upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-02-26 11:32:01 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions
26645 commits 18 branches 854 tags 440 MiB
Commit graph

8425 commits

Author SHA1 Message Date
Mark Andrews
4e2ba60f3c don't add copyright notices 2017-10-29 18:53:07 +11:00
Mukund Sivaraman
625f656aa8 When processing delzone, write one zone config per line to the NZF (#46323) 2017-10-29 07:40:20 +05:30
Tinderbox User
278b68ced5 update copyright notice / whitespace 2017-10-28 23:45:38 +00:00
Evan Hunt
8f532a13cb [master] update xsl version number 2017-10-27 19:19:04 -07:00
Tinderbox User
497f3f913e regen master 2017-10-28 01:12:35 +00:00
Evan Hunt
c9f8165a06 [master] tag initializing keys 
4798.	[func]		Keys specified in "managed-keys" statements
			are tagged as "initializing" until they have been
			updated by a key refresh query. If initialization
			fails it will be visible from "rndc secroots".
			[RT #46267]
 2017-10-27 15:49:44 -07:00
Evan Hunt
1d57d460d4 [master] change rndc-confgen default algorithm 
this completes change 4785. the CHANGES note has been revised:

4785.	[func]		The hmac-md5 algorithm is no longer recommended for
			use with RNDC keys.  The default in rndc-confgen
			is now hmac-sha256. [RT #42272]
 2017-10-27 10:56:43 -07:00
Evan Hunt
959d294067 [master] remove isc-hmac-fixup 
4797.	[func]		Removed "isc-hmac-fixup", as the versions of BIND that
			had the bug it worked around are long past end of
			life. [RT #46411]
 2017-10-27 09:56:11 -07:00
Brian Conry
864bc6b56e [master] Increase the maximum TCP keepalive timeout to 65535 
4796.	[bug]		Increase the maximum configurable TCP keepalive
			timeout to 65535. [RT #44710]
 2017-10-27 14:58:48 +02:00
Evan Hunt
06049b1c6c [master] stats counter for priming queries 
4795.	[func]		A new statistics counter has been added to track
			priming queries. [RT #46313]
 2017-10-26 21:38:43 -07:00
Evan Hunt
3b4f23cdbf [master] dnssec-checkds -s 
4794.	[func]		"dnssec-checkds -s" specifies a file from which
			to read a DS set rather than querying the parent.
			[RT #44667]
 2017-10-26 21:05:11 -07:00
Tinderbox User
08f18efba2 update copyright notice / whitespace 2017-10-26 23:45:58 +00:00
Mark Andrews
09baa0cbb1 use 'grep -w' to reduce false negatives 2017-10-26 16:14:30 +11:00
Mark Andrews
87387d8a41 4793. [bug] nsupdate -[46] could overflow the array of server 
addresses. [RT #46402]
 2017-10-26 16:00:24 +11:00
Evan Hunt
5b69d3da83 [master] check file and tree headers when loading map files 
4792.	[bug]		Fix map file header correctness check. [RT #38418]
 2017-10-25 21:37:00 -07:00
Mark Andrews
3056d6f532 use consistent filename 2017-10-26 11:43:20 +11:00
Mark Andrews
2bbca9594f 4790. [bug] nsupdate could trigger a require when sending a 
update to the second address of the server.
                        [RT #45731]
 2017-10-26 00:29:52 +11:00
Evan Hunt
eb2ef7b53e [master] check new-zones-directory 
4789.	[cleanup]	Check writability of new-zones-directory. [RT #46308]
 2017-10-25 01:19:46 -07:00
Evan Hunt
aebdc6cd7d [master] log when update-policy local gets a key match from a remote host 
4788.	[cleanup]	When using "update-policy local", log a warning
			when an update matching the session key is received
			from a remote host. [RT #46213]

- this completes change #4762.
 2017-10-25 00:58:11 -07:00
Evan Hunt
65314b0fd8 [master] "enable-filter-aaaa" no longer optional 
4786.	[func]		The "filter-aaaa-on-v4" and "filter-aaaa-on-v6"
			options are no longer conditionally compiled.
			[RT #46340]
 2017-10-25 00:33:51 -07:00
Mark Andrews
80739779fc read dig.out.ns3.test$n rather than dig.out.ns2.test$n 2017-10-25 15:02:36 +11:00
Tinderbox User
a53e03205a regen master 2017-10-25 01:08:58 +00:00
Tinderbox User
ea055a82cd update copyright notice / whitespace 2017-10-24 23:47:14 +00:00
Mark Andrews
79e78994d0 add missing semicolon 2017-10-25 10:29:10 +11:00
Evan Hunt
21761bfe79 [master] deprecate HMAC in dnssec-keygen, MD5 in rndc-confgen 
4785.	[func]		The hmac-md5 algorithm is no longer recommended for
			use with RNDC keys. For compatibility reasons, it
			it is still the default algorithm in rndc-confgen,
			but this will be changed to hmac-sha256 in a future
			release. [RT #42272]

4784.	[func]		The use of dnssec-keygen to generate HMAC keys is
			deprecated in favor of tsig-keygen.  dnssec-keygen
			will print a warning when used for this purpose.
			All HMAC algorithms will be removed from
			dnssec-keygen in a future release. [RT #42272]
 2017-10-24 15:35:13 -07:00
Mark Andrews
969d923536 4783. [test] dnssec: 'check that NOTIFY is sent at the end of 
NSEC3 chain generation failed' required more time
                        on some machines for the IXFR to complete. [RT #46388]
 2017-10-25 09:21:14 +11:00
Mark Andrews
6b8e4d6e69 4782. [test] dnssec: 'checking positive and negative validation 
with negative trust anchors' required more time to
                        complete on some machines. [RT #46386]
 2017-10-25 09:13:05 +11:00
Mark Andrews
b49042a6a5 report test number 2017-10-24 15:02:00 +11:00
Evan Hunt
0207f6ff9e [master] omit NS from authority section if it was in answer 
4780.	[bug]		When answering ANY queries, don't include the NS
			RRset in the authority section if it was already
			in the answer section. [RT #44543]
 2017-10-23 19:16:27 -07:00
Mark Andrews
65f8b51893 remove named.memstats and named.run 2017-10-24 12:51:03 +11:00
Mark Andrews
5bead588b7 report if named.run or named.memstats not removed after successful test 2017-10-24 12:45:13 +11:00
Mark Andrews
a59d687db4 4778. [test] Improve synth-from-dnssec testing. [RT #46352] 2017-10-24 09:49:07 +11:00
Evan Hunt
89636d8f30 [master] clean up a redundancy 
4777.	[cleanup]	Removed a redundant call to configure_view_acl().
			[RT #46369]
 2017-10-23 11:11:19 -07:00
Mark Andrews
fe79e2efbf 4774. [bug] <isc/util.h> was incorrectly included in several 
header files. [RT #46311]
 2017-10-19 12:26:32 +11:00
Tinderbox User
208abf3fc7 regen master 2017-10-18 01:10:52 +00:00
Evan Hunt
30419509dd [master] README and relnote fixes 2017-10-17 13:47:33 -07:00
Michał Kępień
2361003a88 [master] Doxygen fixes and cleanups 
4773.	[doc]		Fixed generating Doxygen documentation for functions
			annotated using certain macros.  Miscellaneous
			Doxygen-related cleanups. [RT #46276]
 2017-10-17 06:56:46 +02:00
Michał Kępień
9d47a267c4 [master] Regenerate presigned zone for the filter-aaaa system test [RT #46283] 
This change is only applied to master for consistency with other
branches, where it is required to fix the filter-aaaa system test for
builds without DNSSEC support.
 2017-10-16 09:38:34 +02:00
Evan Hunt
08a3dedda1 [master] also need to add lib directory reference 2017-10-12 16:08:03 -07:00
Evan Hunt
a341252fdd [master] missing reference to libns 2017-10-12 15:46:32 -07:00
Evan Hunt
a8496f51a8 [master] copyrights 2017-10-12 10:57:39 -07:00
Evan Hunt
3abcd7cd8a [master] Revert "[master] tag initializing keys so they can't be used for normal validation" 
This reverts commit 560d8b833e.

This change created a potential race between key refresh queries and
root zone priming queries which could leave the root name servers in
the bad-server cache.
 2017-10-12 10:53:35 -07:00
Evan Hunt
5daa633313 [master] typo 2017-10-11 23:25:46 -07:00
Evan Hunt
28c58f39e9 [master] fix sfcache test failures [rt46264] 2017-10-11 23:24:28 -07:00
Mark Andrews
b856e695d0 copyrights 2017-10-12 16:01:23 +11:00
Mark Andrews
5b60d0608a test for Net::DNS::Nameserver 2017-10-12 15:33:47 +11:00
Mark Andrews
fa644181f5 add Net::DNS prerequiste test 2017-10-12 15:19:45 +11:00
Evan Hunt
d0c3272eaa [master] copyrights 2017-10-11 21:11:37 -07:00
Evan Hunt
560d8b833e [master] tag initializing keys so they can't be used for normal validation 
4773.	[bug]		Keys specified in "managed-keys" statements
			can now only be used when validating key refresh
			queries during initialization of RFC 5011 key
			maintenance. If initialization fails, DNSSEC
			validation of normal queries will also fail.
			Previously, validation of normal queries could
			succeed using the initializing key, potentially
			masking problems with managed-keys. [RT #46077]
 2017-10-11 21:01:13 -07:00
Evan Hunt
9f1e715a64 [master] X_OK bit not supported on windows 2017-10-11 17:43:16 -07:00
Evan Hunt
025f606463 [master] copyrights 2017-10-11 17:08:21 -07:00
Evan Hunt
89b2fc092d [master] use NUL instead of /dev/null for KRB5_CONFIG on windows 2017-10-11 16:03:13 -07:00
Evan Hunt
94f022ec02 [master] fix AFL compile error 2017-10-11 15:26:35 -07:00
Ondřej Surý
1ca7e01aa7 [master] make writable directory and managed-keys directory mandatory - check in load_configuration (cherry-picked from rt46077b) 2017-10-11 08:44:26 +02:00
Ondřej Surý
b4c8cab0e2 Move KRB5_CONFIG=/dev/null to conf.sh.* so the named run in the tests gets the setting 2017-10-11 06:30:53 +00:00
Evan Hunt
16d6fab2e5 [master] make writable directory and managed-keys directory mandatory 
4769.   [bug]           The working directory and managed-keys directory has
                        to be writeable (and seekable). [RT #46077]
 2017-10-11 08:21:23 +02:00
Ondřej Surý
74f46c45b0 Move KRB5_CONFIG=/dev/null to conf.sh.* so it gets applied to named and not only the tsiggss test 2017-10-10 12:22:10 +02:00
Mark Andrews
23a4f70be0 remove unused variable 2017-10-10 20:02:35 +11:00
Tinderbox User
005bdf067b regen master 2017-10-10 01:08:02 +00:00
Evan Hunt
bd08d94f8b [master] add dnssec-cds man page to ARM 2017-10-09 10:58:27 -07:00
Evan Hunt
c89f1bf1b6 [master] turn off memory fill by default 
4768.	[func]		By default, memory is no longer filled with tag values
			when it is allocated or freed; this improves
			performance but makes debugging of certain memory
			issues more difficult. "named -M fill" turns memory
			filling back on. (Building "configure
			--enable-developer", turns memory fill on by
			default again; it can then be disabled with
			"named -M nofill".) [RT #45123]
 2017-10-09 09:55:37 -07:00
Michał Kępień
077f9626c2 [master] Add isc_buffer_printf() 
4767.	[func]		Add a new function, isc_buffer_printf(), which can be
			used to append a formatted string to the used region of
			a buffer. [RT #46201]
 2017-10-09 11:43:07 +02:00
Mark Andrews
5df3f839b2 4766. [cleanup] Addresss Coverity warnings. [RT #46150] 
4765.   [bug]           Address potential INSIST in dnssec-cds. [RT #46150]
 2017-10-09 18:34:31 +11:00
Mark Andrews
2d22725336 4764. [bug] Address portability issues in cds system test. 
[RT #46214]
 2017-10-09 12:58:14 +11:00
Mark Andrews
02a669a9a6 don't force souce port 2017-10-08 06:42:39 +11:00
Mark Andrews
fb5c7e04d3 add lib\ns to link directories 2017-10-07 13:41:10 +11:00
Mark Andrews
ec0a9c0525 check* depend on libns 2017-10-07 10:59:32 +11:00
Evan Hunt
995c41e8f0 [master] further restrict update-policy local 
4762.	[func]		"update-policy local" is now restricted to updates
			from local addresses. (Previously, other addresses
			were allowed so long as updates were signed by the
			local session key.) [RT #45492]
 2017-10-06 15:43:31 -07:00
Evan Hunt
7baa39fc96 [master] it's okay if dns_db_setgluecachestats() returns ISC_R_NOTIMPLEMENTED 2017-10-06 12:52:21 -07:00
Michał Kępień
417218837e [master] Add support for DOA 
4761.	[protocol]	Add support for DOA. [RT #45612]
 2017-10-06 12:22:08 +02:00
Mukund Sivaraman
a0c408c90d Add statistics for glue cache usage (#46028) 2017-10-06 15:44:37 +05:30
Mark Andrews
fffbe14289 add S 2017-10-06 21:10:42 +11:00
Mark Andrews
de4d6c4a2d add ns include 2017-10-06 19:59:45 +11:00
Mark Andrews
b386a826a6 call ns_log_init so that the categories there are registered 2017-10-06 16:41:30 +11:00
Evan Hunt
6e52e19e3b [master] use backquotes not $() 2017-10-05 20:17:24 -07:00
Mark Andrews
b41c1aacbc 4759. [func] Add logging channel "trust-anchor-telementry" to 
record trust-anchor-telementry in incoming requests.
                        Both _ta-XXXX.<anchor>/NULL and EDNS KEY-TAG options
                        are logged.  [RT #46124]
 2017-10-06 13:01:14 +11:00
Tinderbox User
26cde05da4 regen master 2017-10-06 01:08:15 +00:00
Tinderbox User
ddcf6c7d2b update copyright notice / whitespace 2017-10-05 23:45:49 +00:00
Evan Hunt
94f3abed4c [master] remove no-longer-needed check for nonexistence 2017-10-05 11:35:23 -07:00
Evan Hunt
3f3b51e7af [master] fix error reporting on fclose() failure [RT #46199] 2017-10-05 11:07:21 -07:00
Evan Hunt
6e51774a60 [master] remove cds test that fails with --enable-fixed-rrset 2017-10-05 09:58:52 -07:00
Evan Hunt
ba37674d03 [master] dnssec-cds 
4757.   [func]          New "dnssec-cds" command creates a new parent DS
                        RRset based on CDS or CDNSKEY RRsets found in
                        a child zone, and generates either a dsset file
                        or stream of nsupdate commands to update the
                        parent. Thanks to Tony Finch. [RT #46090]
 2017-10-05 01:04:18 -07:00
Michał Kępień
14afc8425b [master] Prevent dig INSIST failures and hangs in some failure modes 
4756.	[bug]		Interrupting dig could lead to an INSIST failure after
			certain errors were encountered while querying a host
			whose name resolved to more than one address.  Change
			4537 increased the odds of triggering this issue by
			causing dig to hang indefinitely when certain error
			paths were evaluated.  dig now also retries TCP queries
			(once) if the server gracefully closes the connection
			before sending a response. [RT #42832, #45159]
 2017-10-05 09:42:31 +02:00
Evan Hunt
d7ee3ed488 [master] don't log when NZF file doesn't exist 
4755.	[cleanup]	Silence unnecessary log message when NZF file doesn't
			exist. [RT #46186]
 2017-10-05 00:12:14 -07:00
Evan Hunt
c370305901 [master] 4754. [bug] dns_zone_setview needs a two stage commit to properly 
handle errors. [RT #45841]
 2017-10-04 23:44:15 -07:00
Evan Hunt
9a28f66610 [master] copy the color-coded test functions to conf.sh.win32 2017-10-04 09:27:40 -07:00
Mark Andrews
055d310e54 add L for wide 2017-10-04 20:44:01 +11:00
Mark Andrews
4615bc5408 stderr to /dev/null also 2017-10-04 19:26:44 +11:00
Mark Andrews
d1e823af15 test for 'printf' 2017-10-04 19:18:56 +11:00
Evan Hunt
e1c96ad444 [master] tag mismatches 2017-10-03 19:38:59 -07:00
Tinderbox User
ca0ae70046 update copyright notice / whitespace 2017-10-03 23:45:48 +00:00
Evan Hunt
a5a60037e5 [master] fix out-of-order synchronization that affected the dnssec test 2017-10-03 14:07:08 -07:00
Mark Andrews
57c04ec865 address shadowed warning 2017-10-04 07:29:13 +11:00
Evan Hunt
9510de7849 [master] fix a test error in smartsign 2017-10-03 12:19:36 -07:00
Evan Hunt
b47814be1c [master] address shadowed variable warning 2017-10-03 11:53:46 -07:00
Evan Hunt
e515fae2ae [master] dnssec-signzone can now add sync records 
4751.	[func]		"dnssec-signzone -S" can now automatically add parent
			synchronization records (CDS and CDNSKEY) according
			to key metadata set using the -Psync and -Dsync
			options to dnssec-keygen and dnssec-settime.
			[RT #46149]
 2017-10-03 01:11:36 -07:00
Evan Hunt
762dc8b871 [master] rndc managed-keys destroy 
4750.	[func]		"rndc managed-keys destroy" shuts down RFC 5011 key
			maintenance and deletes the managed-keys database.
			If followed by "rndc reconfig" or a server restart,
			key maintenance is reinitialized from scratch.
			This is primarily intended for testing. [RT #32456]
 2017-10-03 01:05:46 -07:00
Evan Hunt
f29359299a [master] de-DLV 
4749.	[func]		The ISC DLV service has been shut down, and all
			DLV records have been removed from dlv.isc.org.
			- Removed references to ISC DLV in documentation
			- Removed DLV key from bind.keys
			- No longer use ISC DLV by default in delv
			[RT #46155]
 2017-10-03 00:41:57 -07:00
Mark Andrews
a009d03a1a 4748. [cleanup] Sprintf to snprintf coversions. [RT #46132] 2017-10-03 14:54:19 +11:00
Mark Andrews
c85b467dc0 4747. [func] Synthesis of responses from DNSSEC-verified records. 
Stage 3 - synthesize NODATA responses. [RT #40138]
 2017-10-03 11:16:37 +11:00
Tinderbox User
a57a6dbe62 update copyright notice / whitespace 2017-09-29 23:45:51 +00:00
Evan Hunt
3bb6150cae [master] color-coded test output 
4745.	[test]		Add color-coded pass/fail messages to system
			tests when running on terminals that support them.
			[RT #45977]
 2017-09-29 12:20:55 -07:00
Tinderbox User
5fbc5c9225 regen master 2017-09-29 01:08:37 +00:00
Mark Andrews
dc0a792d94 4744. [bug] Suppress trust-anchor-telementry queries if 
validation is disabled. [RT #46131]
 2017-09-29 09:33:06 +10:00
Evan Hunt
24172bd2ee [master] completed and corrected the crypto-random change 
4724.	[func]		By default, BIND now uses the random number
			functions provided by the crypto library (i.e.,
			OpenSSL or a PKCS#11 provider) as a source of
			randomness rather than /dev/random.  This is
			suitable for virtual machine environments
			which have limited entropy pools and lack
			hardware random number generators.

			This can be overridden by specifying another
			entropy source via the "random-device" option
			in named.conf, or via the -r command line option;
			however, for functions requiring full cryptographic
			strength, such as DNSSEC key generation, this
			cannot be overridden. In particular, the -r
			command line option no longer has any effect on
			dnssec-keygen.

			This can be disabled by building with
			"configure --disable-crypto-rand".
			[RT #31459] [RT #46047]
 2017-09-28 10:09:22 -07:00
Mark Andrews
86e5d14e82 improve forensics 2017-09-28 22:14:30 +10:00
Mark Andrews
e00fdad191 4742. [func] Synthesis of responses from DNSSEC-verified records. 
Stage 2 - synthesis of records from wildcard data.
                        If the dns64 or filter-aaaa* is configured then the
                        involved lookups are currently excluded. [RT #40138]
 2017-09-28 15:16:26 +10:00
Mark Andrews
f9f3f20d2d 4739. [cleanup] Address clang static analysis warnings. [RT #45952] 2017-09-27 10:27:09 +10:00
Mark Andrews
744061a03b 4738. [port] win32: strftime mishandles %Z. [RT #46039] 2017-09-26 23:32:40 +10:00
Mark Andrews
08151d7fce 4737. [cleanup] Address Coverity warnings. [RT #46012] 2017-09-26 23:21:49 +10:00
Mukund Sivaraman
eb1e4cce6c Refactor 
Reviewed on Jabber by Evan.
 2017-09-26 14:54:36 +05:30
Tinderbox User
ffbe6b9537 update copyright notice / whitespace 2017-09-19 23:46:23 +00:00
Mukund Sivaraman
32bcafc316 Change default minimal-responses setting to no-auth-recursive (#46016) 2017-09-19 19:49:02 +05:30
Mukund Sivaraman
e2ed24aa4d Fix use after free when closing an LMDB (#46000) 2017-09-19 19:42:13 +05:30
Tinderbox User
cb5bc50c91 update copyright notice / whitespace 2017-09-18 23:48:50 +00:00
Evan Hunt
49740fb0f2 [master] add I: when echoing information about failed tests 2017-09-18 14:15:37 -07:00
Michał Kępień
f665c724e4 [master] Prevent possible infinite signing loop after retransferring an inline-signed slave using NSEC3 
4727.	[bug]		Retransferring an inline-signed slave using NSEC3
			around the time its NSEC3 salt was changed could result
			in an infinite signing loop. [RT #45080]
 2017-09-18 09:18:45 +02:00
Mark Andrews
0bcb8b0b7c 4725. [bug] Nsupdate: "recvsoa" was incorrectly reported for 
failures in sending the update message.  The correct
                        location to be reported is "update_completed".
                        [RT #46014]
 2017-09-18 14:28:39 +10:00
Francis Dupont
aed87173fd Moved last occurrence of ns_g_entropy to named_g_entropy 2017-09-17 09:50:10 +02:00
Francis Dupont
9c829f4f96 Merged rt31459d (openssl random) 2017-09-16 13:53:29 +02:00
Mark Andrews
3128cd21e3 4723. [bug] Statistics counter DNSTAPdropped was misidentified 
as DNSSECdropped. [RT #46002]
 2017-09-14 23:51:19 +00:00
Tinderbox User
f54a365aeb update copyright notice / whitespace 2017-09-14 23:46:40 +00:00
Evan Hunt
364cabf431 [master] revert dlzexternal changes for portability 2017-09-14 11:33:24 -07:00
Mark Andrews
5fb0c09a5e #include <isc/string.h> 2017-09-14 18:54:46 +10:00
Mark Andrews
cb629cdeda more str{n}{cat,cpy} corrections rt45981_stage2 2017-09-14 18:11:56 +10:00
Mukund Sivaraman
bbe9f1dd95 Link dlzexternal system test's driver against libisc 2017-09-14 13:23:41 +05:30
Tinderbox User
e3bd90ee1b regen master 2017-09-14 01:12:10 +00:00
Tinderbox User
33987cb5fd update copyright notice / whitespace 2017-09-13 23:48:32 +00:00
Mark Andrews
21c12d0107 fix filenamelen so it has the buffer length rather than buffer length - 1 2017-09-14 09:29:28 +10:00
Mukund Sivaraman
188fa6ea68 Add missing <isc/print.h> 2017-09-13 19:44:47 +05:30
Francis Dupont
804ca1d926 Added isc/string.h to shutdown_test which got strlcpy 2017-09-13 14:34:54 +02:00
Evan Hunt
114f95089c [master] cleanup strcat/strcpy 
4722.	[cleanup]	Clean up uses of strcpy() and strcat() in favor of
			strlcpy() and strlcat() for safety. [RT #45981]
 2017-09-13 00:14:37 -07:00
Evan Hunt
06b082c230 [rt31459d] fix first if test in setoption 
(cherry picked from commit abda73147d)
 2017-09-12 23:51:51 -07:00
Evan Hunt
20502f35dd [master] allow CDS/CDNSKEY records to be signed with only KSK 
4721.	[func]		'dnssec-signzone -x' and 'dnssec-dnskey-kskonly'
			options now apply to CDNSKEY and DS records as well
			as DNSKEY. Thanks to Tony Finch. [RT #45689]
 2017-09-12 23:09:48 -07:00
Evan Hunt
cc24a8725f [rt31459d] update the newer tools 2017-09-12 22:49:35 -07:00
Mark Andrews
e930487ce7 give more time for the initial signing of bits in the inline signing test to complete 2017-09-13 12:18:59 +10:00
Evan Hunt
586e65ea5c [rt31459d] rebased rt31459c 2017-09-12 19:05:46 -07:00
Mark Andrews
abda73147d fix first if test in setoption 2017-09-13 11:57:00 +10:00
Evan Hunt
30973087a0 [master] add prefetch stat counter 
4720.	[func]		Added a statistics counter to track prefetch
			queries. [RT #45847]
 2017-09-12 18:41:47 -07:00
Mark Andrews
34130ee25a 4719. [bug] Address PVS static analyzer warnings. [RT #45946] 2017-09-13 09:50:51 +10:00
Tinderbox User
1e33899f86 update copyright notice / whitespace 2017-09-12 23:46:14 +00:00
Evan Hunt
25b33bede4 [master] improve handling of qcount=0 replies 
4717.	[bug]		Treat replies with QCOUNT=0 as truncated if TC=1,
			FORMERR if TC=0, and log the error correctly.
			[RT #45836]
 2017-09-12 15:26:30 -07:00
Evan Hunt
534c43860e [master] update copyrights 2017-09-11 17:47:12 -07:00
Evan Hunt
f3ce87e1a1 [master] copyrights 2017-09-11 17:01:09 -07:00
Tinderbox User
0d9572e437 update copyright notice / whitespace 2017-09-11 23:46:33 +00:00
Evan Hunt
b103b0c011 [master] remap getaddrinfo() to irs_getgetaddrinfo() 
The libirs version of getaddrinfo() cannot be called from within BIND9.
 2017-09-11 15:03:57 -07:00
Evan Hunt
2e0493c046 [master] add print.h 2017-09-11 12:37:58 -07:00
Evan Hunt
3363f3147a [master] DNS Response Policy Service API 
4713.	[func]		Added support for the DNS Response Policy Service
			(DNSRPS) API, which allows named to use an external
			response policy daemon when built with
			"configure --enable-dnsrps".  Thanks to Vernon
			Schryver and Farsight Security. [RT #43376]
 2017-09-11 11:57:43 -07:00
Evan Hunt
8e014c45ae [master] dig: retain domain when retrying with tcp 
4712.	[bug]		"dig +domain" and "dig +search" didn't retain the
			search domain when retrying with TCP. [RT #45547]
 2017-09-11 10:10:16 -07:00
Evan Hunt
3e66721b35 [master] add missing rrtypes to genzones 
4711.	[test]		Some RR types were missing from genzones.sh.
			[RT #45782]
 2017-09-11 09:34:41 -07:00
Tinderbox User
8334115783 regen master 2017-09-10 01:10:23 +00:00
Tinderbox User
672586440b update copyright notice / whitespace 2017-09-09 23:46:01 +00:00
Evan Hunt
e06d728f13 [master] removed outdated library reference 2017-09-09 11:49:04 -07:00
Francis Dupont
90f6140832 Finished merge of rt45019 (openssl hash default) 2017-09-09 10:30:16 +02:00
Evan Hunt
bcb7c7fdad [master] fix tag 2017-09-08 18:22:12 -07:00
Evan Hunt
8eb88aafee [master] add libns and remove liblwres 
4708.   [cleanup]       Legacy Windows builds (i.e. for XP and earlier)
                        are no longer supported. [RT #45186]

4707.	[func]		The lightweight resolver daemon and library (lwresd
			and liblwres) have been removed. [RT #45186]

4706.	[func]		Code implementing name server query processing has
			been moved from bin/named to a new library "libns".
			Functions remaining in bin/named are now prefixed
			with "named_" rather than "ns_".  This will make it
			easier to write unit tests for name server code, or
			link name server functionality into new tools.
			[RT #45186]
 2017-09-08 13:47:34 -07:00
Mark Andrews
164616cb9c don't attempt to link -lcrypto multiple times 2017-09-08 16:15:37 +10:00
Evan Hunt
509ba96497 [rt45019] separate DNS_CRYPTO_LIBS from ISC_OPENSSL_LIBS and use both 2017-09-07 22:05:20 -07:00
Mark Andrews
b6b33d0f48 ISCLIBS should be after DNSLIBS 2017-09-08 12:52:48 +10:00
Tinderbox User
7bd8900aa8 update copyright notice / whitespace 2017-09-07 23:46:43 +00:00
Evan Hunt
1fd1c0b027 [rt45019] fix some library ordering problems 2017-09-06 23:01:54 -07:00
Mark Andrews
7e40d6274e 4703. [bug] BINDInstall.exe was missing some buffer length checks. 
[RT #45898]
 2017-09-07 12:56:16 +10:00
Tinderbox User
40780aa36f update copyright notice / whitespace 2017-09-06 23:46:23 +00:00
Mark Andrews
023ab19634 add quotes arount $send_response 2017-09-06 19:26:10 +10:00
Mark Andrews
b56021f0be silence 'staleanswersok' may be used uninitialized in this function warning. [RT #14147 2017-09-06 12:16:10 +10:00
Tinderbox User
95bbb75143 regen master 2017-09-06 01:11:43 +00:00
Mark Andrews
d1cd273b7b fix merge error 2017-09-06 10:04:17 +10:00
Mark Andrews
df50751585 4700. [func] Serving of stale answers is now supported. This 
allows named to provide stale cached answers when
                        the authoritative server is under attack.
                        See max-stale-ttl, stale-answer-enable,
                        stale-answer-ttl. [RT #44790]
 2017-09-06 09:58:29 +10:00
Tinderbox User
421f833b67 update copyright notice / whitespace 2017-09-04 23:46:16 +00:00
Mark Andrews
e2a737bcb8 4699. [func] Multiple cookie-secret clauses can now be specified. 
The first one specified is used to generate new
                        server cookies.  [RT #45672]
 2017-09-05 09:19:45 +10:00
Michał Kępień
a5dc1bc395 [master] Add --with-python-install-dir configure option 
4698.	[port]		Add --with-python-install-dir configure option to allow
			specifying a nonstandard installation directory for
			Python modules. [RT #45407]
 2017-09-04 08:40:23 +02:00
Mark Andrews
39a7292aab check for dnssec support 2017-09-04 10:23:03 +10:00
Tinderbox User
24036b61f6 update copyright notice / whitespace 2017-09-01 23:45:56 +00:00
Mark Andrews
eb7c571e93 specify algorithm 2017-09-01 15:34:38 +10:00
Mark Andrews
0f1fc8f421 specify algorithm; remove partial duplicate test; add missing test numbers 2017-09-01 14:52:26 +10:00
Tinderbox User
e640ea9343 regen master 2017-09-01 01:11:29 +00:00
Evan Hunt
5999f1ebd6 [master] initialize result and rdataset variables 2017-08-31 14:20:00 -07:00
Mark Andrews
2e743d9bdc Squashed commit of the following: 
commit 2a0e5695da2e0f701191e2783209ac05c9d01e6c
Author: Mark Andrews <marka@isc.org>
Date:   Thu Aug 31 12:15:05 2017 +1000

    remove 'on' from error message

commit f18a8d699b69be35b938cfe2b30ebb30cd78e814
Author: Mark Andrews <marka@isc.org>
Date:   Thu Aug 31 11:58:41 2017 +1000

    add more cookie-secret named-checkconf tests

commit ca8f5f5f57ccbeb970310866523a909eb411a554
Author: Mark Andrews <marka@isc.org>
Date:   Thu Aug 31 11:31:57 2017 +1000

    properly check algorithm names
 2017-08-31 12:19:37 +10:00
Evan Hunt
45afdb2672 [master] remove default algorithm in dnssec-keygen 
4594.	[func]		dnssec-keygen no longer uses RSASHA1 by default;
			the signing algorithm must be specified on
			the command line with the "-a" option.  Signing
			scripts that rely on the existing default behavior
			will break; use "dnssec-keygen -a RSASHA1" to
			repair them. (The goal of this change is to make
			it easier to find scripts using RSASHA1 so they
			can be changed in the event of that algorithm
			being deprecated in the future.) [RT #44755]
 2017-08-30 18:51:11 -07:00
Tinderbox User
2bfc294f0a regen master 2017-08-31 01:11:54 +00:00
Tinderbox User
587f005032 update copyright notice / whitespace 2017-08-30 23:46:18 +00:00
Mark Andrews
0aed466565 4693. [func] Synthesis of responses from DNSSEC-verified records. 
Stage 1 covers NXDOMAIN synthesis from NSEC records.
                        This is controlled by synth-from-dnssec and is enabled
                        by default. [RT #40138]
 2017-08-31 07:57:50 +10:00
Tinderbox User
a5d6b4c4c8 regen master 2017-08-30 01:12:14 +00:00
Tinderbox User
731ec8ce9b update copyright notice / whitespace 2017-08-29 23:46:16 +00:00
Michał Kępień
efe7977c4d [master] Add -4/-6 command line options to nsupdate and rndc 
4691.	[func]		Add -4/-6 command line options to nsupdate and rndc.
			[RT #45632]
 2017-08-29 10:21:54 +02:00
Michał Kępień
d6814700de [master] Ensure consistent handling of -4/-6 command line options in all tools 
4690.	[bug]		Command line options -4/-6 were handled inconsistently
			between tools. [RT #45632]
 2017-08-29 10:19:38 +02:00
Evan Hunt
391a3a2f20 [master] turn on minimal responses for CDS/CDNSKEY 
4678.	[cleanup]	Turn on minimal responses for CDNSKEY and CDS in
			addition to DNSKEY and DS. Thanks to Tony Finch.
			[RT #45690]
 2017-08-25 13:31:53 -07:00
Mark Andrews
07741d43c8 4688. [protocol] Check and display EDNS KEY TAG options (RFC 8145) in 
messages. [RT #44804]
 2017-08-25 08:38:19 +10:00
Tinderbox User
2a08a599ee regen master 2017-08-22 01:11:12 +00:00
Tinderbox User
a08f49ae17 update copyright notice / whitespace 2017-08-21 23:48:07 +00:00
Michał Kępień
330365566d [master] Prevent dnssec-settime from printing a bogus warning 
4686.	[bug]		dnssec-settime -p could print a bogus warning about
			key deletion scheduled before its inactivation when a
			key had an inactivation date set but no deletion date
			set. [RT #45807]
 2017-08-21 10:20:10 +02:00
Michał Kępień
5201b96d03 [master] Fix calculation of dates for a successor key 
4685.	[bug]		dnssec-settime incorrectly calculated publication and
			activation dates for a successor key. [RT #45806]
 2017-08-21 09:55:36 +02:00
Michał Kępień
367fcd7454 [master] Prevent delv from sending bogus queries for provided server address 
4684.	[bug]		delv could send bogus DNS queries when an explicit
			server address was specified on the command line along
			with -4/-6. [RT #45804]
 2017-08-21 09:18:13 +02:00
Tinderbox User
5fbe52fbce regen master 2017-08-18 01:11:45 +00:00
Tinderbox User
22eb446339 update copyright notice / whitespace 2017-08-17 23:46:21 +00:00
Michał Kępień
1aa583b5a5 [master] Prevent nsupdate from immediately exiting on invalid user input in interactive mode 
4683.	[bug]		Prevent nsupdate from immediately exiting on invalid
			user input in interactive mode. [RT #28194]
 2017-08-17 08:29:12 +02:00
Mark Andrews
615b961e02 4682. [bug] Don't report errors on records below a DNAME. 
[RT #44880]
 2017-08-17 15:49:59 +10:00
Tinderbox User
6a14924454 update copyright notice / whitespace 2017-08-15 23:47:19 +00:00
Mark Andrews
52fd57c989 4681. [bug] Log messages from the validator now include the 
associated view unless the view is "_default/IN"
                        or "_dnsclient/IN". [RT #45770]
 2017-08-16 09:29:20 +10:00
Mark Andrews
e85a2c5624 'uname -o' is not portable, suppress error message; remove spurious cat tmp.out; provide forensics for failure analysis 2017-08-15 18:02:24 +10:00
Tinderbox User
1c3b9b7666 update copyright notice / whitespace 2017-08-14 23:48:00 +00:00
Michał Kępień
b55ec74eaa [master] Fix master address failover when GSS-API is used 
4680.	[bug]		Fix failing over to another master server address when
			nsupdate is used with GSS-API. [RT #45380]
 2017-08-14 15:00:25 +02:00
Michał Kępień
877c264edc [master] Make dnssec-verify suggest using -o when appropriate 
4679.	[cleanup]	Suggest using -o when dnssec-verify finds a SOA record
			not at top of zone and -o is not used. [RT #45519]
 2017-08-14 14:01:27 +02:00
Mark Andrews
00f067539a sort options 2017-08-14 21:40:59 +10:00
Evan Hunt
b2bf8de2a3 [master] split up main and add callback function pointers to support iOS 
4677.	[port]		Split up the main function in dig to better support
			the iOS app version. [RT #45508]
 2017-08-10 22:51:24 -07:00
Mukund Sivaraman
b9532d9cf3 Turn on glue-cache by default 
- We decided to do this on the weekly BIND dev meeting
- Mark reviewed patch on Jabber
 2017-08-10 09:06:54 +05:30
Tinderbox User
20809d0a5a regen master 2017-08-10 01:11:49 +00:00
Tinderbox User
f4eb664ce3 update copyright notice / whitespace 2017-08-09 23:47:50 +00:00
Mark Andrews
ff8d856db0 4675. [cleanup] Don't use C++ keyword class. [RT #45726] 2017-08-10 08:42:04 +10:00
Evan Hunt
c8b76b0168 [master] remove sigchase reference in system test 2017-08-09 13:25:15 -07:00
Evan Hunt
c4cfb0b4dc [master] remove dig +sigchase 
4674.   [func]          "dig +sigchase", and related options "+topdown" and
                        "+trusted-keys", have been removed. Use "delv" for
                        queries with DNSSEC validation. [RT #42793]
 2017-08-09 11:03:27 -07:00
Evan Hunt
cdacec1dcb [master] silence gcc 7 warnings 
4673.	[port]		Silence GCC 7 warnings. [RT #45592]
 2017-08-09 00:17:44 -07:00
Evan Hunt
0ad72b96d2 [master] ensure verified_sig 
4670.	[cleanup]	Ensure that a request MAC is never sent back
			in an XFR response unless the signature was
                        verified. [RT #45494]
 2017-08-07 18:54:05 -07:00
Tinderbox User
12ed5d34b9 update copyright notice / whitespace 2017-08-04 23:46:19 +00:00
Evan Hunt
61367c604c [master] refactor resquery_response() and related functions 
4669.	[func]		Iterative query logic in resolver.c has been
			refactored into smaller functions and commented,
			for improved readability, maintainability and
			testability. [RT #45362]
 2017-08-04 16:08:11 -07:00
Tinderbox User
be33f4ead1 update copyright notice / whitespace 2017-08-03 23:46:14 +00:00
Mark Andrews
2019cf29e2 4668. [bug] Use localtime_r and gmtime_r for thread safety. 
[RT #45664]
 2017-08-03 08:42:27 +10:00
Tinderbox User
7f18709b08 regen master 2017-08-02 01:09:18 +00:00
Tinderbox User
b74e1c3b50 update copyright notice / whitespace 2017-08-01 23:46:29 +00:00
Michał Kępień
712825d755 [master] Refactor RDATA unit tests 
4667.	[cleanup]	Refactor RDATA unit tests. [RT #45610]
 2017-08-01 12:15:21 +02:00
Tinderbox User
8cc38b581c regen master 2017-08-01 01:08:53 +00:00
Evan Hunt
681deaaa39 [master] parse numeric domain names correctly 
4666.	[bug]		dnssec-keymgr: Domain names beginning with digits (0-9)
			could cause a parser error when reading the policy
			file. This now works correctly so long as the domain
			name is quoted. [RT #45641]
 2017-07-31 10:43:57 -07:00
Francis Dupont
9b9182fe00 Added Ed25519 support (#44696) 2017-07-31 15:26:00 +02:00
Tinderbox User
93ae9a09a9 regen master 2017-07-29 01:10:15 +00:00
Tinderbox User
9edeb0f922 update copyright notice / whitespace 2017-07-28 23:46:10 +00:00
Evan Hunt
268cea9c12 [master] glue-cache option 
4664.	[func]		Add a "glue-cache" option to enable or disable the
			glue cache. The default is "no" to reduce memory
			usage, but enabling this option will improve
			performance in delegation-heavy zones. [RT #45125]
 2017-07-28 12:57:50 -07:00
Evan Hunt
cee0d603a3 [master] remove unnecessary acronym expansions 2017-07-28 12:22:31 -07:00
Michał Kępień
c150f68609 [master] Clarify error message printed by dnssec-dsfromkey 
4663.	[cleanup]	Clarify error message printed by dnssec-dsfromkey.
			[RT #21731]
 2017-07-28 10:29:22 +02:00
Mark Andrews
71cd6910ba 4659. [bug] Remove spurious log message about lmdb-mapsize 
not being supported when parsing builtin
                        configuration file. [RT #45618]
 2017-07-28 16:02:52 +10:00
Mark Andrews
c91e61f57e add semicolon 2017-07-28 15:59:22 +10:00
Mark Andrews
e54f256bb4 4658. [bug] Clean up build directory created by "setup.py install" 
immediately.  [RT #45628]
 2017-07-28 15:54:45 +10:00
Tinderbox User
f192875d12 update copyright notice / whitespace 2017-07-26 23:46:18 +00:00
Michał Kępień
984a28c771 [master] Properly handle errors in rrchecker system test 
4657.	[bug]		rrchecker system test result could be improperly
			determined. [RT #45602]
 2017-07-26 10:40:06 +02:00
Michał Kępień
383240d572 [master] Process "port" and "dscp" for "default-masters" 
4656.	[bug]		Apply "port" and "dscp" values specified in catalog
			zone's "default-masters" option to the generated
			configuration of its member zones. [RT #45545]
 2017-07-26 09:28:28 +02:00
Tinderbox User
9ab5ec1d72 update copyright notice / whitespace 2017-07-21 23:46:06 +00:00
Mark Andrews
4bf32aa587 4654. [cleanup] Don't use C++ keywords delete, new and namespace. 
[RT #45538]
 2017-07-21 11:52:24 +10:00
Tinderbox User
0297ebcc89 update copyright notice / whitespace 2017-07-20 23:45:27 +00:00
Mark Andrews
124712666e 4653. [bug] Reorder includes to move @DST_OPENSSL_INC@ and 
@ISC_OPENSSL_INC@ after shipped include directories.
                        [RT #45581]
 2017-07-20 11:52:03 +10:00
Tinderbox User
b55ae9abd2 update copyright notice / whitespace 2017-07-19 23:45:23 +00:00
Mark Andrews
a5a4cf96c6 4653. [bug] Reorder includes in bin/nsupdate/Makefile.in. 
[RT #45581]
 2017-07-20 09:34:23 +10:00
Mark Andrews
cda91a09e4 4651. [bug] Nsupdate could attempt to use a zeroed address on 
server timeout. [RT #45417]

(cherry picked from commit dac36869f3)
 2017-07-19 15:36:41 +10:00
Mark Andrews
6375d42bae 4651. [bug] Nsupdate could attempt to use a zeroed address on 
server timeout. [RT #45417]

(cherry picked from commit 38edf586f9)
 2017-07-19 15:36:41 +10:00
Tinderbox User
a9404a04a5 update copyright notice / whitespace 2017-07-11 01:46:41 +00:00
Mark Andrews
abe5cf42b3 4649. [bug] The wrong zone was logged when a catalog zone is added. 
[RT #45520]
 2017-07-10 10:36:56 +10:00
Mark Andrews
1e9b39fe26 4648. [bug] "rndc reconfig" on a slave no longer causes all member 
zones of configured catalog zones to be removed from
                        configuration. [RT #45310]
 2017-07-10 09:06:13 +10:00
Ray Bellis
70676a01eb fixed new warning with previous iOS patch 2017-07-04 12:12:11 +01:00
Ray Bellis
03a4e4381e fix warnings from iOS build of dig 2017-07-04 11:51:36 +01:00
Mark Andrews
f7a22ae512 loop waiting for ns4/managed-keys.bind to be written 2017-07-04 15:53:12 +10:00
Tinderbox User
67fa096a59 update copyright notice / whitespace 2017-06-30 23:45:35 +00:00
Evan Hunt
b05b3fab3c [master] fix RSA parsing when md5 disabled 
4645.	[bug]		Fix PKCS#11 RSA parsing when MD5 is disabled.
			[RT #45300]
 2017-06-29 15:53:35 -07:00
Evan Hunt
0d90835d2a [master] enhanced rfc 5011 logging 
4642.	[cleanup]	Add more logging of RFC 5011 events affecting the
			status of managed keys: newly observed keys,
			deletion of revoked keys, etc. [RT #45354]
 2017-06-27 10:49:43 -07:00
Mark Andrews
b551ee14bd 4640. [bug] If query_findversion failed in query_getdb due to 
memory failure the error status was incorrectly
                        discarded. [RT #45331]
 2017-06-23 17:17:28 +10:00
Mark Andrews
5aa648e8f4 add const 2017-06-17 16:13:27 +10:00
Mark Andrews
94eff196e4 4637 broke old style command line with a salt of '-' [RT #45388] 2017-06-16 12:45:36 +10:00
Tinderbox User
d6b626e9a7 regen master 2017-06-14 01:08:21 +00:00
Tinderbox User
a00838da96 update copyright notice / whitespace 2017-06-13 23:45:34 +00:00
Evan Hunt
19a72397da [master] put in a missing #ifdef section 2017-06-13 14:50:49 -07:00
Evan Hunt
bf05e66bb3 [master] prevent reload failure due to LMDB database perms 
4638.	[bug]		Reloading or reconfiguring named could fail on
			some platforms when LMDB was in use. [RT #45203]
 2017-06-13 10:15:34 -07:00
Evan Hunt
0471530aae [master] nsec3hash -r 
4637.	[func]		"nsec3hash -r" option ("rdata order") takes arguments
			in the same order as they appear in NSEC3 or
			NSEC3PARAM records, so that NSEC3 parameters can
			be cut and pasted from an existing record. Thanks
			to Tony Finch for the contribution. [RT #45183]
 2017-06-13 00:39:10 -07:00
Mark Andrews
e85e95c19e 4636. [bug] Normalize rpz policy zone names when checking for 
existence. [RT #45358]
 2017-06-13 13:06:47 +10:00
Mukund Sivaraman
2c11da8441 Don't log NSDNAME failures as NSIP (#45052) 2017-06-12 14:04:15 +05:30
Tinderbox User
3e7ed60f99 update copyright notice / whitespace 2017-06-08 23:45:23 +00:00
Michał Kępień
9e94f388a7 Revert "4634. [test] Avoid races in mkeys test. [RT #45293]" 
This reverts commit 54d4737b7f.
 2017-06-08 14:19:36 +02:00
Michał Kępień
54d4737b7f 4634. [test] Avoid races in mkeys test. [RT #45293] 2017-06-08 13:40:27 +02:00
Tinderbox User
bb01fced12 update copyright notice / whitespace 2017-05-30 23:45:32 +00:00
Evan Hunt
967a3b9419 [master] quote service registry paths 
4532.	[security]	The BIND installer on Windows used an unquoted
                        service path, which can enable privilege escalation.
			(CVE-2017-3141) [RT #45229]
 2017-05-30 13:35:59 -07:00
Evan Hunt
2648c49be7 [master] fix rpz formerr loop 
4531.	[security]	Some RPZ configurations could go into an infinite
			query loop when encountering responses with TTL=0.
			(CVE-2017-3140) [RT #45181]
 2017-05-30 12:30:28 -07:00
Mark Andrews
aa3a8979bc 4530. [bug] "dyndb" is dependent on dlopen existing / being 
enabled. [RT #45291]
 2017-05-30 11:34:37 +10:00
Mark Andrews
e51d62ecae 4629. [bug] dns_client_startupdate could not be called with a 
running client. [RT #45277]
 2017-05-30 09:47:41 +10:00
Tinderbox User
f8d33c2b2a update copyright notice / whitespace 2017-05-28 23:45:39 +00:00
Evan Hunt
594eadcc34 [master] Add DLZ db version to activeversions 
4628.	[bug]		Fixed a potential reference leak in query_getdb().
			[RT #45247]
 2017-05-28 14:26:54 -07:00
Evan Hunt
5f6aa5954c [master] Use 127.0.0.1 as interface for rndc in logfileconfig test 2017-05-28 14:23:06 -07:00
Mark Andrews
0a78894304 test crypto support 2017-05-26 16:03:49 +10:00
Tinderbox User
e085a5fc5e update copyright notice / whitespace 2017-05-24 23:45:29 +00:00
Mark Andrews
b9c5b37e0c make chain system test work with python 3 2017-05-24 21:40:41 +10:00
Mark Andrews
a5dc0d5066 use 'python -u' to run python scripts 2017-05-24 15:09:39 +10:00
Evan Hunt
0221bfed7d [master] copyrights 2017-05-23 16:40:42 -07:00
Evan Hunt
6d7693c4af [master] add chain ordering tests 
4626.	[test]		Added more tests for handling of different record
			ordering in CNAME and DNAME responses. [QA #430]
 2017-05-22 17:05:55 -07:00
Evan Hunt
03a7a952c0 [master] don't keep an LMDB transaction open across an exclusive section 
4625.	[bug]		Running "rndc addzone" and "rndc delzone" at close
			to the same time could trigger a deadlock if using
			LMDB. [RT #45209]
 2017-05-16 08:47:20 -07:00
Mark Andrews
1611ceb8b2 4622. [bug] Remove unnecessary escaping of semicolon in CAA and 
URI records. [RT #45216]
 2017-05-11 10:54:52 +10:00
Mark Andrews
0c18eb4783 4619. [bug] Call isc_mem_put instead of isc_mem_free in 
bin/named/server.c:setup_newzones. [RT #45202]
 2017-05-10 11:10:43 +10:00
Tinderbox User
b439455672 update copyright notice / whitespace 2017-05-08 23:45:33 +00:00
Mark Andrews
31f4fb98e2 4617. [test] Update rndc system test to be more delay tolerant. 
[RT #45177]
 2017-05-09 04:07:48 +10:00
Evan Hunt
3a554a444c [master] fix lmdb delzone 
4616.	[bug]		When using LMDB, zones deleted using "rndc delzone"
			were not correctly removed from the new-zone
			database. [RT #45185]
 2017-05-04 12:32:32 -07:00
Tinderbox User
b168f3f805 update copyright notice / whitespace 2017-05-02 23:45:36 +00:00
Mark Andrews
33e94f501f 4615. [bug] AD could be set on truncated answer with no records 
present in the answer and authority sections.
                        [RT #45140]
 2017-05-03 07:51:41 +10:00
Mark Andrews
78551a3f2c remove unused assignments [RT #45147] 2017-05-03 07:45:18 +10:00
Evan Hunt
d39ab7440e [master] automatically tune max-journal-size 
4613.	[func]		By default, the maximum size of a zone journal file
			is now twice the size of the zone's contents (there
			is little benefit to a journal larger than this).
			This can be overridden by setting "max-journal-size"
			to "unlimited" or to an explicit value up to 2G.
			Thanks to Tony Finch. [RT #38324]
 2017-05-02 13:23:08 -07:00
Tinderbox User
57994a07f7 regen master 2017-04-27 00:43:03 +00:00
Tinderbox User
08e0f8fcfa update copyright notice / whitespace 2017-04-26 23:45:32 +00:00
Mukund Sivaraman
241b49e611 Set a LMDB mapsize and also provide a config option to control it (#44954) 2017-04-26 23:51:26 +05:30
Tinderbox User
c118d16a1c regen master 2017-04-25 01:06:00 +00:00
Tinderbox User
18b7760b29 update copyright notice / whitespace 2017-04-24 23:45:33 +00:00
Evan Hunt
2dfb992349 [master] new-zones-directory option 
4610.	[func]		The "new-zones-directory" option specifies the
			location of NZF or NZD files for storing
			configuration of zones added by "rndc addzone".
			Thanks to Petr Menšík. [RT #44853]
 2017-04-23 23:16:53 -07:00
Mark Andrews
7ef453bf43 4608. [func] DiG now warns about .local queries which are reserved 
for Multicast DNS. [RT #44783]
 2017-04-24 11:56:22 +10:00
Mark Andrews
a14562e120 4606. [port] Stop using experimental "Experimental keys on scalar" 
feature of perl as it has been removed. [RT #45012]
 2017-04-24 11:17:18 +10:00
Tinderbox User
70698c6d17 regen master 2017-04-24 01:06:39 +00:00
Evan Hunt
6ce8a05f6c [master] update copyrights that had been missed recently 2017-04-23 17:06:00 -07:00
Tinderbox User
f5fa655319 regen master 2017-04-23 01:06:11 +00:00
Tinderbox User
1f6505a424 update copyright notice / whitespace 2017-04-22 23:45:41 +00:00
Mukund Sivaraman
03be5a6b4e Improve performance for delegation heavy answers and also general query performance (#44029) 2017-04-22 09:22:44 +05:30
Evan Hunt
8e12350a6f [master] Merge branch 'master' of ssh://repo.isc.org/proj/git/prod/bind9 2017-04-21 16:45:43 -07:00
Tinderbox User
3618b965d1 update copyright notice / whitespace 2017-04-21 23:45:41 +00:00
Evan Hunt
8a28d9f1d4 [master] auto-generate named.conf.docbook 
4603.	[doc]		Automatically generate named.conf(5) man page
			from doc/misc/options. Thanks to Tony Finch.
			[RT #43525]
 2017-04-21 16:27:56 -07:00
Evan Hunt
b9e736f4f6 [master] typo in rndc doc 2017-04-21 13:16:40 -07:00
Mukund Sivaraman
f7c66b31d4 Update fuzzing support to test validating resolver (#44787) 2017-04-21 16:33:18 +05:30
Mukund Sivaraman
b0dbcba2d2 Validate glue before adding it to the additional section (#45062) 2017-04-21 14:51:24 +05:30
Mukund Sivaraman
dd7d1df874 Increase minimum RSA keygen size to 1024 bits (#36895) 2017-04-21 12:00:40 +05:30
Evan Hunt
f5c39b072c [master] hex output mode for dnstap-read 
4594.	[func]		"dnstap-read -x" prints a hex dump of the wire
			format of each logged DNS message. [RT #44816]
 2017-04-20 20:22:19 -07:00
Tinderbox User
2d863323b6 regen master 2017-04-21 01:05:18 +00:00
Evan Hunt
6d19d975c6 [master] python 3 compatibility 
4591.	[port]		Addressed some python 3 compatibility issues.
			Thanks to Ville Skytta. [RT #44955] [RT #44956]
 2017-04-20 17:30:35 -07:00
Tinderbox User
3b443e87a0 update copyright notice / whitespace 2017-04-20 23:45:39 +00:00
Evan Hunt
bdbdc69a75 [master] correct a mistake in nsupdate help 2017-04-20 16:17:19 -07:00
Evan Hunt
66b71679b7 [master] nsupdate: send tkey queries to the right server 
4588.	[bug]		nsupdate could send queries for TKEY to the wrong
			server when using GSSAPI. Thanks to Tomas Hozza.
			[RT #39893]
 2017-04-20 09:28:37 -07:00
Mark Andrews
706c6ac5e2 fix 'minimal-any yes;' to force TCP / UDP 2017-04-20 17:59:45 +10:00
Mark Andrews
600b027731 4587. [bug] named-checkzone failed to handle occulted data below 
DNAMEs correctly. [RT #44877]
 2017-04-20 13:28:48 +10:00
Mark Andrews
033a59090c 4586. [func] dig, host and nslookup now use TCP for ANY queries. 
[RT #44687]
 2017-04-20 13:20:41 +10:00
Mark Andrews
3742338a7b 4585. [port] win32: Set CompileAS value. [RT #42474] 2017-04-20 12:41:40 +10:00
Tinderbox User
e67fe90a1f regen master 2017-04-12 01:05:15 +00:00
Tinderbox User
b4099ed035 update copyright notice / whitespace 2017-04-11 23:45:37 +00:00
Evan Hunt
a477a025d5 [master] correct -M in synopsis 2017-04-11 12:24:10 -07:00
Tinderbox User
38704ecee9 regen master 2017-03-26 01:05:14 +00:00
Tinderbox User
0d9aa35cac update copyright notice / whitespace 2017-03-25 23:45:38 +00:00
Evan Hunt
39eb1d0353 [master] host -A 
4593.	[func]		"host -A" returns most records for a name but
			omits RRSIG, NSEC and NSEC3. (Thanks to Tony Finch.)
			[RT #43032]
 2017-03-25 12:49:25 -07:00
Evan Hunt
db93f3d4b3 [master] document that delv should be used instead of sigchase 2017-03-25 12:22:51 -07:00
Mark Andrews
8e8dfc5941 4582. [security] 'rndc ""' could trigger a assertion failure in named. 
(CVE-2017-3138) [RT #44924]
 2017-03-25 02:00:17 +11:00
Tinderbox User
0fbf291dad update copyright notice / whitespace 2017-03-16 23:46:35 +00:00
Mark Andrews
f94f3e2791 4581. [port] Linux: Add getpid and getrandom to the list of system 
calls named uses for seccomp. [RT #44883]
 2017-03-16 11:21:18 +11:00
Tinderbox User
db1010fe82 update copyright notice / whitespace 2017-03-10 23:46:18 +00:00
Evan Hunt
612b2e2c0d [master] timestamp suffixes for log files 
4579.	[func]		Logging channels and dnstap output files can now
			be configured with a "suffix" option, set to
			either "increment" or "timestamp", indicating
			whether to use incrementing numbers or timestamps
			as the file suffix when rolling over a log file.
			[RT #42838]
 2017-03-08 23:20:40 -08:00
Mark Andrews
9301c35ae6 adjust range 2017-03-02 12:32:04 +11:00
Mark Andrews
d411448ceb allow more time for the IPv6 transfer attemt to timeout and fall over to IPv4 2017-03-02 12:19:10 +11:00
Tinderbox User
02716f97c1 regen master 2017-03-02 01:05:06 +00:00
Tinderbox User
1baa50950b update copyright notice / whitespace 2017-03-01 01:52:56 +00:00
Mark Andrews
f240f4a5de Reimplement: 
4578.   [security]      Some chaining (CNAME or DNAME) responses to upstream
                        queries could trigger assertion failures.
                        (CVE-2017-3137) [RT #44734]
 2017-03-01 12:01:16 +11:00
Tinderbox User
ed5bf0e581 update copyright notice / whitespace 2017-02-28 23:45:28 +00:00
Mark Andrews
02fa49a4d8 fix nsupdate reference 2017-03-01 08:33:09 +11:00
Tinderbox User
e04dff4bfd update copyright notice / whitespace 2017-02-21 23:45:37 +00:00
Witold Krecicki
0790f8a361 4577. [func] Make qtype of resolver fuzzing packet configurable via command line. [RT #43540] 2017-02-21 03:49:55 -08:00
Tinderbox User
e66aaccfd8 update copyright notice / whitespace 2017-02-20 23:45:32 +00:00
Witold Krecicki
fa9b4de716 4576. [func] The RPZ implementation has been substantially refactored for improved performance and reliability. [RT #43449] 2017-02-20 11:57:28 +01:00
Mark Andrews
3bce12e4b6 4575. [security] Dns64 with break-dnssec yes; can result in a 
assertion failure. (CVE-2017-3136) [RT #44653]
 2017-02-15 12:18:51 +11:00
Mark Andrews
af2b20ee3f 4574. [bug] Dig leaked memory with multiple +subnet options. 
[RT #44683]
 2017-02-14 15:52:40 +11:00
Evan Hunt
1df7a6fed6 [master] call flow description was incomplete 2017-02-09 13:52:45 -08:00
Evan Hunt
d16500cece [master] restore some code from change 4556 2017-02-08 17:33:13 -08:00
Tinderbox User
f929677ed8 update copyright notice / whitespace 2017-02-08 23:45:32 +00:00
wpk
96912e44b0 4573. [func] Query logic has been substantially refactored (e.g. query_find function has been split into smaller functions) for improved readability, maintainability 2017-02-08 22:15:01 +01:00
Evan Hunt
d8339932af [master] fix memory leak from dnstap-output parsing 2017-02-06 22:13:51 -08:00
Evan Hunt
c4e4bd6a09 [master] dnstap size and versions options 
4572.	[func]		The "dnstap-output" option can now take "size" and
			"versions" parameters to indicate the maximum size
			a dnstap log file can grow before rolling to a new
			file, and how many old files to retain. [RT #44502]
 2017-02-06 16:34:58 -08:00
Tinderbox User
88ee987de6 update copyright notice / whitespace 2017-02-06 02:58:07 +00:00