors. [RT #46410]
 2017-10-30 07:40:59 +11:00
Mark Andrews
4e2ba60f3c don't add copyright notices 2017-10-29 18:53:07 +11:00
Mukund Sivaraman
625f656aa8 When processing delzone, write one zone config per line to the NZF (#46323) 2017-10-29 07:40:20 +05:30
Tinderbox User
278b68ced5 update copyright notice / whitespace 2017-10-28 23:45:38 +00:00
Evan Hunt
8f532a13cb [master] update xsl version number 2017-10-27 19:19:04 -07:00
Tinderbox User
497f3f913e regen master 2017-10-28 01:12:35 +00:00
Evan Hunt
c9f8165a06 [master] tag initializing keys 
4798.	[func]		Keys specified in "managed-keys" statements
			are tagged as "initializing" until they have been
			updated by a key refresh query. If initialization
			fails it will be visible from "rndc secroots".
			[RT #46267]
 2017-10-27 15:49:44 -07:00
Evan Hunt
1d57d460d4 [master] change rndc-confgen default algorithm 
this completes change 4785. the CHANGES note has been revised:

4785.	[func]		The hmac-md5 algorithm is no longer recommended for
			use with RNDC keys.  The default in rndc-confgen
			is now hmac-sha256. [RT #42272]
 2017-10-27 10:56:43 -07:00
Evan Hunt
959d294067 [master] remove isc-hmac-fixup 
4797.	[func]		Removed "isc-hmac-fixup", as the versions of BIND that
			had the bug it worked around are long past end of
			life. [RT #46411]
 2017-10-27 09:56:11 -07:00
Brian Conry
864bc6b56e [master] Increase the maximum TCP keepalive timeout to 65535 
4796.	[bug]		Increase the maximum configurable TCP keepalive
			timeout to 65535. [RT #44710]
 2017-10-27 14:58:48 +02:00
Evan Hunt
06049b1c6c [master] stats counter for priming queries 
4795.	[func]		A new statistics counter has been added to track
			priming queries. [RT #46313]
 2017-10-26 21:38:43 -07:00
Evan Hunt
3b4f23cdbf [master] dnssec-checkds -s 
4794.	[func]		"dnssec-checkds -s" specifies a file from which
			to read a DS set rather than querying the parent.
			[RT #44667]
 2017-10-26 21:05:11 -07:00
Tinderbox User
08f18efba2 update copyright notice / whitespace 2017-10-26 23:45:58 +00:00
Mark Andrews
09baa0cbb1 use 'grep -w' to reduce false negatives 2017-10-26 16:14:30 +11:00
Mark Andrews
87387d8a41 4793. [bug] nsupdate -[46] could overflow the array of server 
addresses. [RT #46402]
 2017-10-26 16:00:24 +11:00
Evan Hunt
5b69d3da83 [master] check file and tree headers when loading map files 
4792.	[bug]		Fix map file header correctness check. [RT #38418]
 2017-10-25 21:37:00 -07:00
Mark Andrews
3056d6f532 use consistent filename 2017-10-26 11:43:20 +11:00
Mark Andrews
2bbca9594f 4790. [bug] nsupdate could trigger a require when sending a 
update to the second address of the server.
                        [RT #45731]
 2017-10-26 00:29:52 +11:00
Evan Hunt
eb2ef7b53e [master] check new-zones-directory 
4789.	[cleanup]	Check writability of new-zones-directory. [RT #46308]
 2017-10-25 01:19:46 -07:00
Evan Hunt
aebdc6cd7d [master] log when update-policy local gets a key match from a remote host 
4788.	[cleanup]	When using "update-policy local", log a warning
			when an update matching the session key is received
			from a remote host. [RT #46213]

- this completes change #4762.
 2017-10-25 00:58:11 -07:00
Evan Hunt
65314b0fd8 [master] "enable-filter-aaaa" no longer optional 
4786.	[func]		The "filter-aaaa-on-v4" and "filter-aaaa-on-v6"
			options are no longer conditionally compiled.
			[RT #46340]
 2017-10-25 00:33:51 -07:00
Mark Andrews
80739779fc read dig.out.ns3.test$n rather than dig.out.ns2.test$n 2017-10-25 15:02:36 +11:00
Tinderbox User
a53e03205a regen master 2017-10-25 01:08:58 +00:00
Tinderbox User
ea055a82cd update copyright notice / whitespace 2017-10-24 23:47:14 +00:00
Mark Andrews
79e78994d0 add missing semicolon 2017-10-25 10:29:10 +11:00
Evan Hunt
21761bfe79 [master] deprecate HMAC in dnssec-keygen, MD5 in rndc-confgen 
4785.	[func]		The hmac-md5 algorithm is no longer recommended for
			use with RNDC keys. For compatibility reasons, it
			it is still the default algorithm in rndc-confgen,
			but this will be changed to hmac-sha256 in a future
			release. [RT #42272]

4784.	[func]		The use of dnssec-keygen to generate HMAC keys is
			deprecated in favor of tsig-keygen.  dnssec-keygen
			will print a warning when used for this purpose.
			All HMAC algorithms will be removed from
			dnssec-keygen in a future release. [RT #42272]
 2017-10-24 15:35:13 -07:00
Mark Andrews
969d923536 4783. [test] dnssec: 'check that NOTIFY is sent at the end of 
NSEC3 chain generation failed' required more time
                        on some machines for the IXFR to complete. [RT #46388]
 2017-10-25 09:21:14 +11:00
Mark Andrews
6b8e4d6e69 4782. [test] dnssec: 'checking positive and negative validation 
with negative trust anchors' required more time to
                        complete on some machines. [RT #46386]
 2017-10-25 09:13:05 +11:00
Mark Andrews
b49042a6a5 report test number 2017-10-24 15:02:00 +11:00
Evan Hunt
0207f6ff9e [master] omit NS from authority section if it was in answer 
4780.	[bug]		When answering ANY queries, don't include the NS
			RRset in the authority section if it was already
			in the answer section. [RT #44543]
 2017-10-23 19:16:27 -07:00
Mark Andrews
65f8b51893 remove named.memstats and named.run 2017-10-24 12:51:03 +11:00
Mark Andrews
5bead588b7 report if named.run or named.memstats not removed after successful test 2017-10-24 12:45:13 +11:00
Mark Andrews
a59d687db4 4778. [test] Improve synth-from-dnssec testing. [RT #46352] 2017-10-24 09:49:07 +11:00
Evan Hunt
89636d8f30 [master] clean up a redundancy 
4777.	[cleanup]	Removed a redundant call to configure_view_acl().
			[RT #46369]
 2017-10-23 11:11:19 -07:00
Mark Andrews
fe79e2efbf 4774. [bug] <isc/util.h> was incorrectly included in several 
header files. [RT #46311]
 2017-10-19 12:26:32 +11:00
Tinderbox User
208abf3fc7 regen master 2017-10-18 01:10:52 +00:00
Evan Hunt
30419509dd [master] README and relnote fixes 2017-10-17 13:47:33 -07:00
Michał Kępień
2361003a88 [master] Doxygen fixes and cleanups 
4773.	[doc]		Fixed generating Doxygen documentation for functions
			annotated using certain macros.  Miscellaneous
			Doxygen-related cleanups. [RT #46276]
 2017-10-17 06:56:46 +02:00
Michał Kępień
9d47a267c4 [master] Regenerate presigned zone for the filter-aaaa system test [RT #46283] 
This change is only applied to master for consistency with other
branches, where it is required to fix the filter-aaaa system test for
builds without DNSSEC support.
 2017-10-16 09:38:34 +02:00
Evan Hunt
08a3dedda1 [master] also need to add lib directory reference 2017-10-12 16:08:03 -07:00
Evan Hunt
a341252fdd [master] missing reference to libns 2017-10-12 15:46:32 -07:00
Evan Hunt
a8496f51a8 [master] copyrights 2017-10-12 10:57:39 -07:00
Evan Hunt
3abcd7cd8a [master] Revert "[master] tag initializing keys so they can't be used for normal validation" 
This reverts commit 560d8b833e.

This change created a potential race between key refresh queries and
root zone priming queries which could leave the root name servers in
the bad-server cache.
 2017-10-12 10:53:35 -07:00
Evan Hunt
5daa633313 [master] typo 2017-10-11 23:25:46 -07:00
Evan Hunt
28c58f39e9 [master] fix sfcache test failures [rt46264] 2017-10-11 23:24:28 -07:00
Mark Andrews
b856e695d0 copyrights 2017-10-12 16:01:23 +11:00
Mark Andrews
5b60d0608a test for Net::DNS::Nameserver 2017-10-12 15:33:47 +11:00
Mark Andrews
fa644181f5 add Net::DNS prerequiste test 2017-10-12 15:19:45 +11:00
Evan Hunt
d0c3272eaa [master] copyrights 2017-10-11 21:11:37 -07:00
Evan Hunt
560d8b833e [master] tag initializing keys so they can't be used for normal validation 
4773.	[bug]		Keys specified in "managed-keys" statements
			can now only be used when validating key refresh
			queries during initialization of RFC 5011 key
			maintenance. If initialization fails, DNSSEC
			validation of normal queries will also fail.
			Previously, validation of normal queries could
			succeed using the initializing key, potentially
			masking problems with managed-keys. [RT #46077]
 2017-10-11 21:01:13 -07:00
Evan Hunt
9f1e715a64 [master] X_OK bit not supported on windows 2017-10-11 17:43:16 -07:00
Evan Hunt
025f606463 [master] copyrights 2017-10-11 17:08:21 -07:00
Evan Hunt
89b2fc092d [master] use NUL instead of /dev/null for KRB5_CONFIG on windows 2017-10-11 16:03:13 -07:00
Evan Hunt
94f022ec02 [master] fix AFL compile error 2017-10-11 15:26:35 -07:00
Ondřej Surý
1ca7e01aa7 [master] make writable directory and managed-keys directory mandatory - check in load_configuration (cherry-picked from rt46077b) 2017-10-11 08:44:26 +02:00
Ondřej Surý
b4c8cab0e2 Move KRB5_CONFIG=/dev/null to conf.sh.* so the named run in the tests gets the setting 2017-10-11 06:30:53 +00:00
Evan Hunt
16d6fab2e5 [master] make writable directory and managed-keys directory mandatory 
4769.   [bug]           The working directory and managed-keys directory has
                        to be writeable (and seekable). [RT #46077]
 2017-10-11 08:21:23 +02:00
Ondřej Surý
74f46c45b0 Move KRB5_CONFIG=/dev/null to conf.sh.* so it gets applied to named and not only the tsiggss test 2017-10-10 12:22:10 +02:00
Mark Andrews
23a4f70be0 remove unused variable 2017-10-10 20:02:35 +11:00
Tinderbox User
005bdf067b regen master 2017-10-10 01:08:02 +00:00
Evan Hunt
bd08d94f8b [master] add dnssec-cds man page to ARM 2017-10-09 10:58:27 -07:00
Evan Hunt
c89f1bf1b6 [master] turn off memory fill by default 
4768.	[func]		By default, memory is no longer filled with tag values
			when it is allocated or freed; this improves
			performance but makes debugging of certain memory
			issues more difficult. "named -M fill" turns memory
			filling back on. (Building "configure
			--enable-developer", turns memory fill on by
			default again; it can then be disabled with
			"named -M nofill".) [RT #45123]
 2017-10-09 09:55:37 -07:00
Michał Kępień
077f9626c2 [master] Add isc_buffer_printf() 
4767.	[func]		Add a new function, isc_buffer_printf(), which can be
			used to append a formatted string to the used region of
			a buffer. [RT #46201]
 2017-10-09 11:43:07 +02:00
Mark Andrews
5df3f839b2 4766. [cleanup] Addresss Coverity warnings. [RT #46150] 
4765.   [bug]           Address potential INSIST in dnssec-cds. [RT #46150]
 2017-10-09 18:34:31 +11:00
Mark Andrews
2d22725336 4764. [bug] Address portability issues in cds system test. 
[RT #46214]
 2017-10-09 12:58:14 +11:00
Mark Andrews
02a669a9a6 don't force souce port 2017-10-08 06:42:39 +11:00
Mark Andrews
fb5c7e04d3 add lib\ns to link directories 2017-10-07 13:41:10 +11:00
Mark Andrews
ec0a9c0525 check* depend on libns 2017-10-07 10:59:32 +11:00
Evan Hunt
995c41e8f0 [master] further restrict update-policy local 
4762.	[func]		"update-policy local" is now restricted to updates
			from local addresses. (Previously, other addresses
			were allowed so long as updates were signed by the
			local session key.) [RT #45492]
 2017-10-06 15:43:31 -07:00
Evan Hunt
7baa39fc96 [master] it's okay if dns_db_setgluecachestats() returns ISC_R_NOTIMPLEMENTED 2017-10-06 12:52:21 -07:00
Michał Kępień
417218837e [master] Add support for DOA 
4761.	[protocol]	Add support for DOA. [RT #45612]
 2017-10-06 12:22:08 +02:00
Mukund Sivaraman
a0c408c90d Add statistics for glue cache usage (#46028) 2017-10-06 15:44:37 +05:30
Mark Andrews
fffbe14289 add S 2017-10-06 21:10:42 +11:00
Mark Andrews
de4d6c4a2d add ns include 2017-10-06 19:59:45 +11:00
Mark Andrews
b386a826a6 call ns_log_init so that the categories there are registered 2017-10-06 16:41:30 +11:00
Evan Hunt
6e52e19e3b [master] use backquotes not $() 2017-10-05 20:17:24 -07:00
Mark Andrews
b41c1aacbc 4759. [func] Add logging channel "trust-anchor-telementry" to 
record trust-anchor-telementry in incoming requests.
                        Both _ta-XXXX.<anchor>/NULL and EDNS KEY-TAG options
                        are logged.  [RT #46124]
 2017-10-06 13:01:14 +11:00
Tinderbox User
26cde05da4 regen master 2017-10-06 01:08:15 +00:00
Tinderbox User
ddcf6c7d2b update copyright notice / whitespace 2017-10-05 23:45:49 +00:00
Evan Hunt
94f3abed4c [master] remove no-longer-needed check for nonexistence 2017-10-05 11:35:23 -07:00
Evan Hunt
3f3b51e7af [master] fix error reporting on fclose() failure [RT #46199] 2017-10-05 11:07:21 -07:00
Evan Hunt
6e51774a60 [master] remove cds test that fails with --enable-fixed-rrset 2017-10-05 09:58:52 -07:00
Evan Hunt
ba37674d03 [master] dnssec-cds 
4757.   [func]          New "dnssec-cds" command creates a new parent DS
                        RRset based on CDS or CDNSKEY RRsets found in
                        a child zone, and generates either a dsset file
                        or stream of nsupdate commands to update the
                        parent. Thanks to Tony Finch. [RT #46090]
 2017-10-05 01:04:18 -07:00
Michał Kępień
14afc8425b [master] Prevent dig INSIST failures and hangs in some failure modes 
4756.	[bug]		Interrupting dig could lead to an INSIST failure after
			certain errors were encountered while querying a host
			whose name resolved to more than one address.  Change
			4537 increased the odds of triggering this issue by
			causing dig to hang indefinitely when certain error
			paths were evaluated.  dig now also retries TCP queries
			(once) if the server gracefully closes the connection
			before sending a response. [RT #42832, #45159]
 2017-10-05 09:42:31 +02:00
Evan Hunt
d7ee3ed488 [master] don't log when NZF file doesn't exist 
4755.	[cleanup]	Silence unnecessary log message when NZF file doesn't
			exist. [RT #46186]
 2017-10-05 00:12:14 -07:00
Evan Hunt
c370305901 [master] 4754. [bug] dns_zone_setview needs a two stage commit to properly 
handle errors. [RT #45841]
 2017-10-04 23:44:15 -07:00
Evan Hunt
9a28f66610 [master] copy the color-coded test functions to conf.sh.win32 2017-10-04 09:27:40 -07:00
Mark Andrews
055d310e54 add L for wide 2017-10-04 20:44:01 +11:00
Mark Andrews
4615bc5408 stderr to /dev/null also 2017-10-04 19:26:44 +11:00
Mark Andrews
d1e823af15 test for 'printf' 2017-10-04 19:18:56 +11:00
Evan Hunt
e1c96ad444 [master] tag mismatches 2017-10-03 19:38:59 -07:00
Tinderbox User
ca0ae70046 update copyright notice / whitespace 2017-10-03 23:45:48 +00:00
Evan Hunt
a5a60037e5 [master] fix out-of-order synchronization that affected the dnssec test 2017-10-03 14:07:08 -07:00
Mark Andrews
57c04ec865 address shadowed warning 2017-10-04 07:29:13 +11:00
Evan Hunt
9510de7849 [master] fix a test error in smartsign 2017-10-03 12:19:36 -07:00
Evan Hunt
b47814be1c [master] address shadowed variable warning 2017-10-03 11:53:46 -07:00
Evan Hunt
e515fae2ae [master] dnssec-signzone can now add sync records 
4751.	[func]		"dnssec-signzone -S" can now automatically add parent
			synchronization records (CDS and CDNSKEY) according
			to key metadata set using the -Psync and -Dsync
			options to dnssec-keygen and dnssec-settime.
			[RT #46149]
 2017-10-03 01:11:36 -07:00
Evan Hunt
762dc8b871 [master] rndc managed-keys destroy 
4750.	[func]		"rndc managed-keys destroy" shuts down RFC 5011 key
			maintenance and deletes the managed-keys database.
			If followed by "rndc reconfig" or a server restart,
			key maintenance is reinitialized from scratch.
			This is primarily intended for testing. [RT #32456]
 2017-10-03 01:05:46 -07:00
Evan Hunt
f29359299a [master] de-DLV 
4749.	[func]		The ISC DLV service has been shut down, and all
			DLV records have been removed from dlv.isc.org.
			- Removed references to ISC DLV in documentation
			- Removed DLV key from bind.keys
			- No longer use ISC DLV by default in delv
			[RT #46155]
 2017-10-03 00:41:57 -07:00
Mark Andrews
a009d03a1a 4748. [cleanup] Sprintf to snprintf coversions. [RT #46132] 2017-10-03 14:54:19 +11:00
Mark Andrews
c85b467dc0 4747. [func] Synthesis of responses from DNSSEC-verified records. 
Stage 3 - synthesize NODATA responses. [RT #40138]
 2017-10-03 11:16:37 +11:00
Tinderbox User
a57a6dbe62 update copyright notice / whitespace 2017-09-29 23:45:51 +00:00
Evan Hunt
3bb6150cae [master] color-coded test output 
4745.	[test]		Add color-coded pass/fail messages to system
			tests when running on terminals that support them.
			[RT #45977]
 2017-09-29 12:20:55 -07:00
Tinderbox User
5fbc5c9225 regen master 2017-09-29 01:08:37 +00:00
Mark Andrews
dc0a792d94 4744. [bug] Suppress trust-anchor-telementry queries if 
validation is disabled. [RT #46131]
 2017-09-29 09:33:06 +10:00
Evan Hunt
24172bd2ee [master] completed and corrected the crypto-random change 
4724.	[func]		By default, BIND now uses the random number
			functions provided by the crypto library (i.e.,
			OpenSSL or a PKCS#11 provider) as a source of
			randomness rather than /dev/random.  This is
			suitable for virtual machine environments
			which have limited entropy pools and lack
			hardware random number generators.

			This can be overridden by specifying another
			entropy source via the "random-device" option
			in named.conf, or via the -r command line option;
			however, for functions requiring full cryptographic
			strength, such as DNSSEC key generation, this
			cannot be overridden. In particular, the -r
			command line option no longer has any effect on
			dnssec-keygen.

			This can be disabled by building with
			"configure --disable-crypto-rand".
			[RT #31459] [RT #46047]
 2017-09-28 10:09:22 -07:00
Mark Andrews
86e5d14e82 improve forensics 2017-09-28 22:14:30 +10:00
Mark Andrews
e00fdad191 4742. [func] Synthesis of responses from DNSSEC-verified records. 
Stage 2 - synthesis of records from wildcard data.
                        If the dns64 or filter-aaaa* is configured then the
                        involved lookups are currently excluded. [RT #40138]
 2017-09-28 15:16:26 +10:00
Mark Andrews
f9f3f20d2d 4739. [cleanup] Address clang static analysis warnings. [RT #45952] 2017-09-27 10:27:09 +10:00
Mark Andrews
744061a03b 4738. [port] win32: strftime mishandles %Z. [RT #46039] 2017-09-26 23:32:40 +10:00
Mark Andrews
08151d7fce 4737. [cleanup] Address Coverity warnings. [RT #46012] 2017-09-26 23:21:49 +10:00
Mukund Sivaraman
eb1e4cce6c Refactor 
Reviewed on Jabber by Evan.
 2017-09-26 14:54:36 +05:30
Tinderbox User
ffbe6b9537 update copyright notice / whitespace 2017-09-19 23:46:23 +00:00
Mukund Sivaraman
32bcafc316 Change default minimal-responses setting to no-auth-recursive (#46016) 2017-09-19 19:49:02 +05:30
Mukund Sivaraman
e2ed24aa4d Fix use after free when closing an LMDB (#46000) 2017-09-19 19:42:13 +05:30
Tinderbox User
cb5bc50c91 update copyright notice / whitespace 2017-09-18 23:48:50 +00:00
Evan Hunt
49740fb0f2 [master] add I: when echoing information about failed tests 2017-09-18 14:15:37 -07:00
Michał Kępień
f665c724e4 [master] Prevent possible infinite signing loop after retransferring an inline-signed slave using NSEC3 
4727.	[bug]		Retransferring an inline-signed slave using NSEC3
			around the time its NSEC3 salt was changed could result
			in an infinite signing loop. [RT #45080]
 2017-09-18 09:18:45 +02:00
Mark Andrews
0bcb8b0b7c 4725. [bug] Nsupdate: "recvsoa" was incorrectly reported for 
failures in sending the update message.  The correct
                        location to be reported is "update_completed".
                        [RT #46014]
 2017-09-18 14:28:39 +10:00
Francis Dupont
aed87173fd Moved last occurrence of ns_g_entropy to named_g_entropy 2017-09-17 09:50:10 +02:00
Francis Dupont
9c829f4f96 Merged rt31459d (openssl random) 2017-09-16 13:53:29 +02:00
Mark Andrews
3128cd21e3 4723. [bug] Statistics counter DNSTAPdropped was misidentified 
as DNSSECdropped. [RT #46002]
 2017-09-14 23:51:19 +00:00
Tinderbox User
f54a365aeb update copyright notice / whitespace 2017-09-14 23:46:40 +00:00
Evan Hunt
364cabf431 [master] revert dlzexternal changes for portability 2017-09-14 11:33:24 -07:00
Mark Andrews
5fb0c09a5e #include <isc/string.h> 2017-09-14 18:54:46 +10:00
Mark Andrews
cb629cdeda more str{n}{cat,cpy} corrections rt45981_stage2 2017-09-14 18:11:56 +10:00
Mukund Sivaraman
bbe9f1dd95 Link dlzexternal system test's driver against libisc 2017-09-14 13:23:41 +05:30
Tinderbox User
e3bd90ee1b regen master 2017-09-14 01:12:10 +00:00
Tinderbox User
33987cb5fd update copyright notice / whitespace 2017-09-13 23:48:32 +00:00
Mark Andrews
21c12d0107 fix filenamelen so it has the buffer length rather than buffer length - 1 2017-09-14 09:29:28 +10:00
Mukund Sivaraman
188fa6ea68 Add missing <isc/print.h> 2017-09-13 19:44:47 +05:30
Francis Dupont
804ca1d926 Added isc/string.h to shutdown_test which got strlcpy 2017-09-13 14:34:54 +02:00
Evan Hunt
114f95089c [master] cleanup strcat/strcpy 
4722.	[cleanup]	Clean up uses of strcpy() and strcat() in favor of
			strlcpy() and strlcat() for safety. [RT #45981]
 2017-09-13 00:14:37 -07:00
Evan Hunt
06b082c230 [rt31459d] fix first if test in setoption 
(cherry picked from commit abda73147d)
 2017-09-12 23:51:51 -07:00
Evan Hunt
20502f35dd [master] allow CDS/CDNSKEY records to be signed with only KSK 
4721.	[func]		'dnssec-signzone -x' and 'dnssec-dnskey-kskonly'
			options now apply to CDNSKEY and DS records as well
			as DNSKEY. Thanks to Tony Finch. [RT #45689]
 2017-09-12 23:09:48 -07:00
Evan Hunt
cc24a8725f [rt31459d] update the newer tools 2017-09-12 22:49:35 -07:00
Mark Andrews
e930487ce7 give more time for the initial signing of bits in the inline signing test to complete 2017-09-13 12:18:59 +10:00
Evan Hunt
586e65ea5c [rt31459d] rebased rt31459c 2017-09-12 19:05:46 -07:00
Mark Andrews
abda73147d fix first if test in setoption 2017-09-13 11:57:00 +10:00
Evan Hunt
30973087a0 [master] add prefetch stat counter 
4720.	[func]		Added a statistics counter to track prefetch
			queries. [RT #45847]
 2017-09-12 18:41:47 -07:00
Mark Andrews
34130ee25a 4719. [bug] Address PVS static analyzer warnings. [RT #45946] 2017-09-13 09:50:51 +10:00
Tinderbox User
1e33899f86 update copyright notice / whitespace 2017-09-12 23:46:14 +00:00
Evan Hunt
25b33bede4 [master] improve handling of qcount=0 replies 
4717.	[bug]		Treat replies with QCOUNT=0 as truncated if TC=1,
			FORMERR if TC=0, and log the error correctly.
			[RT #45836]
 2017-09-12 15:26:30 -07:00
Evan Hunt
534c43860e [master] update copyrights 2017-09-11 17:47:12 -07:00
Evan Hunt
f3ce87e1a1 [master] copyrights 2017-09-11 17:01:09 -07:00
Tinderbox User
0d9572e437 update copyright notice / whitespace 2017-09-11 23:46:33 +00:00
Evan Hunt
b103b0c011 [master] remap getaddrinfo() to irs_getgetaddrinfo() 
The libirs version of getaddrinfo() cannot be called from within BIND9.
 2017-09-11 15:03:57 -07:00
Evan Hunt
2e0493c046 [master] add print.h 2017-09-11 12:37:58 -07:00
Evan Hunt
3363f3147a [master] DNS Response Policy Service API 
4713.	[func]		Added support for the DNS Response Policy Service
			(DNSRPS) API, which allows named to use an external
			response policy daemon when built with
			"configure --enable-dnsrps".  Thanks to Vernon
			Schryver and Farsight Security. [RT #43376]
 2017-09-11 11:57:43 -07:00
Evan Hunt
8e014c45ae [master] dig: retain domain when retrying with tcp 
4712.	[bug]		"dig +domain" and "dig +search" didn't retain the
			search domain when retrying with TCP. [RT #45547]
 2017-09-11 10:10:16 -07:00
Evan Hunt
3e66721b35 [master] add missing rrtypes to genzones 
4711.	[test]		Some RR types were missing from genzones.sh.
			[RT #45782]
 2017-09-11 09:34:41 -07:00