From 81f11a70588c6929d1aefd529b940efb70747fc2 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Mon, 10 Jul 2000 22:11:48 +0000 Subject: [PATCH 001/226] 322. [bug] Queries for KEY RRs are now sent to the parent server rather than the authoritative one, making DNSSEC insecurity proofs work in many cases where they previously didn't. --- CHANGES | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGES b/CHANGES index 285cd654c1..a76bad2c67 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,9 @@ +o + 322. [bug] Queries for KEY RRs are now sent to the parent + server rather than the authoritative one, making + DNSSEC insecurity proofs work in many cases + where they previously didn't. + 321. [bug] When synthesizing a CNAME RR for a DNAME response, query_addcname() failed to intitialize the type and class of the CNAME dns_rdata_t, From a7bec08f7cc37d7fceb689caa7a77cf52e45c2b2 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Mon, 10 Jul 2000 22:13:17 +0000 Subject: [PATCH 002/226] the 'controls' statement is now implemented --- doc/misc/options | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/misc/options b/doc/misc/options index cffa338a29..68405a3035 100644 --- a/doc/misc/options +++ b/doc/misc/options @@ -1,7 +1,7 @@ Copyright (C) 2000 Internet Software Consortium. See COPYRIGHT in the source root or http://www.isc.org/copyright for terms. -$Id: options,v 1.29 2000/06/22 21:54:12 tale Exp $ +$Id: options,v 1.30 2000/07/10 22:13:17 gson Exp $ This is a summary of the implementation status of the various named.conf options in BIND 9. @@ -111,7 +111,7 @@ key Yes logging Yes -controls No +controls Yes server ip_addr { [ bogus yes_or_no; ] No From ce8d0fffea20fe03fd0f075263f529ad55f82aac Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Mon, 10 Jul 2000 22:15:42 +0000 Subject: [PATCH 003/226] clarified 322 --- CHANGES | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGES b/CHANGES index a76bad2c67..17f4f3a1f5 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,6 @@ -o + 322. [bug] Queries for KEY RRs are now sent to the parent - server rather than the authoritative one, making + server before the authoritative one, making DNSSEC insecurity proofs work in many cases where they previously didn't. From a4db2a47f544382539c6984a63bdc8d168c49e8f Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Mon, 10 Jul 2000 22:20:43 +0000 Subject: [PATCH 004/226] incremented library version numbers to 1.0.0 --- lib/dns/api | 2 +- lib/isc/api | 2 +- lib/lwres/api | 2 +- lib/omapi/api | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/dns/api b/lib/dns/api index 494278e7f5..91fedd3885 100644 --- a/lib/dns/api +++ b/lib/dns/api @@ -1,3 +1,3 @@ -LIBINTERFACE = 0 +LIBINTERFACE = 1 LIBREVISION = 0 LIBAGE = 0 diff --git a/lib/isc/api b/lib/isc/api index 494278e7f5..91fedd3885 100644 --- a/lib/isc/api +++ b/lib/isc/api @@ -1,3 +1,3 @@ -LIBINTERFACE = 0 +LIBINTERFACE = 1 LIBREVISION = 0 LIBAGE = 0 diff --git a/lib/lwres/api b/lib/lwres/api index 494278e7f5..91fedd3885 100644 --- a/lib/lwres/api +++ b/lib/lwres/api @@ -1,3 +1,3 @@ -LIBINTERFACE = 0 +LIBINTERFACE = 1 LIBREVISION = 0 LIBAGE = 0 diff --git a/lib/omapi/api b/lib/omapi/api index 494278e7f5..91fedd3885 100644 --- a/lib/omapi/api +++ b/lib/omapi/api @@ -1,3 +1,3 @@ -LIBINTERFACE = 0 +LIBINTERFACE = 1 LIBREVISION = 0 LIBAGE = 0 From 796b1656b62ac362a5a4515dc9fe1607ed1d714c Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Mon, 10 Jul 2000 22:49:46 +0000 Subject: [PATCH 005/226] pulldown: If the testsock.pl test fails, try 5 times (2 seconds between tries) in case a server took some time to fully free the port. (Appears to be an occasional problem on Solaris) --- bin/tests/system/start.sh | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/bin/tests/system/start.sh b/bin/tests/system/start.sh index 62bddaf906..7ab3524525 100644 --- a/bin/tests/system/start.sh +++ b/bin/tests/system/start.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: start.sh,v 1.24 2000/07/07 18:25:08 bwelling Exp $ +# $Id: start.sh,v 1.25 2000/07/10 22:49:46 mws Exp $ # # Start name servers for running system tests. @@ -28,16 +28,26 @@ test $# -gt 0 || { echo "usage: $0 test-directory" >&2; exit 1; } test -d "$1" || { echo No test directory: "$1"; exit 1; } -if $PERL ./testsock.pl -p 5300 -then - : -else - echo "$0: could not bind to server addresses, server still running?" - echo "I:server sockets not available" - echo "R:FAIL" - sh ./stop.sh $1 - exit 1 -fi +portup=0 +testloop=0 +while [ $portup == 0 ] +do + if $PERL ./testsock.pl -p 5300 + then + portup=1 + else + echo "I:Couldn't bind to socket (yet)" + sleep 2 + testloop=`expr $testloop + 1` + if [ $testloop == 5 ]; then + echo "$0: could not bind to server addresses, still running?" + echo "I:server sockets not available" + echo "R:FAIL" + sh ./stop.sh $1 + exit 1 + fi + fi +done cd $1 From acc859e12c147037b4fb9d6da83c9c27d26feaea Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Mon, 10 Jul 2000 23:04:42 +0000 Subject: [PATCH 006/226] updated to describe current options --- bin/rndc/rndc.8 | 152 +++++++++++++++++++++++++++------------------ doc/man/bin/rndc.8 | 152 +++++++++++++++++++++++++++------------------ 2 files changed, 182 insertions(+), 122 deletions(-) diff --git a/bin/rndc/rndc.8 b/bin/rndc/rndc.8 index b101e4a671..82778ad5d5 100644 --- a/bin/rndc/rndc.8 +++ b/bin/rndc/rndc.8 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.8,v 1.2 2000/07/04 01:25:01 tale Exp $ +.\" $Id: rndc.8,v 1.3 2000/07/10 23:04:42 tale Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC 8 @@ -24,13 +24,13 @@ .Nd name server control utility .Sh SYNOPSIS .Nm rndc -.\" -c option has been zapped for now -.\" .Op Fl c Ar config-file +.Op Fl c Ar config-file +.Op Fl k Ar key_id +.Op Fl M .Op Fl m .Op Fl p Ar port# -.\" -s option has been zapped for now -.\" .Op Fl s Ar server -.Ar server +.Op Fl s Ar server +.Op Fl v .Ar command .... .Sh DESCRIPTION This command allows the system administrator to control the operation @@ -38,51 +38,46 @@ of a name server. It supersedes the .Xr ndc 8 utility that was provided in old BIND releases. +If .Nm rndc -uses a secure channel with encryption algorithms and keys to -communicate with the name server. -In the current version of -.Nm ndc , -the only supported encryption algorithm is HMAC-MD5 which uses a -shared secret. -This provides TSIG-style authentication for the command request -and the name server's response. +is invoked with no command line options or arguments, it +prints a short summary of the supported commands and the available +options and their arguments. .Pp -.Nm +.Nm rndc +uses a secure channel with digital signatures to communicate +with the name server. +In the current versions of +.Nm rndc +and +.Xr named 8 +the only supported encryption algorithm is HMAC-MD5, which uses a +shared secret on each end of the connection. +This provides TSIG-style authentication for the command request +and the name server's response. All commands sent over the channel +must be signed by a key_id known to the server. +.Pp +.Nm rndc reads its default configuration file, .Pa /etc/rndc.conf to determine how to contact the name server and decide what algorithm and keys is should use. -.\" An alternate configuration file can be specified with the -.\" .Ar c -.\" option. -.\" .Ar config-file -.\" is the name of the configuration file to use instead of the default -.\" one, -.\" .Pa /etc/rndc.conf . -.\" .Pp +An alternate configuration file can be specified with the +.Ar c +option. +.Pp .Ar server -is the name of the server which matches a +is the name or address of the server which matches a .Dv server{} statement in the configuration file for .Nm rndc . -If an explicit null argument is supplied in -.Ar server , -.Nm rndc -will contact some default name server which is defined by a +If no +.Ar server +is supplied on the command line, the host named by the .Dv default-server clause in the -.Fv options{} -statement of -.Pa /etc/rndc.conf . -.Pp -Currently, the -.Fl m -option makes -.Nm rndc -print details of its internal memory usage statistics. -This option will only be of interest to BIND9 developers and may be -removed or changed in a future release. +.Dv options{} +statement of the configuration file will be used. .Pp The .Fl p @@ -90,19 +85,52 @@ option is used to make .Nm rndc send commands to TCP port number .Ar port# -on the system running the name server instead of the default. -The standard port number used by BIND9 name servers for receiving -control commands is 953. +on the system running the name server instead of BIND 9's +default control channel port of 953. .Pp -If +The +.Fl k +option identifies the +.Ar key_id +to use from the configuration file. The +.Ar key_id +must be known by +.Xr named +with the same algorithm and secret string in order for +control message validation to succeed. If no +.Fl k +option is provided, .Nm rndc -is invoked with no command-line options or arguments, it -prints a short summary of the supported commands and the available -options and their arguments. +will first look for a +.Dv key +clause in the +.Dv server{} +statement of the server being used, or if no +.Dv server{} +statement is present for that host, then the +.Dv default-key +clause of the +.Dv options{} +statement. Note that .Pp +The configuration file for +.Nm rdnc +contains shared secrets which are used to send authenticated +control commands to name servers, and should therefore not have +general read or write access. +.Pp +The +.Fl M , +.Fl m , +and +.Fl v +options provided debugging information and are primarily of interest +only to the BIND 9 developers. They might be changed or removed in +future releases. .Pp The only valid value for .Ar command -is \*qreload\*q, which forces the name server to reload. +is \*qreload\*q, which forces the name server to reload its configuation +file and zones. Further commands will be provided in future releases as the management capabilities of .Nm rndc @@ -118,21 +146,23 @@ offers at least as many management capabilities as the old .Xr ndc utility. .Pp -The configuration file for -.Nm rdnc -probably contains shared secrets which are used to send authenticated -control commands to name servers. -The file should therefore not have general read or write access. +There is currently no way to provide the shared secret for a key_id +without using the configuration file, and thus the +.Fl c +option is really required in order for +.Nm rndc +to issue validly signed commands to +.Xr named . .Pp -In the current BIND9 release, the name server only listens for -.Nm rndc -commands on the loopback interface, 127.0.0.1. -This means that -.Nm rndc -only works on the same system that runs the name server. -This limitation will be removed in a future release. +Several error messages could be clearer. For example, trying to connect +from an address that is not in the list of acceptable addresses +configured into +.Xr named +will result in the error message "end of file" when the server just +unceremonisously closes the connection. .Sh SEE ALSO -.Xr named 8 , -.Xr RFC2845 , .Xr rndc.conf 5 , +.Xr named 8 , +.Xr named.conf 5 , +.Xr RFC2845 , .Xr ndc 8 . diff --git a/doc/man/bin/rndc.8 b/doc/man/bin/rndc.8 index b101e4a671..82778ad5d5 100644 --- a/doc/man/bin/rndc.8 +++ b/doc/man/bin/rndc.8 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.8,v 1.2 2000/07/04 01:25:01 tale Exp $ +.\" $Id: rndc.8,v 1.3 2000/07/10 23:04:42 tale Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC 8 @@ -24,13 +24,13 @@ .Nd name server control utility .Sh SYNOPSIS .Nm rndc -.\" -c option has been zapped for now -.\" .Op Fl c Ar config-file +.Op Fl c Ar config-file +.Op Fl k Ar key_id +.Op Fl M .Op Fl m .Op Fl p Ar port# -.\" -s option has been zapped for now -.\" .Op Fl s Ar server -.Ar server +.Op Fl s Ar server +.Op Fl v .Ar command .... .Sh DESCRIPTION This command allows the system administrator to control the operation @@ -38,51 +38,46 @@ of a name server. It supersedes the .Xr ndc 8 utility that was provided in old BIND releases. +If .Nm rndc -uses a secure channel with encryption algorithms and keys to -communicate with the name server. -In the current version of -.Nm ndc , -the only supported encryption algorithm is HMAC-MD5 which uses a -shared secret. -This provides TSIG-style authentication for the command request -and the name server's response. +is invoked with no command line options or arguments, it +prints a short summary of the supported commands and the available +options and their arguments. .Pp -.Nm +.Nm rndc +uses a secure channel with digital signatures to communicate +with the name server. +In the current versions of +.Nm rndc +and +.Xr named 8 +the only supported encryption algorithm is HMAC-MD5, which uses a +shared secret on each end of the connection. +This provides TSIG-style authentication for the command request +and the name server's response. All commands sent over the channel +must be signed by a key_id known to the server. +.Pp +.Nm rndc reads its default configuration file, .Pa /etc/rndc.conf to determine how to contact the name server and decide what algorithm and keys is should use. -.\" An alternate configuration file can be specified with the -.\" .Ar c -.\" option. -.\" .Ar config-file -.\" is the name of the configuration file to use instead of the default -.\" one, -.\" .Pa /etc/rndc.conf . -.\" .Pp +An alternate configuration file can be specified with the +.Ar c +option. +.Pp .Ar server -is the name of the server which matches a +is the name or address of the server which matches a .Dv server{} statement in the configuration file for .Nm rndc . -If an explicit null argument is supplied in -.Ar server , -.Nm rndc -will contact some default name server which is defined by a +If no +.Ar server +is supplied on the command line, the host named by the .Dv default-server clause in the -.Fv options{} -statement of -.Pa /etc/rndc.conf . -.Pp -Currently, the -.Fl m -option makes -.Nm rndc -print details of its internal memory usage statistics. -This option will only be of interest to BIND9 developers and may be -removed or changed in a future release. +.Dv options{} +statement of the configuration file will be used. .Pp The .Fl p @@ -90,19 +85,52 @@ option is used to make .Nm rndc send commands to TCP port number .Ar port# -on the system running the name server instead of the default. -The standard port number used by BIND9 name servers for receiving -control commands is 953. +on the system running the name server instead of BIND 9's +default control channel port of 953. .Pp -If +The +.Fl k +option identifies the +.Ar key_id +to use from the configuration file. The +.Ar key_id +must be known by +.Xr named +with the same algorithm and secret string in order for +control message validation to succeed. If no +.Fl k +option is provided, .Nm rndc -is invoked with no command-line options or arguments, it -prints a short summary of the supported commands and the available -options and their arguments. +will first look for a +.Dv key +clause in the +.Dv server{} +statement of the server being used, or if no +.Dv server{} +statement is present for that host, then the +.Dv default-key +clause of the +.Dv options{} +statement. Note that .Pp +The configuration file for +.Nm rdnc +contains shared secrets which are used to send authenticated +control commands to name servers, and should therefore not have +general read or write access. +.Pp +The +.Fl M , +.Fl m , +and +.Fl v +options provided debugging information and are primarily of interest +only to the BIND 9 developers. They might be changed or removed in +future releases. .Pp The only valid value for .Ar command -is \*qreload\*q, which forces the name server to reload. +is \*qreload\*q, which forces the name server to reload its configuation +file and zones. Further commands will be provided in future releases as the management capabilities of .Nm rndc @@ -118,21 +146,23 @@ offers at least as many management capabilities as the old .Xr ndc utility. .Pp -The configuration file for -.Nm rdnc -probably contains shared secrets which are used to send authenticated -control commands to name servers. -The file should therefore not have general read or write access. +There is currently no way to provide the shared secret for a key_id +without using the configuration file, and thus the +.Fl c +option is really required in order for +.Nm rndc +to issue validly signed commands to +.Xr named . .Pp -In the current BIND9 release, the name server only listens for -.Nm rndc -commands on the loopback interface, 127.0.0.1. -This means that -.Nm rndc -only works on the same system that runs the name server. -This limitation will be removed in a future release. +Several error messages could be clearer. For example, trying to connect +from an address that is not in the list of acceptable addresses +configured into +.Xr named +will result in the error message "end of file" when the server just +unceremonisously closes the connection. .Sh SEE ALSO -.Xr named 8 , -.Xr RFC2845 , .Xr rndc.conf 5 , +.Xr named 8 , +.Xr named.conf 5 , +.Xr RFC2845 , .Xr ndc 8 . From 60f0c97c9024e75a74b9b1a8f3c24274663a3dc9 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Mon, 10 Jul 2000 23:05:51 +0000 Subject: [PATCH 007/226] fix broken shell code --- bin/tests/system/start.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/bin/tests/system/start.sh b/bin/tests/system/start.sh index 7ab3524525..9ac22da012 100644 --- a/bin/tests/system/start.sh +++ b/bin/tests/system/start.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: start.sh,v 1.25 2000/07/10 22:49:46 mws Exp $ +# $Id: start.sh,v 1.26 2000/07/10 23:05:51 bwelling Exp $ # # Start name servers for running system tests. @@ -30,7 +30,7 @@ test -d "$1" || { echo No test directory: "$1"; exit 1; } portup=0 testloop=0 -while [ $portup == 0 ] +while [ $portup = 0 ] do if $PERL ./testsock.pl -p 5300 then @@ -39,7 +39,7 @@ do echo "I:Couldn't bind to socket (yet)" sleep 2 testloop=`expr $testloop + 1` - if [ $testloop == 5 ]; then + if [ $testloop = 5 ]; then echo "$0: could not bind to server addresses, still running?" echo "I:server sockets not available" echo "R:FAIL" From 4ebb4093f80e32e4a57ff3769f7fd4ad2217ee44 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Mon, 10 Jul 2000 23:23:30 +0000 Subject: [PATCH 008/226] assertion -> assertion failure; tabified --- CHANGES | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/CHANGES b/CHANGES index 17f4f3a1f5..124d706fa7 100644 --- a/CHANGES +++ b/CHANGES @@ -33,7 +33,7 @@ more than one key specified for the inet clause. 313. [bug] When parsing resolv.conf, don't terminate on an - error. Instead, parse as much as possible, but + error. Instead, parse as much as possible, but still return an error if one was found. 312. [bug] Increase the number of allowed elements in the @@ -73,11 +73,11 @@ destroying the query context and then want to use it again when the send event posted, triggering an assertion as it tried to cancel an already-canceled - query. (RT #77) + query. (RT #77) - 306. [bug] Reading HMAC-MD5 private key files didn't work. + 306. [bug] Reading HMAC-MD5 private key files didn't work. - 305. [bug] When reloading the server with a config file + 305. [bug] When reloading the server with a config file containing a syntax error, it could catch an assertion failure trying to perform zone maintenance on tentatively created zones whose @@ -106,7 +106,7 @@ 299. [cleanup] Get the user and group information before changing the root directory, so the administrator does not need to keep a copy of the user and group databases in the - chroot'ed environment. Suggested by Hakan Olsson. + chroot'ed environment. Suggested by Hakan Olsson. --- 9.0.0b5 released --- @@ -116,7 +116,7 @@ 297. [bug] Specifying a key name that wasn't fully qualified in certain parts of the config file could cause - an assertion. + an assertion failure. 296. [bug] "make install" from a separate build directory failed unless configure had been run in the source @@ -148,7 +148,7 @@ over TCP just because the incoming recursive query was a TCP one. - 290. [cleanup] +twiddle option to dig (for testing only) removed. + 290. [cleanup] +twiddle option to dig (for testing only) removed. 289. [cleanup] dig is now installed in $bindir instead of $sbindir. host is now installed in $bindir. (Be sure to remove @@ -169,7 +169,7 @@ 285. [bug] A change made to the dst API for beta4 inadvertently broke OMAPI's creation of a dst key from an incoming - message, causing an assertion to be triggered. Fixed. + message, causing an assertion to be triggered. Fixed. 284. [func] The DNSSEC key generation and signing tools now generate randomness from keyboard input on systems From e09caeceef8a6759de5c34ffba9a7a566eb8c74c Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Mon, 10 Jul 2000 23:46:50 +0000 Subject: [PATCH 009/226] print the test info before executing the test --- bin/tests/system/dnssec/tests.sh | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh index b4956cd0b7..f2c77fbc0d 100644 --- a/bin/tests/system/dnssec/tests.sh +++ b/bin/tests/system/dnssec/tests.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: tests.sh,v 1.19 2000/07/10 21:40:16 bwelling Exp $ +# $Id: tests.sh,v 1.20 2000/07/10 23:46:50 bwelling Exp $ # # Perform tests @@ -32,69 +32,70 @@ rm -f dig.out.* DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocmd -p 5300" # Check the example. domain +echo "I:checking that zone transfer worked" ret=0 $DIG $DIGOPTS a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 $DIG $DIGOPTS a.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns3.test$n || ret=1 n=`expr $n + 1` -echo "I:checking that zone transfer worked" if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` +echo "I:checking positive validation" ret=0 $DIG $DIGOPTS +noauth a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 $DIG $DIGOPTS +noauth a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 n=`expr $n + 1` -echo "I:checking positive validation" if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` # Check the insecure.example domain +echo "I:checking 1-server insecurity proof" ret=0 $DIG $DIGOPTS a.insecure.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 $DIG $DIGOPTS a.insecure.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 n=`expr $n + 1` -echo "I:checking 1-server insecurity proof" if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` # Check the secure.example domain +echo "I:checking multi-stage positive validation" ret=0 $DIG $DIGOPTS a.secure.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 $DIG $DIGOPTS a.secure.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 n=`expr $n + 1` -echo "I:checking multi-stage positive validation" if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` # Check the bogus domain +echo "I:checking negative validation" ret=0 $DIG $DIGOPTS a.bogus.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 n=`expr $n + 1` -echo "I:checking negative validation" if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` # Try validating a key with a bad trusted key. # This should fail. +echo "I:checking that validation fails with a misconfigured trusted key" ret=0 $DIG $DIGOPTS example. key @10.53.0.5 -p 5300 > dig.out.ns5.test$n || ret=1 grep "SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1 n=`expr $n + 1` -echo "I:checking that validation fails with a misconfigured trusted key" if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` # Check the insecure.secure.example domain (insecurity proof) +echo "I:checking 2-server insecurity proof" ret=0 $DIG $DIGOPTS a.insecure.secure.example. @10.53.0.2 a > dig.out.ns2.test$n \ || ret=1 @@ -102,12 +103,12 @@ $DIG $DIGOPTS a.insecure.secure.example. @10.53.0.4 a > dig.out.ns4.test$n \ || ret=1 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 n=`expr $n + 1` -echo "I:checking 2-server insecurity proof" if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` # Check a negative response in insecure.secure.example +echo "I:checking 2-server insecurity proof with a negative answer" ret=0 $DIG $DIGOPTS q.insecure.secure.example. @10.53.0.2 a > dig.out.ns2.test$n \ || ret=1 @@ -115,7 +116,6 @@ $DIG $DIGOPTS q.insecure.secure.example. @10.53.0.4 a > dig.out.ns4.test$n \ || ret=1 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 n=`expr $n + 1` -echo "I:checking 2-server insecurity proof with a negative answer" if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` From 7d7bd1b4f0270691f434d37b1052259a13185663 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Mon, 10 Jul 2000 23:52:36 +0000 Subject: [PATCH 010/226] added missing CHANGES entry: 323. [bug] dns_rbt_findname() did not ignore empty rbt nodes. Because of this, servers authoritative for a parent and grandchild zone but not authoritative for the intervening child zone did not correctly issue referrals to the servers of the child zone. --- CHANGES | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGES b/CHANGES index 124d706fa7..349b93e81b 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,10 @@ + 323. [bug] dns_rbt_findname() did not ignore empty rbt nodes. + Because of this, servers authoritative for a parent + and grandchild zone but not authoritative for the + intervening child zone did not correctly issue + referrals to the servers of the child zone. + 322. [bug] Queries for KEY RRs are now sent to the parent server before the authoritative one, making DNSSEC insecurity proofs work in many cases From 32d6b7bbfb2f23c1bb9480441ede5cd2f0f51aa0 Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Tue, 11 Jul 2000 00:23:38 +0000 Subject: [PATCH 011/226] use base64 for the secret; describe how base64 secrets can be made; clarify the interaction of some of the statements and the command line; clarify the double quote rules --- bin/rndc/rndc.conf.5 | 110 +++++++++++++++++++++++++++++++-------- doc/man/bin/rndc.conf.5 | 110 +++++++++++++++++++++++++++++++-------- doc/man/misc/rndc.conf.5 | 110 +++++++++++++++++++++++++++++++-------- 3 files changed, 261 insertions(+), 69 deletions(-) diff --git a/bin/rndc/rndc.conf.5 b/bin/rndc/rndc.conf.5 index 218366d57b..5d9ac5b0e1 100644 --- a/bin/rndc/rndc.conf.5 +++ b/bin/rndc/rndc.conf.5 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.conf.5,v 1.1 2000/06/29 06:14:18 jim Exp $ +.\" $Id: rndc.conf.5,v 1.2 2000/07/11 00:23:38 tale Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC.CONF 5 @@ -58,11 +58,8 @@ statement contains two clauses. The .Dv default-server clause -is followed by the name of a name server. -This must be identified by a -.Dv server{} -statement elsewhere in the file. -This server will +is followed by the name or address of a name server. +This host will be used when no name server is given as an argument to .Nm rndc . The @@ -71,52 +68,76 @@ clause is followed by the name of a key which is identified by a .Dv key{} statement. -If no other suitable key can be found in the file, this default key -will be used to authenticate commands sent to the name -server and its responses. -The key name is enclosed in double quotes. +If no +.Fl k +option is provided on the +.Xr rndc +command line, and no +.Dv key +clause is found in a a matching +.Dv server{} +statement, this default key will be used to authenticate the server's +commands and responses. .Pp After the keyword .Dv server , the .Dv server{} -statement is followed by a string which is the hostname for the +statement is followed by a string which is the hostname or address for a name server. -The statement has a single clause: +The statement has a single clause, .Dv key . -This contains the name of a key which is enclosed in double quotes. The key name must match the name of a .Dv key{} statement in the file. .Pp The .Dv key{} -statement begins with an identifying string - the name of the key. +statement begins with an identifying string, the name of the key. The statement has two clauses. .Dv algorithm identifies the encryption algorithm for .Nm rndc -to use. -Currently only HMAC-MD5 is supported. +to use; currently only HMAC-MD5 is supported. This is followed by a .Dv secret clause which contains the base-64 encoding of the algorithm's encryption key. The base-64 string is enclosed in double quotes. +.Pp +There are two common ways to generate the base-64 string for the +.Dv secret . +The BIND 9 program +.Xr dnssec-keygen 8 +can be used to generate a random key, or the +.Xr mmencode 1 +program, also known as +.Xr mimencode 1 , +can be used to generate a base-64 string from known input. +.Xr mmencode +does not ship with BIND 9 but is available on many systems. +See the +.Sx EXAMPLES +section for sample command lines for each. +.Pp +Normally it is not necessary to double quote host or key names, but +host addresses must always be double quoted and both host and key +names must be double quoted when they match another keyword, such as +having a key named "key". .Sh EXAMPLE .Bd -literal indent options { - default-server localhost; - default-key "samplekey"; + default-server localhost; + default-key samplekey; }; server localhost { - key "samplekey"; + key samplekey; }; -key "samplekey" { - algorithm hmac-md5; - secret "strong enough for a man, but made for a woman"; +key samplekey { + algorithm hmac-md5; + secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K"; }; .Ed .Pp @@ -135,6 +156,49 @@ uses the HMAC-MD5 algorithm and its .Dv secret clause contains the base-64 encoding of the HMAC-MD5 secret enclosed in double quotes. +.Pp +To generate a random secret with +.Xr dnssec-keygen : +.Bd -literal indent +$ dnssec-keygen -a hmac-md5 -b 128 -n user rndc +.Ed +.Pp +The base-64 string will appear in two files, +.Pa Krndc.+157.+{random}.key +and +.Pa Krndc.+157.+{random}.private . +After extracting the key to be +placed in the +.Nm rndc.conf +and +.Xr named.conf +.Dv key{} +statements, the +.Pa .key +and +.Pa .private +files can be removed. +.Pp +To generate a secret from known input with +.Xr mmenode : +.Bd -literal indent +$ echo "known plaintext for a secret" | mmencode +.Ed +.Sh LIMITATIONS +There is currently no way to specify the port for +.Xr rndc +to use. This will be remedied in future releases by allowing a +.Dv port +clause to the +.Dv server{} +statement and a +.Dv default-port +clause to the +.Dv options{} +statement. .Sh SEE ALSO .Xr rndc 8 , -"BIND9 Administrators Manual" +.Xr named.conf 8 , +.Xr dnssec-keygen 8 , +.Xr mmencode 1 , +"BIND9 Administrators Manual". diff --git a/doc/man/bin/rndc.conf.5 b/doc/man/bin/rndc.conf.5 index 218366d57b..5d9ac5b0e1 100644 --- a/doc/man/bin/rndc.conf.5 +++ b/doc/man/bin/rndc.conf.5 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.conf.5,v 1.1 2000/06/29 06:14:18 jim Exp $ +.\" $Id: rndc.conf.5,v 1.2 2000/07/11 00:23:38 tale Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC.CONF 5 @@ -58,11 +58,8 @@ statement contains two clauses. The .Dv default-server clause -is followed by the name of a name server. -This must be identified by a -.Dv server{} -statement elsewhere in the file. -This server will +is followed by the name or address of a name server. +This host will be used when no name server is given as an argument to .Nm rndc . The @@ -71,52 +68,76 @@ clause is followed by the name of a key which is identified by a .Dv key{} statement. -If no other suitable key can be found in the file, this default key -will be used to authenticate commands sent to the name -server and its responses. -The key name is enclosed in double quotes. +If no +.Fl k +option is provided on the +.Xr rndc +command line, and no +.Dv key +clause is found in a a matching +.Dv server{} +statement, this default key will be used to authenticate the server's +commands and responses. .Pp After the keyword .Dv server , the .Dv server{} -statement is followed by a string which is the hostname for the +statement is followed by a string which is the hostname or address for a name server. -The statement has a single clause: +The statement has a single clause, .Dv key . -This contains the name of a key which is enclosed in double quotes. The key name must match the name of a .Dv key{} statement in the file. .Pp The .Dv key{} -statement begins with an identifying string - the name of the key. +statement begins with an identifying string, the name of the key. The statement has two clauses. .Dv algorithm identifies the encryption algorithm for .Nm rndc -to use. -Currently only HMAC-MD5 is supported. +to use; currently only HMAC-MD5 is supported. This is followed by a .Dv secret clause which contains the base-64 encoding of the algorithm's encryption key. The base-64 string is enclosed in double quotes. +.Pp +There are two common ways to generate the base-64 string for the +.Dv secret . +The BIND 9 program +.Xr dnssec-keygen 8 +can be used to generate a random key, or the +.Xr mmencode 1 +program, also known as +.Xr mimencode 1 , +can be used to generate a base-64 string from known input. +.Xr mmencode +does not ship with BIND 9 but is available on many systems. +See the +.Sx EXAMPLES +section for sample command lines for each. +.Pp +Normally it is not necessary to double quote host or key names, but +host addresses must always be double quoted and both host and key +names must be double quoted when they match another keyword, such as +having a key named "key". .Sh EXAMPLE .Bd -literal indent options { - default-server localhost; - default-key "samplekey"; + default-server localhost; + default-key samplekey; }; server localhost { - key "samplekey"; + key samplekey; }; -key "samplekey" { - algorithm hmac-md5; - secret "strong enough for a man, but made for a woman"; +key samplekey { + algorithm hmac-md5; + secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K"; }; .Ed .Pp @@ -135,6 +156,49 @@ uses the HMAC-MD5 algorithm and its .Dv secret clause contains the base-64 encoding of the HMAC-MD5 secret enclosed in double quotes. +.Pp +To generate a random secret with +.Xr dnssec-keygen : +.Bd -literal indent +$ dnssec-keygen -a hmac-md5 -b 128 -n user rndc +.Ed +.Pp +The base-64 string will appear in two files, +.Pa Krndc.+157.+{random}.key +and +.Pa Krndc.+157.+{random}.private . +After extracting the key to be +placed in the +.Nm rndc.conf +and +.Xr named.conf +.Dv key{} +statements, the +.Pa .key +and +.Pa .private +files can be removed. +.Pp +To generate a secret from known input with +.Xr mmenode : +.Bd -literal indent +$ echo "known plaintext for a secret" | mmencode +.Ed +.Sh LIMITATIONS +There is currently no way to specify the port for +.Xr rndc +to use. This will be remedied in future releases by allowing a +.Dv port +clause to the +.Dv server{} +statement and a +.Dv default-port +clause to the +.Dv options{} +statement. .Sh SEE ALSO .Xr rndc 8 , -"BIND9 Administrators Manual" +.Xr named.conf 8 , +.Xr dnssec-keygen 8 , +.Xr mmencode 1 , +"BIND9 Administrators Manual". diff --git a/doc/man/misc/rndc.conf.5 b/doc/man/misc/rndc.conf.5 index 218366d57b..5d9ac5b0e1 100644 --- a/doc/man/misc/rndc.conf.5 +++ b/doc/man/misc/rndc.conf.5 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.conf.5,v 1.1 2000/06/29 06:14:18 jim Exp $ +.\" $Id: rndc.conf.5,v 1.2 2000/07/11 00:23:38 tale Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC.CONF 5 @@ -58,11 +58,8 @@ statement contains two clauses. The .Dv default-server clause -is followed by the name of a name server. -This must be identified by a -.Dv server{} -statement elsewhere in the file. -This server will +is followed by the name or address of a name server. +This host will be used when no name server is given as an argument to .Nm rndc . The @@ -71,52 +68,76 @@ clause is followed by the name of a key which is identified by a .Dv key{} statement. -If no other suitable key can be found in the file, this default key -will be used to authenticate commands sent to the name -server and its responses. -The key name is enclosed in double quotes. +If no +.Fl k +option is provided on the +.Xr rndc +command line, and no +.Dv key +clause is found in a a matching +.Dv server{} +statement, this default key will be used to authenticate the server's +commands and responses. .Pp After the keyword .Dv server , the .Dv server{} -statement is followed by a string which is the hostname for the +statement is followed by a string which is the hostname or address for a name server. -The statement has a single clause: +The statement has a single clause, .Dv key . -This contains the name of a key which is enclosed in double quotes. The key name must match the name of a .Dv key{} statement in the file. .Pp The .Dv key{} -statement begins with an identifying string - the name of the key. +statement begins with an identifying string, the name of the key. The statement has two clauses. .Dv algorithm identifies the encryption algorithm for .Nm rndc -to use. -Currently only HMAC-MD5 is supported. +to use; currently only HMAC-MD5 is supported. This is followed by a .Dv secret clause which contains the base-64 encoding of the algorithm's encryption key. The base-64 string is enclosed in double quotes. +.Pp +There are two common ways to generate the base-64 string for the +.Dv secret . +The BIND 9 program +.Xr dnssec-keygen 8 +can be used to generate a random key, or the +.Xr mmencode 1 +program, also known as +.Xr mimencode 1 , +can be used to generate a base-64 string from known input. +.Xr mmencode +does not ship with BIND 9 but is available on many systems. +See the +.Sx EXAMPLES +section for sample command lines for each. +.Pp +Normally it is not necessary to double quote host or key names, but +host addresses must always be double quoted and both host and key +names must be double quoted when they match another keyword, such as +having a key named "key". .Sh EXAMPLE .Bd -literal indent options { - default-server localhost; - default-key "samplekey"; + default-server localhost; + default-key samplekey; }; server localhost { - key "samplekey"; + key samplekey; }; -key "samplekey" { - algorithm hmac-md5; - secret "strong enough for a man, but made for a woman"; +key samplekey { + algorithm hmac-md5; + secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K"; }; .Ed .Pp @@ -135,6 +156,49 @@ uses the HMAC-MD5 algorithm and its .Dv secret clause contains the base-64 encoding of the HMAC-MD5 secret enclosed in double quotes. +.Pp +To generate a random secret with +.Xr dnssec-keygen : +.Bd -literal indent +$ dnssec-keygen -a hmac-md5 -b 128 -n user rndc +.Ed +.Pp +The base-64 string will appear in two files, +.Pa Krndc.+157.+{random}.key +and +.Pa Krndc.+157.+{random}.private . +After extracting the key to be +placed in the +.Nm rndc.conf +and +.Xr named.conf +.Dv key{} +statements, the +.Pa .key +and +.Pa .private +files can be removed. +.Pp +To generate a secret from known input with +.Xr mmenode : +.Bd -literal indent +$ echo "known plaintext for a secret" | mmencode +.Ed +.Sh LIMITATIONS +There is currently no way to specify the port for +.Xr rndc +to use. This will be remedied in future releases by allowing a +.Dv port +clause to the +.Dv server{} +statement and a +.Dv default-port +clause to the +.Dv options{} +statement. .Sh SEE ALSO .Xr rndc 8 , -"BIND9 Administrators Manual" +.Xr named.conf 8 , +.Xr dnssec-keygen 8 , +.Xr mmencode 1 , +"BIND9 Administrators Manual". From 7f2ac7414c0e40d215175db10d0f8ecc85b61cc2 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 11 Jul 2000 00:36:44 +0000 Subject: [PATCH 012/226] Test that a query for a security root succeeds. --- bin/tests/system/dnssec/tests.sh | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh index f2c77fbc0d..15e1a9a3aa 100644 --- a/bin/tests/system/dnssec/tests.sh +++ b/bin/tests/system/dnssec/tests.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: tests.sh,v 1.20 2000/07/10 23:46:50 bwelling Exp $ +# $Id: tests.sh,v 1.21 2000/07/11 00:36:44 bwelling Exp $ # # Perform tests @@ -119,5 +119,16 @@ n=`expr $n + 1` if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` +# Check that the query for a security root is successful and has ad set + +echo "I:checking security root query" +ret=0 +$DIG $DIGOPTS . @10.53.0.4 key > dig.out.ns4.test$n || ret=1 +grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 +grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 +n=`expr $n + 1` +if [ $ret != 0 ]; then echo "I:failed"; fi +status=`expr $status + $ret` + echo "I:exit status: $status" exit $status From 3734f3f1bad4160cdd7563bc4801bca7e82f8abd Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Tue, 11 Jul 2000 00:37:58 +0000 Subject: [PATCH 013/226] -k flag changed to -y to be compatible with dig and nsupdate. (... since I have to update the ARM anyway ...) --- bin/rndc/rndc.8 | 15 +++++---------- bin/rndc/rndc.c | 14 +++++++------- bin/rndc/rndc.conf.5 | 4 ++-- doc/man/bin/rndc.8 | 15 +++++---------- doc/man/bin/rndc.conf.5 | 4 ++-- doc/man/misc/rndc.conf.5 | 4 ++-- 6 files changed, 23 insertions(+), 33 deletions(-) diff --git a/bin/rndc/rndc.8 b/bin/rndc/rndc.8 index 82778ad5d5..8185edf2a3 100644 --- a/bin/rndc/rndc.8 +++ b/bin/rndc/rndc.8 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.8,v 1.3 2000/07/10 23:04:42 tale Exp $ +.\" $Id: rndc.8,v 1.4 2000/07/11 00:37:57 tale Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC 8 @@ -25,12 +25,12 @@ .Sh SYNOPSIS .Nm rndc .Op Fl c Ar config-file -.Op Fl k Ar key_id .Op Fl M .Op Fl m .Op Fl p Ar port# .Op Fl s Ar server .Op Fl v +.Op Fl y Ar key_id .Ar command .... .Sh DESCRIPTION This command allows the system administrator to control the operation @@ -89,7 +89,7 @@ on the system running the name server instead of BIND 9's default control channel port of 953. .Pp The -.Fl k +.Fl y option identifies the .Ar key_id to use from the configuration file. The @@ -98,7 +98,7 @@ must be known by .Xr named with the same algorithm and secret string in order for control message validation to succeed. If no -.Fl k +.Fl y option is provided, .Nm rndc will first look for a @@ -147,12 +147,7 @@ offers at least as many management capabilities as the old utility. .Pp There is currently no way to provide the shared secret for a key_id -without using the configuration file, and thus the -.Fl c -option is really required in order for -.Nm rndc -to issue validly signed commands to -.Xr named . +without using the configuration file. .Pp Several error messages could be clearer. For example, trying to connect from an address that is not in the list of acceptable addresses diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c index fc3e18ac5a..31e3ffae3a 100644 --- a/bin/rndc/rndc.c +++ b/bin/rndc/rndc.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: rndc.c,v 1.15 2000/07/10 11:38:37 tale Exp $ */ +/* $Id: rndc.c,v 1.16 2000/07/11 00:37:56 tale Exp $ */ /* * Principal Author: DCL @@ -227,7 +227,7 @@ ndc_signalhandler(omapi_object_t *handle, const char *name, va_list ap) { static void usage(void) { fprintf(stderr, "\ -Usage: %s [-c config] [-s server] [-p port] [-k key] command [command ...]\n\ +Usage: %s [-c config] [-s server] [-p port] [-y key] command [command ...]\n\ \n\ command is one of the following for named:\n\ \n\ @@ -285,16 +285,12 @@ main(int argc, char **argv) { else progname = *argv; - while ((ch = isc_commandline_parse(argc, argv, "c:k:Mmp:s:v")) != -1) { + while ((ch = isc_commandline_parse(argc, argv, "c:Mmp:s:vy:")) != -1) { switch (ch) { case 'c': conffile = isc_commandline_argument; break; - case 'k': - keyname = isc_commandline_argument; - break; - case 'M': isc_mem_debugging = ISC_TRUE; break; @@ -323,6 +319,10 @@ main(int argc, char **argv) { verbose = ISC_TRUE; break; + case 'y': + keyname = isc_commandline_argument; + break; + case '?': usage(); exit(1); diff --git a/bin/rndc/rndc.conf.5 b/bin/rndc/rndc.conf.5 index 5d9ac5b0e1..8e37f976bf 100644 --- a/bin/rndc/rndc.conf.5 +++ b/bin/rndc/rndc.conf.5 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.conf.5,v 1.2 2000/07/11 00:23:38 tale Exp $ +.\" $Id: rndc.conf.5,v 1.3 2000/07/11 00:37:58 tale Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC.CONF 5 @@ -69,7 +69,7 @@ is followed by the name of a key which is identified by a .Dv key{} statement. If no -.Fl k +.Fl y option is provided on the .Xr rndc command line, and no diff --git a/doc/man/bin/rndc.8 b/doc/man/bin/rndc.8 index 82778ad5d5..8185edf2a3 100644 --- a/doc/man/bin/rndc.8 +++ b/doc/man/bin/rndc.8 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.8,v 1.3 2000/07/10 23:04:42 tale Exp $ +.\" $Id: rndc.8,v 1.4 2000/07/11 00:37:57 tale Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC 8 @@ -25,12 +25,12 @@ .Sh SYNOPSIS .Nm rndc .Op Fl c Ar config-file -.Op Fl k Ar key_id .Op Fl M .Op Fl m .Op Fl p Ar port# .Op Fl s Ar server .Op Fl v +.Op Fl y Ar key_id .Ar command .... .Sh DESCRIPTION This command allows the system administrator to control the operation @@ -89,7 +89,7 @@ on the system running the name server instead of BIND 9's default control channel port of 953. .Pp The -.Fl k +.Fl y option identifies the .Ar key_id to use from the configuration file. The @@ -98,7 +98,7 @@ must be known by .Xr named with the same algorithm and secret string in order for control message validation to succeed. If no -.Fl k +.Fl y option is provided, .Nm rndc will first look for a @@ -147,12 +147,7 @@ offers at least as many management capabilities as the old utility. .Pp There is currently no way to provide the shared secret for a key_id -without using the configuration file, and thus the -.Fl c -option is really required in order for -.Nm rndc -to issue validly signed commands to -.Xr named . +without using the configuration file. .Pp Several error messages could be clearer. For example, trying to connect from an address that is not in the list of acceptable addresses diff --git a/doc/man/bin/rndc.conf.5 b/doc/man/bin/rndc.conf.5 index 5d9ac5b0e1..8e37f976bf 100644 --- a/doc/man/bin/rndc.conf.5 +++ b/doc/man/bin/rndc.conf.5 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.conf.5,v 1.2 2000/07/11 00:23:38 tale Exp $ +.\" $Id: rndc.conf.5,v 1.3 2000/07/11 00:37:58 tale Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC.CONF 5 @@ -69,7 +69,7 @@ is followed by the name of a key which is identified by a .Dv key{} statement. If no -.Fl k +.Fl y option is provided on the .Xr rndc command line, and no diff --git a/doc/man/misc/rndc.conf.5 b/doc/man/misc/rndc.conf.5 index 5d9ac5b0e1..8e37f976bf 100644 --- a/doc/man/misc/rndc.conf.5 +++ b/doc/man/misc/rndc.conf.5 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.conf.5,v 1.2 2000/07/11 00:23:38 tale Exp $ +.\" $Id: rndc.conf.5,v 1.3 2000/07/11 00:37:58 tale Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC.CONF 5 @@ -69,7 +69,7 @@ is followed by the name of a key which is identified by a .Dv key{} statement. If no -.Fl k +.Fl y option is provided on the .Xr rndc command line, and no From ea01648cb950b8d4b5625a8a91a4c1c019dec885 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Tue, 11 Jul 2000 00:37:59 +0000 Subject: [PATCH 014/226] added missing CHANGES entry: 324. [func] In the resolver, turn EDNS0 off if there is no response after a number of retransmissions. This is to allow queries some chance of succeeding even if all the authoritative servers of a zone silently discard EDNS0 requests instead of sending an error response like they ought to. --- CHANGES | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGES b/CHANGES index 349b93e81b..6fa0dd4b32 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,11 @@ + 324. [func] In the resolver, turn EDNS0 off if there is no + response after a number of retransmissions. + This is to allow queries some chance of succeeding + even if all the authoritative servers of a zone + silently discard EDNS0 requests instead of + sending an error response like they ought to. + 323. [bug] dns_rbt_findname() did not ignore empty rbt nodes. Because of this, servers authoritative for a parent and grandchild zone but not authoritative for the From 87983da955bf63128de85d180359bdc418516c3c Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Tue, 11 Jul 2000 01:30:56 +0000 Subject: [PATCH 015/226] use configure-generated sysconfdir, add version string --- bin/rndc/Makefile.in | 6 +++++- bin/rndc/rndc.c | 10 ++++++---- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/bin/rndc/Makefile.in b/bin/rndc/Makefile.in index 5c3988b833..1526db1744 100644 --- a/bin/rndc/Makefile.in +++ b/bin/rndc/Makefile.in @@ -13,7 +13,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: Makefile.in,v 1.8 2000/06/28 16:27:17 tale Exp $ +# $Id: Makefile.in,v 1.9 2000/07/11 01:30:55 tale Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -49,6 +49,10 @@ SRCS = rndc.c @BIND9_MAKE_RULES@ +rndc.@O@ rndc.c: + ${LIBTOOL} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \ + -DRNDC_SYSCONFDIR=\"${sysconfdir}\" -c ${srcdir}/rndc.c + rndc: ${OBJS} ${DEPLIBS} ${LIBTOOL} ${CC} ${CFLAGS} -o $@ ${OBJS} ${LIBS} diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c index 31e3ffae3a..a3ebdf8f72 100644 --- a/bin/rndc/rndc.c +++ b/bin/rndc/rndc.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: rndc.c,v 1.16 2000/07/11 00:37:56 tale Exp $ */ +/* $Id: rndc.c,v 1.17 2000/07/11 01:30:56 tale Exp $ */ /* * Principal Author: DCL @@ -40,7 +40,8 @@ #include static const char *progname; -static const char *conffile = "/etc/rndc.conf"; +static const char *conffile = RNDC_SYSCONFDIR "/rndc.conf"; +static const char *version = VERSION; static isc_boolean_t verbose; static isc_mem_t *mctx; @@ -241,8 +242,9 @@ command is one of the following for named:\n\ *stop Stop the server.\n\ *restart Restart the server.\n\ \n\ -* == not yet implemented\n", - progname); +* == not yet implemented\n\ +Version: %s\n", + progname, version); } #undef DO From 37ea500c8acc98372c0c498424fea32ea80d548b Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Tue, 11 Jul 2000 01:31:06 +0000 Subject: [PATCH 016/226] use base64 for secret in sample config --- bin/rndc/rndc.conf | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/bin/rndc/rndc.conf b/bin/rndc/rndc.conf index a443745d57..a27bb4c67f 100644 --- a/bin/rndc/rndc.conf +++ b/bin/rndc/rndc.conf @@ -15,7 +15,11 @@ * SOFTWARE. */ -/* $Id: rndc.conf,v 1.3 2000/06/22 21:50:02 tale Exp $ */ +/* $Id: rndc.conf,v 1.4 2000/07/11 01:31:06 tale Exp $ */ + +/* + * Sample rndc configuration file. + */ options { default-server localhost; @@ -28,5 +32,5 @@ server localhost { key "key" { algorithm hmac-md5; - secret "strong enough for a man, but made for a woman"; + secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K"; }; From 6c3371d89a9e7d928b86e076f37a1ea6b5433d94 Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Tue, 11 Jul 2000 02:40:58 +0000 Subject: [PATCH 017/226] Add test for leading zero in SOA serial --- bin/tests/master/dns_master_load_11_data | 12 ++++++++++++ bin/tests/master/master11.data | 6 ++++++ bin/tests/master/t_master.c | 17 ++++++++++++++++- 3 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 bin/tests/master/dns_master_load_11_data create mode 100644 bin/tests/master/master11.data diff --git a/bin/tests/master/dns_master_load_11_data b/bin/tests/master/dns_master_load_11_data new file mode 100644 index 0000000000..7b667b273b --- /dev/null +++ b/bin/tests/master/dns_master_load_11_data @@ -0,0 +1,12 @@ +# +# test data for dns_master_load test 11 +# +# format is: +# masterfile origin class expected_result +# where +# masterfile name is the name of a file containing master data +# origin is the origin +# class is the zone's class +# expected_result is a text representation of a dns_result_t +# +master11.data test in ISC_R_SUCCESS diff --git a/bin/tests/master/master11.data b/bin/tests/master/master11.data new file mode 100644 index 0000000000..0aaec25ecf --- /dev/null +++ b/bin/tests/master/master11.data @@ -0,0 +1,6 @@ +; +; The following serial number contains a leading 0 and a 9 so the +; we can catch cases where it is incorrectly treated as a octal +; number. +; +@ 300 IN SOA ns hostmaster 00090000 1200 3600 604800 300 diff --git a/bin/tests/master/t_master.c b/bin/tests/master/t_master.c index d5e59eb566..c63cd94558 100644 --- a/bin/tests/master/t_master.c +++ b/bin/tests/master/t_master.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: t_master.c,v 1.25 2000/07/09 12:48:43 marka Exp $ */ +/* $Id: t_master.c,v 1.26 2000/07/11 02:40:58 marka Exp $ */ #include @@ -302,6 +302,20 @@ t10() { t_result(result); } +static const char *a11 = + "dns_master_loadfile allow leading zeros in SOA"; + +static void +t11() { + int result; + + t_assert("dns_master_loadfile", 11, T_REQUIRED, a11); + result = test_master_x("dns_master_load_11_data"); + + t_result(result); +} + + testspec_t T_testlist[] = { { t1, "ISC_R_SUCCESS" }, { t2, "ISC_R_UNEXPECTEDEND" }, @@ -313,6 +327,7 @@ testspec_t T_testlist[] = { { t8, "$INCLUDE" }, { t9, "$INCLUDE w/ DNS_BADCLASS" }, { t10, "non empty blank lines" }, + { t11, "leading zeros in serial" }, { NULL, NULL } }; From 5c0a406664065d54824675e3d2f795ea9e2a56b8 Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Tue, 11 Jul 2000 02:44:54 +0000 Subject: [PATCH 018/226] 325. [bug] isc_lex_gettoken was processing octal strings when ISC_LEXOPT_CNUMBER was not set. --- CHANGES | 2 ++ lib/isc/lex.c | 9 +++++++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/CHANGES b/CHANGES index 6fa0dd4b32..abe061d290 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,5 @@ + 325. [bug] isc_lex_gettoken was processing octal strings when + ISC_LEXOPT_CNUMBER was not set. 324. [func] In the resolver, turn EDNS0 off if there is no response after a number of retransmissions. diff --git a/lib/isc/lex.c b/lib/isc/lex.c index 5a838a9a77..2ee37d41d2 100644 --- a/lib/isc/lex.c +++ b/lib/isc/lex.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: lex.c,v 1.32 2000/07/10 05:11:17 marka Exp $ */ +/* $Id: lex.c,v 1.33 2000/07/11 02:44:54 marka Exp $ */ #include @@ -511,8 +511,13 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) { if (c == ' ' || c == '\t' || c == '\r' || c == '\n' || c == EOF || lex->specials[c]) { + int base; + if ((options & ISC_LEXOPT_CNUMBER) != 0) + base = 0; + else + base = 10; pushback(source, c); - ulong = strtoul(lex->data, &e, 0); + ulong = strtoul(lex->data, &e, base); if (ulong == ULONG_MAX && errno == ERANGE) { return (ISC_R_RANGE); From 6331b9a45efba4e4e71e66ce4e2613a3433d18b2 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Tue, 11 Jul 2000 17:35:49 +0000 Subject: [PATCH 019/226] Don't try and reset timers which aren't being used. --- bin/dig/dig.c | 9 ++++++++- bin/dig/dighost.c | 12 ++++++++---- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/bin/dig/dig.c b/bin/dig/dig.c index f8f1183420..fd60e1fead 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.c,v 1.57 2000/07/10 18:02:27 bwelling Exp $ */ +/* $Id: dig.c,v 1.58 2000/07/11 17:35:48 mws Exp $ */ #include #include @@ -644,6 +644,13 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { timeout = atoi(&rv[0][6]); if (timeout <= 0) timeout = 1; + debug ("timeout set to %d", timeout); + } else if (strncmp(rv[0], "+timeout=", 9) == 0) { + /* Global option always */ + timeout = atoi(&rv[0][9]); + if (timeout <= 0) + timeout = 1; + debug ("timeout set to %d", timeout); } else if (strncmp(rv[0], "+tries=", 7) == 0) { if (have_host) { lookup->retries = atoi(&rv[0][7]); diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index fe8f0399a7..c7d96458b8 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.73 2000/07/10 18:02:28 bwelling Exp $ */ +/* $Id: dighost.c,v 1.74 2000/07/11 17:35:49 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -1193,6 +1193,7 @@ send_udp(dig_lookup_t *lookup) { local_timeout = UDP_TIMEOUT; } else local_timeout = timeout; + debug ("have local timeout of %d", local_timeout); isc_interval_set(&lookup->interval, local_timeout, 0); result = isc_timer_create(timermgr, isc_timertype_once, NULL, &lookup->interval, global_task, @@ -1763,19 +1764,21 @@ recv_done(isc_task_t *task, isc_event_t *event) { * the timeout to much longer, so brief network * outages won't cause the XFR to abort */ - if (timeout != INT_MAX) { + if ((timeout != INT_MAX) && + (query->lookup->timer != NULL)) { if (timeout == 0) { if (query->lookup->tcp_mode) local_timeout = TCP_TIMEOUT; else local_timeout = UDP_TIMEOUT; } else { - if (((long)timeout * 4) < - (long)INT_MAX) + if (timeout < (INT_MAX / 4)) local_timeout = timeout * 4; else local_timeout = INT_MAX; } + debug ("have local timeout of %d", + local_timeout); isc_interval_set(&query->lookup->interval, local_timeout, 0); result = isc_timer_reset(query->lookup->timer, @@ -1953,6 +1956,7 @@ do_lookup_tcp(dig_lookup_t *lookup) { local_timeout = UDP_TIMEOUT; } else local_timeout = timeout; + debug ("have local timeout of %d", local_timeout); isc_interval_set(&lookup->interval, local_timeout, 0); result = isc_timer_create(timermgr, isc_timertype_once, NULL, &lookup->interval, global_task, From 1b4e3f88bb63d84fdca5464507d14180bae5cd40 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Tue, 11 Jul 2000 17:49:02 +0000 Subject: [PATCH 020/226] Minor typo in error result --- bin/dig/dighost.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index c7d96458b8..6a058a2c1a 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.74 2000/07/11 17:35:49 mws Exp $ */ +/* $Id: dighost.c,v 1.75 2000/07/11 17:49:02 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -1786,7 +1786,7 @@ recv_done(isc_task_t *task, isc_event_t *event) { NULL, &query->lookup->interval, ISC_FALSE); - check_result(result, "isc_timer_create"); + check_result(result, "isc_timer_reset"); } } if (query->lookup->xfr_q == query) { From adade77942b069127a7094df419b3ad39dafb385 Mon Sep 17 00:00:00 2001 From: James Brister Date: Tue, 11 Jul 2000 19:09:10 +0000 Subject: [PATCH 021/226] 326. [func] 'keys' in an 'inet' control statement is now required and must have at least one item in it. warning is issued if a 'unix' control channel is defined (not supported). --- CHANGES | 6 ++ bin/tests/named.conf | 12 ++- lib/dns/config/confctl.c | 61 ++++++++++- lib/dns/config/confctx.c | 11 +- lib/dns/config/confkeys.c | 23 ++++- lib/dns/include/dns/confctl.h | 18 +++- lib/dns/include/dns/confkeys.h | 180 ++++++++++++++------------------- 7 files changed, 197 insertions(+), 114 deletions(-) diff --git a/CHANGES b/CHANGES index abe061d290..e3f7a294d3 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,9 @@ + 326. [func] 'keys' in an 'inet' control statement is now + required and must have at least one item in it. + + warning is issued if a 'unix' control channel is + defined (not supported). + 325. [bug] isc_lex_gettoken was processing octal strings when ISC_LEXOPT_CNUMBER was not set. diff --git a/bin/tests/named.conf b/bin/tests/named.conf index 3e7c85e1f8..3887ae02bc 100644 --- a/bin/tests/named.conf +++ b/bin/tests/named.conf @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: named.conf,v 1.40 2000/07/07 23:11:41 brister Exp $ */ +/* $Id: named.conf,v 1.41 2000/07/11 19:09:01 brister Exp $ */ /* * This is a worthless, nonrunnable example of a named.conf file that has @@ -198,10 +198,12 @@ options { * Control listeners, for "ndc". Every nameserver needs at least one. */ controls { - inet * port 52 allow { any; }; // a bad idea - inet 10.0.0.1 allow { any; }; // a bad idea - inet 10.0.0.2 allow { none; } keys { "key-1"; "key-2"; };// a bad idea - unix "/var/run/ndc" perm 0600 owner 0 group 0; // the default + // 'inet' lines without a 'port' defaults to 'port 953' + // 'keys' must be used and the list must have at least one entry + inet * port 52 allow { any; } keys { "key2"; }; + inet 10.0.0.1 allow { any; } keys { "key4";}; + inet 10.0.0.2 allow { none; } keys { "key-1"; "key-2"; }; + unix "/var/run/ndc" perm 0600 owner 0 group 0; // ignored by named. }; zone "master.demo.zone" { diff --git a/lib/dns/config/confctl.c b/lib/dns/config/confctl.c index 8103db49b8..bf60f4f468 100644 --- a/lib/dns/config/confctl.c +++ b/lib/dns/config/confctl.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confctl.c,v 1.24 2000/07/10 11:28:30 tale Exp $ */ +/* $Id: confctl.c,v 1.25 2000/07/11 19:09:02 brister Exp $ */ #include @@ -23,6 +23,7 @@ #include #include +#include isc_result_t dns_c_ctrllist_new(isc_mem_t *mem, dns_c_ctrllist_t **newlist) { @@ -46,7 +47,30 @@ dns_c_ctrllist_new(isc_mem_t *mem, dns_c_ctrllist_t **newlist) { return (ISC_R_SUCCESS); } - + + +isc_result_t +dns_c_ctrllist_validate(dns_c_ctrllist_t *cl) { + dns_c_ctrl_t *ctl; + isc_result_t result = ISC_R_SUCCESS; + + REQUIRE(DNS_C_CONFCTLLIST_VALID(cl)); + + ctl = dns_c_ctrllist_head(cl); + if (ctl == NULL) { + isc_log_write(dns_lctx,DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, ISC_LOG_WARNING, + "empty control statement"); + } else { + while (result == ISC_R_SUCCESS && ctl != NULL) { + result = dns_c_ctrl_validate(ctl); + ctl = dns_c_ctrl_next(ctl); + } + } + + return (result); +} + void dns_c_ctrllist_print(FILE *fp, int indent, dns_c_ctrllist_t *cl) { dns_c_ctrl_t *ctl; @@ -102,6 +126,39 @@ dns_c_ctrllist_delete(dns_c_ctrllist_t **list) { return (ISC_R_SUCCESS); } + +isc_result_t +dns_c_ctrl_validate(dns_c_ctrl_t *ctrl) +{ + isc_result_t result = ISC_R_SUCCESS; + + REQUIRE(DNS_C_CONFCTL_VALID(ctrl)); + + if (ctrl->control_type == dns_c_unix_control) { + isc_log_write(dns_lctx,DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, ISC_LOG_WARNING, + "unix sockets are not not implmented for" + " control channels"); + } else if (ctrl->keyidlist == NULL) { + isc_log_write(dns_lctx,DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, ISC_LOG_WARNING, + "the KEYS clause of an INET control " + "channel must be used"); + result = ISC_R_FAILURE; + } else if (dns_c_kidlist_keycount(ctrl->keyidlist) == 0) { + isc_log_write(dns_lctx,DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, ISC_LOG_WARNING, + "the KEYS clause of an INET control " + "channel must not be empty"); + result = ISC_R_FAILURE; + } + + + return (result); +} + + + isc_result_t dns_c_ctrlinet_new(isc_mem_t *mem, dns_c_ctrl_t **control, isc_sockaddr_t addr, in_port_t port, diff --git a/lib/dns/config/confctx.c b/lib/dns/config/confctx.c index e32cfe753f..169e3ffbf6 100644 --- a/lib/dns/config/confctx.c +++ b/lib/dns/config/confctx.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confctx.c,v 1.72 2000/07/07 22:57:53 brister Exp $ */ +/* $Id: confctx.c,v 1.73 2000/07/11 19:09:04 brister Exp $ */ #include @@ -229,6 +229,7 @@ dns_c_checkconfig(dns_c_ctx_t *cfg) isc_result_t tmpres; dns_c_rrsolist_t *olist; dns_c_lstnlist_t *listenlist; + dns_c_ctrllist_t *controls; if (dns_c_ctx_getnamedxfer(cfg, &cpval) != ISC_R_NOTFOUND) { @@ -492,6 +493,14 @@ dns_c_checkconfig(dns_c_ctx_t *cfg) } } + if (dns_c_ctx_getcontrols(cfg, &controls) != ISC_R_NOTFOUND) { + tmpres = dns_c_ctrllist_validate(controls); + if (tmpres != ISC_R_SUCCESS) { + result = tmpres; + } + } + + return (result); } diff --git a/lib/dns/config/confkeys.c b/lib/dns/config/confkeys.c index f18cd908cb..638294242f 100644 --- a/lib/dns/config/confkeys.c +++ b/lib/dns/config/confkeys.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confkeys.c,v 1.24 2000/07/07 23:11:43 brister Exp $ */ +/* $Id: confkeys.c,v 1.25 2000/07/11 19:09:06 brister Exp $ */ #include @@ -450,6 +450,27 @@ dns_c_kidlist_delete(dns_c_kidlist_t **list) } +isc_uint32_t +dns_c_kidlist_keycount(dns_c_kidlist_t *list) +{ + dns_c_kid_t *kid; + isc_uint32_t count = 0; + + REQUIRE(DNS_C_KEYIDLIST_VALID(list)); + + kid = ISC_LIST_HEAD(list->keyids); + while (kid != NULL) { + count++; + kid = ISC_LIST_NEXT(kid, next); + } + + return (count); +} + + + + + static isc_result_t keyid_delete(dns_c_kid_t **keyid) { diff --git a/lib/dns/include/dns/confctl.h b/lib/dns/include/dns/confctl.h index a3982e884a..fbcaae801b 100644 --- a/lib/dns/include/dns/confctl.h +++ b/lib/dns/include/dns/confctl.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confctl.h,v 1.18 2000/07/10 11:28:31 tale Exp $ */ +/* $Id: confctl.h,v 1.19 2000/07/11 19:09:07 brister Exp $ */ #ifndef DNS_CONFCTL_H #define DNS_CONFCTL_H 1 @@ -161,6 +161,16 @@ dns_c_ctrl_delete(dns_c_ctrl_t **control); * ISC_R_SUCCESS */ + +isc_result_t +dns_c_ctrl_validate(dns_c_ctrl_t *ctrl); +/* + * Validates one control statement enty. + * The KEYS must be used. UNIX types are ignored (so we issue a warning for + * that. + */ + + void dns_c_ctrl_print(FILE *fp, int indent, dns_c_ctrl_t *ctl); /* @@ -187,6 +197,12 @@ dns_c_ctrllist_new(isc_mem_t *mem, dns_c_ctrllist_t **newlist); * ISC_R_NOMEMORY -- insufficient memory available. */ +isc_result_t +dns_c_ctrllist_validate(dns_c_ctrllist_t *cl); +/* + * Validates the subclauses of the control statement. + */ + isc_result_t dns_c_ctrllist_delete(dns_c_ctrllist_t **list); /* diff --git a/lib/dns/include/dns/confkeys.h b/lib/dns/include/dns/confkeys.h index 379251724e..4ee4c9034d 100644 --- a/lib/dns/include/dns/confkeys.h +++ b/lib/dns/include/dns/confkeys.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confkeys.h,v 1.17 2000/06/22 21:55:22 tale Exp $ */ +/* $Id: confkeys.h,v 1.18 2000/07/11 19:09:09 brister Exp $ */ #ifndef DNS_CONFKEYS_H #define DNS_CONFKEYS_H 1 @@ -195,152 +195,124 @@ struct dns_c_kid_list { ISC_LANG_BEGINDECLS -isc_result_t -dns_c_pklist_new(isc_mem_t *mem, dns_c_pklist_t **pklist); +isc_result_t dns_c_pklist_new(isc_mem_t *mem, dns_c_pklist_t **pklist); -isc_result_t -dns_c_pklist_delete(dns_c_pklist_t **list); +isc_result_t dns_c_pklist_delete(dns_c_pklist_t **list); -isc_result_t -dns_c_pklist_addpubkey(dns_c_pklist_t *list, dns_c_pubkey_t *pkey, - isc_boolean_t deepcopy); +isc_result_t dns_c_pklist_addpubkey(dns_c_pklist_t *list, dns_c_pubkey_t *pkey, + isc_boolean_t deepcopy); -isc_result_t -dns_c_pklist_findpubkey(dns_c_pklist_t *list, dns_c_pubkey_t **pubkey, - isc_uint32_t flags, isc_uint32_t protocol, - isc_uint32_t algorithm, const char *key); +isc_result_t dns_c_pklist_findpubkey(dns_c_pklist_t *list, + dns_c_pubkey_t **pubkey, + isc_uint32_t flags, isc_uint32_t protocol, + isc_uint32_t algorithm, const char *key); -isc_result_t -dns_c_pklist_rmpubkey(dns_c_pklist_t *list, isc_uint32_t flags, - isc_uint32_t protocol, isc_uint32_t algorithm, - const char *key); +isc_result_t dns_c_pklist_rmpubkey(dns_c_pklist_t *list, isc_uint32_t flags, + isc_uint32_t protocol, + isc_uint32_t algorithm, const char *key); -void -dns_c_pklist_print(FILE *fp, int indent, dns_c_pklist_t *pubkey); +void dns_c_pklist_print(FILE *fp, int indent, dns_c_pklist_t *pubkey); -isc_result_t -dns_c_pubkey_new(isc_mem_t *mem, isc_uint32_t flags, isc_uint32_t protocol, - isc_uint32_t algorithm, const char *key, - dns_c_pubkey_t **pubkey); +isc_result_t dns_c_pubkey_new(isc_mem_t *mem, isc_uint32_t flags, + isc_uint32_t protocol, + isc_uint32_t algorithm, + const char *key, + dns_c_pubkey_t **pubkey); -isc_result_t -dns_c_pubkey_delete(dns_c_pubkey_t **pubkey); +isc_result_t dns_c_pubkey_delete(dns_c_pubkey_t **pubkey); -isc_result_t -dns_c_pubkey_copy(isc_mem_t *mem, dns_c_pubkey_t **dest, dns_c_pubkey_t *src); +isc_result_t dns_c_pubkey_copy(isc_mem_t *mem, dns_c_pubkey_t **dest, + dns_c_pubkey_t *src); -isc_boolean_t -dns_c_pubkey_equal(dns_c_pubkey_t *k1, dns_c_pubkey_t *k2); +isc_boolean_t dns_c_pubkey_equal(dns_c_pubkey_t *k1, dns_c_pubkey_t *k2); -void -dns_c_pubkey_print(FILE *fp, int indent, dns_c_pubkey_t *pubkey); +void dns_c_pubkey_print(FILE *fp, int indent, dns_c_pubkey_t *pubkey); -isc_result_t -dns_c_kidlist_new(isc_mem_t *mem, dns_c_kidlist_t **list); +isc_result_t dns_c_kidlist_new(isc_mem_t *mem, dns_c_kidlist_t **list); -isc_result_t -dns_c_kidlist_delete(dns_c_kidlist_t **list); +isc_result_t dns_c_kidlist_delete(dns_c_kidlist_t **list); -isc_result_t -dns_c_kidlist_undef(dns_c_kidlist_t *list, const char *keyid); +isc_uint32_t dns_c_kidlist_keycount(dns_c_kidlist_t *list); -isc_result_t -dns_c_kidlist_find(dns_c_kidlist_t *list, const char *keyid, - dns_c_kid_t **retval); + +isc_result_t dns_c_kidlist_undef(dns_c_kidlist_t *list, const char *keyid); -void -dns_c_kidlist_append(dns_c_kidlist_t *list, dns_c_kid_t *keyid); +isc_result_t dns_c_kidlist_find(dns_c_kidlist_t *list, const char *keyid, + dns_c_kid_t **retval); -void -dns_c_kidlist_print(FILE *fp, int indent, dns_c_kidlist_t *list); +void dns_c_kidlist_append(dns_c_kidlist_t *list, dns_c_kid_t *keyid); -isc_result_t -dns_c_kid_new(isc_mem_t *mem, const char *name, dns_c_kid_t **keyid); +void dns_c_kidlist_print(FILE *fp, int indent, dns_c_kidlist_t *list); -isc_result_t -dns_c_kdeflist_new(isc_mem_t *mem, dns_c_kdeflist_t **list); +isc_result_t dns_c_kid_new(isc_mem_t *mem, const char *name, + dns_c_kid_t **keyid); -isc_result_t -dns_c_kdeflist_delete(dns_c_kdeflist_t **list); +isc_result_t dns_c_kdeflist_new(isc_mem_t *mem, dns_c_kdeflist_t **list); -isc_result_t -dns_c_kdeflist_copy(isc_mem_t *mem, dns_c_kdeflist_t **dest, - dns_c_kdeflist_t *src); +isc_result_t dns_c_kdeflist_delete(dns_c_kdeflist_t **list); -isc_result_t -dns_c_kdeflist_append(dns_c_kdeflist_t *list, dns_c_kdef_t *key, - isc_boolean_t copy); +isc_result_t dns_c_kdeflist_copy(isc_mem_t *mem, dns_c_kdeflist_t **dest, + dns_c_kdeflist_t *src); -isc_result_t -dns_c_kdeflist_undef(dns_c_kdeflist_t *list, const char *keyid); +isc_result_t dns_c_kdeflist_append(dns_c_kdeflist_t *list, dns_c_kdef_t *key, + isc_boolean_t copy); -isc_result_t -dns_c_kdeflist_find(dns_c_kdeflist_t *list, const char *keyid, - dns_c_kdef_t **retval); +isc_result_t dns_c_kdeflist_undef(dns_c_kdeflist_t *list, const char *keyid); -void -dns_c_kdeflist_print(FILE *fp, int indent, dns_c_kdeflist_t *list); +isc_result_t dns_c_kdeflist_find(dns_c_kdeflist_t *list, const char *keyid, + dns_c_kdef_t **retval); -isc_result_t -dns_c_kdef_new(isc_mem_t *mem, const char *name, dns_c_kdef_t **keyid); +void dns_c_kdeflist_print(FILE *fp, int indent, dns_c_kdeflist_t *list); -isc_result_t -dns_c_kdef_delete(dns_c_kdef_t **keydef); +isc_result_t dns_c_kdef_new(isc_mem_t *mem, const char *name, + dns_c_kdef_t **keyid); -isc_result_t -dns_c_kdef_copy(isc_mem_t *mem, dns_c_kdef_t **dest, dns_c_kdef_t *src); +isc_result_t dns_c_kdef_delete(dns_c_kdef_t **keydef); -void -dns_c_kdef_print(FILE *fp, int indent, dns_c_kdef_t *keydef); +isc_result_t dns_c_kdef_copy(isc_mem_t *mem, dns_c_kdef_t **dest, + dns_c_kdef_t *src); -isc_result_t -dns_c_kdef_setalgorithm(dns_c_kdef_t *elem, const char *algorithm); +void dns_c_kdef_print(FILE *fp, int indent, dns_c_kdef_t *keydef); -isc_result_t -dns_c_kdef_setsecret(dns_c_kdef_t *elem, const char *secret); +isc_result_t dns_c_kdef_setalgorithm(dns_c_kdef_t *elem, + const char *algorithm); -isc_result_t -dns_c_tkeylist_new(isc_mem_t *mem, dns_c_tkeylist_t **newlist); +isc_result_t dns_c_kdef_setsecret(dns_c_kdef_t *elem, const char *secret); -isc_result_t -dns_c_tkeylist_delete(dns_c_tkeylist_t **list); +isc_result_t dns_c_tkeylist_new(isc_mem_t *mem, dns_c_tkeylist_t **newlist); -isc_result_t -dns_c_tkeylist_copy(isc_mem_t *mem, dns_c_tkeylist_t **dest, - dns_c_tkeylist_t *src); +isc_result_t dns_c_tkeylist_delete(dns_c_tkeylist_t **list); -void -dns_c_tkeylist_print(FILE *fp, int indent, dns_c_tkeylist_t *list); +isc_result_t dns_c_tkeylist_copy(isc_mem_t *mem, dns_c_tkeylist_t **dest, + dns_c_tkeylist_t *src); -isc_result_t -dns_c_tkeylist_append(dns_c_tkeylist_t *list, dns_c_tkey_t *element, - isc_boolean_t copy); +void dns_c_tkeylist_print(FILE *fp, int indent, dns_c_tkeylist_t *list); -isc_result_t -dns_c_tkey_new(isc_mem_t *mem, const char *domain, isc_uint32_t flags, - isc_uint32_t protocol, isc_uint32_t algorithm, - const char *key, dns_c_tkey_t **newkey); +isc_result_t dns_c_tkeylist_append(dns_c_tkeylist_t *list, + dns_c_tkey_t *element, + isc_boolean_t copy); -isc_result_t -dns_c_tkey_delete(dns_c_tkey_t **tkey); +isc_result_t dns_c_tkey_new(isc_mem_t *mem, const char *domain, + isc_uint32_t flags, + isc_uint32_t protocol, isc_uint32_t algorithm, + const char *key, dns_c_tkey_t **newkey); -isc_result_t -dns_c_tkey_copy(isc_mem_t *mem, dns_c_tkey_t **dest, dns_c_tkey_t *src); +isc_result_t dns_c_tkey_delete(dns_c_tkey_t **tkey); -isc_result_t -dns_c_tkey_getflags(dns_c_tkey_t *tkey, isc_uint32_t *flags); +isc_result_t dns_c_tkey_copy(isc_mem_t *mem, dns_c_tkey_t **dest, + dns_c_tkey_t *src); -isc_result_t -dns_c_tkey_getprotocol(dns_c_tkey_t *tkey, isc_uint32_t *protocol); +isc_result_t dns_c_tkey_getflags(dns_c_tkey_t *tkey, isc_uint32_t *flags); -isc_result_t -dns_c_tkey_getalgorithm(dns_c_tkey_t *tkey, isc_uint32_t *algorithm); +isc_result_t dns_c_tkey_getprotocol(dns_c_tkey_t *tkey, + isc_uint32_t *protocol); -isc_result_t -dns_c_tkey_getkey(dns_c_tkey_t *tkey, const char **key); +isc_result_t dns_c_tkey_getalgorithm(dns_c_tkey_t *tkey, + isc_uint32_t *algorithm); -void -dns_c_tkey_print(FILE *fp, int indent, dns_c_tkey_t *tkey); +isc_result_t dns_c_tkey_getkey(dns_c_tkey_t *tkey, const char **key); + +void dns_c_tkey_print(FILE *fp, int indent, dns_c_tkey_t *tkey); ISC_LANG_ENDDECLS From 838f13fbdc513895d1826201a11531dbde9de04a Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 11 Jul 2000 19:18:05 +0000 Subject: [PATCH 022/226] Set default signal handlers for SIGINT and SIGTERM (SIGHUP already had one). This doesn't appear to have an effect on any platform, but it seems like a good idea. --- lib/isc/unix/app.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c index c936a91711..8a4283b7ee 100644 --- a/lib/isc/unix/app.c +++ b/lib/isc/unix/app.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: app.c,v 1.19 2000/06/29 07:40:58 explorer Exp $ */ +/* $Id: app.c,v 1.20 2000/07/11 19:18:05 bwelling Exp $ */ #include @@ -152,11 +152,17 @@ isc_app_start(void) { /* * On Solaris 2, delivery of a signal whose action is SIG_IGN * will not cause sigwait() to return. We may have inherited - * a SIG_IGN action for SIGHUP from our parent process, - * (e.g, Solaris cron). Set an action of SIG_DFL to make + * unexpected actions for SIGHUP, SIGINT, and SIGTERM from our parent + * process, * (e.g, Solaris cron). Set an action of SIG_DFL to make * sure sigwait() works as expected. */ result = handle_signal(SIGHUP, SIG_DFL); + if (result != ISC_R_SUCCESS) + return (result); + result = handle_signal(SIGTERM, SIG_DFL); + if (result != ISC_R_SUCCESS) + return (result); + result = handle_signal(SIGINT, SIG_DFL); if (result != ISC_R_SUCCESS) return (result); From f4d9f465cd29963a99554bbe2936509ea3568c89 Mon Sep 17 00:00:00 2001 From: James Brister Date: Tue, 11 Jul 2000 20:13:09 +0000 Subject: [PATCH 023/226] 327. [bug] rndc.conf parser wasn't correctly recognising an IP address where a host specification was required. --- CHANGES | 3 ++ lib/dns/config/confndc.c | 90 ++++++++++++++++++++-------------------- 2 files changed, 49 insertions(+), 44 deletions(-) diff --git a/CHANGES b/CHANGES index e3f7a294d3..ffced6322b 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,6 @@ + 327. [bug] rndc.conf parser wasn't correctly recognising an IP + address where a host specification was required. + 326. [func] 'keys' in an 'inet' control statement is now required and must have at least one item in it. diff --git a/lib/dns/config/confndc.c b/lib/dns/config/confndc.c index 72d57f00d0..a73c720391 100644 --- a/lib/dns/config/confndc.c +++ b/lib/dns/config/confndc.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confndc.c,v 1.20 2000/07/10 11:27:11 tale Exp $ */ +/* $Id: confndc.c,v 1.21 2000/07/11 20:13:09 brister Exp $ */ /* ** options { @@ -144,51 +144,39 @@ static struct keywordtoken misc_tokens[] = { -static isc_result_t -parse_file(ndcpcontext *pctx, dns_c_ndcctx_t **context); +static isc_result_t parse_file(ndcpcontext *pctx, dns_c_ndcctx_t **context); -static isc_result_t -parse_statement(ndcpcontext *pctx); -static isc_result_t -parse_options(ndcpcontext *pctx, dns_c_ndcopts_t **opts); -static isc_result_t -parse_serverstmt(ndcpcontext *pctx, dns_c_ndcserver_t **server); -static isc_result_t -parse_keystmt(ndcpcontext *pctx, dns_c_kdeflist_t *keys); +static isc_result_t parse_statement(ndcpcontext *pctx); +static isc_result_t parse_options(ndcpcontext *pctx, dns_c_ndcopts_t **opts); +static isc_result_t parse_serverstmt(ndcpcontext *pctx, dns_c_ndcserver_t **server); +static isc_result_t parse_keystmt(ndcpcontext *pctx, dns_c_kdeflist_t *keys); -static const char * -keyword2str(isc_int32_t val); -static isc_boolean_t -eat(ndcpcontext *pctx, isc_uint32_t token); -static isc_boolean_t -eat_eos(ndcpcontext *pctx); -static isc_boolean_t -eat_lbrace(ndcpcontext *pctx); -static isc_boolean_t -eat_rbrace(ndcpcontext *pctx); +static const char * keyword2str(isc_int32_t val); +static isc_boolean_t eat(ndcpcontext *pctx, isc_uint32_t token); +static isc_boolean_t eat_eos(ndcpcontext *pctx); +static isc_boolean_t eat_lbrace(ndcpcontext *pctx); +static isc_boolean_t eat_rbrace(ndcpcontext *pctx); -static isc_boolean_t -looking_at(ndcpcontext *pctx, isc_uint32_t token); -static isc_boolean_t -looking_at_anystring(ndcpcontext *pctx); +static isc_boolean_t looking_at(ndcpcontext *pctx, isc_uint32_t token); +static isc_boolean_t looking_at_anystring(ndcpcontext *pctx); -static isc_result_t -parser_setup(ndcpcontext *pctx, isc_mem_t *mem, const char *filename); -static void -parser_complain(isc_boolean_t is_warning, isc_boolean_t print_last_token, - ndcpcontext *pctx, const char *format, va_list args); -static void -parser_error(ndcpcontext *pctx, isc_boolean_t lasttoken, const char *fmt, ...); -static void -parser_warn(ndcpcontext *pctx, isc_boolean_t lasttoken, const char *fmt, ...); -static isc_boolean_t -is_ip6addr(const char *string, struct in6_addr *addr); -static isc_boolean_t -is_ip4addr(const char *string, struct in_addr *addr); -static isc_result_t -getnexttoken(ndcpcontext *pctx); -static void -syntax_error(ndcpcontext *pctx, isc_uint32_t keyword); +static isc_boolean_t looking_at_stringoripaddr(ndcpcontext *pctx); + + +static isc_result_t parser_setup(ndcpcontext *pctx, isc_mem_t *mem, + const char *filename); +static void parser_complain(isc_boolean_t is_warning, + isc_boolean_t print_last_token, + ndcpcontext *pctx, const char *format, + va_list args); +static void parser_error(ndcpcontext *pctx, isc_boolean_t lasttoken, + const char *fmt, ...); +static void parser_warn(ndcpcontext *pctx, isc_boolean_t lasttoken, + const char *fmt, ...); +static isc_boolean_t is_ip6addr(const char *string, struct in6_addr *addr); +static isc_boolean_t is_ip4addr(const char *string, struct in_addr *addr); +static isc_result_t getnexttoken(ndcpcontext *pctx); +static void syntax_error(ndcpcontext *pctx, isc_uint32_t keyword); /* *********************************************************************** */ @@ -950,7 +938,7 @@ parse_options(ndcpcontext *pctx, dns_c_ndcopts_t **opts) { switch (option) { case L_DEFAULT_SERVER: - if (!looking_at_anystring(pctx)) + if (!looking_at_stringoripaddr(pctx)) return (result); result = dns_c_ndcopts_setdefserver(newopts, @@ -1067,7 +1055,7 @@ parse_serverstmt(ndcpcontext *pctx, dns_c_ndcserver_t **server) { break; case L_HOST: - if (!looking_at_anystring(pctx)) { + if (!looking_at_stringoripaddr(pctx)) { result = ISC_R_FAILURE; goto done; } @@ -1347,6 +1335,20 @@ looking_at_anystring(ndcpcontext *pctx) { return (ISC_TRUE); } + +static isc_boolean_t +looking_at_stringoripaddr(ndcpcontext *pctx) { + if (pctx->currtok != L_STRING && pctx->currtok != L_QSTRING && + pctx->currtok != L_IP4ADDR && pctx->currtok != L_IP6ADDR) { + parser_error(pctx, ISC_TRUE, + "expected a hostname or an ip address"); + return (ISC_FALSE); + } + + return (ISC_TRUE); +} + + static isc_boolean_t eat_lbrace(ndcpcontext *pctx) { return (eat(pctx, L_LBRACE)); From 9bf765ab3a5203b854d32266e6162e547791383c Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Tue, 11 Jul 2000 21:51:13 +0000 Subject: [PATCH 024/226] 328. [func] Added isc_base64_decodestring(). (This is basically bin/named/server.c:base64_cstring_tobuffer(), which I will remove in another revision that will not need to be pulled up. I also would like to change isc_base64_totext() and isc_base64_tobuffer() to be isc_base64_encoderegion() and isc_base64_decodelexer(), unless there are exceptions. I find their existing names to be quite confusing with regard to what translation function each performs.) --- CHANGES | 7 ++++--- lib/isc/base64.c | 35 ++++++++++++++++++++++++++++++++++- lib/isc/include/isc/base64.h | 26 ++++++++++++++++++++++++-- 3 files changed, 62 insertions(+), 6 deletions(-) diff --git a/CHANGES b/CHANGES index ffced6322b..2919ba89c2 100644 --- a/CHANGES +++ b/CHANGES @@ -1,11 +1,12 @@ + 328. [func] Added isc_base64_decodestring(). + 327. [bug] rndc.conf parser wasn't correctly recognising an IP address where a host specification was required. 326. [func] 'keys' in an 'inet' control statement is now required and must have at least one item in it. - - warning is issued if a 'unix' control channel is - defined (not supported). + A "not supported" warning is now issued if a 'unix' + control channel is defined. 325. [bug] isc_lex_gettoken was processing octal strings when ISC_LEXOPT_CNUMBER was not set. diff --git a/lib/isc/base64.c b/lib/isc/base64.c index a6f01ba50f..29ae56b39e 100644 --- a/lib/isc/base64.c +++ b/lib/isc/base64.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: base64.c,v 1.15 2000/06/21 21:56:29 tale Exp $ */ +/* $Id: base64.c,v 1.16 2000/07/11 21:51:12 tale Exp $ */ #include @@ -160,6 +160,39 @@ isc_base64_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length) { return (ISC_R_SUCCESS); } +isc_result_t +isc_base64_decodestring(isc_mem_t *mctx, char *cstr, isc_buffer_t *target) { + isc_result_t result; + isc_buffer_t source; + isc_lex_t *lex = NULL; + isc_boolean_t isopen = ISC_FALSE; + + REQUIRE(mctx != NULL); + REQUIRE(cstr != NULL); + REQUIRE(ISC_BUFFER_VALID(target)); + + isc_buffer_init(&source, cstr, strlen(cstr)); + isc_buffer_add(&source, strlen(cstr)); + + result = isc_lex_create(mctx, 256, &lex); + + if (result == ISC_R_SUCCESS) + result = isc_lex_openbuffer(lex, &source); + + if (result == ISC_R_SUCCESS) { + isopen = ISC_TRUE; + result = isc_base64_tobuffer(lex, target, -1); + } + + if (isopen) + (void)isc_lex_close(lex); + if (lex != NULL) + isc_lex_destroy(&lex); + + return (result); +} + + static isc_result_t str_totext(const char *source, isc_buffer_t *target) { unsigned int l; diff --git a/lib/isc/include/isc/base64.h b/lib/isc/include/isc/base64.h index 7fe9b316c2..f3aec10e2a 100644 --- a/lib/isc/include/isc/base64.h +++ b/lib/isc/include/isc/base64.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: base64.h,v 1.9 2000/06/06 17:50:38 gson Exp $ */ +/* $Id: base64.h,v 1.10 2000/07/11 21:51:13 tale Exp $ */ #ifndef ISC_BASE64_H #define ISC_BASE64_H 1 @@ -53,10 +53,31 @@ isc_base64_totext(isc_region_t *source, int wordlength, * necessary. */ +isc_result_t +isc_base64_decodestring(isc_mem_t *mctx, char *cstr, isc_buffer_t *target); +/* + * Decode a null-terminated base64 string. + * + * Requires: + * 'mctx' is non-null. + * 'cstr' is non-null. + * 'target' is a valid buffer. + * + * Returns: + * ISC_R_SUCCESS -- the entire decoded representation of 'cstring' + * fit in 'target'. + * ISC_R_BADBASE64 -- 'cstr' is not a valid base64 encoding. + * + * Other error returns are any possible error code from: + * isc_lex_create(), + * isc_lex_openbuffer(), + * isc_base64_tobuffer(). + */ + isc_result_t isc_base64_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length); /* - * Convert base64 encoded text into data. + * Convert base64 encoded text from a lexer context into data. * * Requires: * 'lex' is a valid lexer context @@ -71,6 +92,7 @@ isc_base64_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length); */ + ISC_LANG_ENDDECLS #endif /* ISC_BASE64_H */ From ce2be9b7211ab5bacaa10fe74ef35def3a3f6089 Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Tue, 11 Jul 2000 22:03:12 +0000 Subject: [PATCH 025/226] 329. [func] omapi_auth_register() now takes a size_t argument for the length of a key's secret data. Previously OMAPI only stored secrets up to the first NUL byte. This change was made to cope with decoded base64 secrets, so in this revision omapiconf.c and rndc.c also decode the secret. --- CHANGES | 4 ++++ bin/named/omapiconf.c | 40 ++++++++++++++++++++++++++------- bin/rndc/rndc.c | 15 +++++++++---- lib/omapi/auth.c | 19 +++++++++------- lib/omapi/include/omapi/omapi.h | 6 ++--- 5 files changed, 61 insertions(+), 23 deletions(-) diff --git a/CHANGES b/CHANGES index 2919ba89c2..0772b30444 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ + 329. [func] omapi_auth_register() now takes a size_t argument for + the length of a key's secret data. Previously + OMAPI only stored secrets up to the first NUL byte. + 328. [func] Added isc_base64_decodestring(). 327. [bug] rndc.conf parser wasn't correctly recognising an IP diff --git a/bin/named/omapiconf.c b/bin/named/omapiconf.c index 1a72729f2e..ebb31fcf85 100644 --- a/bin/named/omapiconf.c +++ b/bin/named/omapiconf.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: omapiconf.c,v 1.4 2000/07/10 22:04:08 tale Exp $ */ +/* $Id: omapiconf.c,v 1.5 2000/07/11 22:03:09 tale Exp $ */ /* * Principal Author: DCL @@ -23,12 +23,16 @@ #include +#include +#include #include #include #include #include #include +#include + #include #include #include @@ -195,6 +199,8 @@ register_keys(dns_c_ctrl_t *control, dns_c_kdeflist_t *keydeflist, { dns_c_kid_t *keyid; dns_c_kdef_t *keydef; + const char secret[1024]; + isc_buffer_t b; isc_result_t result; /* @@ -221,9 +227,9 @@ register_keys(dns_c_ctrl_t *control, dns_c_kdeflist_t *keydeflist, * the keys statement. */ keydef = NULL; - (void)dns_c_kdeflist_find(keydeflist, keyid->keyid, - &keydef); - if (keydef == NULL) + result = dns_c_kdeflist_find(keydeflist, keyid->keyid, + &keydef); + if (result != ISC_R_SUCCESS) isc_log_write(ns_g_lctx, ISC_LOGCATEGORY_GENERAL, NS_LOGMODULE_OMAPI, ISC_LOG_WARNING, "couldn't find key %s for" @@ -237,13 +243,31 @@ register_keys(dns_c_ctrl_t *control, dns_c_kdeflist_t *keydeflist, "command channel %s", keydef->algorithm, keydef->keyid, socktext); - keydef = NULL; + result = DST_R_UNSUPPORTEDALG; + keydef = NULL; /* Prevent more error messages. */ } - if (keydef != NULL) + if (result == ISC_R_SUCCESS) { + isc_buffer_init(&b, secret, sizeof(secret)); + result = isc_base64_decodestring(ns_g_mctx, + keydef->secret, + &b); + } + + if (keydef != NULL && result != ISC_R_SUCCESS) { + isc_log_write(ns_g_lctx, ISC_LOGCATEGORY_GENERAL, + NS_LOGMODULE_OMAPI, ISC_LOG_WARNING, + "can't use secret for key %s on " + "command channel %s: %s", + keydef->keyid, socktext, + isc_result_totext(result)); + keydef = NULL; /* Prevent more error messages. */ + + } else if (result == ISC_R_SUCCESS) result = omapi_auth_register(keydef->keyid, - keydef->secret, - OMAPI_AUTH_HMACMD5); + OMAPI_AUTH_HMACMD5, + isc_buffer_base(&b), + isc_buffer_usedlength(&b)); if (keydef != NULL && result != ISC_R_SUCCESS) isc_log_write(ns_g_lctx, ISC_LOGCATEGORY_GENERAL, diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c index a3ebdf8f72..4efa7846dd 100644 --- a/bin/rndc/rndc.c +++ b/bin/rndc/rndc.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: rndc.c,v 1.17 2000/07/11 01:30:56 tale Exp $ */ +/* $Id: rndc.c,v 1.18 2000/07/11 22:03:08 tale Exp $ */ /* * Principal Author: DCL @@ -25,6 +25,8 @@ #include +#include +#include #include #include #include @@ -273,7 +275,8 @@ main(int argc, char **argv) { dns_c_kdeflist_t *keys = NULL; dns_c_kdef_t *key = NULL; const char *keyname = NULL; - const char *secret = NULL; + char secret[1024]; + isc_buffer_t secretbuf; char *command; const char *servername = NULL; const char *host = NULL; @@ -396,7 +399,6 @@ main(int argc, char **argv) { INSIST(key->secret != NULL); INSIST(key->algorithm != NULL); - secret = key->secret; if (strcasecmp(key->algorithm, "hmac-md5") == 0) algorithm = OMAPI_AUTH_HMACMD5; else { @@ -405,6 +407,10 @@ main(int argc, char **argv) { exit(1); } + isc_buffer_init(&secretbuf, secret, sizeof(secret)); + DO("decode base64 secret", + isc_base64_decodestring(mctx, key->secret, &secretbuf)); + if (server != NULL) (void)dns_c_ndcserver_gethost(server, &host); @@ -432,7 +438,8 @@ main(int argc, char **argv) { ndc_g_ndc.type = ndc_type; DO("register local authenticator", - omapi_auth_register(keyname, secret, algorithm)); + omapi_auth_register(keyname, algorithm, isc_buffer_base(&secretbuf), + isc_buffer_usedlength(&secretbuf))); DO("create protocol manager", omapi_object_create(&omapimgr, NULL, 0)); diff --git a/lib/omapi/auth.c b/lib/omapi/auth.c index 9d121b32d2..418320f628 100644 --- a/lib/omapi/auth.c +++ b/lib/omapi/auth.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: auth.c,v 1.9 2000/06/28 03:09:44 tale Exp $ */ +/* $Id: auth.c,v 1.10 2000/07/11 22:03:10 tale Exp $ */ /* Principal Author: DCL */ @@ -58,6 +58,7 @@ struct auth { unsigned int magic; char *name; char *secret; + size_t secretlen; unsigned int algorithms; ISC_LINK(auth_t) link; @@ -133,10 +134,8 @@ auth_makekey(const char *name, unsigned int algorithm, dst_key_t **key) { return (ISC_R_UNEXPECTED); } - length = strlen(auth->secret); - isc_buffer_init(&secret, auth->secret, length); - isc_buffer_add(&secret, length); - + isc_buffer_init(&secret, auth->secret, auth->secretlen); + isc_buffer_add(&secret, auth->secretlen); length = strlen(auth->name); isc_buffer_init(&srcb, auth->name, length); @@ -171,8 +170,8 @@ auth_delete(auth_t *a) { } isc_result_t -omapi_auth_register(const char *name, const char *secret, - unsigned int algorithms) +omapi_auth_register(const char *name, unsigned int algorithms, + const unsigned char *secret, size_t secretlen) { auth_t *new = NULL; isc_result_t result = ISC_R_SUCCESS; @@ -199,9 +198,13 @@ omapi_auth_register(const char *name, const char *secret, if (new->name == NULL) result = ISC_R_NOMEMORY; - new->secret = isc_mem_strdup(omapi_mctx, secret); + new->secret = isc_mem_allocate(omapi_mctx, secretlen); if (new->secret == NULL) result = ISC_R_NOMEMORY; + else { + memcpy(new->secret, secret, secretlen); + new->secretlen = secretlen; + } new->algorithms = algorithms; diff --git a/lib/omapi/include/omapi/omapi.h b/lib/omapi/include/omapi/omapi.h index b10cc45e37..f0535890cc 100644 --- a/lib/omapi/include/omapi/omapi.h +++ b/lib/omapi/include/omapi/omapi.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: omapi.h,v 1.14 2000/07/10 11:22:59 tale Exp $ */ +/* $Id: omapi.h,v 1.15 2000/07/11 22:03:12 tale Exp $ */ /* * Definitions for the object management API and protocol. @@ -94,8 +94,8 @@ struct omapi_object { * Public functions defined in auth.c. */ isc_result_t -omapi_auth_register(const char *name, const char *secret, - unsigned int algorithms); +omapi_auth_register(const char *name, unsigned int algorithms, + const unsigned char *secret, size_t secretlen); void omapi_auth_deregister(const char *name); From 403cc93b27c43da09faf0e53d31709e2d5d9cbba Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Tue, 11 Jul 2000 22:44:33 +0000 Subject: [PATCH 026/226] typo in log message --- lib/dns/zone.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/dns/zone.c b/lib/dns/zone.c index 843b71ae6b..b68971cd9c 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: zone.c,v 1.155 2000/07/04 04:21:38 marka Exp $ */ +/* $Id: zone.c,v 1.156 2000/07/11 22:44:33 gson Exp $ */ #include @@ -3917,7 +3917,7 @@ got_transfer_quota(isc_task_t *task, isc_event_t *event) { xfrtype = dns_rdatatype_axfr; } else { zone_log(zone, me, ISC_LOG_DEBUG(3), - "requesting IXFR form %s", + "requesting IXFR from %s", mastertext); xfrtype = dns_rdatatype_ixfr; } From eae2a15326c3cdd5ee0cb7b71736785349fa8bc0 Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Tue, 11 Jul 2000 23:02:32 +0000 Subject: [PATCH 027/226] use ns_g_server->aclenv to match localhost and localnets in the allow{} clause --- bin/named/omapiconf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/named/omapiconf.c b/bin/named/omapiconf.c index ebb31fcf85..051f499e15 100644 --- a/bin/named/omapiconf.c +++ b/bin/named/omapiconf.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: omapiconf.c,v 1.5 2000/07/11 22:03:09 tale Exp $ */ +/* $Id: omapiconf.c,v 1.6 2000/07/11 23:02:32 tale Exp $ */ /* * Principal Author: DCL @@ -137,7 +137,7 @@ verify_connection(isc_sockaddr_t *sockaddr, void *arg) { listener = arg; result = dns_acl_match(&netaddr, NULL, listener->acl, - NULL, &match, NULL); + &ns_g_server->aclenv, &match, NULL); if (result != ISC_R_SUCCESS || match <= 0) return (ISC_FALSE); From b95b59db2637a72cf6553c42cc7c27813c7ae3a9 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Tue, 11 Jul 2000 23:42:56 +0000 Subject: [PATCH 028/226] Increase max wait time for transfer to Retry time + 1 minute, since some OS's appear to drop UDP packets and not get the initial SOA reply. --- bin/tests/system/xferquota/tests.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/bin/tests/system/xferquota/tests.sh b/bin/tests/system/xferquota/tests.sh index 810a7c5b57..c27fba206a 100644 --- a/bin/tests/system/xferquota/tests.sh +++ b/bin/tests/system/xferquota/tests.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: tests.sh,v 1.15 2000/07/07 23:18:51 gson Exp $ +# $Id: tests.sh,v 1.16 2000/07/11 23:42:56 mws Exp $ SYSTEMTESTTOP=.. . $SYSTEMTESTTOP/conf.sh @@ -26,7 +26,7 @@ SYSTEMTESTTOP=.. count=0 ticks=0 -while [ $count != 300 ]; do +while [ $count != 360 ]; do if [ $ticks = 1 ]; then echo "I:Changing test zone..." cp ns1/changing2.db ns1/changing.db @@ -35,7 +35,7 @@ while [ $count != 300 ]; do sleep 1 ticks=`expr $ticks + 1` seconds=`expr $ticks \* 1` - if [ $ticks = 60 ]; then + if [ $ticks = 300 ]; then echo "I:Took too long to load zones" exit 1 fi From 969b3374ed8c5ba3a65556d9823ce832c98b5336 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 12 Jul 2000 00:22:57 +0000 Subject: [PATCH 029/226] no space between function name and arg list --- bin/dig/dig.c | 8 ++++---- bin/dig/dighost.c | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/bin/dig/dig.c b/bin/dig/dig.c index fd60e1fead..b3d3ec4f95 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.c,v 1.58 2000/07/11 17:35:48 mws Exp $ */ +/* $Id: dig.c,v 1.59 2000/07/12 00:22:56 gson Exp $ */ #include #include @@ -644,13 +644,13 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { timeout = atoi(&rv[0][6]); if (timeout <= 0) timeout = 1; - debug ("timeout set to %d", timeout); + debug("timeout set to %d", timeout); } else if (strncmp(rv[0], "+timeout=", 9) == 0) { /* Global option always */ timeout = atoi(&rv[0][9]); if (timeout <= 0) timeout = 1; - debug ("timeout set to %d", timeout); + debug("timeout set to %d", timeout); } else if (strncmp(rv[0], "+tries=", 7) == 0) { if (have_host) { lookup->retries = atoi(&rv[0][7]); @@ -1250,7 +1250,7 @@ main(int argc, char **argv) { */ #if 0 if (taskmgr != NULL) { - debug ("Freeing taskmgr"); + debug("Freeing taskmgr"); isc_taskmgr_destroy(&taskmgr); } if (isc_mem_debugging) diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index 6a058a2c1a..9a754997bf 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.75 2000/07/11 17:49:02 mws Exp $ */ +/* $Id: dighost.c,v 1.76 2000/07/12 00:22:57 gson Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -1193,7 +1193,7 @@ send_udp(dig_lookup_t *lookup) { local_timeout = UDP_TIMEOUT; } else local_timeout = timeout; - debug ("have local timeout of %d", local_timeout); + debug("have local timeout of %d", local_timeout); isc_interval_set(&lookup->interval, local_timeout, 0); result = isc_timer_create(timermgr, isc_timertype_once, NULL, &lookup->interval, global_task, @@ -1777,7 +1777,7 @@ recv_done(isc_task_t *task, isc_event_t *event) { else local_timeout = INT_MAX; } - debug ("have local timeout of %d", + debug("have local timeout of %d", local_timeout); isc_interval_set(&query->lookup->interval, local_timeout, 0); @@ -1956,7 +1956,7 @@ do_lookup_tcp(dig_lookup_t *lookup) { local_timeout = UDP_TIMEOUT; } else local_timeout = timeout; - debug ("have local timeout of %d", local_timeout); + debug("have local timeout of %d", local_timeout); isc_interval_set(&lookup->interval, local_timeout, 0); result = isc_timer_create(timermgr, isc_timertype_once, NULL, &lookup->interval, global_task, From de73f221e6f0941a12aa2ab91ef7c1ffa321632b Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Wed, 12 Jul 2000 00:42:54 +0000 Subject: [PATCH 030/226] Parenthesis error in trace mode. (To see delegations in +trace, you need to do +trace +authority in dig. Should this be defaulted?) --- bin/dig/dighost.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index 9a754997bf..df7561240e 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.76 2000/07/12 00:22:57 gson Exp $ */ +/* $Id: dighost.c,v 1.77 2000/07/12 00:42:54 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -1793,11 +1793,11 @@ recv_done(isc_task_t *task, isc_event_t *event) { if ((query->lookup->trace)|| (query->lookup->ns_search_only)) { debug("in TRACE code"); - if ((show_details || - ((dns_message_firstname(msg, - DNS_SECTION_ANSWER) - == ISC_R_SUCCESS))) && - !query->lookup->trace_root ) { + if (show_details || + (((dns_message_firstname(msg, + DNS_SECTION_ANSWER) + == ISC_R_SUCCESS)) && + !query->lookup->trace_root)) { printmessage(query, msg, ISC_TRUE); } if ((msg->rcode != 0) && From 931e154a1e597ab183b2a0cece9401f361a47f06 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Wed, 12 Jul 2000 00:46:50 +0000 Subject: [PATCH 031/226] Change ticks to 360, not zones... --- bin/tests/system/xferquota/tests.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/bin/tests/system/xferquota/tests.sh b/bin/tests/system/xferquota/tests.sh index c27fba206a..3a99e23f55 100644 --- a/bin/tests/system/xferquota/tests.sh +++ b/bin/tests/system/xferquota/tests.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: tests.sh,v 1.16 2000/07/11 23:42:56 mws Exp $ +# $Id: tests.sh,v 1.17 2000/07/12 00:46:50 mws Exp $ SYSTEMTESTTOP=.. . $SYSTEMTESTTOP/conf.sh @@ -26,7 +26,7 @@ SYSTEMTESTTOP=.. count=0 ticks=0 -while [ $count != 360 ]; do +while [ $count != 300 ]; do if [ $ticks = 1 ]; then echo "I:Changing test zone..." cp ns1/changing2.db ns1/changing.db @@ -35,7 +35,7 @@ while [ $count != 360 ]; do sleep 1 ticks=`expr $ticks + 1` seconds=`expr $ticks \* 1` - if [ $ticks = 300 ]; then + if [ $ticks = 360 ]; then echo "I:Took too long to load zones" exit 1 fi From 42833075debe1b1d4c4d39e94cb8f66e3fba2a0f Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Wed, 12 Jul 2000 01:15:00 +0000 Subject: [PATCH 032/226] typo in dependency statement --- bin/rndc/Makefile.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/rndc/Makefile.in b/bin/rndc/Makefile.in index 1526db1744..5c444d41b6 100644 --- a/bin/rndc/Makefile.in +++ b/bin/rndc/Makefile.in @@ -13,7 +13,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: Makefile.in,v 1.9 2000/07/11 01:30:55 tale Exp $ +# $Id: Makefile.in,v 1.10 2000/07/12 01:15:00 bwelling Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -49,7 +49,7 @@ SRCS = rndc.c @BIND9_MAKE_RULES@ -rndc.@O@ rndc.c: +rndc.@O@: rndc.c ${LIBTOOL} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \ -DRNDC_SYSCONFDIR=\"${sysconfdir}\" -c ${srcdir}/rndc.c From e7a99528b496636fffb6948b24b33f22ec134c0b Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Wed, 12 Jul 2000 01:15:34 +0000 Subject: [PATCH 033/226] The third parameter to dst_lib_init is an integer, so should be 0, not NULL. --- bin/rndc/rndc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c index 4efa7846dd..725491071b 100644 --- a/bin/rndc/rndc.c +++ b/bin/rndc/rndc.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: rndc.c,v 1.18 2000/07/11 22:03:08 tale Exp $ */ +/* $Id: rndc.c,v 1.19 2000/07/12 01:15:34 bwelling Exp $ */ /* * Principal Author: DCL @@ -355,7 +355,7 @@ main(int argc, char **argv) { DO("create entropy pool", isc_entropy_create(mctx, &entropy)); /* XXXDCL probably should use ISC_ENTROPY_GOOD. talk with graff. */ DO("initialize digital signatures", - dst_lib_init(mctx, entropy, NULL)); + dst_lib_init(mctx, entropy, 0)); DO(conffile, dns_c_ndcparseconf(conffile, mctx, &config)); From 473cb90680ac3404147c3a0934a77d0dffaac998 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Wed, 12 Jul 2000 01:41:35 +0000 Subject: [PATCH 034/226] Choose reasonable default values for +trace mode. --- bin/dig/dig.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/bin/dig/dig.c b/bin/dig/dig.c index b3d3ec4f95..6bd4b43cd0 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.c,v 1.59 2000/07/12 00:22:56 gson Exp $ */ +/* $Id: dig.c,v 1.60 2000/07/12 01:41:35 mws Exp $ */ #include #include @@ -157,7 +157,7 @@ show_usage(void) { " +domain=### (Set default domainname)\n" " +bufsize=### (Set EDNS0 Max UDP packet size)\n" " +[no]search (Set whether to use searchlist)\n" -" +[no]defname (Set whether to use default domaon)\n" +" +[no]defname (Set whether to use default domain)\n" " +[no]recursive (Recursive mode)\n" " +[no]aaonly (Set AA flag in query)\n" " +[no]details (Show details of all requests)\n" @@ -214,8 +214,9 @@ received(int bytes, int frmsize, char *frm, dig_query_t *query) { puts(""); } else if (query->lookup->identify && !short_form) { diff = isc_time_microdiff(&now, &query->time_sent); - printf(";; Received %u bytes from %.*s in %d ms\n", - bytes, frmsize, frm, (int)diff/1000); + printf(";; Received %u bytes from %.*s(%s) in %d ms\n\n", + bytes, frmsize, frm, query->servname, + (int)diff/1000); } } @@ -773,7 +774,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { lookup->stats = ISC_FALSE; } lookup->section_additional = ISC_FALSE; - lookup->section_authority = ISC_FALSE; + lookup->section_authority = ISC_TRUE; lookup->section_question = ISC_FALSE; show_details = ISC_TRUE; } else { @@ -785,7 +786,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { stats = ISC_FALSE; } section_additional = ISC_FALSE; - section_authority = ISC_FALSE; + section_authority = ISC_TRUE; section_question = ISC_FALSE; show_details = ISC_TRUE; } From a6f31a3fd079f37ad0a7c75ef2d50842cd01811c Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Wed, 12 Jul 2000 01:46:57 +0000 Subject: [PATCH 035/226] Only install default handlers for SIGTERM and SIGWAIT if we haven't installed other handlers already. --- lib/isc/unix/app.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c index 8a4283b7ee..1bbcaade23 100644 --- a/lib/isc/unix/app.c +++ b/lib/isc/unix/app.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: app.c,v 1.20 2000/07/11 19:18:05 bwelling Exp $ */ +/* $Id: app.c,v 1.21 2000/07/12 01:46:57 bwelling Exp $ */ #include @@ -154,17 +154,22 @@ isc_app_start(void) { * will not cause sigwait() to return. We may have inherited * unexpected actions for SIGHUP, SIGINT, and SIGTERM from our parent * process, * (e.g, Solaris cron). Set an action of SIG_DFL to make - * sure sigwait() works as expected. + * sure sigwait() works as expected. Only do this for SIGTERM and + * SIGINT if we don't have sigwait(), since a different handler is + * installed above. */ result = handle_signal(SIGHUP, SIG_DFL); if (result != ISC_R_SUCCESS) return (result); + +#ifdef HAVE_SIGWAIT result = handle_signal(SIGTERM, SIG_DFL); if (result != ISC_R_SUCCESS) return (result); result = handle_signal(SIGINT, SIG_DFL); if (result != ISC_R_SUCCESS) return (result); +#endif /* * Block SIGHUP, SIGINT, SIGTERM. From 52eae74966c3a0b96e95f73db0545301f934fdbb Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 12 Jul 2000 02:07:32 +0000 Subject: [PATCH 036/226] reviewed and edited --- bin/named/named.8 | 46 +++++++++++++++++++++------------------------ doc/man/bin/named.8 | 46 +++++++++++++++++++++------------------------ 2 files changed, 42 insertions(+), 50 deletions(-) diff --git a/bin/named/named.8 b/bin/named/named.8 index d6eef1d892..51d464e943 100644 --- a/bin/named/named.8 +++ b/bin/named/named.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: named.8,v 1.2 2000/06/28 02:51:46 jim Exp $ +.\" $Id: named.8,v 1.3 2000/07/12 02:07:32 gson Exp $ .\" .Dd Jun 30, 2000 .Dt NAMED 8 @@ -39,7 +39,7 @@ is the ISC implementation of an Internet domain name server. See RFCs 1033, 1034, and 1035 for more information on the Internet domain name system. For historical reasons, the ISC's DNS software is known as BIND - -Berkeley Internet Nameserver Distribution - because it was originally +Berkeley Internet Name Daemon - because it was originally supplied with BSD .Ux releases. @@ -61,7 +61,7 @@ More information can be found in .Pp Although some command-line options can be used with .Nm named , -the name server's behaviour is controlled by its configuration file, +the name server's behaviour is mainly controlled by its configuration file, .Pa /etc/named.conf . Refer to the BIND9 Administrator Reference Manual for further details. .Pp @@ -73,7 +73,7 @@ are as follows: use .Ar config-file as the configuration file instead of the default, -.Pa /etc/resolv.conf . +.Pa /etc/named.conf . .It Fl d set the daemon's debug level to .Ar debuglevel . @@ -85,19 +85,21 @@ run .Nm named in the foreground. .It Fl g -also runs the name server in the foreground, but -logs to +run +.Nm named +in the foreground and force all logging to .Dv stderr . .It Fl n -create threads that use +create .Ar #cpus -CPUs if the hardware and software permits this. -When -.Ar #cpus -is set to zero, +worker threads to take advantage of multiple CPUs. +If no option is given, .Nm named -will try to determine the number of CPUs present and use 1 if this -attempt fails. +will try to determine the number of CPUs present and create +one thread per CPU. If +.Nm named +is unable to determine the number of CPUs, a single worker thread +is created. .It Fl p listen for queries on port .Ar port# @@ -106,7 +108,7 @@ instead of the default port number, 53. write memory usage statistics to .Dv stdout on exit. -This option is only of interest +This option is mainly of interest to BIND9 developers and may be removed or changed in a future release. .It Fl t tells @@ -121,11 +123,12 @@ as UID .Ar user-id . .Nm named will change its UID after it has -carried out any privileged operations, such as writing the PID file -or creating a socket that listens on port number 53. +carried out any privileged operations, such as +creating sockets that listen on privileged ports. .It Fl x -load DNS data from +load data from .Ar cache-file . +into the cache of the default view. This option must not be used. It is only of interest to BIND9 developers and may be removed or changed in a future release. @@ -143,15 +146,8 @@ A or .Dv SIGTERM signal can be used to gracefully shut down the server. -With the exception of -.Dv SIGPIPE -which -.Nm named -uses internally, sending any other signals to the name server +Sending any other signals to the name server will have an undefined outcome. -The most likely result will be for the name server to terminate. -It could hang because an internal deadlock was created when the name -server took delivery of the signal. .\".Sh CONFIGURATION FILE FORMAT .\".Nm named 's .\"configuration file is too complex to describe in detail here. diff --git a/doc/man/bin/named.8 b/doc/man/bin/named.8 index d6eef1d892..51d464e943 100644 --- a/doc/man/bin/named.8 +++ b/doc/man/bin/named.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: named.8,v 1.2 2000/06/28 02:51:46 jim Exp $ +.\" $Id: named.8,v 1.3 2000/07/12 02:07:32 gson Exp $ .\" .Dd Jun 30, 2000 .Dt NAMED 8 @@ -39,7 +39,7 @@ is the ISC implementation of an Internet domain name server. See RFCs 1033, 1034, and 1035 for more information on the Internet domain name system. For historical reasons, the ISC's DNS software is known as BIND - -Berkeley Internet Nameserver Distribution - because it was originally +Berkeley Internet Name Daemon - because it was originally supplied with BSD .Ux releases. @@ -61,7 +61,7 @@ More information can be found in .Pp Although some command-line options can be used with .Nm named , -the name server's behaviour is controlled by its configuration file, +the name server's behaviour is mainly controlled by its configuration file, .Pa /etc/named.conf . Refer to the BIND9 Administrator Reference Manual for further details. .Pp @@ -73,7 +73,7 @@ are as follows: use .Ar config-file as the configuration file instead of the default, -.Pa /etc/resolv.conf . +.Pa /etc/named.conf . .It Fl d set the daemon's debug level to .Ar debuglevel . @@ -85,19 +85,21 @@ run .Nm named in the foreground. .It Fl g -also runs the name server in the foreground, but -logs to +run +.Nm named +in the foreground and force all logging to .Dv stderr . .It Fl n -create threads that use +create .Ar #cpus -CPUs if the hardware and software permits this. -When -.Ar #cpus -is set to zero, +worker threads to take advantage of multiple CPUs. +If no option is given, .Nm named -will try to determine the number of CPUs present and use 1 if this -attempt fails. +will try to determine the number of CPUs present and create +one thread per CPU. If +.Nm named +is unable to determine the number of CPUs, a single worker thread +is created. .It Fl p listen for queries on port .Ar port# @@ -106,7 +108,7 @@ instead of the default port number, 53. write memory usage statistics to .Dv stdout on exit. -This option is only of interest +This option is mainly of interest to BIND9 developers and may be removed or changed in a future release. .It Fl t tells @@ -121,11 +123,12 @@ as UID .Ar user-id . .Nm named will change its UID after it has -carried out any privileged operations, such as writing the PID file -or creating a socket that listens on port number 53. +carried out any privileged operations, such as +creating sockets that listen on privileged ports. .It Fl x -load DNS data from +load data from .Ar cache-file . +into the cache of the default view. This option must not be used. It is only of interest to BIND9 developers and may be removed or changed in a future release. @@ -143,15 +146,8 @@ A or .Dv SIGTERM signal can be used to gracefully shut down the server. -With the exception of -.Dv SIGPIPE -which -.Nm named -uses internally, sending any other signals to the name server +Sending any other signals to the name server will have an undefined outcome. -The most likely result will be for the name server to terminate. -It could hang because an internal deadlock was created when the name -server took delivery of the signal. .\".Sh CONFIGURATION FILE FORMAT .\".Nm named 's .\"configuration file is too complex to describe in detail here. From d8417b5f3406f4ace0f3bdb228b05a7b701976d6 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 12 Jul 2000 05:06:33 +0000 Subject: [PATCH 037/226] added notes about dotted serial numbers and unbalanced quotes --- doc/misc/migration | 43 ++++++++++++++++++++++++++++++++++--------- 1 file changed, 34 insertions(+), 9 deletions(-) diff --git a/doc/misc/migration b/doc/misc/migration index a5d290eebf..ab20894abb 100644 --- a/doc/misc/migration +++ b/doc/misc/migration @@ -10,16 +10,24 @@ there is still a number of caveats you should be aware of when upgrading an existing BIND 8 installation to use BIND 9. -Unimplemented Options and Changed Defaults +1. Configuration File Compatibility -Some BIND 8 configuration options are still unimplemented in BIND 9, -and the default values of some options have changed. If your -named.conf file uses an unimplemented option, named will log a warning -message. A message is also logged about each option whose default has -changed unless the option is set explicitly in named.conf. +1.1. Unimplemented Options and Changed Defaults + +BIND 9.0.0 supports most, but not all but not of the named.conf +options of BIND 8. Unimplemented options include those for selective +(per-domain) forwarding, sortlists, statistics, and process limits; +for a complete list, see doc/misc/options. We plan to implement most +of these in in BIND 9.1. + +If your named.conf file uses an unimplemented option, named will log a +warning message. A message is also logged about each option whose +default has changed unless the option is set explicitly in named.conf. -Strict RFC1035 Interpretation of TTLs in Zone Files +2. Zone File Compatibility + +2.1. Strict RFC1035 Interpretation of TTLs in Zone Files BIND 8 allowed you to omit all TTLs from a zone file, and used the value of the SOA MINTTL field as a default for missing TTL values. @@ -34,7 +42,24 @@ logged and loading the zone file fails. To avoid problems, use a $TTL directive in each zone file. -Interoperability Impact of New Query Features +2.2. Periods in SOA Serial Numbers Deprecated + +Some versions of BIND allow SOA serial numbers with an embedded +period, like "3.002", and convert them into integers in a rather +unintuitive way. This feature is not supported by BIND 9; serial +numbers must be integers. + + +2.3. Handling of Unbalanced Quotes + +TXT records with unbalanced quotes, like 'host TXT "foo', were not +treated as errors in some versions of BIND. If your zone files +contain such records, you will get potentially confusing error +messages like "unexpected end of file" because BIND 9 will interpret +everything up to the next quote character as a literal string. + + +3. Interoperability Impact of New Protocol Features BIND 9 uses EDNS0 (RFC2671) to advertise its receive buffer size. It also sets the AD bit in queries to indicate that it wishes to receive @@ -54,4 +79,4 @@ completely. We have contacted the manufacturer of the name server in case and are trying to resolve the issue with them. -$Id: migration,v 1.1 2000/06/30 22:44:08 gson Exp $ +$Id: migration,v 1.2 2000/07/12 05:06:33 gson Exp $ From b9db5f75cf75029230bea6297f3512634472f288 Mon Sep 17 00:00:00 2001 From: Jim Reid Date: Wed, 12 Jul 2000 13:49:07 +0000 Subject: [PATCH 038/226] fixed some typos and incorrect troff macro calls put the text into our (as yet undocumented) manpage canonical format --- bin/rndc/rndc.8 | 33 +++++++++++++++++++-------------- doc/man/bin/rndc.8 | 33 +++++++++++++++++++-------------- 2 files changed, 38 insertions(+), 28 deletions(-) diff --git a/bin/rndc/rndc.8 b/bin/rndc/rndc.8 index 8185edf2a3..83c5646adb 100644 --- a/bin/rndc/rndc.8 +++ b/bin/rndc/rndc.8 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.8,v 1.4 2000/07/11 00:37:57 tale Exp $ +.\" $Id: rndc.8,v 1.5 2000/07/12 13:49:07 jim Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC 8 @@ -54,7 +54,8 @@ and the only supported encryption algorithm is HMAC-MD5, which uses a shared secret on each end of the connection. This provides TSIG-style authentication for the command request -and the name server's response. All commands sent over the channel +and the name server's response. +All commands sent over the channel must be signed by a key_id known to the server. .Pp .Nm rndc @@ -62,8 +63,10 @@ reads its default configuration file, .Pa /etc/rndc.conf to determine how to contact the name server and decide what algorithm and keys is should use. -An alternate configuration file can be specified with the -.Ar c +.Ar config-file +is the pathname for an alternate configuration file which can be supplied +with the +.Fl c option. .Pp .Ar server @@ -92,12 +95,13 @@ The .Fl y option identifies the .Ar key_id -to use from the configuration file. The +to use from the configuration file. .Ar key_id must be known by .Xr named with the same algorithm and secret string in order for -control message validation to succeed. If no +control message validation to succeed. +If no .Fl y option is provided, .Nm rndc @@ -111,12 +115,12 @@ statement is present for that host, then the .Dv default-key clause of the .Dv options{} -statement. Note that .Pp -The configuration file for +statement. +Note that the configuration file for .Nm rdnc contains shared secrets which are used to send authenticated -control commands to name servers, and should therefore not have -general read or write access. +control commands to name servers. +It should therefore not have general read or write access. .Pp The .Fl M , @@ -124,8 +128,8 @@ The and .Fl v options provided debugging information and are primarily of interest -only to the BIND 9 developers. They might be changed or removed in -future releases. +only to the BIND 9 developers. +They might be changed or removed in future releases. .Pp The only valid value for .Ar command @@ -149,12 +153,13 @@ utility. There is currently no way to provide the shared secret for a key_id without using the configuration file. .Pp -Several error messages could be clearer. For example, trying to connect +Several error messages could be clearer. +For example, trying to connect from an address that is not in the list of acceptable addresses configured into .Xr named will result in the error message "end of file" when the server just -unceremonisously closes the connection. +unceremoniously closes the connection. .Sh SEE ALSO .Xr rndc.conf 5 , .Xr named 8 , diff --git a/doc/man/bin/rndc.8 b/doc/man/bin/rndc.8 index 8185edf2a3..83c5646adb 100644 --- a/doc/man/bin/rndc.8 +++ b/doc/man/bin/rndc.8 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.8,v 1.4 2000/07/11 00:37:57 tale Exp $ +.\" $Id: rndc.8,v 1.5 2000/07/12 13:49:07 jim Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC 8 @@ -54,7 +54,8 @@ and the only supported encryption algorithm is HMAC-MD5, which uses a shared secret on each end of the connection. This provides TSIG-style authentication for the command request -and the name server's response. All commands sent over the channel +and the name server's response. +All commands sent over the channel must be signed by a key_id known to the server. .Pp .Nm rndc @@ -62,8 +63,10 @@ reads its default configuration file, .Pa /etc/rndc.conf to determine how to contact the name server and decide what algorithm and keys is should use. -An alternate configuration file can be specified with the -.Ar c +.Ar config-file +is the pathname for an alternate configuration file which can be supplied +with the +.Fl c option. .Pp .Ar server @@ -92,12 +95,13 @@ The .Fl y option identifies the .Ar key_id -to use from the configuration file. The +to use from the configuration file. .Ar key_id must be known by .Xr named with the same algorithm and secret string in order for -control message validation to succeed. If no +control message validation to succeed. +If no .Fl y option is provided, .Nm rndc @@ -111,12 +115,12 @@ statement is present for that host, then the .Dv default-key clause of the .Dv options{} -statement. Note that .Pp -The configuration file for +statement. +Note that the configuration file for .Nm rdnc contains shared secrets which are used to send authenticated -control commands to name servers, and should therefore not have -general read or write access. +control commands to name servers. +It should therefore not have general read or write access. .Pp The .Fl M , @@ -124,8 +128,8 @@ The and .Fl v options provided debugging information and are primarily of interest -only to the BIND 9 developers. They might be changed or removed in -future releases. +only to the BIND 9 developers. +They might be changed or removed in future releases. .Pp The only valid value for .Ar command @@ -149,12 +153,13 @@ utility. There is currently no way to provide the shared secret for a key_id without using the configuration file. .Pp -Several error messages could be clearer. For example, trying to connect +Several error messages could be clearer. +For example, trying to connect from an address that is not in the list of acceptable addresses configured into .Xr named will result in the error message "end of file" when the server just -unceremonisously closes the connection. +unceremoniously closes the connection. .Sh SEE ALSO .Xr rndc.conf 5 , .Xr named 8 , From e9729674d69e6f120c7fbaeda0e82830f82a6a5d Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Wed, 12 Jul 2000 15:33:41 +0000 Subject: [PATCH 039/226] don't warn about missing keys{} clause or non-inet type, since the config parser will have already warned about that. --- bin/named/omapiconf.c | 44 ++++++++++++------------------------------- 1 file changed, 12 insertions(+), 32 deletions(-) diff --git a/bin/named/omapiconf.c b/bin/named/omapiconf.c index 051f499e15..0f4e0e18a1 100644 --- a/bin/named/omapiconf.c +++ b/bin/named/omapiconf.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: omapiconf.c,v 1.6 2000/07/11 23:02:32 tale Exp $ */ +/* $Id: omapiconf.c,v 1.7 2000/07/12 15:33:41 tale Exp $ */ /* * Principal Author: DCL @@ -443,42 +443,22 @@ ns_omapi_configure(isc_mem_t *mctx, dns_c_ctx_t *cctx, for (control = dns_c_ctrllist_head(controls); control != NULL; control = dns_c_ctrl_next(control)) { - if (keydeflist == NULL) + /* + * The parser handles BIND 8 configuration file syntax, + * so it allows a control_type of dns_c_unix_control, + * as well as an inet phrase with no keys{} clause. + * However, it already warned that those were + * unsupported, so there is no need to do so again. + * The keydeflist == NULL case was already warned + * about a few lines above. + */ + if (control->control_type != dns_c_inet_control || + keydeflist == NULL || control->keyidlist == NULL) continue; - if (control->control_type != dns_c_inet_control) { - /* - * The only other type coming out of the - * configuration system is dns_c_unix_control. - */ - isc_log_write(ns_g_lctx, - ISC_LOGCATEGORY_GENERAL, - NS_LOGMODULE_OMAPI, - ISC_LOG_WARNING, - "unix control channel type is " - "not supported"); - continue; - } - isc_sockaddr_format(&control->u.inet_v.addr, socktext, sizeof(socktext)); - /* - * XXXDCL confparser.y currently allows the keys clause - * to be absent, which is pointless. it needs to be - * required. - */ - if (control->keyidlist == NULL) { - isc_log_write(ns_g_lctx, - ISC_LOGCATEGORY_GENERAL, - NS_LOGMODULE_OMAPI, - ISC_LOG_WARNING, - "missing keys clause for " - "control channel %s", - socktext); - continue; - } - isc_log_write(ns_g_lctx, ISC_LOGCATEGORY_GENERAL, NS_LOGMODULE_OMAPI, ISC_LOG_DEBUG(9), "processing control channel %s", From 8af589aea39af11339c317259b88b5e666e55ca0 Mon Sep 17 00:00:00 2001 From: James Brister Date: Wed, 12 Jul 2000 15:36:09 +0000 Subject: [PATCH 040/226] It's no longer a fatal error if a keys{} clause is missing on a control channel definition, nor if the keys{} clause is empty. Warnings are issued. --- lib/dns/config/confctl.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/lib/dns/config/confctl.c b/lib/dns/config/confctl.c index bf60f4f468..d1f6465bd5 100644 --- a/lib/dns/config/confctl.c +++ b/lib/dns/config/confctl.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confctl.c,v 1.25 2000/07/11 19:09:02 brister Exp $ */ +/* $Id: confctl.c,v 1.26 2000/07/12 15:36:09 brister Exp $ */ #include @@ -144,16 +144,13 @@ dns_c_ctrl_validate(dns_c_ctrl_t *ctrl) DNS_LOGMODULE_CONFIG, ISC_LOG_WARNING, "the KEYS clause of an INET control " "channel must be used"); - result = ISC_R_FAILURE; } else if (dns_c_kidlist_keycount(ctrl->keyidlist) == 0) { isc_log_write(dns_lctx,DNS_LOGCATEGORY_CONFIG, DNS_LOGMODULE_CONFIG, ISC_LOG_WARNING, "the KEYS clause of an INET control " "channel must not be empty"); - result = ISC_R_FAILURE; } - return (result); } From 4034406393893f4d07ab07b56da3541155493855 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 12 Jul 2000 15:55:10 +0000 Subject: [PATCH 041/226] inet control channels are supported, unix ones are not --- doc/misc/options | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/doc/misc/options b/doc/misc/options index 68405a3035..dfe3b8a633 100644 --- a/doc/misc/options +++ b/doc/misc/options @@ -1,7 +1,7 @@ Copyright (C) 2000 Internet Software Consortium. See COPYRIGHT in the source root or http://www.isc.org/copyright for terms. -$Id: options,v 1.30 2000/07/10 22:13:17 gson Exp $ +$Id: options,v 1.31 2000/07/12 15:55:10 gson Exp $ This is a summary of the implementation status of the various named.conf options in BIND 9. @@ -111,7 +111,10 @@ key Yes logging Yes -controls Yes +controls { + [ inet ... ] Yes% + [ unix ... ] Obsolete +}; server ip_addr { [ bogus yes_or_no; ] No From 2c24bbb10b479cc7024defc208bca74c7389f756 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 12 Jul 2000 16:17:38 +0000 Subject: [PATCH 042/226] clarified warning messages --- lib/dns/config/confctl.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/lib/dns/config/confctl.c b/lib/dns/config/confctl.c index d1f6465bd5..22567d7e83 100644 --- a/lib/dns/config/confctl.c +++ b/lib/dns/config/confctl.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confctl.c,v 1.26 2000/07/12 15:36:09 brister Exp $ */ +/* $Id: confctl.c,v 1.27 2000/07/12 16:17:38 gson Exp $ */ #include @@ -137,18 +137,18 @@ dns_c_ctrl_validate(dns_c_ctrl_t *ctrl) if (ctrl->control_type == dns_c_unix_control) { isc_log_write(dns_lctx,DNS_LOGCATEGORY_CONFIG, DNS_LOGMODULE_CONFIG, ISC_LOG_WARNING, - "unix sockets are not not implmented for" - " control channels"); + "type 'unix' control channels are " + "not implemented"); } else if (ctrl->keyidlist == NULL) { isc_log_write(dns_lctx,DNS_LOGCATEGORY_CONFIG, DNS_LOGMODULE_CONFIG, ISC_LOG_WARNING, - "the KEYS clause of an INET control " - "channel must be used"); + "type 'inet' control channel has no 'keys' " + "clause; control channel will be disabled"); } else if (dns_c_kidlist_keycount(ctrl->keyidlist) == 0) { isc_log_write(dns_lctx,DNS_LOGCATEGORY_CONFIG, DNS_LOGMODULE_CONFIG, ISC_LOG_WARNING, - "the KEYS clause of an INET control " - "channel must not be empty"); + "type 'inet' control channel has no keys; " + "control channel will be disabled"); } return (result); From 2831bea28e254c0691fa938fd1325d40f7341508 Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Wed, 12 Jul 2000 16:43:03 +0000 Subject: [PATCH 043/226] make rndc output appear as I: lines --- bin/tests/system/views/tests.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/bin/tests/system/views/tests.sh b/bin/tests/system/views/tests.sh index 29ea2c138f..24167f8399 100644 --- a/bin/tests/system/views/tests.sh +++ b/bin/tests/system/views/tests.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: tests.sh,v 1.17 2000/07/10 11:39:46 tale Exp $ +# $Id: tests.sh,v 1.18 2000/07/12 16:43:03 tale Exp $ # # Perform tests @@ -44,8 +44,8 @@ cp ns2/example2.db ns2/example.db echo "I:sleeping five seconds then reloading ns2 and ns3 with rndc" sleep 5 -$RNDC -c rndc.conf -s 10.53.0.2 -p 9953 reload -$RNDC -c rndc.conf -s 10.53.0.3 -p 9953 reload +$RNDC -c rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /' +$RNDC -c rndc.conf -s 10.53.0.3 -p 9953 reload 2>&1 | sed 's/^/I:ns3 /' echo "I:sleeping one minute" sleep 60 From 00148ffb6beab48b15755841d728abbacc1461ba Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 12 Jul 2000 16:48:19 +0000 Subject: [PATCH 044/226] reviewed; made minor stylistic changes --- bin/rndc/rndc.8 | 16 +++++++--------- doc/man/bin/rndc.8 | 16 +++++++--------- 2 files changed, 14 insertions(+), 18 deletions(-) diff --git a/bin/rndc/rndc.8 b/bin/rndc/rndc.8 index 83c5646adb..5518d13d81 100644 --- a/bin/rndc/rndc.8 +++ b/bin/rndc/rndc.8 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.8,v 1.5 2000/07/12 13:49:07 jim Exp $ +.\" $Id: rndc.8,v 1.6 2000/07/12 16:48:19 gson Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC 8 @@ -45,8 +45,8 @@ prints a short summary of the supported commands and the available options and their arguments. .Pp .Nm rndc -uses a secure channel with digital signatures to communicate -with the name server. +communicates with the name server over a TCP connection, +sending commands authenticated with digital signatures. In the current versions of .Nm rndc and @@ -63,11 +63,9 @@ reads its default configuration file, .Pa /etc/rndc.conf to determine how to contact the name server and decide what algorithm and keys is should use. -.Ar config-file -is the pathname for an alternate configuration file which can be supplied -with the +The .Fl c -option. +option can be used to specify an alternate configuration file. .Pp .Ar server is the name or address of the server which matches a @@ -84,7 +82,7 @@ statement of the configuration file will be used. .Pp The .Fl p -option is used to make +option can be used to make .Nm rndc send commands to TCP port number .Ar port# @@ -158,7 +156,7 @@ For example, trying to connect from an address that is not in the list of acceptable addresses configured into .Xr named -will result in the error message "end of file" when the server just +will result in the error message "end of file" when the server unceremoniously closes the connection. .Sh SEE ALSO .Xr rndc.conf 5 , diff --git a/doc/man/bin/rndc.8 b/doc/man/bin/rndc.8 index 83c5646adb..5518d13d81 100644 --- a/doc/man/bin/rndc.8 +++ b/doc/man/bin/rndc.8 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.8,v 1.5 2000/07/12 13:49:07 jim Exp $ +.\" $Id: rndc.8,v 1.6 2000/07/12 16:48:19 gson Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC 8 @@ -45,8 +45,8 @@ prints a short summary of the supported commands and the available options and their arguments. .Pp .Nm rndc -uses a secure channel with digital signatures to communicate -with the name server. +communicates with the name server over a TCP connection, +sending commands authenticated with digital signatures. In the current versions of .Nm rndc and @@ -63,11 +63,9 @@ reads its default configuration file, .Pa /etc/rndc.conf to determine how to contact the name server and decide what algorithm and keys is should use. -.Ar config-file -is the pathname for an alternate configuration file which can be supplied -with the +The .Fl c -option. +option can be used to specify an alternate configuration file. .Pp .Ar server is the name or address of the server which matches a @@ -84,7 +82,7 @@ statement of the configuration file will be used. .Pp The .Fl p -option is used to make +option can be used to make .Nm rndc send commands to TCP port number .Ar port# @@ -158,7 +156,7 @@ For example, trying to connect from an address that is not in the list of acceptable addresses configured into .Xr named -will result in the error message "end of file" when the server just +will result in the error message "end of file" when the server unceremoniously closes the connection. .Sh SEE ALSO .Xr rndc.conf 5 , From 94b74284684fc3586fe4256100639dfdd9c1a20b Mon Sep 17 00:00:00 2001 From: Jim Reid Date: Wed, 12 Jul 2000 17:17:03 +0000 Subject: [PATCH 045/226] first drafts of the nsupdate and host man pages --- bin/dig/host.1 | 218 +++++++++++++++++++++++++++++ bin/nsupdate/nsupdate.8 | 301 ++++++++++++++++++++++++++++++++++++++++ doc/man/bin/host.1 | 218 +++++++++++++++++++++++++++++ doc/man/bin/nsupdate.8 | 301 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 1038 insertions(+) create mode 100644 bin/dig/host.1 create mode 100644 bin/nsupdate/nsupdate.8 create mode 100644 doc/man/bin/host.1 create mode 100644 doc/man/bin/nsupdate.8 diff --git a/bin/dig/host.1 b/bin/dig/host.1 new file mode 100644 index 0000000000..14d1497645 --- /dev/null +++ b/bin/dig/host.1 @@ -0,0 +1,218 @@ +.\" Copyright (C) @YEARS@ Internet Software Consortium. +.\" +.\" Permission to use, copy, modify, and distribute this software for any +.\" purpose with or without fee is hereby granted, provided that the above +.\" copyright notice and this permission notice appear in all copies. +.\" +.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS +.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES +.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE +.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL +.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR +.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS +.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS +.\" SOFTWARE. +.\" +.\" $Id: host.1,v 1.1 2000/07/12 17:17:03 jim Exp $ +.\" +.Dd Jun 30, 2000 +.Dt HOST 1 +.Os BIND9 9 +.ds vT BIND9 Programmer's Manual +.Sh NAME +.Nm host +.Nd DNS lookup utility +.Sh SYNOPSIS +.Nm host +.Op Fl aCdlrTwv +.Op Fl c Ar class +.Op Fl N Ar ndots +.Op Fl R Ar number +.Op Fl t Ar type +.Op Fl W Ar wait +.Ar name +.Op Ar server +.Sh DESCRIPTION +.Nm host +is a simple utility for performing DNS lookups. +It is normally used to convert names to IP addresses and vice versa. +When no arguments or options are given, +.Nm host +prints a short summary of its command line arguments and options. +.Pp +.Ar name +is the domain name that is to be looked up. +It can also be a dotted-decimal string representing an IPv4 address, +in which case +.Nm host +will by default perform a reverse lookup for that address. +.Ar server +is an optional argument which is either the name or IP address of the +name server that +.Nm host +should query instead of the server or servers listed in +.Pa /etc/resolv.conf . +.Pp +The +.Fl a +(all) option is equivalent to setting the +.Fl v +option and asking +.Nm host +to make a query of type ANY. +.Pp +When the +.Fl C +option is used, +.Nm host +will attempt to display the SOA records for zone +.Ar name +from all the listed authoritative name servers for that zone. +The list of name servers is defined by the NS records that are found for +the zone. +.Pp +The +.Fl c +option instructs to make a DNS query of class +.Ar class . +This can be used to lookup Hesiod or Chaosnet class resource records. +The default class is IN: Internet. +.Pp +Verbose output is generated by +.Nm host +when the +.Fl d +or +.Fl v +option is used. +The two options are equivalent. +They have been provided for backwards compatibility. +In previous versions, the +.Fl d +option switched on debugging traces and +.Fl v +enabled verbose output. +.Pp +List mode is selected by the +.Fl l +option. +This makes +.Nm host +perform a zone transfer for zone +.Ar name . +The argument is provided for compatibility with older implemementations. +This option is equivalent to making a query of type AXFR. +.Pp +The +.Fl N +option sets the number of dots that have to be in +.Ar name +before the root name servers are queried for that name. +The default number of dots is zero. +Unlike previous versions of +.Nm host , +the BIND9 implementation does not append domain names from the +.Dv domain +or +.Dv search +directives in +.Pa /etc/resolv.conf . +Therefore +.Ar name +should be a fully-qualified domain name. +.Pp +The number of UDP retries for a lookup can be changed with the +.Fl R +option. +.Ar number +indicates how many times +.Nm host +will repeat a query that does not get answered. +The default number of retries is 1. +If +.Ar number +is negative or zero, the number of retries will default to 1. +.Pp +Non-recursive queries can be made via the +.Fl r +option. +Setting this option clears the +.Dv RD +- recursion desired - bit in the query which +.Nm host +makes. +This should mean that the name server receiving the query will not attemp +to resolve +.Ar name . +The +.Fl r +option enables +.Nm host +to mimic the behaviour of a name server by making non-recursive queries +and expecting to receive answers to those queries that are usually +referrals to other name servers. +.Pp +By default +.Nm host +uses UDP when making queries. +The +.Fl T +option makes it use a TCP connection when querying the name server. +TCP queries will be automatically made when the query type requires +that a TCP connection: zone transfer (AXFR) requests for example. +.Pp +The +.Fl t +option is used to select the query type. +.Ar type +can be any recognised query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. +When no query type is specified, +.Nm host +automatically selects an appropriate query type. +By default it looks for A records unless the +.Fl C +option is supplied or +.Ar name +is a dotted-decimal IPv4 address. +These will make +.Nm host +look for SOA and PTR records respectively. +.Pp +The time to wait for a reply can be controlled through the +.Fl W +and +.Fl w +options. +The +.Fl W +option makes +.Nm host +wait for +.Ar wait +seconds. +If +.Ar wait +is less than one, +the wait interval is set to one second. +When the +.Fl w +option is used, +.Nm host +will effectively wait forever for a reply. +The time to wait for a response will be set to the number of seconds +given by the hardware's maximum value for an integer quantity. +.Sh FILES +.Pa /etc/resolv.conf +.Sh SEE ALSO +.Xr dig 1 , +.Xr resolver 5 +.Xr named 8 . +.Sh BUGS +.Nm host +does not yet know how to handle command line arguments that are IPv6 +addresses, even though the record types for those addresses are +fully supported by the BIND9 DNS library. +.Pp +Apart from this self-contradicting sentence, the +.Fl D +option is undocumented. diff --git a/bin/nsupdate/nsupdate.8 b/bin/nsupdate/nsupdate.8 new file mode 100644 index 0000000000..75b1205c2a --- /dev/null +++ b/bin/nsupdate/nsupdate.8 @@ -0,0 +1,301 @@ +.\" Copyright (C) @YEARS@ Internet Software Consortium. +.\" +.\" Permission to use, copy, modify, and distribute this software for any +.\" purpose with or without fee is hereby granted, provided that the above +.\" copyright notice and this permission notice appear in all copies. +.\" +.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS +.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES +.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE +.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL +.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR +.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS +.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS +.\" SOFTWARE. +.\" +.\" $Id: nsupdate.8,v 1.1 2000/07/12 17:17:03 jim Exp $ +.\" +.Dd Jun 30, 2000 +.Dt NSUPDATE 8 +.Os BIND9 9 +.ds vT BIND9 Programmer's Manual +.Sh NAME +.Nm nsupdate +.Nd Dynamic DNS update utility +.Sh SYNOPSIS +.Nm nsupdate +.Op Fl d +.Oo +.Fl y Ar keyname:secret | +.Fl k Ar keyfile +.Oc +.Op Fl v +.Sh DESCRIPTION +.Nm nsupdate +is used to submit Dynamic DNS Update requests as defined in RFC2136 +to a name server. +This allows resource records to be added or removed from a zone +without manually editing the zone file. +A single update request could contain requests to add or remove more than one +resource record. +.Pp +Zones that are under dynamic control via +.Nm nsupdate +or a DHCP server should not be edited by hand. +Manual edits could +conflict with dynamic updates or the name server's transaction log +activities which keep the file copy of the zone consistent with its +internal representation in the name server's memory. +.Pp +The names of resource records that are dynamically added or removed with +.Nm nsupdate +have to be in the same zone. +Requests are sent to the zone's master server. +This is identified by the MNAME field of the zone's SOA record. +.Pp +The +.Fl d +option makes +.Nm nsupdate +operate in debug mode. +This provides tracing information about the update requests that are +made and the replies received from the name server. +.Pp +Transaction signatures can be used to authenticate the Dynamic DNS +updates. +These use the TSIG resource record type described in RFC2845. +The signatures rely on a shared secret that should only be known to +.Nm nsupdate +and the name server. +Currently, the only supported encryption algorithm for TSIG is +HMAC-MD5, which is defined in RFC 2104. +Once other algorithms are defined for TSIG, applications will need to +ensure they select the appropriate algorithm as well as the key when +authenticating each other. +Suitable +.Dv key{} +and +.Dv server{} +statements will be added to +.Pa /etc/named.conf +so that the appropriate secret key and algorithm can be associated +with the IP address of the +client application that will be using TSIG authentication. +.Pp +.Nm nsupdate +uses the +.Fl y +and +.Fl k +options to provide the shared secret needed to generate a TSIG record +for authenticating Dynamic DNS update requests. +These options are mutually exclusive. +The +.Fl k +option gets +.Nm nsupdate +to read the shared secret from the file +.Ar keyfile . +When the +.Fl y +is used, a signature is generated from +.Ar keyname:secret. +.Ar keyname +is the name of the key, +and +.Ar secret +is a string comprising the shared secret. +Use of the +.Fl y +option is discouraged because the shared secret is supplied as a command +line argument in clear text. +This may be visible in the output from +.Xr ps 1 +or in a history file maintained by the user's shell. +.Pp +By default +.Nm nsupdate +uses UDP to send update requests to the name server. +The +.Fl v +option makes +.Nm nsupdate +use a TCP connection. +This may be preferable when a batch of update requests are made. +.Sh INPUT FORMAT +.Nm nsupdate +reads commands from its standard input. +Each command is supplied on exactly one line of input. +Commands can be update instructions or prerequisite checks on the +contents of the zone. +These checks set conditions that some name or set of +resource records (RRset) either exists or is absent from the zone. +These conditions must be met if the entire update request is to succeed. +Updates will be rejected if the tests for the prerequisite conditions fail. +Every update request consists of zero or more prerequisites +and one or more updates. +This allows a suitably authenticated update request to proceed if some +specified resource records are present or missing from the zone. +A blank input line causes the accumulated commands to be sent as one Dynamic +DNS update request to the name server. +.Pp +The command formats and their meaning are as follows: +.Bl -ohang indent +.It Xo +.Ic prereq nxdomain Va domain-name +.Xc +.sp 1 +Requires that no resource record of any type exists with name +.Va domain-name . +.It Xo +.Ic prereq yxdomain Va domain-name +.Xc +.sp 1 +Requires that +.Va domain-name +exists as at least one resource record of any type. +.It Xo +.Ic prereq nxrrset Va domain-name Op class +.Va type +.Xc +.sp 1 +Requires that no resource record exists of the specified +.Va type , +.Va class +and +.Va domain-name . +If +.Va class +is omitted, IN (internet) is assumed. +.It Xo +.Ic prereq yxrrset +.Va domain-name Op class +.Va type Op data... +.Xc +.sp 1 +This requires that a resource record of the specified type +.Va type , +.Va class +and name +.Va domain-name +must exist. +If +.Va class +is omitted, IN (internet) is assumed. +If +.Va data +is supplied, it has to exactly match the corresponding RDATA for +.Va name . +.Va data +is written in the standard text representation of the resource record's +RDATA. +.It Xo +.Ic update delete +.Va domain-name Op class +.Va Op type Op data... +.Xc +.sp 1 +Deletes any resource records named +.Va domain-name . +If +.Va type +and +.Va data +is provided, only matching resource records will be removed. +The internet class is assumed if +.Va class +is not supplied. +.It Xo +.Ic update add +.Va domain-name ttl Op class +.Va type data.. +.Xc +.sp 1 +Adds a new resource record with the specified +.Va ttl , +.Va class +and +.Va data . +.El +.Sh EXAMPLES +The examples below show how +.Nm nsupdate +could be used to insert and delete resource records from the +.Dv example.com +zone. +Notice that the input in each example contains a trailing blank line so that +a group of commands are sent as one dynamic update request to the +master name server for +.Dv example.com . +.Bd -literal -offset indent +# nsupdate +> update delete oldhost.example.com A +> update add newhost.example.com 86400 A 172.16.1.1 +> +.Ed +.Pp +Any A records for +.Dv oldhost.example.com +are deleted. +and an A record for +.Dv newhost.example.com +it IP address 172.16.1.1 is added. +The newly-added record has a 1 day TTL (86400 seconds) +.Bd -literal -offset indent +# nsupdate +> prereq nxdomain nickname.example.com +> update add nickname.example.com CNAME somehost.example.com +> +.Ed +.Pp +The prerequisite condition gets the name server to check that there +are no resource records of any type for +.Dv nickname.example.com . +If there are, the update request fails. +If this name does not exist, a CNAME for it is added. +This ensures that when the CNAME is added, it cannot conflict with the +long-standing rule in RFC1034 that a name must not exist as any other +record type if it exists as a CNAME. +(The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have +SIG, KEY and NXT records.) +.Sh NAME SERVER PROCESSING +.Pp +When a successful update request is made, the BIND9 name server +increments the serial number in the zone's SOA record. +A transaction log file is written containing details of the resource +records that have been added or removed. +This allows the name server to roll forward to the current state of the +zone if it is restarted before a fresh copy of the zone file is written +out by the name server. +XXXJR WHEN DOES IT DO THAT??? +It then sends a NOTIFY message to the zone's slave servers to inform +them that the zone's contents have changed. +.Sh FILES +.Bl -tag -width Kname.+157.+{random}.private -compact +.It Pa /etc/named.conf +name server configuration file +.It Pa Kname.+157.+{random}.key +base-64 encoding of HMAC-MD5 key created by +.Xr dnssec-keygen 8 . +.It Pa Kname.+157.+{random}.private +base-64 encoding of HMAC-MD5 key created by +.Xr dnssec-keygen 8 . +.El +.Sh SEE ALSO +.Xr RFC2136 , +.Xr RFC2137 , +.Xr RFC2104 , +.Xr RFC2845 , +.Xr RFC1034 , +.Xr RFC2535 , +.Xr named 8 , +.Xr dnssec-keygen 8 . +.Sh BUGS +The +.Fl D +and +.Fl M +options are not documented apart from this self-referential paragraph. +They provide additional debugging information which is primarily of interest +to the BIND9 developers. +These options might be changed or removed in future releases. diff --git a/doc/man/bin/host.1 b/doc/man/bin/host.1 new file mode 100644 index 0000000000..14d1497645 --- /dev/null +++ b/doc/man/bin/host.1 @@ -0,0 +1,218 @@ +.\" Copyright (C) @YEARS@ Internet Software Consortium. +.\" +.\" Permission to use, copy, modify, and distribute this software for any +.\" purpose with or without fee is hereby granted, provided that the above +.\" copyright notice and this permission notice appear in all copies. +.\" +.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS +.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES +.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE +.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL +.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR +.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS +.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS +.\" SOFTWARE. +.\" +.\" $Id: host.1,v 1.1 2000/07/12 17:17:03 jim Exp $ +.\" +.Dd Jun 30, 2000 +.Dt HOST 1 +.Os BIND9 9 +.ds vT BIND9 Programmer's Manual +.Sh NAME +.Nm host +.Nd DNS lookup utility +.Sh SYNOPSIS +.Nm host +.Op Fl aCdlrTwv +.Op Fl c Ar class +.Op Fl N Ar ndots +.Op Fl R Ar number +.Op Fl t Ar type +.Op Fl W Ar wait +.Ar name +.Op Ar server +.Sh DESCRIPTION +.Nm host +is a simple utility for performing DNS lookups. +It is normally used to convert names to IP addresses and vice versa. +When no arguments or options are given, +.Nm host +prints a short summary of its command line arguments and options. +.Pp +.Ar name +is the domain name that is to be looked up. +It can also be a dotted-decimal string representing an IPv4 address, +in which case +.Nm host +will by default perform a reverse lookup for that address. +.Ar server +is an optional argument which is either the name or IP address of the +name server that +.Nm host +should query instead of the server or servers listed in +.Pa /etc/resolv.conf . +.Pp +The +.Fl a +(all) option is equivalent to setting the +.Fl v +option and asking +.Nm host +to make a query of type ANY. +.Pp +When the +.Fl C +option is used, +.Nm host +will attempt to display the SOA records for zone +.Ar name +from all the listed authoritative name servers for that zone. +The list of name servers is defined by the NS records that are found for +the zone. +.Pp +The +.Fl c +option instructs to make a DNS query of class +.Ar class . +This can be used to lookup Hesiod or Chaosnet class resource records. +The default class is IN: Internet. +.Pp +Verbose output is generated by +.Nm host +when the +.Fl d +or +.Fl v +option is used. +The two options are equivalent. +They have been provided for backwards compatibility. +In previous versions, the +.Fl d +option switched on debugging traces and +.Fl v +enabled verbose output. +.Pp +List mode is selected by the +.Fl l +option. +This makes +.Nm host +perform a zone transfer for zone +.Ar name . +The argument is provided for compatibility with older implemementations. +This option is equivalent to making a query of type AXFR. +.Pp +The +.Fl N +option sets the number of dots that have to be in +.Ar name +before the root name servers are queried for that name. +The default number of dots is zero. +Unlike previous versions of +.Nm host , +the BIND9 implementation does not append domain names from the +.Dv domain +or +.Dv search +directives in +.Pa /etc/resolv.conf . +Therefore +.Ar name +should be a fully-qualified domain name. +.Pp +The number of UDP retries for a lookup can be changed with the +.Fl R +option. +.Ar number +indicates how many times +.Nm host +will repeat a query that does not get answered. +The default number of retries is 1. +If +.Ar number +is negative or zero, the number of retries will default to 1. +.Pp +Non-recursive queries can be made via the +.Fl r +option. +Setting this option clears the +.Dv RD +- recursion desired - bit in the query which +.Nm host +makes. +This should mean that the name server receiving the query will not attemp +to resolve +.Ar name . +The +.Fl r +option enables +.Nm host +to mimic the behaviour of a name server by making non-recursive queries +and expecting to receive answers to those queries that are usually +referrals to other name servers. +.Pp +By default +.Nm host +uses UDP when making queries. +The +.Fl T +option makes it use a TCP connection when querying the name server. +TCP queries will be automatically made when the query type requires +that a TCP connection: zone transfer (AXFR) requests for example. +.Pp +The +.Fl t +option is used to select the query type. +.Ar type +can be any recognised query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. +When no query type is specified, +.Nm host +automatically selects an appropriate query type. +By default it looks for A records unless the +.Fl C +option is supplied or +.Ar name +is a dotted-decimal IPv4 address. +These will make +.Nm host +look for SOA and PTR records respectively. +.Pp +The time to wait for a reply can be controlled through the +.Fl W +and +.Fl w +options. +The +.Fl W +option makes +.Nm host +wait for +.Ar wait +seconds. +If +.Ar wait +is less than one, +the wait interval is set to one second. +When the +.Fl w +option is used, +.Nm host +will effectively wait forever for a reply. +The time to wait for a response will be set to the number of seconds +given by the hardware's maximum value for an integer quantity. +.Sh FILES +.Pa /etc/resolv.conf +.Sh SEE ALSO +.Xr dig 1 , +.Xr resolver 5 +.Xr named 8 . +.Sh BUGS +.Nm host +does not yet know how to handle command line arguments that are IPv6 +addresses, even though the record types for those addresses are +fully supported by the BIND9 DNS library. +.Pp +Apart from this self-contradicting sentence, the +.Fl D +option is undocumented. diff --git a/doc/man/bin/nsupdate.8 b/doc/man/bin/nsupdate.8 new file mode 100644 index 0000000000..75b1205c2a --- /dev/null +++ b/doc/man/bin/nsupdate.8 @@ -0,0 +1,301 @@ +.\" Copyright (C) @YEARS@ Internet Software Consortium. +.\" +.\" Permission to use, copy, modify, and distribute this software for any +.\" purpose with or without fee is hereby granted, provided that the above +.\" copyright notice and this permission notice appear in all copies. +.\" +.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS +.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES +.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE +.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL +.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR +.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS +.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS +.\" SOFTWARE. +.\" +.\" $Id: nsupdate.8,v 1.1 2000/07/12 17:17:03 jim Exp $ +.\" +.Dd Jun 30, 2000 +.Dt NSUPDATE 8 +.Os BIND9 9 +.ds vT BIND9 Programmer's Manual +.Sh NAME +.Nm nsupdate +.Nd Dynamic DNS update utility +.Sh SYNOPSIS +.Nm nsupdate +.Op Fl d +.Oo +.Fl y Ar keyname:secret | +.Fl k Ar keyfile +.Oc +.Op Fl v +.Sh DESCRIPTION +.Nm nsupdate +is used to submit Dynamic DNS Update requests as defined in RFC2136 +to a name server. +This allows resource records to be added or removed from a zone +without manually editing the zone file. +A single update request could contain requests to add or remove more than one +resource record. +.Pp +Zones that are under dynamic control via +.Nm nsupdate +or a DHCP server should not be edited by hand. +Manual edits could +conflict with dynamic updates or the name server's transaction log +activities which keep the file copy of the zone consistent with its +internal representation in the name server's memory. +.Pp +The names of resource records that are dynamically added or removed with +.Nm nsupdate +have to be in the same zone. +Requests are sent to the zone's master server. +This is identified by the MNAME field of the zone's SOA record. +.Pp +The +.Fl d +option makes +.Nm nsupdate +operate in debug mode. +This provides tracing information about the update requests that are +made and the replies received from the name server. +.Pp +Transaction signatures can be used to authenticate the Dynamic DNS +updates. +These use the TSIG resource record type described in RFC2845. +The signatures rely on a shared secret that should only be known to +.Nm nsupdate +and the name server. +Currently, the only supported encryption algorithm for TSIG is +HMAC-MD5, which is defined in RFC 2104. +Once other algorithms are defined for TSIG, applications will need to +ensure they select the appropriate algorithm as well as the key when +authenticating each other. +Suitable +.Dv key{} +and +.Dv server{} +statements will be added to +.Pa /etc/named.conf +so that the appropriate secret key and algorithm can be associated +with the IP address of the +client application that will be using TSIG authentication. +.Pp +.Nm nsupdate +uses the +.Fl y +and +.Fl k +options to provide the shared secret needed to generate a TSIG record +for authenticating Dynamic DNS update requests. +These options are mutually exclusive. +The +.Fl k +option gets +.Nm nsupdate +to read the shared secret from the file +.Ar keyfile . +When the +.Fl y +is used, a signature is generated from +.Ar keyname:secret. +.Ar keyname +is the name of the key, +and +.Ar secret +is a string comprising the shared secret. +Use of the +.Fl y +option is discouraged because the shared secret is supplied as a command +line argument in clear text. +This may be visible in the output from +.Xr ps 1 +or in a history file maintained by the user's shell. +.Pp +By default +.Nm nsupdate +uses UDP to send update requests to the name server. +The +.Fl v +option makes +.Nm nsupdate +use a TCP connection. +This may be preferable when a batch of update requests are made. +.Sh INPUT FORMAT +.Nm nsupdate +reads commands from its standard input. +Each command is supplied on exactly one line of input. +Commands can be update instructions or prerequisite checks on the +contents of the zone. +These checks set conditions that some name or set of +resource records (RRset) either exists or is absent from the zone. +These conditions must be met if the entire update request is to succeed. +Updates will be rejected if the tests for the prerequisite conditions fail. +Every update request consists of zero or more prerequisites +and one or more updates. +This allows a suitably authenticated update request to proceed if some +specified resource records are present or missing from the zone. +A blank input line causes the accumulated commands to be sent as one Dynamic +DNS update request to the name server. +.Pp +The command formats and their meaning are as follows: +.Bl -ohang indent +.It Xo +.Ic prereq nxdomain Va domain-name +.Xc +.sp 1 +Requires that no resource record of any type exists with name +.Va domain-name . +.It Xo +.Ic prereq yxdomain Va domain-name +.Xc +.sp 1 +Requires that +.Va domain-name +exists as at least one resource record of any type. +.It Xo +.Ic prereq nxrrset Va domain-name Op class +.Va type +.Xc +.sp 1 +Requires that no resource record exists of the specified +.Va type , +.Va class +and +.Va domain-name . +If +.Va class +is omitted, IN (internet) is assumed. +.It Xo +.Ic prereq yxrrset +.Va domain-name Op class +.Va type Op data... +.Xc +.sp 1 +This requires that a resource record of the specified type +.Va type , +.Va class +and name +.Va domain-name +must exist. +If +.Va class +is omitted, IN (internet) is assumed. +If +.Va data +is supplied, it has to exactly match the corresponding RDATA for +.Va name . +.Va data +is written in the standard text representation of the resource record's +RDATA. +.It Xo +.Ic update delete +.Va domain-name Op class +.Va Op type Op data... +.Xc +.sp 1 +Deletes any resource records named +.Va domain-name . +If +.Va type +and +.Va data +is provided, only matching resource records will be removed. +The internet class is assumed if +.Va class +is not supplied. +.It Xo +.Ic update add +.Va domain-name ttl Op class +.Va type data.. +.Xc +.sp 1 +Adds a new resource record with the specified +.Va ttl , +.Va class +and +.Va data . +.El +.Sh EXAMPLES +The examples below show how +.Nm nsupdate +could be used to insert and delete resource records from the +.Dv example.com +zone. +Notice that the input in each example contains a trailing blank line so that +a group of commands are sent as one dynamic update request to the +master name server for +.Dv example.com . +.Bd -literal -offset indent +# nsupdate +> update delete oldhost.example.com A +> update add newhost.example.com 86400 A 172.16.1.1 +> +.Ed +.Pp +Any A records for +.Dv oldhost.example.com +are deleted. +and an A record for +.Dv newhost.example.com +it IP address 172.16.1.1 is added. +The newly-added record has a 1 day TTL (86400 seconds) +.Bd -literal -offset indent +# nsupdate +> prereq nxdomain nickname.example.com +> update add nickname.example.com CNAME somehost.example.com +> +.Ed +.Pp +The prerequisite condition gets the name server to check that there +are no resource records of any type for +.Dv nickname.example.com . +If there are, the update request fails. +If this name does not exist, a CNAME for it is added. +This ensures that when the CNAME is added, it cannot conflict with the +long-standing rule in RFC1034 that a name must not exist as any other +record type if it exists as a CNAME. +(The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have +SIG, KEY and NXT records.) +.Sh NAME SERVER PROCESSING +.Pp +When a successful update request is made, the BIND9 name server +increments the serial number in the zone's SOA record. +A transaction log file is written containing details of the resource +records that have been added or removed. +This allows the name server to roll forward to the current state of the +zone if it is restarted before a fresh copy of the zone file is written +out by the name server. +XXXJR WHEN DOES IT DO THAT??? +It then sends a NOTIFY message to the zone's slave servers to inform +them that the zone's contents have changed. +.Sh FILES +.Bl -tag -width Kname.+157.+{random}.private -compact +.It Pa /etc/named.conf +name server configuration file +.It Pa Kname.+157.+{random}.key +base-64 encoding of HMAC-MD5 key created by +.Xr dnssec-keygen 8 . +.It Pa Kname.+157.+{random}.private +base-64 encoding of HMAC-MD5 key created by +.Xr dnssec-keygen 8 . +.El +.Sh SEE ALSO +.Xr RFC2136 , +.Xr RFC2137 , +.Xr RFC2104 , +.Xr RFC2845 , +.Xr RFC1034 , +.Xr RFC2535 , +.Xr named 8 , +.Xr dnssec-keygen 8 . +.Sh BUGS +The +.Fl D +and +.Fl M +options are not documented apart from this self-referential paragraph. +They provide additional debugging information which is primarily of interest +to the BIND9 developers. +These options might be changed or removed in future releases. From 8d6c369232229e6f42be52cc14d6349570e9dc01 Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Wed, 12 Jul 2000 17:29:58 +0000 Subject: [PATCH 046/226] work with new omapi_protocol_listen and omapi_auth_register APIs --- bin/tests/omapi_test.c | 44 ++++++++++++++++++++++++++++++++---------- 1 file changed, 34 insertions(+), 10 deletions(-) diff --git a/bin/tests/omapi_test.c b/bin/tests/omapi_test.c index 4728ddfe04..f20db38a70 100644 --- a/bin/tests/omapi_test.c +++ b/bin/tests/omapi_test.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: omapi_test.c,v 1.24 2000/06/28 03:37:47 tale Exp $ */ +/* $Id: omapi_test.c,v 1.25 2000/07/12 17:29:58 tale Exp $ */ /* * Test code for OMAPI. @@ -409,6 +409,8 @@ do_connect(const char *host, int port) { client_object_t *client = NULL; isc_result_t result; const char *key; + const char *bad_secret1 = "this secret is wrong"; + const char *bad_secret2 = "Yet Another Secret"; RUNTIME_CHECK(omapi_object_register(&client_type, "client", client_setvalue, @@ -446,13 +448,15 @@ do_connect(const char *host, int port) { omapi_auth_deregister(KEY1_NAME); RUNTIME_CHECK(omapi_auth_register(KEY1_NAME, - "this secret is wrong", - OMAPI_AUTH_HMACMD5) + OMAPI_AUTH_HMACMD5, + bad_secret1, + strlen(bad_secret1)) == ISC_R_SUCCESS); } else if (error_unknownsig) { RUNTIME_CHECK(omapi_auth_register(KEY2_NAME, - "Yet Another Secret", - OMAPI_AUTH_HMACMD5) + OMAPI_AUTH_HMACMD5, + bad_secret2, + strlen(bad_secret2)) == ISC_R_SUCCESS); key = KEY2_NAME; @@ -538,6 +542,25 @@ listen_done(isc_task_t *task, isc_event_t *event) { omapi_lib_destroy(); } +static isc_boolean_t +verify_connection(isc_sockaddr_t *sockaddr, void *arg) { + /* XXXDCL test the connection verification code */ + UNUSED(sockaddr); + UNUSED(arg); + + return (ISC_TRUE); +} + +static isc_boolean_t +verify_key(const char *name, unsigned int algorithm, void *arg) { + /* XXXDCL test the key verification code */ + UNUSED(name); + UNUSED(algorithm); + UNUSED(arg); + + return (ISC_TRUE); +} + static void do_listen(int port) { omapi_object_t *listener = NULL; @@ -591,7 +614,8 @@ do_listen(int port) { */ inaddr.s_addr = INADDR_ANY; isc_sockaddr_fromin(&sockaddr, &inaddr, port); - RUNTIME_CHECK(omapi_protocol_listen(listener, &sockaddr, acl, 1, + RUNTIME_CHECK(omapi_protocol_listen(listener, &sockaddr, + verify_connection, verify_key, listen_done, listener) == ISC_R_SUCCESS); @@ -623,6 +647,7 @@ main(int argc, char **argv) { isc_socketmgr_t *socketmgr = NULL; isc_taskmgr_t *taskmgr = NULL; isc_entropy_t *entropy = NULL; + const char *secret = "shhh, this is a secret"; int ch; progname = strrchr(*argv, '/'); @@ -683,14 +708,13 @@ main(int argc, char **argv) { * Initialize the signature library. */ RUNTIME_CHECK(isc_entropy_create(mctx, &entropy) == ISC_R_SUCCESS); - RUNTIME_CHECK(dst_lib_init(mctx, entropy, ISC_ENTROPY_BLOCKING) - == ISC_R_SUCCESS); + RUNTIME_CHECK(dst_lib_init(mctx, entropy, 0) == ISC_R_SUCCESS); /* * The secret key is shared on both the client and server side. */ - RUNTIME_CHECK(omapi_auth_register(KEY1_NAME, "shhh, this is a secret", - OMAPI_AUTH_HMACMD5) + RUNTIME_CHECK(omapi_auth_register(KEY1_NAME, OMAPI_AUTH_HMACMD5, + secret, strlen(secret)) == ISC_R_SUCCESS); if (argc >= 1 && strcmp(argv[0], "listen") == 0) { From 0d3bf3c5f1608229244e0a455d6e0fd7f0434abe Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 12 Jul 2000 17:37:57 +0000 Subject: [PATCH 047/226] reviewed; removed requirement to always quote host addresses --- bin/rndc/rndc.conf.5 | 8 +++----- doc/man/bin/rndc.conf.5 | 8 +++----- doc/man/misc/rndc.conf.5 | 8 +++----- 3 files changed, 9 insertions(+), 15 deletions(-) diff --git a/bin/rndc/rndc.conf.5 b/bin/rndc/rndc.conf.5 index 8e37f976bf..010b5e1dc2 100644 --- a/bin/rndc/rndc.conf.5 +++ b/bin/rndc/rndc.conf.5 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.conf.5,v 1.3 2000/07/11 00:37:58 tale Exp $ +.\" $Id: rndc.conf.5,v 1.4 2000/07/12 17:37:57 gson Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC.CONF 5 @@ -120,10 +120,8 @@ See the .Sx EXAMPLES section for sample command lines for each. .Pp -Normally it is not necessary to double quote host or key names, but -host addresses must always be double quoted and both host and key -names must be double quoted when they match another keyword, such as -having a key named "key". +Host and key names must be quoted using double quotes if they +match a keyword, such as having a key named "key". .Sh EXAMPLE .Bd -literal indent options { diff --git a/doc/man/bin/rndc.conf.5 b/doc/man/bin/rndc.conf.5 index 8e37f976bf..010b5e1dc2 100644 --- a/doc/man/bin/rndc.conf.5 +++ b/doc/man/bin/rndc.conf.5 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.conf.5,v 1.3 2000/07/11 00:37:58 tale Exp $ +.\" $Id: rndc.conf.5,v 1.4 2000/07/12 17:37:57 gson Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC.CONF 5 @@ -120,10 +120,8 @@ See the .Sx EXAMPLES section for sample command lines for each. .Pp -Normally it is not necessary to double quote host or key names, but -host addresses must always be double quoted and both host and key -names must be double quoted when they match another keyword, such as -having a key named "key". +Host and key names must be quoted using double quotes if they +match a keyword, such as having a key named "key". .Sh EXAMPLE .Bd -literal indent options { diff --git a/doc/man/misc/rndc.conf.5 b/doc/man/misc/rndc.conf.5 index 8e37f976bf..010b5e1dc2 100644 --- a/doc/man/misc/rndc.conf.5 +++ b/doc/man/misc/rndc.conf.5 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: rndc.conf.5,v 1.3 2000/07/11 00:37:58 tale Exp $ +.\" $Id: rndc.conf.5,v 1.4 2000/07/12 17:37:57 gson Exp $ .\" .Dd Jun 30, 2000 .Dt RDNC.CONF 5 @@ -120,10 +120,8 @@ See the .Sx EXAMPLES section for sample command lines for each. .Pp -Normally it is not necessary to double quote host or key names, but -host addresses must always be double quoted and both host and key -names must be double quoted when they match another keyword, such as -having a key named "key". +Host and key names must be quoted using double quotes if they +match a keyword, such as having a key named "key". .Sh EXAMPLE .Bd -literal indent options { From a8ea4d2e3fc4bb2e46daaa76f10325d0b8637e8f Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 12 Jul 2000 17:41:24 +0000 Subject: [PATCH 048/226] moved rndc.conf.5 from doc/man/misc to doc/man/bin for inclusion in RC1 (by repository copy) --- doc/man/misc/rndc.conf.5 | 202 --------------------------------------- 1 file changed, 202 deletions(-) delete mode 100644 doc/man/misc/rndc.conf.5 diff --git a/doc/man/misc/rndc.conf.5 b/doc/man/misc/rndc.conf.5 deleted file mode 100644 index 010b5e1dc2..0000000000 --- a/doc/man/misc/rndc.conf.5 +++ /dev/null @@ -1,202 +0,0 @@ -.\" Copyright (C) @YEARS@ Internet Software Consortium. -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS -.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES -.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE -.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\" SOFTWARE. -.\" -.\" $Id: rndc.conf.5,v 1.4 2000/07/12 17:37:57 gson Exp $ -.\" -.Dd Jun 30, 2000 -.Dt RDNC.CONF 5 -.Os BIND9 9 -.ds vT BIND9 Programmer's Manual -.Sh NAME -.Nm rdnc.conf -.Nd rdnc configuration file -.Sh SYNOPSIS -.Nm rdnc.conf -.Sh DESCRIPTION -The BIND9 utility for controlling the name server, -.Nm rndc , -has its own configuration file -.Pa /etc/rndc.conf . -This file has a similar structure and syntax to -.Pa named.conf , -the file used to configure the name server. -Statements are enclosed in braces and terminated with a semi-colon. -Clauses in the statements are also semi-colon terminated. -The usual comment styles are supported: -.Bl -tag -width UNIX-style: -.It C style: /* */ -.It C++ style: // to end of line -.It Unix style: # to end of line -.El -.Pp -.Pa rndc.conf -is much simpler than -.Pa named.conf . -The file uses three statements: an -.Dv options{} -statement, a -.Dv server{} -statement and a -.Dv key{} -statement. -.Pp -The -.Dv options{} -statement contains two clauses. -The -.Dv default-server -clause -is followed by the name or address of a name server. -This host will -be used when no name server is given as an argument to -.Nm rndc . -The -.Dv default-key -clause -is followed by the name of a key which is identified by a -.Dv key{} -statement. -If no -.Fl y -option is provided on the -.Xr rndc -command line, and no -.Dv key -clause is found in a a matching -.Dv server{} -statement, this default key will be used to authenticate the server's -commands and responses. -.Pp -After the keyword -.Dv server , -the -.Dv server{} -statement is followed by a string which is the hostname or address for a -name server. -The statement has a single clause, -.Dv key . -The key name must match the name of a -.Dv key{} -statement in the file. -.Pp -The -.Dv key{} -statement begins with an identifying string, the name of the key. -The statement has two clauses. -.Dv algorithm -identifies the encryption algorithm for -.Nm rndc -to use; currently only HMAC-MD5 is supported. -This is followed by a -.Dv secret -clause which contains the base-64 encoding of the -algorithm's encryption key. -The base-64 string is enclosed in double quotes. -.Pp -There are two common ways to generate the base-64 string for the -.Dv secret . -The BIND 9 program -.Xr dnssec-keygen 8 -can be used to generate a random key, or the -.Xr mmencode 1 -program, also known as -.Xr mimencode 1 , -can be used to generate a base-64 string from known input. -.Xr mmencode -does not ship with BIND 9 but is available on many systems. -See the -.Sx EXAMPLES -section for sample command lines for each. -.Pp -Host and key names must be quoted using double quotes if they -match a keyword, such as having a key named "key". -.Sh EXAMPLE -.Bd -literal indent -options { - default-server localhost; - default-key samplekey; -}; - -server localhost { - key samplekey; -}; - -key samplekey { - algorithm hmac-md5; - secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K"; -}; -.Ed -.Pp -In the above example, -.Nm rndc -will by default use the server at localhost (127.0.0.1) and the key called -.Dv samplekey . -Commands to the localhost server will use the -.Dv samplekey -key. -The -.Dv key{} -statement indicates that -.Dv samplekey -uses the HMAC-MD5 algorithm and its -.Dv secret -clause contains the base-64 encoding of the HMAC-MD5 secret enclosed -in double quotes. -.Pp -To generate a random secret with -.Xr dnssec-keygen : -.Bd -literal indent -$ dnssec-keygen -a hmac-md5 -b 128 -n user rndc -.Ed -.Pp -The base-64 string will appear in two files, -.Pa Krndc.+157.+{random}.key -and -.Pa Krndc.+157.+{random}.private . -After extracting the key to be -placed in the -.Nm rndc.conf -and -.Xr named.conf -.Dv key{} -statements, the -.Pa .key -and -.Pa .private -files can be removed. -.Pp -To generate a secret from known input with -.Xr mmenode : -.Bd -literal indent -$ echo "known plaintext for a secret" | mmencode -.Ed -.Sh LIMITATIONS -There is currently no way to specify the port for -.Xr rndc -to use. This will be remedied in future releases by allowing a -.Dv port -clause to the -.Dv server{} -statement and a -.Dv default-port -clause to the -.Dv options{} -statement. -.Sh SEE ALSO -.Xr rndc 8 , -.Xr named.conf 8 , -.Xr dnssec-keygen 8 , -.Xr mmencode 1 , -"BIND9 Administrators Manual". From 76959783dd4beab35f5c3b560bf9f81a3b0e10a3 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Wed, 12 Jul 2000 17:44:03 +0000 Subject: [PATCH 049/226] Documentation changes in usage message. --- bin/dig/dig.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bin/dig/dig.c b/bin/dig/dig.c index 6bd4b43cd0..1d8943fde5 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.c,v 1.60 2000/07/12 01:41:35 mws Exp $ */ +/* $Id: dig.c,v 1.61 2000/07/12 17:44:03 mws Exp $ */ #include #include @@ -160,6 +160,8 @@ show_usage(void) { " +[no]defname (Set whether to use default domain)\n" " +[no]recursive (Recursive mode)\n" " +[no]aaonly (Set AA flag in query)\n" +" +[no]adflag (Set AD flag in query)\n" +" +[no]cdflag (Set CD flag in query)\n" " +[no]details (Show details of all requests)\n" " +ndots=### (Set NDOTS value)\n" " +[no]comments (Control display of comment lines)\n" @@ -169,6 +171,7 @@ show_usage(void) { " +[no]additional (Control display of additional)\n" " +[no]short (Disable everything except short\n" " form of answer)\n" +" +[no]all (Set or clear all display flags)\n" " +qr (Print question before sending)\n" " +[no]cdflag (Set or clear CD flag in query)\n" " +[no]adflag (Set or clear AD flag in query)\n" From f83bad6f7890281b90c9595198f88b88a1ea69f6 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 12 Jul 2000 17:54:40 +0000 Subject: [PATCH 050/226] imported new ARM from Mary --- doc/arm/Bv9ARM.1.html | 51 +- doc/arm/Bv9ARM.2.html | 3 +- doc/arm/Bv9ARM.3.html | 523 +--------------- doc/arm/Bv9ARM.4.html | 104 ++-- doc/arm/Bv9ARM.5.html | 3 +- doc/arm/Bv9ARM.6.html | 1079 ++++++++++++++++----------------- doc/arm/Bv9ARM.7.html | 3 +- doc/arm/Bv9ARM.8.html | 12 +- doc/arm/Bv9ARM.9.html | 161 ++--- doc/arm/Bv9ARM.css | 19 - doc/arm/Bv9ARM.html | 5 +- doc/arm/Bv9ARM.txt | 1320 +++++++++++++++++++++++------------------ 12 files changed, 1423 insertions(+), 1860 deletions(-) diff --git a/doc/arm/Bv9ARM.1.html b/doc/arm/Bv9ARM.1.html index 6a495e7a9d..99f44fd118 100644 --- a/doc/arm/Bv9ARM.1.html +++ b/doc/arm/Bv9ARM.1.html @@ -16,8 +16,9 @@ - SOFTWARE. --> - + + @@ -91,7 +92,7 @@ Bibliography In this document, we use the following general typographic conventions:

- - - - - - - - - -
+

@@ -99,7 +100,7 @@ In this document, we use the following general typographic conventions:

To describe:

+

@@ -109,14 +110,14 @@ We use the style:

+

a pathname, filename, URL, hostname,
mailing list name, or new term or concept

 +

@@ -126,13 +127,13 @@ Italic

+

literal user input

 +

@@ -142,13 +143,13 @@ Fixed Width Bold

+

variable user input

 +

@@ -158,13 +159,13 @@ Fixed Width Italic

+

program output

 +

@@ -180,7 +181,7 @@ Fixed Width The following conventions are used in descriptions of the BIND configuration file:

- - - - - - - - - - - - - -
+

@@ -188,7 +189,7 @@ The following conventions are used in descriptions of the BIND configuration fil To describe:

+

@@ -198,13 +199,13 @@ We use the style:

+

keywords

 +

@@ -214,13 +215,13 @@ Sans Serif Bold

+

variables

 +
@@ -230,13 +231,13 @@ Sans Serif Italic
+

"meta-syntactic" information (within brackets when optional)

 +

@@ -246,13 +247,13 @@ Fixed Width Italic

+

Command line input

 +

@@ -262,13 +263,13 @@ Fixed Width Bold

+

Program output

 +

@@ -278,13 +279,13 @@ Fixed Width

+

Optional input

 +

diff --git a/doc/arm/Bv9ARM.2.html b/doc/arm/Bv9ARM.2.html index 8830f858af..f55426a50b 100644 --- a/doc/arm/Bv9ARM.2.html +++ b/doc/arm/Bv9ARM.2.html @@ -16,8 +16,9 @@ - SOFTWARE. --> - + + diff --git a/doc/arm/Bv9ARM.3.html b/doc/arm/Bv9ARM.3.html index c41e868646..0d89da9cb0 100644 --- a/doc/arm/Bv9ARM.3.html +++ b/doc/arm/Bv9ARM.3.html @@ -16,525 +16,6 @@ - SOFTWARE. --> - + - - - - - Section 3. Nameserver Configuration - -

    -

    - - -Section 3. Nameserver Configuration

    -
-

- - -In this section we provide some suggested configurations along with guidelines for their use. We also address the topic of reasonable option setting.

-
-
    -

    - - -3.1 - -Sample Configurations

    -
-
-
    -

    - - -3.1.1 A Caching-only Nameserver

    -
-

- - -The following sample configuration is appropriate for a caching-only name server for use by clients internal to a corporation. All queries from outside clients are refused.

- -
-
-// Two corporate subnets we wish to allow queries from.
-acl "corpnets" { 192.168.4.0/24; 192.168.7.0/24; };
-options {
-     directory "/etc/namedb";		// Working directory
-     pid-file "named.pid";		// Put pid file in working dir
-     allow-query { "corpnets "; };
-};
-// Root server hints
-zone "." { type hint; file "root.hint"; };
-// Provide a reverse mapping for the loopback address 127.0.0.1
-zone "0.0.127.in-addr.arpa" {
-     type master;
-     file "localhost.rev";
-     notify no;
-
-};
-
-
-
-
    -

    - - -3.1.2 An Authoritative-only Nameserver

    -
-

- - -This sample configuration is for an authoritative-only server that is the master server for " -example.com -" and a slave for the subdomain " -eng.example.com -".

- -
-options {
-     directory "/etc/namedb";		// Working directory
-     pid-file "named.pid";		// Put pid file in working dir
-     allow-query { any; };		// This is the default
-     recursion no;			// Do not provide recursive service
-};
-// Root server hints
-zone "." { type hint; file "root.hint"; }; 
-
-// Provide a reverse mapping for the loopback address 127.0.0.1
-     zone "0.0.127.in-addr.arpa" {
-     type master;
-     file "localhost.rev";
-     notify no;
-};
-// We are the master server for example.com
-zone "example.com" {
-     type master;
-     file "example.com.db";
-     // IP addresses of slave servers allowed to transfer example.com
-     allow-transfer {
-          192.168.4.14;
-          192.168.5.53;
-     };
-};
-
-// We are a slave server for eng.example.com
-zone "eng.example.com" {
-     type slave;
-     file "eng.example.com.bk";
-     // IP address of eng.example.com master server
-     masters { 192.168.4.12; };
-};
-
- -
-
-
-
    -

    - - -3.2 Load Balancing

    -
-

- - -Primitive load balancing can be achieved in DNS using multiple A records for one name.

-

- - -For example, if you have three WWW servers with network addresses of 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the following means that clients will connect to each machine one third of the time:

-

- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-

- - -Name

-		 -

- - -TTL

-		 -

- - -CLASS

-		 -

- - -TYPE

-		 -

- - -Resource Record (RR) Data

-
-

- - - -www -

-		 -

- - - -600 -

-		 -

- - - -IN -

-		 -

- - - -A -

-		 -

- - - -10.0.0.1 -

-
-

- - - - - 

-		 -

- - - -600 -

-		 -

- - - -IN -

-		 -

- - - -A -

-		 -

- - - -10.0.0.2 -

-
-

- - - - - 

-		 -

- - - -600 -

-		 -

- - - -IN -

-		 -

- - - -A -

-		 -

- - - -10.0.0.3 -

-
-

- - -When a resolver queries for these records, BIND will rotate them and respond to the query with the records in a different order. In the example above, clients will randomly receive records in the order 1, 2, 3; 2, 3, 1; and 3, 1, 2. Most clients will use the first record returned and discard the rest.

-

- - -For more detail on ordering responses, check the -rrset-order - substatement in the -options - statement under RRset Ordering. This substatement is not supported in BIND 9, and only the ordering scheme described above is available.

-
-
-
    -

    - - -3.3 - -Notify

    -
-

- - -DNS Notify is a mechanism that allows master nameservers to notify their slave servers of changes to a zone's data. In response to a -NOTIFY - from a master server, the slave will check to see that its version of the zone is the current version and, if not, initiate a transfer.

-

- - -DNS Notify is fully documented in RFC 1996. See also the description of the zone option -also-notify - under Zone Transfers -. More information about -notify - can be found under Boolean Options -.

-
-
-
    -

    - - -3.4 Nameserver Operations

    -
-
-
    -

    - - -3.4.1 Tools for Use With the Nameserver Daemon

    -
-

- - -There are several indispensable diagnostic, administrative and monitoring tools available to the system administrator for controlling and debugging the nameserver daemon. We describe several in this section

-
-
    -
    - - -3.4.1.1 Diagnostic Tools
    -
-
-
-
- - -dig
-

- - -The domain information groper ( -dig -) is a command line tool that can be used to gather information from the Domain Name System servers. Dig has two modes: simple interactive mode for a single query, and batch mode which executes a query for each in a list of several query lines. All query options are accessible from the command line.

-
-
-
- - -Usage
-
-
-dig [@server] domain [<query-type>] [<query-class>]
-     [+<query-option>] [-<dig-option>] [%comment]
-
-

- - -The usual simple use of dig will take the form

-
-
-dig @server domain query-type query-class
-
-

- - -For more information and a list of available commands and options, see the dig man page.

-
-
-
- - -host
-

- - -The - - -host - - -utility provides a simple DNS lookup using a command-line interface for looking up Internet hostnames. By default, the utility converts between host names and Internet addresses, but its functionality can be extended with the use of options.

-
-
-
- - -Usage
-
-
-host [-aCdlrTwv] [-c class] [-N ndots] [-t type]
-     [-W timeout] [-R retries] hostname [server]
-
-
-
- - -nslookup
-

- - - -nslookup - is a program used to query Internet domain nameservers. -nslookup - has two modes: interactive and non-interactive. Interactive mode allows the user to query nameservers for information about various hosts and domains or to print a list of hosts in a domain. Non-interactive mode is used to print just the name and requested information for a host or domain.

-
-
-
- - -Usage
-
-
-nslookup [-option ...] [host-to-find | -[server]]
-
-

- - -Interactive mode is entered when no arguments are given (the default nameserver will be used) or when the first argument is a hyphen (`-') and the second argument is the host name or Internet address of a nameserver.

-

- - -Non-interactive mode is used when the name or Internet address of the host to be looked up is given as the first argument. The optional second argument specifies the host name or address of a nameserver.

-

- - -The options listed under the "set" command (see the -nslookup - man page for details) can be specified in the -.nslookuprc - file in the user's home directory if they are listed one per line. Options can also be specified on the command line if they precede the arguments and are prefixed with a hyphen. For example, to change the default query type to host information, and the initial time-out to 10 seconds, type:

-
-
-nslookup -query=hinfo -timeout=10
-
-

- - -For more information and a list of available commands and options, see the -nslookup - man page.

-

- - -Due to its arcane user interface and frequently inconsistent behavior, we do not recommend the use of -nslookup -, and it is not installed by default when installing BIND 9. Use -dig - instead.

-
-
-
    -
    - - -3.4.1.2 Administrative Tools
    -
-

- - -Administrative tools play an integral part in the management of a server.

-
-
-
- - -rndc
-

- - -The remote name daemon control ( -rndc -) program is a program that allows the system administrator to control the operation of a nameserver. If you run -rndc - without any options it will display a usage message.

-

- - -Usage:

-
-
-rndc [-p port] [-m] server command [command ...]
-
-

- - -For more information and a list of available commands and options, see the -rndc - man page.

-
-
-
-
-

Return to BIND 9 Administrator Reference Manual table of contents.

- - - - + Section 3. Nameserver Configuration

    Section 3. Nameserver Configuration

In this section we provide some suggested configurations along with guidelines for their use. We also address the topic of reasonable option setting.

    3.1 Sample Configurations

    3.1.1 A Caching-only Nameserver

The following sample configuration is appropriate for a caching-only name server for use by clients internal to a corporation. All queries from outside clients are refused.


// Two corporate subnets we wish to allow queries from.
acl "corpnets" { 192.168.4.0/24; 192.168.7.0/24; };
options {
     directory "/etc/namedb";		// Working directory
     pid-file "named.pid";		// Put pid file in working dir
     allow-query { "corpnets "; };
};
// Root server hints
zone "." { type hint; file "root.hint"; };
// Provide a reverse mapping for the loopback address 127.0.0.1
zone "0.0.127.in-addr.arpa" {
     type master;
     file "localhost.rev";
     notify no;

};

    3.1.2 An Authoritative-only Nameserver

This sample configuration is for an authoritative-only server that is the master server for " example.com " and a slave for the subdomain " eng.example.com ".

options {
     directory "/etc/namedb";		// Working directory
     pid-file "named.pid";		// Put pid file in working dir
     allow-query { any; };		// This is the default
     recursion no;			// Do not provide recursive service
};
// Root server hints
zone "." { type hint; file "root.hint"; }; 

// Provide a reverse mapping for the loopback address 127.0.0.1
     zone "0.0.127.in-addr.arpa" {
     type master;
     file "localhost.rev";
     notify no;
};
// We are the master server for example.com
zone "example.com" {
     type master;
     file "example.com.db";
     // IP addresses of slave servers allowed to transfer example.com
     allow-transfer {
          192.168.4.14;
          192.168.5.53;
     };
};

// We are a slave server for eng.example.com
zone "eng.example.com" {
     type slave;
     file "eng.example.com.bk";
     // IP address of eng.example.com master server
     masters { 192.168.4.12; };
};

    3.2 Load Balancing

Primitive load balancing can be achieved in DNS using multiple A records for one name.

For example, if you have three WWW servers with network addresses of 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the following means that clients will connect to each machine one third of the time:


 

Name

TTL

CLASS

TYPE

Resource Record (RR) Data

www

600

IN

A

10.0.0.1

 

600

IN

A

10.0.0.2

 

600

IN

A

10.0.0.3

When a resolver queries for these records, BIND will rotate them and respond to the query with the records in a different order. In the example above, clients will randomly receive records in the order 1, 2, 3; 2, 3, 1; and 3, 1, 2. Most clients will use the first record returned and discard the rest.

For more detail on ordering responses, check the rrset-order substatement in the options statement under RRset Ordering. This substatement is not supported in BIND 9, and only the ordering scheme described above is available.

    3.3 Notify

DNS Notify is a mechanism that allows master nameservers to notify their slave servers of changes to a zone's data. In response to a NOTIFY from a master server, the slave will check to see that its version of the zone is the current version and, if not, initiate a transfer.

DNS Notify is fully documented in RFC 1996. See also the description of the zone option also-notify under Zone Transfers . More information about notify can be found under Boolean Options .

    3.4 Nameserver Operations

    3.4.1 Tools for Use With the Nameserver Daemon

There are several indispensable diagnostic, administrative and monitoring tools available to the system administrator for controlling and debugging the nameserver daemon. We describe several in this section

    3.4.1.1 Diagnostic Tools
dig

The domain information groper ( dig ) is a command line tool that can be used to gather information from the Domain Name System servers. Dig has two modes: simple interactive mode for a single query, and batch mode which executes a query for each in a list of several query lines. All query options are accessible from the command line.

Usage

dig [@server] domain [<query-type>] [<query-class>]
     [+<query-option>] [-<dig-option>] [%comment]

The usual simple use of dig will take the form


dig @server domain query-type query-class

For more information and a list of available commands and options, see the dig man page.

host

The host utility provides a simple DNS lookup using a command-line interface for looking up Internet hostnames. By default, the utility converts between host names and Internet addresses, but its functionality can be extended with the use of options.

Usage

host [-aCdlrTwv] [-c class] [-N ndots] [-t type]
     [-W timeout] [-R retries] hostname [server]
For more information and a list of available commands and options, see the host man page.

nslookup

nslookup is a program used to query Internet domain nameservers. nslookup has two modes: interactive and non-interactive. Interactive mode allows the user to query nameservers for information about various hosts and domains or to print a list of hosts in a domain. Non-interactive mode is used to print just the name and requested information for a host or domain.

Usage

nslookup [-option ...] [host-to-find | -[server]]

Interactive mode is entered when no arguments are given (the default nameserver will be used) or when the first argument is a hyphen (`-') and the second argument is the host name or Internet address of a nameserver.

Non-interactive mode is used when the name or Internet address of the host to be looked up is given as the first argument. The optional second argument specifies the host name or address of a nameserver.

The options listed under the "set" command (see the nslookup man page for details) can be specified in the .nslookuprc file in the user's home directory if they are listed one per line. Options can also be specified on the command line if they precede the arguments and are prefixed with a hyphen. For example, to change the default query type to host information, and the initial time-out to 10 seconds, type:


nslookup -query=hinfo -timeout=10

For more information and a list of available commands and options, see the nslookup man page.

Due to its arcane user interface and frequently inconsistent behavior, we do not recommend the use of nslookup , and it is not installed by default when installing BIND 9. Use dig instead.

    3.4.1.2 Administrative Tools

Administrative tools play an integral part in the management of a server.

rndc

The remote name daemon control (rndc) program allows the system administrator to control the operation of a nameserver. If you run (rndc) without any options it will display a usage message as follows:

Usage
rndc [-c config] [-s server] [-p port] [-y key] command [command ...]
command is one of the following for named:
*status Display ps(1) status of named.
*dumpdb Dump database and cache to /var/tmp/named_dump.db.
reload Reload configuration file and zones.
*stats Dump statistics to /var/tmp/named.stats.
*trace Increment debugging level by one.
*notrace Set debugging level to 0.
*querylog Toggle query logging.
*stop Stop the server.
*restart Restart the server.
* == not yet implemented

As noted above, "reload" is the only command available for BIND 9.0.0. The other commands, and more, are planned to be implemented for future releases.

A configuration file is required, since all communication with the server is authenticated with digital signatures that rely on a shared secret, and there is no way to provide that secret other than with a configuration file. The default location for the rndc configuration file is /etc/rndc.conf, but an alternate location can be specified with the "-c" option.

The format of the configuration file is similar to that of named.conf, but limited to only three statements, the options{}, key{} and server{} statements. These statements are what associate the secret keys to the servers with which they are meant to be shared. The order of statements is not significant.

The options{} statement has two clauses: default-server and default-key. default-server takes a host name or address argument and represents the server that will be contacted if no "-s" option is provided on the command line. default-key takes the name of the key as its argument, as defined by a key{} statement. In the future a default-port clause will be added to specify the port to which rndc should connect.

The key{} statement names a key with its string argument. The string is required by the server to be a valid domain name, though it need not actually be hierarchical; thus, a string like "rndc_key" is a valid name. The key{} statement has two clauses: algorithm and secret. While the configuration parser will accept any string as the argument to algorithm, currently only the string "hmac-md5" has any meaning. The secret is a base-64 encoded string, typically generated with either dnssec-keygen or mmencode.

The server{} statement uses the key clause to associate a key{}-defined key with a server. The argument to the server{} statement is a host name or address (addresses must be double quoted). The argument to the key clause is the name of key as defined by the key{} statement. A port clause will be added to a future release to specify the port to which rndc should connect on the given server.

A sample minimal configuration file is as follows:

key rndc_key {
     algorithm "hmac-md5";
     secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
};
options {
     default-server localhost;
     default-key rndc_key;
};

This file, if installed as /etc/rndc.conf, would allow the command:

$ rndc reload

to connect to 127.0.0.1 port 953 and cause the nameserver to reload, if a nameserver on the local machine were running with following controls statements:

controls {
     inet 127.0.0.1 allow { localhost; } keys { rndc_key; };         
};

and it had an identical key statement for rndc_key.

 

3.4.2 Signals

Certain UNIX signals cause the name server to take specific actions, as described in the following table. These signals can be sent using the kill command.

 

SIGHUP

Causes the server to read named.conf and reload the database.

SIGTERM

Causes the server to clean up and exit.

SIGINT

Causes the server to clean up and exit.

Return to BIND 9 Administrator Reference Manual table of contents.

\ No newline at end of file diff --git a/doc/arm/Bv9ARM.4.html b/doc/arm/Bv9ARM.4.html index e63145e715..83c36f2f6e 100644 --- a/doc/arm/Bv9ARM.4.html +++ b/doc/arm/Bv9ARM.4.html @@ -16,8 +16,9 @@ - SOFTWARE. --> - + + @@ -60,7 +61,7 @@ Updating of secure zones (zones using DNSSEC) is modelled after the -http://www.ietf.org/html.charters/dnsext-charter.html +http://www.ietf.org/html.charters/dnsext-charter.html for information about the DNS Extensions working group.) SIG and NXT records affected by updates are automatically regenerated by the server using an online zone key. Update authorization is based on transaction signatures and an explicit server policy.

@@ -164,11 +165,8 @@ site2.internal To protect the - site1.interna - -l - and - + site1.internal + and site2.internal domains, the internal nameservers must be configured to disallow all queries to these domains from any external hosts, including the bastion hosts.

@@ -195,7 +193,7 @@ In addition, the public site1 and site2.example.com - zones should have special MX records that contain wildcard (`*') records pointing to the bastion hosts. This is needed because external mail servers do not have any other way of looking up how to deliver mail to those internal hosts. With the wildcard records, the mail will be delivered to the bastion host, which can then forward it on to internal hosts.

+ zones should have special MX records that contain wildcard ('*') records pointing to the bastion hosts. This is needed because external mail servers do not have any other way of looking up how to deliver mail to those internal hosts. With the wildcard records, the mail will be delivered to the bastion host, which can then forward it on to internal hosts.

@@ -347,9 +345,9 @@ bastion-ips-go-here; }; options { ... ... - allow-transfer { none; }; // sample allow-transfer (no one) - allow-query { internals; externals; }; // restrict query access - allow-recursion { internals; externals; }; // restrict recursion + allow-transfer { none; }; // sample allow-transfer (no one) + allow-query { internals; externals; }; // restrict query access + allow-recursion { internals; externals; }; // restrict recursion ... ... }; @@ -406,9 +404,11 @@ BIND primarily supports TSIG for server to server communication. This includes z TSIG might be most useful for dynamic update. A primary server for a dynamic zone should use access control to control updates, but IP-based access control is insufficient. Key-based access control is far superior. See RFC 2845 in the Proposed Standards section of the Appendix. The nsupdate - program that is shipped with BIND 8 supports TSIG via the " + program supports TSIG via the " -k -" command line option.

+" and " +-y +"command line options.

@@ -800,7 +800,7 @@ dnssec-makekeyset The following command generates a key set containing the above key and another key similarly generated, with a TTL of 3600 and a signature validity period of 10 days starting from now.

-dnssec-makekeyset -t 3600 -s now -e now+864000 Kchild.example.+003+12345 
+dnssec-makekeyset -t 3600 -e +864000 Kchild.example.+003+12345 
 Kchild.example.+003+23456
@@ -1117,62 +1117,46 @@ To replicate the previous example using bitstrings:

4.8.5 Using DNAME for Delegation of IPv6 Reverse Addresses

-

- - -Delegation of reverse addresses is done through the new DNAME RR. In the example above, where -\[x2/3].ip6.int. - needs to delegate - - -\[xFFF0] - - -to an organization ( -example2.com -), the domain administrator would insert a line similar to the following in the -\[x2/3].ip6.int. - zone:

+In IPV6, the same host may have many addresses from many network providers. Since the trailing portion of the address usually remains constant, DNAME can help reduce the number of zone files used for reverse mapping that need to be maintained. + +For example, consider a host which has two providers (example.net and example2.net) and therefore two IPv6 addresses. Since the host chooses its own 64 bit host address portion, the provider address is the only part that changes: 
-$ORIGIN \[x2/3].ip6.int.
-\[xFFF0/13] 1h IN DNAME ip6.example2.com.
+$ORIGIN example.com.
+host		A6	64 ::1234:5678:1212:5675 cust1.example.net.
+		A6	64 ::1234:5678:1212:5675 subnet5.example2.net.
+
+
+$ORIGIN example.net.
+cust1		A6	48 0:0:0:dddd:: ipv6net.example.net.
+ipv6net		A6	0  aa:bb:cccc::
+
+
+$ORIGIN example2.net.
+subnet5		A6	48 0:0:0:1:: ipv6net2.example2.net.
+ipv6net2	A6	0  6666:5555:4::
-

- - - -example2.com - would then place into the -ip6 -zone:

+This sets up forward lookups. To handle the reverse lookups, the provider example.net would have: 
-$ORIGIN ip6.example.com.
-\[x80500201/32] 1h IN DNAME ip6.example.com.
-
- -

- - -Finally, -example.com -needs to include in the -ip6.example.com - zone:

+$ORIGIN \[x00aa00bbcccc/48].ip6.arpa. +\[xdddd/16] DNAME ipv6-rev.example.com. + +and example2.net would have: 
-$ORIGIN ip6.example.com.
-\[x00090A0020FFFE812B32/80] 1h IN PTR host.example.com.
+$ORIGIN \[x666655550004/48].ip6.arpa.
+\[x0001/16]		DNAME		ipv6-rev.example.com.
+
+example.com needs only one zone file to handle both of these reverse mappings: + +
+$ORIGIN ipv6-rev.example.com.
+\[x1234567812125675/64]		PTR		host.example.com.
-

- - -We suggest that the top of your administrative control ( -example.com -, in this case) provide all the bits required for reverse and forward resolution to allow name resolution even if the network is disconnected from the Internet. This will also allow operation with DNSSEC if you set up a false trusted server for "." containing only delegations for your forward and reverse zones directly to the top of your administrative control. This should be signed with a key trusted by all of your clients, equivalent to the real key for ".".

+
diff --git a/doc/arm/Bv9ARM.5.html b/doc/arm/Bv9ARM.5.html index 73137da636..0ec12ef76b 100644 --- a/doc/arm/Bv9ARM.5.html +++ b/doc/arm/Bv9ARM.5.html @@ -16,8 +16,9 @@ - SOFTWARE. --> - + + diff --git a/doc/arm/Bv9ARM.6.html b/doc/arm/Bv9ARM.6.html index a1381e2a9f..d38394114b 100644 --- a/doc/arm/Bv9ARM.6.html +++ b/doc/arm/Bv9ARM.6.html @@ -16,8 +16,9 @@ - SOFTWARE. --> - + + @@ -60,7 +61,7 @@ Following is a list of elements used throughout the BIND configuration file docu  

- - - - - - - - - - - - - - - - - - - - - + + + + - - - - - - -
+
@@ -68,7 +69,7 @@ Following is a list of elements used throughout the BIND configuration file docu acl_name
+

@@ -80,7 +81,7 @@ acl

+
@@ -88,7 +89,7 @@ acl address_match_list
+

@@ -112,7 +113,7 @@ Address Match Lists

+
@@ -120,7 +121,7 @@ Address Match Lists domain_name
+

@@ -130,7 +131,7 @@ my.test.domain

+
@@ -138,7 +139,7 @@ my.test.domain dotted_decimal
+

@@ -152,7 +153,7 @@ One or more integers valued 0 through 255 separated only by dots (`.'), such as

+
@@ -160,7 +161,7 @@ One or more integers valued 0 through 255 separated only by dots (`.'), such as ip4_addr
+

@@ -170,7 +171,7 @@ dotted_decimal

+
@@ -178,7 +179,7 @@ dotted_decimal ip6_addr
+

@@ -188,7 +189,7 @@ fe80::200:f8ff:fe01:9742

+
@@ -196,7 +197,7 @@ fe80::200:f8ff:fe01:9742 ip_addr
+

@@ -210,7 +211,7 @@ ip6_addr

+
@@ -218,7 +219,7 @@ ip6_addr ip_port
+

@@ -230,7 +231,7 @@ number

+
@@ -238,7 +239,7 @@ number ip_prefix
+

@@ -260,15 +261,15 @@ ip_addr

+
-key_name +key_id
+

@@ -278,7 +279,23 @@ domain_name

+ +
+ + + +key_list +
+		 +

+ + +A list of one or more key-ids, separated by semicolons and ending with a semicolon.

+
@@ -286,7 +303,7 @@ domain_name number
+

@@ -294,7 +311,7 @@ A non-negative integer with an entire range limited by the range of a C language

+
@@ -302,7 +319,7 @@ A non-negative integer with an entire range limited by the range of a C language path_name
+

@@ -316,7 +333,7 @@ zones/master/my.test.domain

+
@@ -324,7 +341,7 @@ zones/master/my.test.domain size_spec
+

@@ -374,7 +391,7 @@ unlimited

+
@@ -382,7 +399,7 @@ unlimited yes_or_no
+

@@ -610,7 +627,7 @@ The following statements are supported:

 

- - - - - - - - - - - - - - - - - - - -
+

@@ -618,7 +635,7 @@ The following statements are supported:

acl

+

@@ -626,7 +643,7 @@ defines a named IP address matching list, for access control and other uses.
+

@@ -634,7 +651,7 @@ defines a named IP address matching list, for access control and other uses.

controls

+

@@ -644,7 +661,7 @@ rndc

+

@@ -652,7 +669,7 @@ rndc include

+

@@ -660,7 +677,7 @@ includes a file.
+

@@ -668,7 +685,7 @@ includes a file.

key

+

@@ -676,7 +693,7 @@ specifies key information for use in authentication and authorization using TSIG

+

@@ -684,7 +701,7 @@ specifies key information for use in authentication and authorization using TSIG logging

+

@@ -692,7 +709,7 @@ specifies what the server logs, and where the log messages are sent.
+

@@ -700,7 +717,7 @@ specifies what the server logs, and where the log messages are sent.

options

+

@@ -708,7 +725,7 @@ controls global server configuration options and sets defaults for other stateme

+

@@ -716,7 +733,7 @@ controls global server configuration options and sets defaults for other stateme server

+

@@ -724,7 +741,7 @@ sets certain configuration options on a per-server basis.
+

@@ -732,7 +749,7 @@ sets certain configuration options on a per-server basis.

trusted-keys

+

@@ -740,7 +757,7 @@ defines trusted DNSSEC keys.
+

@@ -748,7 +765,7 @@ defines trusted DNSSEC keys.

view

+

@@ -756,7 +773,7 @@ defines a view.
+

@@ -764,7 +781,7 @@ defines a view.

zone

+

@@ -826,7 +843,7 @@ The following ACLs are built-in:

 

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+

@@ -834,7 +851,7 @@ The following ACLs are built-in:

any

+

@@ -842,7 +859,7 @@ Matches all hosts.
+

@@ -850,7 +867,7 @@ Matches all hosts.

none

+

@@ -858,7 +875,7 @@ Matches no hosts.
+

@@ -866,7 +883,7 @@ Matches no hosts.

localhost

+

@@ -874,7 +891,7 @@ Matches the IP addresses of all interfaces on the system.
+

@@ -882,7 +899,7 @@ Matches the IP addresses of all interfaces on the system.

localnets

+

@@ -902,11 +919,9 @@ controls 


 controls {
-   [ inet (ip_addr|*) port ip_port allow { address_match_list } ;
-         [ inet...;[...]]]
-   [ unix string permission number owner number group number ;
-         [ unix...;[..]]]
-};
+   [ inet (ip_addr|*) port ip_port allow { address_match_list } 
+         keys { key-list } ;
+   [ inet...;};
@@ -924,44 +939,42 @@ controls The controls statement declares control channels to be used by system administrators to affect the operation of the local nameserver. These control channels are used by the -ndc +rndc utility to send commands to and retrieve non-DNS results from a nameserver.

- + -A UNIX control channel is a "first in first out" (FIFO) named pipe in the file system, and access to it is controlled by normal file system permissions. It is created by -named - with the specified file mode bits (see the -chmod(1) - manual page), user and group owner. Note that, unlike -chmod -, the mode bits specified for -permission - will normally have a leading -0 - so the number is interpreted as octal. Also note that the user and group ownership specified as owner and group must be given as numbers, not names. It is recommended that the permissions be restricted to administrative personnel only to prevent random users on the system from having the ability to manage the local nameserver.

+An inet control channel is a TCP/IP socket accessible to the Internet, +created at the specified ip_port on the specified ip_addr. If no port +is specified, port 953 is used by default. "*" cannot be used for +ip_port.

- + -An -inet - control channel is a TCP/IP socket accessible to the Internet, created at the specified -ip_port - on the specified -ip_addr -. It is recommended that 127.0.0.1 be the only -ip_addr - used, and this only if you trust all non-privileged users on the local host to manage your nameserver.

+The ability to issue commands over the control channel is restricted +by the allow and keys clauses. Connections to the control channel are +permitted based on the address permissions in address_match_list. +key_id members of the address_match_list are ignored, and instead are +interpreted independently based the key_list. Each key_id in the +key_list is allowed to be used to authenticate commands and responses +given over the control channel by digitally signing each message +between the server and a command client (see rndc in Section 3.4.1.2). +All commands to the control channel must be signed by one of its +specified keys to be honored.

- + - -The - -controls - - statement is not yet implemented in BIND 9. The server always listens for control connections on IP address 127.0.0.1, port 953. -

+For the initial release of BIND 9.0.0, only one command is possible +over the command channel, the command to reload the server. We will +expand command set in future releases.

+

+ + +The UNIX control channel type of BIND 8 is not supported in BIND +9.0.0, and is not expected to be added in future releases. If it is +present in the controls statement from a BIND 8 configuration file, a +non-fatal warning will be logged.

+
@@ -1284,7 +1297,6 @@ ndc notrace severity debug 3; }; -

@@ -1442,7 +1454,7 @@ More categories may be added in future BIND releases. +

@@ -1450,7 +1462,7 @@ More categories may be added in future BIND releases. +

@@ -1458,7 +1470,7 @@ The default category defines the logging options for those categories where no s

+

@@ -1466,7 +1478,7 @@ The default category defines the logging options for those categories where no s general

+

@@ -1474,7 +1486,7 @@ The catch-all. Many things still aren't classified into categories, and they all

+

@@ -1482,7 +1494,7 @@ The catch-all. Many things still aren't classified into categories, and they all database

+

@@ -1490,7 +1502,7 @@ Messages relating to the databases used internally by the name server to store z

+

@@ -1498,7 +1510,7 @@ Messages relating to the databases used internally by the name server to store z security

+

@@ -1506,7 +1518,7 @@ Approval and denial of requests.
+

@@ -1514,7 +1526,7 @@ Approval and denial of requests.

config

+

@@ -1522,7 +1534,7 @@ Configuration file parsing and processing.
+

@@ -1530,7 +1542,7 @@ Configuration file parsing and processing.

resolver

+

@@ -1538,7 +1550,7 @@ DNS resolution, such as the recursive lookups performed on behalf of clients by

+

@@ -1546,7 +1558,7 @@ DNS resolution, such as the recursive lookups performed on behalf of clients by xfer-in

+

@@ -1554,7 +1566,7 @@ Zone transfers the server is receiving.
+

@@ -1562,7 +1574,7 @@ Zone transfers the server is receiving.

xfer-out

+

@@ -1570,7 +1582,7 @@ Zone transfers the server is sending.
+

@@ -1578,7 +1590,7 @@ Zone transfers the server is sending.

notify

+

@@ -1586,7 +1598,7 @@ The NOTIFY protocol.
+

@@ -1594,7 +1606,7 @@ The NOTIFY protocol.

client

+

@@ -1602,7 +1614,7 @@ Processing of client requests.
+

@@ -1610,7 +1622,7 @@ Processing of client requests.

network

+

@@ -1618,7 +1630,7 @@ Network operations.
+

@@ -1626,7 +1638,7 @@ Network operations.

update

+

@@ -1675,42 +1687,42 @@ named.conf [ multiple-cnames yes_or_no; ] [ notify yes_or_no; ] [ recursion yes_or_no; ] - [ rfc2308-type1 yes_or_no; ] - [ use-id-pool yes_or_no; ] - [ maintain-ixfr-base yes_or_no; ] - [ forward ( only | first ); ] - [ forwarders { [ in_addr ; [ in_addr ; ... ] ] }; ] - [ check-names ( master | slave | response )( warn | fail | ignore ); ] - [ allow-query { address_match_list }; ] - [ allow-transfer { address_match_list }; ] - [ allow-recursion { address_match_list }; ] - [ blackhole { address_match_list }; ] - [ listen-on [ port ip_port ] { address_match_list }; ] - [ query-source [ address ( ip_addr | * ) ] [ port ( ip_port | * ) ]; ] - [ max-transfer-time-in number; ] - [ max-transfer-time-out number; ] - [ max-transfer-idle-in number; ] - [ max-transfer-idle-out number; ] - [ tcp-clients number; ] - [ recursive-clients number; ] - [ serial-queries number; ] + [ rfc2308-type1 yes_or_no; ] + [ use-id-pool yes_or_no; ] + [ maintain-ixfr-base yes_or_no; ] + [ forward ( only | first ); ] + [ forwarders { [ in_addr ; [ in_addr ; ... ] ] }; ] + [ check-names ( master | slave | response )( warn | fail | ignore ); ] + [ allow-query { address_match_list }; ] + [ allow-transfer { address_match_list }; ] + [ allow-recursion { address_match_list }; ] + [ blackhole { address_match_list }; ] + [ listen-on [ port ip_port ] { address_match_list }; ] + [ query-source [ address ( ip_addr | * ) ] [ port ( ip_port | * ) ]; ] + [ max-transfer-time-in number; ] + [ max-transfer-time-out number; ] + [ max-transfer-idle-in number; ] + [ max-transfer-idle-out number; ] + [ tcp-clients number; ] + [ recursive-clients number; ] + [ serial-queries number; ] [ transfer-format ( one-answer | many-answers ); ] - [ transfers-in number; ] - [ transfers-out number; ] - [ transfers-per-ns number; ] - [ transfer-source ip4_addr; ] - [ transfer-source-v6 ip6_addr; ] - [ also-notify { ip_addr; [ ip_addr; ... ] }; ] - [ max-ixfr-log-size number; ] [ coresize size_spec ; ] [ datasize size_spec ; ] [ files size_spec ; ] [ stacksize size_spec ; ] [ cleaning-interval number; ] [ heartbeat-interval number; ] [ interface-interval number; ] [ statistics-interval number; ] - [ topology { address_match_list }; ] - [ sortlist { address_match_list }; ] - [ rrset-order { order_spec ; [ order_spec ; ... ] ] }; [ lame-ttl number; ] [ max-ncache-ttl number; ] - [ max-cache-ttl number; ] - [ sig-validity-interval number ; ] + [ transfers-in number; ] + [ transfers-out number; ] + [ transfers-per-ns number; ] + [ transfer-source ip4_addr; ] + [ transfer-source-v6 ip6_addr; ] + [ also-notify { ip_addr; [ ip_addr; ... ] }; ] + [ max-ixfr-log-size number; ] [ coresize size_spec ; ] [ datasize size_spec ; ] [ files size_spec ; ] [ stacksize size_spec ; ] [ cleaning-interval number; ] [ heartbeat-interval number; ] [ interface-interval number; ] [ statistics-interval number; ] + [ topology { address_match_list }; ] + [ sortlist { address_match_list }; ] + [ rrset-order { order_spec ; [ order_spec ; ... ] ] }; [ lame-ttl number; ] [ max-ncache-ttl number; ] + [ max-cache-ttl number; ] + [ sig-validity-interval number ; ] [ min-roots number; ] [ use-ixfr yes_or_no ; ] [ treat-cr-as-space yes_or_no ; ] -}; +};

@@ -1732,7 +1744,7 @@ options statement, an options block with each option set to its default will be used.

- - - - - - - - - - - - - - - - - -
+

@@ -1740,7 +1752,7 @@ options version

+

@@ -1752,7 +1764,7 @@ chaos

+

@@ -1760,7 +1772,7 @@ chaos directory

+

@@ -1772,7 +1784,7 @@ named.run

+

@@ -1780,7 +1792,7 @@ named.run named-xfer

+

@@ -1794,7 +1806,7 @@ named-xfer

+

@@ -1802,7 +1814,7 @@ named-xfer tkey-domain

+

@@ -1824,7 +1836,7 @@ domainname

+

@@ -1832,7 +1844,7 @@ domainname tkey-dhkey

+

@@ -1842,7 +1854,7 @@ TKEY

+

@@ -1850,7 +1862,7 @@ TKEY dump-file

+

@@ -1866,7 +1878,7 @@ Not yet implemented in BIND 9.

+

@@ -1874,7 +1886,7 @@ Not yet implemented in BIND 9. memstatistics-file

+

@@ -1886,7 +1898,7 @@ Not yet implemented in BIND 9.

+

@@ -1894,7 +1906,7 @@ Not yet implemented in BIND 9. pid-file

+

@@ -1907,7 +1919,7 @@ The pathname of the file the server writes its process ID in. If not specified,

+

@@ -1915,7 +1927,7 @@ The pathname of the file the server writes its process ID in. If not specified, statistics-file

+

@@ -1937,7 +1949,7 @@ Not yet implemented in BIND 9 Boolean Options - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+

@@ -1945,7 +1957,7 @@ Boolean Options auth-nxdomain

+

@@ -1961,7 +1973,7 @@ yes

+

@@ -1969,7 +1981,7 @@ yes deallocate-on-exit

+

@@ -1977,7 +1989,7 @@ This option was used in BIND 8 to enable checking for memory leaks on exit. BIND

+

@@ -1985,7 +1997,7 @@ This option was used in BIND 8 to enable checking for memory leaks on exit. BIND dialup

+

@@ -2022,7 +2034,7 @@ Not yet implemented in BIND 9.

+

@@ -2030,7 +2042,7 @@ Not yet implemented in BIND 9. fake-iquery

+

@@ -2038,7 +2050,7 @@ In BIND 8, this option was used to enable simulating the obsolete DNS query type

+

@@ -2046,7 +2058,7 @@ In BIND 8, this option was used to enable simulating the obsolete DNS query type fetch-glue

+

@@ -2072,7 +2084,7 @@ Not yet implemented in BIND 9.

+

@@ -2080,7 +2092,7 @@ Not yet implemented in BIND 9. has-old-clients

+

@@ -2101,7 +2113,7 @@ no

+

@@ -2109,7 +2121,7 @@ no host-statistics

+

@@ -2125,7 +2137,7 @@ Not yet implemented in BIND 9.

+

@@ -2133,7 +2145,7 @@ Not yet implemented in BIND 9. maintain-ixfr-base

+

@@ -2147,7 +2159,7 @@ no

+

@@ -2155,7 +2167,7 @@ no multiple-cnames

+

@@ -2163,7 +2175,7 @@ This option was used in BIND 8 to allow a domain name to allow multiple CNAME re

+

@@ -2171,7 +2183,7 @@ This option was used in BIND 8 to allow a domain name to allow multiple CNAME re notify

+

@@ -2191,7 +2203,7 @@ options notify

+

@@ -2199,7 +2211,7 @@ options notify recursion

+

@@ -2213,7 +2225,7 @@ fetch-glue

+

@@ -2221,7 +2233,7 @@ fetch-glue rfc2308-type1

+

@@ -2235,7 +2247,7 @@ Not yet implemented in BIND 9

+

@@ -2243,7 +2255,7 @@ Not yet implemented in BIND 9 use-id-pool

+

@@ -2253,7 +2265,7 @@ This option is obsolete

+

@@ -2261,7 +2273,7 @@ This option is obsolete treat-cr-as-space

+

@@ -2298,7 +2310,7 @@ The forwarding facility can be used to create a large site-wide cache on a few s  

- - - -
+

@@ -2306,7 +2318,7 @@ The forwarding facility can be used to create a large site-wide cache on a few s forward

+

@@ -2318,7 +2330,7 @@ only

+

@@ -2326,7 +2338,7 @@ only forwarders

+

@@ -2366,7 +2378,7 @@ Three checking methods are available:

 

- - - - - -
+

@@ -2374,7 +2386,7 @@ Three checking methods are available:

ignore

+

@@ -2382,7 +2394,7 @@ No checking is done.
+

@@ -2390,7 +2402,7 @@ No checking is done.

warn

+

@@ -2398,7 +2410,7 @@ Names are checked against their expected client contexts. Invalid names are logg

+

@@ -2406,7 +2418,7 @@ Names are checked against their expected client contexts. Invalid names are logg fail

+

@@ -2470,7 +2482,7 @@ Address Match Lists  

- - - - - - - -
+

@@ -2478,7 +2490,7 @@ Address Match Lists allow-query

+

@@ -2492,7 +2504,7 @@ options allow-query

+

@@ -2500,7 +2512,7 @@ options allow-query allow-recursion

+

@@ -2508,7 +2520,7 @@ Specifies which hosts are allowed to make recursive queries through this server.

+

@@ -2516,7 +2528,7 @@ Specifies which hosts are allowed to make recursive queries through this server. allow-transfer

+

@@ -2530,7 +2542,7 @@ options allow-transfer

+

@@ -2538,7 +2550,7 @@ options allow-transfer blackhole

+

@@ -2692,7 +2704,7 @@ BIND has mechanisms in place to facilitate zone transfers and set limits on the  

- - - - - - - - - - - - - - - - - - - - - - - -
+

@@ -2700,7 +2712,7 @@ BIND has mechanisms in place to facilitate zone transfers and set limits on the also-notify

+

@@ -2720,7 +2732,7 @@ also-notify

+

@@ -2728,7 +2740,7 @@ also-notify max-transfer-time-in

+

@@ -2736,7 +2748,7 @@ Inbound zone transfers running longer than this many minutes will be terminated.

+

@@ -2744,7 +2756,7 @@ Inbound zone transfers running longer than this many minutes will be terminated. max-transfer-idle-in

+

@@ -2752,7 +2764,7 @@ Inbound zone transfers making no progress in this many minutes will be terminate

+

@@ -2760,7 +2772,7 @@ Inbound zone transfers making no progress in this many minutes will be terminate max-transfer-time-out

+

@@ -2768,7 +2780,7 @@ Outbound zone transfers running longer than this many minutes will be terminated

+

@@ -2776,19 +2788,15 @@ Outbound zone transfers running longer than this many minutes will be terminated max-transfer-idle-out

+

-Outbound zone transfers making no progress in this many minutes will be terminated. The default is 60 minutes

-

- - -(1 hour).

+Outbound zone transfers making no progress in this many minutes will be terminated. The default is 60 minutes (1 hour).
+

@@ -2796,7 +2804,7 @@ Outbound zone transfers making no progress in this many minutes will be terminat serial-queries

+

@@ -2808,7 +2816,7 @@ Not yet implemented in BIND 9.

+

@@ -2816,7 +2824,7 @@ Not yet implemented in BIND 9. transfer-format

+

@@ -2836,7 +2844,7 @@ server

+

@@ -2844,7 +2852,7 @@ server transfers-in

+

@@ -2856,7 +2864,7 @@ transfers-in

+

@@ -2864,7 +2872,7 @@ transfers-in transfers-out

+

@@ -2874,7 +2882,7 @@ The maximum number of outbound zone transfers that can be running concurrently.

+

@@ -2882,7 +2890,7 @@ The maximum number of outbound zone transfers that can be running concurrently. transfers-per-ns

+

@@ -2900,7 +2908,7 @@ server

+

@@ -2908,7 +2916,7 @@ server transfer-source

+

@@ -2927,7 +2935,7 @@ zone

+

@@ -2935,7 +2943,7 @@ zone transfer-source-v6

+

@@ -2979,7 +2987,7 @@ Configuration File Elements  

- - - - - - - - - - - - - -
+

@@ -2987,7 +2995,7 @@ Configuration File Elements coresize

+

@@ -2999,7 +3007,7 @@ Not yet implemented in BIND 9.

+

@@ -3007,7 +3015,7 @@ Not yet implemented in BIND 9. datasize

+

@@ -3019,7 +3027,7 @@ Not yet implemented in BIND 9.

+

@@ -3027,7 +3035,7 @@ Not yet implemented in BIND 9. files

+

@@ -3049,7 +3057,7 @@ Not yet implemented in BIND 9.

+

@@ -3057,7 +3065,7 @@ Not yet implemented in BIND 9. max-ixfr-log-size

+

@@ -3069,7 +3077,7 @@ Not yet implemented in BIND 9.

+

@@ -3077,7 +3085,7 @@ Not yet implemented in BIND 9. recursive-clients

+

@@ -3087,7 +3095,7 @@ The maximum number of simultaneous recursive lookups the server will perform on

+

@@ -3095,7 +3103,7 @@ The maximum number of simultaneous recursive lookups the server will perform on stacksize

+

@@ -3107,7 +3115,7 @@ Not yet implemented in BIND 9.

+

@@ -3115,7 +3123,7 @@ Not yet implemented in BIND 9. tcp-clients

+

@@ -3126,12 +3134,13 @@ The maximum number of simultaneous client TCP connections that the server will a

-
- +

+ -Resource limits are not yet implemented in BIND 9. -

+ Resource limits are not yet implemented in BIND 9. +

+
@@ -3147,7 +3156,7 @@ Resource limits are not yet implemented in BIND 9.  

- - - - - - - -
+

@@ -3155,7 +3164,7 @@ Resource limits are not yet implemented in BIND 9. cleaning-interval

+

@@ -3169,7 +3178,7 @@ minutes. The default is

+

@@ -3177,7 +3186,7 @@ minutes. The default is heartbeat-interval

+

@@ -3193,7 +3202,7 @@ Not yet implemented in BIND 9.

+

@@ -3201,7 +3210,7 @@ Not yet implemented in BIND 9. interface-interval

+

@@ -3217,7 +3226,7 @@ listen-on

+

@@ -3225,7 +3234,7 @@ listen-on statistics-interval

+

@@ -3450,7 +3459,7 @@ ordering  

- - - - - -
+

@@ -3458,7 +3467,7 @@ ordering fixed

+

@@ -3466,7 +3475,7 @@ Records are returned in the order they are defined in the zone file.
+

@@ -3474,7 +3483,7 @@ Records are returned in the order they are defined in the zone file.

random

+

@@ -3482,7 +3491,7 @@ Records are returned in some random order.
+

@@ -3490,7 +3499,7 @@ Records are returned in some random order.

cyclic

+

@@ -3563,7 +3572,7 @@ Tuning  

- - - - - - - - - -
+

@@ -3571,7 +3580,7 @@ Tuning lame-ttl

+

@@ -3585,7 +3594,7 @@ Not yet implemented in BIND 9.

+

@@ -3593,7 +3602,7 @@ Not yet implemented in BIND 9. max-ncache-ttl

+

@@ -3611,7 +3620,7 @@ max-ncache-ttl

+

@@ -3619,7 +3628,7 @@ max-ncache-ttl max-cache-ttl

+

@@ -3629,7 +3638,7 @@ max-cache-ttl

+

@@ -3637,7 +3646,7 @@ max-cache-ttl min-roots

+

@@ -3649,7 +3658,7 @@ Not yet implemented in BIND 9.

+

@@ -3657,7 +3666,7 @@ Not yet implemented in BIND 9. sig-validity-interval

+

@@ -3702,16 +3711,14 @@ server Statement Grammar - - 


 server ip_addr {

     [ bogus yes_or_no ; ]
     [ provide-ixfr yes_or_no ; ]
     [ request-ixfr yes_or_no ; ]
     [ transfers number ; ]
-    [ transfer-format ( one-answer | many-answers ) ; ]
-        [ keys { string ; [ string ; [...]] } ; ]
+    [ transfer-format ( one-answer | many-answers ) ; ]
+    [ keys { string ; [ string ; [...]] } ; ]
 }; }
@@ -3838,13 +3845,11 @@ trusted-keys 

 trusted-keys {
-    string number number number string ;
-    [ string number number number string ; [...]]
+    string number number number string ;
+    [ string number number number string ; [...]]
 }; }
- -
@@ -3882,7 +3887,7 @@ view 

  view view name {
       match_clients { address_match_list } ; 
-      [view_option; ...]
+      [view_option; ...]
       [zone_statement; ...]]
 };
@@ -4024,7 +4029,7 @@ zone [ allow-query { address_match_list } ; ] [ allow-transfer { address_match_list } ; ] [ allow-update { address_match_list } ; ] - [ update-policy { update_policy_rule[...] } ; ] + [ update-policy { update_policy_rule[...] } ; ] [ allow-update-forwarding { address_match_list } ; ] [ also-notify { [ ip_addr ; [ip_addr ; [...]]] } ; ] [ check-names (warn|fail|ignore) ; ] @@ -4042,11 +4047,11 @@ zone [ max-transfer-time-in number ; ] [ max-transfer-time-out number ; ] [ notify true_or_false ; ] - [ pubkey number number number string ; ] - [ transfer-source (ip4_addr | *) ; ] - [ transfer-source-v6 (ip6_addr | *) ; ] - [ sig-validity-interval number ; ]}] -; + [ pubkey number number number string ; ] + [ transfer-source (ip4_addr | *) ; ] + [ transfer-source-v6 (ip6_addr | *) ; ] + [ sig-validity-interval number ; ] +} ];
@@ -4065,7 +4070,7 @@ zone 6.2.20.1 Zone Types - - - - - - - - - -
+

@@ -4073,7 +4078,7 @@ zone master

+

@@ -4081,7 +4086,7 @@ The server has a master copy of the data for the zone and will be able to provid

+

@@ -4089,7 +4094,7 @@ The server has a master copy of the data for the zone and will be able to provid slave

+

@@ -4104,7 +4109,7 @@ is just the first two letters of the zone name. (Most operating systems behave v

+

@@ -4112,7 +4117,7 @@ is just the first two letters of the zone name. (Most operating systems behave v stub

+

@@ -4124,7 +4129,7 @@ In BIND 4/8, zone transfers of a parent zone included the NS records from s

+

@@ -4132,7 +4137,7 @@ In BIND 4/8, zone transfers of a parent zone included the NS records from s forward

+

@@ -4158,7 +4163,7 @@ Domain-specific forwarding is not yet implemented in BIND 9.

+

@@ -4166,7 +4171,7 @@ Domain-specific forwarding is not yet implemented in BIND 9. hint

+

@@ -4216,7 +4221,7 @@ CHAOS 6.2.20.3 Zone Options - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+

@@ -4224,7 +4229,7 @@ CHAOS allow-query

+

@@ -4236,7 +4241,7 @@ Access Control

+

@@ -4244,7 +4249,7 @@ Access Control allow-transfer

+

@@ -4256,7 +4261,7 @@ Access Control

+

@@ -4264,7 +4269,7 @@ Access Control allow-update

+

@@ -4272,7 +4277,7 @@ Specifies which hosts are allowed to submit Dynamic DNS updates for master zones

+

@@ -4280,7 +4285,7 @@ Specifies which hosts are allowed to submit Dynamic DNS updates for master zones update-policy

+

@@ -4290,7 +4295,7 @@ Dynamic Update Policies

+

@@ -4298,7 +4303,7 @@ Dynamic Update Policies allow-update-forwarding

+

@@ -4308,7 +4313,7 @@ Update forwarding is not yet implemented.

+

@@ -4316,7 +4321,7 @@ Update forwarding is not yet implemented. also-notify

+

@@ -4335,7 +4340,7 @@ also-notify

+

@@ -4343,7 +4348,7 @@ also-notify check-names

+

@@ -4356,7 +4361,7 @@ Not yet implemented in BIND 9.

+

@@ -4364,7 +4369,7 @@ Not yet implemented in BIND 9. dialup

+

@@ -4379,7 +4384,7 @@ Not yet implemented in BIND 9.

+

@@ -4387,7 +4392,7 @@ Not yet implemented in BIND 9. forward

+

@@ -4402,7 +4407,7 @@ Not yet implemented in BIND 9.

+

@@ -4410,7 +4415,7 @@ Not yet implemented in BIND 9. forwarders

+

@@ -4426,7 +4431,7 @@ Not yet implemented in BIND 9.

+

@@ -4434,7 +4439,7 @@ Not yet implemented in BIND 9. ixfr-base

+

@@ -4444,7 +4449,7 @@ jnl

+

@@ -4452,7 +4457,7 @@ jnl max-transfer-time-in

+

@@ -4465,7 +4470,7 @@ Zone Transfers

+

@@ -4473,7 +4478,7 @@ Zone Transfers max-transfer-idle-in

+

@@ -4486,7 +4491,7 @@ Zone Transfers

+

@@ -4494,7 +4499,7 @@ Zone Transfers max-transfer-time-out

+

@@ -4507,7 +4512,7 @@ Zone Transfers

+

@@ -4515,7 +4520,7 @@ Zone Transfers max-transfer-idle-out

+

@@ -4528,7 +4533,7 @@ Zone Transfers

+

@@ -4536,7 +4541,7 @@ Zone Transfers notify

+

@@ -4548,7 +4553,7 @@ Boolean Options

+

@@ -4556,7 +4561,7 @@ Boolean Options pubkey

+

@@ -4564,7 +4569,7 @@ In BIND 8, this option was intended for specifying a public zone key for verific

+

@@ -4572,7 +4577,7 @@ In BIND 8, this option was intended for specifying a public zone key for verific sig-validity-interval

+

@@ -4584,7 +4589,7 @@ Tuning

+

@@ -4592,23 +4597,21 @@ Tuning transfer-source

+

-Determines which local address will be bound to the IPv4 TCP connection used to fetch this zone. If not set, it defaults to a system controlled value which will usually be the address of the interface "closest to" the remote end. This address must appear in the remote end's -allow-transfer - option for this zone if one is specified.

+Determines which local address will be bound to the IPv4 TCP connection used to fetch this zone. If not set, it defaults to a system controlled value which will usually be the address of the interface "closest to" the remote end. If the remote end user is an allow-transfer option for this zone, the address, supplied by the transfer-source option, needs to be specified in that allow-transfer option.
+

transfer-source-v6

 +

@@ -4688,7 +4691,7 @@ self .

- - - - - - - -
+
@@ -4696,7 +4699,7 @@ self name
+

@@ -4704,7 +4707,7 @@ Matches when the updated name is the same as the name in the name field.
+
@@ -4712,7 +4715,7 @@ Matches when the updated name is the same as the name in the name field.

subdomain
+

@@ -4720,7 +4723,7 @@ Matches when the updated name is a subdomain of the name in the name field.
+
@@ -4728,7 +4731,7 @@ Matches when the updated name is a subdomain of the name in the name field.

wildcard
+

@@ -4736,7 +4739,7 @@ Matches when the updated name is a valid expansion of the wildcard name in the n

+
@@ -4744,7 +4747,7 @@ Matches when the updated name is a valid expansion of the wildcard name in the n self
+

@@ -4800,13 +4803,13 @@ RRset Ordering The components of a Resource Record are

- - - - - - - - - -
+

owner name

 +

@@ -4814,13 +4817,13 @@ the domain name where the RR is found.
+

type

 +

@@ -4828,13 +4831,13 @@ an encoded 16 bit value that specifies the type of the resource in this resource

+

TTL

 +

@@ -4842,13 +4845,13 @@ the time to live of the RR. This field is a 32 bit integer in units of seconds,

+

class

 +

@@ -4856,13 +4859,13 @@ an encoded 16 bit value that identifies a protocol family or instance of a proto

+

RDATA

 +

@@ -4878,13 +4881,13 @@ types of valid RRs (some of these listed, although not obsolete, are experimental (x) or historical (h) and no longer in general use):

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+

A

 +

@@ -4892,13 +4895,13 @@ a host address.
+

A6

 +

@@ -4906,13 +4909,13 @@ an IPv6 address.
+

AAAA

 +

@@ -4920,13 +4923,13 @@ Obsolete format of IPv6 address
+

AFSDB

 +

@@ -4934,13 +4937,13 @@ AFSDB
+

CNAME

 +

@@ -4948,13 +4951,13 @@ identifies the canonical name of an alias.
+

DNAME

 +

@@ -4962,13 +4965,13 @@ for delegation of reverse addresses. Replaces the domain name specified with ano

+

HINFO

 +

@@ -4976,13 +4979,13 @@ identifies the CPU and OS used by a host.
+

ISDN

 +

@@ -4990,13 +4993,13 @@ ISDN
+

KEY

 +

@@ -5004,13 +5007,13 @@ stores a public key associated with a DNS name.
+

LOC

 +

@@ -5018,13 +5021,13 @@ LOC
+

MX

 +

@@ -5032,13 +5035,13 @@ identifies a mail exchange for the domain. See RFC 974 for details.
+

NS

 +

@@ -5046,13 +5049,13 @@ the authoritative nameserver for the domain.
+

NXT

 +

@@ -5060,13 +5063,13 @@ used in DNSSEC to securely indicate that RRs with an owner name in a certain nam

+

PTR

 +

@@ -5074,13 +5077,13 @@ a pointer to another part of the domain name space.
+

RP

 +

@@ -5088,13 +5091,13 @@ RP
+

RT

 +

@@ -5102,13 +5105,13 @@ RT
+

SIG

 +

@@ -5116,13 +5119,13 @@ SIG
+

SOA

 +

@@ -5130,13 +5133,13 @@ identifies the start of a zone of authority.
+

SRV

 +

@@ -5144,13 +5147,13 @@ information about well known network services (replaces WKS).
+

WKS

 +

@@ -5158,13 +5161,13 @@ WKS
+

X25

 +

@@ -5180,13 +5183,13 @@ classes of resource records are currently valid in the DNS:

- -
+

IN

 +

@@ -5212,13 +5215,13 @@ RDATA is the type-dependent or class-dependent data that describes the resource:

- - - - - - - - - - - - - - - -
+

A

 +

@@ -5226,13 +5229,13 @@ for the IN class, a 32 bit IP address.
+

A6

 +

@@ -5240,13 +5243,13 @@ maps a domain name to an IPv6 address, with a provision for indirection for lead

+

CNAME

 +

@@ -5254,13 +5257,13 @@ a domain name.
+

DNAME

 +

@@ -5268,13 +5271,13 @@ provides alternate naming to an entire subtree of the domain name space, rather

+

MX

 +

@@ -5282,13 +5285,13 @@ a 16 bit preference value (lower is better) followed by a host name willing to a

+

NS

 +

@@ -5296,13 +5299,13 @@ a fully qualified domain name.
+

PTR

 +

@@ -5310,13 +5313,13 @@ a fully qualified domain name.
+

SOA

 +

@@ -5366,7 +5369,7 @@ The resource data or RDATA section of the RR are given using knowledge of the ty For example, we might show the RRs carried in a message as:

- - - - - - - - - - - - - - - - - -
+

@@ -5374,7 +5377,7 @@ For example, we might show the RRs carried in a message as:

ISI.EDU.

+

@@ -5382,7 +5385,7 @@ ISI.EDU. MX

+

@@ -5392,7 +5395,7 @@ MX

+

@@ -5400,7 +5403,7 @@ MX  

 +

@@ -5408,7 +5411,7 @@ MX MX

+

@@ -5418,7 +5421,7 @@ MX

+

@@ -5426,7 +5429,7 @@ MX VENERA.ISI.EDU

+

@@ -5434,7 +5437,7 @@ VENERA.ISI.EDU A

+

@@ -5444,7 +5447,7 @@ A

+

@@ -5452,7 +5455,7 @@ A  

 +

@@ -5460,7 +5463,7 @@ A A

+

@@ -5470,7 +5473,7 @@ A

+

@@ -5478,7 +5481,7 @@ A VAXA.ISI.EDU

+

@@ -5486,7 +5489,7 @@ VAXA.ISI.EDU A

+

@@ -5496,7 +5499,7 @@ A

+

@@ -5504,7 +5507,7 @@ A  

 +

@@ -5512,7 +5515,7 @@ A A

+

@@ -5536,7 +5539,7 @@ This example shows six RRs, with two RRs at each of three domain names.

Similarly we might see:

- - - - - -
+

@@ -5544,7 +5547,7 @@ Similarly we might see:

XX.LCS.MIT.EDU. IN

+

@@ -5552,7 +5555,7 @@ XX.LCS.MIT.EDU. IN A

+

@@ -5562,7 +5565,7 @@ A

+

@@ -5570,7 +5573,7 @@ A CH

+

@@ -5578,7 +5581,7 @@ CH A

+

@@ -5623,7 +5626,7 @@ For a given domain, if there is both a CNAME record and an MX record, the MX rec For example:

- - - - - - - - - - - - - - - - - - - - - - - - -
+

@@ -5631,7 +5634,7 @@ For example:

example.com.

+

@@ -5639,7 +5642,7 @@ example.com. IN

+

@@ -5647,7 +5650,7 @@ IN MX

+

@@ -5655,7 +5658,7 @@ MX 10

+

@@ -5665,7 +5668,7 @@ mail.example.com.

+

@@ -5673,7 +5676,7 @@ mail.example.com.  

 +

@@ -5681,7 +5684,7 @@ mail.example.com. IN

+

@@ -5689,7 +5692,7 @@ IN MX

+

@@ -5697,7 +5700,7 @@ MX 10

+

@@ -5707,7 +5710,7 @@ mail2.example.com.

+

@@ -5715,7 +5718,7 @@ mail2.example.com.  

 +

@@ -5723,7 +5726,7 @@ mail2.example.com. IN

+

@@ -5731,7 +5734,7 @@ IN MX

+

@@ -5739,7 +5742,7 @@ MX 20

+

@@ -5749,7 +5752,7 @@ mail.backup.org.

+

@@ -5757,7 +5760,7 @@ mail.backup.org. mail.example.com.

+

@@ -5765,7 +5768,7 @@ mail.example.com. IN

+

@@ -5773,7 +5776,7 @@ IN A

+

@@ -5781,7 +5784,7 @@ A 10.0.0.1

+

@@ -5791,7 +5794,7 @@ A

+

@@ -5799,7 +5802,7 @@ A mail2.example.com.

+

@@ -5807,7 +5810,7 @@ mail2.example.com. IN

+

@@ -5815,7 +5818,7 @@ IN A

+

@@ -5823,7 +5826,7 @@ A 10.0.0.2

+

@@ -5863,13 +5866,13 @@ The time to live of the RR field is a 32 bit integer represented in units of sec  

- - - - - -
+

SOA

 +

@@ -5881,13 +5884,13 @@ The maximum time for negative caching is 3 hours (3h).
+

$TTL

 +

@@ -5895,13 +5898,13 @@ The $TTL directive at the top of the zone file (before the SOA) gives a default

+

RR TTLs

 +

@@ -6207,7 +6210,7 @@ is equivalent to

 

- - - - - - - -
+

@@ -6215,7 +6218,7 @@ is equivalent to

range

+

@@ -6223,7 +6226,7 @@ This can be one of two forms: start-stop or start-stop/step. If the first form i

+

@@ -6231,7 +6234,7 @@ This can be one of two forms: start-stop or start-stop/step. If the first form i lhs

+

@@ -6253,7 +6256,7 @@ is appended to the name.
+

@@ -6261,7 +6264,7 @@ is appended to the name.

type

+

@@ -6269,7 +6272,7 @@ At present the only supported types are PTR, CNAME and NS.
+

@@ -6277,7 +6280,7 @@ At present the only supported types are PTR, CNAME and NS.

rhs

+

@@ -6294,92 +6297,6 @@ $GENERATE It is not yet implemented in BIND 9.

-
- -

- - -6.3.7 Signals

- -

- - -Certain UNIX signals cause the name server to take specific actions, as described in the following table. These signals can be sent using the -kill - command.

-

- - - 

- - - - - - - - - - - - - - - - - -
-

- - - -SIGHUP -

-		 -

- - -Causes the server to read -named.conf - and reload the database.

-
-

- - - -SIGTERM -

-		 -

- - -Causes the server to clean up and exit.

-
-

- - - -SIGINT -

-		 -

- - -Causes the server to clean up and exit.

-
-

- - - -SIGQUIT -

-		 -

- - -Causes the server to clean up and exit.

-
-

Return to BIND 9 Administrator Reference Manual table of contents.

diff --git a/doc/arm/Bv9ARM.7.html b/doc/arm/Bv9ARM.7.html index 84f34c0c07..c8fc9f2e32 100644 --- a/doc/arm/Bv9ARM.7.html +++ b/doc/arm/Bv9ARM.7.html @@ -16,8 +16,9 @@ - SOFTWARE. --> - + + diff --git a/doc/arm/Bv9ARM.8.html b/doc/arm/Bv9ARM.8.html index 8f29c488c9..3752bed20f 100644 --- a/doc/arm/Bv9ARM.8.html +++ b/doc/arm/Bv9ARM.8.html @@ -16,8 +16,9 @@ - SOFTWARE. --> - + + @@ -84,14 +85,13 @@ The Internet Software Consortium (ISC) offers a wide range of support and servic

-To discuss arrangements for support, contact -info@isc.org +To discuss arrangements for support, contact +info@isc.org or visit the ISC web page at
- -http://www.isc.org/services/support/ - to read more.

+ +http://www.isc.org/services/support/ to read more.

diff --git a/doc/arm/Bv9ARM.9.html b/doc/arm/Bv9ARM.9.html index 2a63b8eee3..3c58c66851 100644 --- a/doc/arm/Bv9ARM.9.html +++ b/doc/arm/Bv9ARM.9.html @@ -16,8 +16,9 @@ - SOFTWARE. --> - + + @@ -25,15 +26,20 @@ Appendices
-
- - -Appendices
+

+ + +

+Appendices +

+

+
-
+

-Historical DNS Information

+Appendix B. Historical DNS Information
-
+

-General DNS Reference Information

+Appendix C. General DNS Reference Information
@@ -137,37 +143,37 @@ The aggregatable global Unicast address format is as follows:

 

- - - - - - - - - - - - - - - - - - - - - - - - - -
+

3

 +

13

 +

8

 +

24

 +

16

 +

@@ -175,37 +181,37 @@ The aggregatable global Unicast address format is as follows:
+

FP

 +

TLA ID

 +

RES

 +

NLA ID

 +

SLA ID

 +

@@ -219,13 +225,13 @@ Interface ID

<------ Public Topology ------>

 +

 

 +

@@ -233,37 +239,37 @@ Interface ID
+

 

 +

 

 +

 

 +

 

 +

<-Site Topology->

 +

@@ -271,37 +277,37 @@ Interface ID
+

 

 +

 

 +

 

 +

 

 +

 

 +

@@ -315,19 +321,19 @@ Interface ID

Where

- - - - - - - - - - - - - - - - - -
+

FP

 +

=

 +

@@ -335,19 +341,19 @@ Format Prefix (001)
+

TLA ID

 +

=

 +

@@ -355,19 +361,19 @@ Top-Level Aggregation Identifier
+

RES

 +

=

 +

@@ -375,19 +381,19 @@ Reserved for future use
+

NLA ID

 +

=

 +

@@ -395,19 +401,19 @@ Next-Level Aggregation Identifier
+

SLA ID

 +

=

 +

@@ -415,19 +421,19 @@ Site-Level Aggregation Identifier
+

INTERFACE ID

 +

=

 +

@@ -444,7 +450,7 @@ Public Topology network section of the address range. The Site Topology - is where you can subnet this space, much the same as subnetting an IPv4 class A or B network into class Cs. The + is where you can subnet this space, much the same as subnetting an IPv4 /16 network into /24 subnets. The Interface Identifier is the address of an individual interface on a given network. (With IPv6, addresses belong to interfaces rather than machines.)

@@ -461,25 +467,25 @@ The internal structure of the Public Topology for an A6 global unicast address c  

- - - - - - - - diff --git a/doc/arm/Bv9ARM.txt b/doc/arm/Bv9ARM.txt index dfb62a15e7..e99004b0fa 100644 --- a/doc/arm/Bv9ARM.txt +++ b/doc/arm/Bv9ARM.txt @@ -2587,7 +2587,7 @@ description of size_spec in Configuration File Elements for more details. recursive-clients The maximum number of simultaneous recursive lookups the server will perform on behalf of clients. The default is - 100. + 1000. stacksize The maximum amount of stack memory the server may use. The default is default. Not yet implemented in BIND 9. From 6f12e3ca45c560f2f7c8eaa037e84eeab82f9475 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Mon, 24 Jul 2000 20:10:26 +0000 Subject: [PATCH 167/226] Restored the "done" variable removed in 1.150 and made the result code check after the loop deal with ISC_R_SUCCESS instead. The previous fix had the side effect of keeping multiple answers to non-ANY queries, causing assertion failures in cache_name() which is not prepared to deal with this situation --- lib/dns/resolver.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 9bb3380b9a..edff8c49b1 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: resolver.c,v 1.150 2000/07/19 23:19:05 gson Exp $ */ +/* $Id: resolver.c,v 1.151 2000/07/24 20:10:26 gson Exp $ */ #include @@ -3286,7 +3286,7 @@ answer_response(fetchctx_t *fctx) { qname = &fctx->name; type = fctx->type; result = dns_message_firstname(message, DNS_SECTION_ANSWER); - while (result == ISC_R_SUCCESS) { + while (!done && result == ISC_R_SUCCESS) { name = NULL; dns_message_currentname(message, DNS_SECTION_ANSWER, &name); external = ISC_TF(!dns_name_issubdomain(name, &fctx->domain)); @@ -3297,12 +3297,20 @@ answer_response(fetchctx_t *fctx) { found = ISC_FALSE; want_chaining = ISC_FALSE; aflag = 0; - if (rdataset->type == type || - type == dns_rdatatype_any) { + if (rdataset->type == type) { /* * We've found an ordinary answer. */ found = ISC_TRUE; + done = ISC_TRUE; + aflag = DNS_RDATASETATTR_ANSWER; + } else if (type == dns_rdatatype_any) { + /* + * We've found an answer matching + * an ANY query. There may be + * more. + */ + found = ISC_TRUE; aflag = DNS_RDATASETATTR_ANSWER; } else if (rdataset->type == dns_rdatatype_sig && rdataset->covers == type) { @@ -3497,7 +3505,9 @@ answer_response(fetchctx_t *fctx) { } result = dns_message_nextname(message, DNS_SECTION_ANSWER); } - if (result != ISC_R_NOMORE) + if (result == ISC_R_NOMORE) + result = ISC_R_SUCCESS; + if (result != ISC_R_SUCCESS) return (result); /* @@ -3584,10 +3594,10 @@ answer_response(fetchctx_t *fctx) { } result = dns_message_nextname(message, DNS_SECTION_AUTHORITY); } - if (result != ISC_R_NOMORE) - return (result); + if (result == ISC_R_NOMORE) + result = ISC_R_SUCCESS; - return (ISC_R_SUCCESS); + return (result); } static void From 1933e4c41f767e893b05a93ad86b0c31653f8142 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Mon, 24 Jul 2000 20:46:55 +0000 Subject: [PATCH 168/226] Allow users to place a .digrc file in the current directory which will specify defaults. --- bin/dig/dig.c | 64 ++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 48 insertions(+), 16 deletions(-) diff --git a/bin/dig/dig.c b/bin/dig/dig.c index d2baccf383..87c1288bc2 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.c,v 1.75 2000/07/24 18:07:01 mws Exp $ */ +/* $Id: dig.c,v 1.76 2000/07/24 20:46:55 mws Exp $ */ #include #include @@ -566,7 +566,8 @@ reorder_args(int argc, char *argv[]) { * that routine. */ static void -parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { +parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, + int argc, char **argv) { isc_boolean_t have_host = ISC_FALSE; isc_result_t result; isc_textregion_t tr; @@ -599,6 +600,33 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { if (!is_batchfile) { debug("making new lookup"); default_lookup = make_empty_lookup(); + + /* + * Treat .digrc as a special batchfile + * XXXMWS should check $HOME in some portable way + */ + batchfp = fopen(".digrc", "r"); + if (batchfp != NULL) { + while (fgets(batchline, sizeof(batchline), + batchfp) != 0) { + debug("config line %s", batchline); + bargc = 1; + bargv[bargc] = strtok(batchline, " \t\r\n"); + while ((bargv[bargc] != NULL) && + (bargc < 14)) { + bargc++; + bargv[bargc] = strtok(NULL, " \t\r\n"); + } + + bargv[0] = argv[0]; + argv0 = argv[0]; + + reorder_args(bargc, (char **)bargv); + parse_args(ISC_TRUE, ISC_TRUE, bargc, + (char **)bargv); + } + fclose(batchfp); + } } lookup = default_lookup; @@ -901,7 +929,8 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { isc_mem_debugging = 1; } else if (strcmp(rv[0], "-debug") == 0) { debugging = ISC_TRUE; - } else if (strncmp(rv[0], "-x", 2) == 0) { + } else if ((strncmp(rv[0], "-x", 2) == 0) && + !config_only) { /* * XXXMWS Only works for ipv4 now. * Can't use inet_pton here, since we allow @@ -957,14 +986,16 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { lookup->rdclass = rdclass; continue; } - lookup=clone_lookup(default_lookup, ISC_TRUE); - strncpy(lookup->textname, rv[0], MXNAME-1); - lookup->trace_root = ISC_TF(lookup->trace || - lookup->ns_search_only); - lookup->new_search = ISC_TRUE; - ISC_LIST_APPEND(lookup_list, lookup, link); - have_host = ISC_TRUE; - debug("looking up %s", lookup->textname); + if (!config_only) { + lookup=clone_lookup(default_lookup, ISC_TRUE); + strncpy(lookup->textname, rv[0], MXNAME-1); + lookup->trace_root = ISC_TF(lookup->trace || + lookup->ns_search_only); + lookup->new_search = ISC_TRUE; + ISC_LIST_APPEND(lookup_list, lookup, link); + have_host = ISC_TRUE; + debug("looking up %s", lookup->textname); + } } } /* @@ -993,10 +1024,10 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { argv0 = argv[0]; reorder_args(bargc, (char **)bargv); - parse_args(ISC_TRUE, bargc, (char **)bargv); + parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv); } } - if (lookup_list.head == NULL) { + if ((lookup_list.head == NULL) && !config_only) { lookup=clone_lookup(default_lookup, ISC_TRUE); lookup->trace_root = ISC_TF(lookup->trace || lookup->ns_search_only); @@ -1005,7 +1036,8 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { lookup->rdtype = dns_rdatatype_ns; ISC_LIST_APPEND(lookup_list, lookup, link); } - printgreeting(argc, argv); + if (!config_only) + printgreeting(argc, argv); } /* @@ -1044,7 +1076,7 @@ dighost_shutdown(void) { bargv[0] = argv0; reorder_args(bargc, (char **)bargv); - parse_args(ISC_TRUE, bargc, (char **)bargv); + parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv); start_lookup(); } else { batchname = NULL; @@ -1068,7 +1100,7 @@ main(int argc, char **argv) { result = isc_app_start(); check_result(result, "isc_app_start"); setup_libs(); - parse_args(ISC_FALSE, argc, argv); + parse_args(ISC_FALSE, ISC_FALSE, argc, argv); setup_system(); result = isc_app_onrun(mctx, global_task, onrun_callback, NULL); check_result(result, "isc_app_onrun"); From 36007b707f28f36864e8d76f11379b22e9737538 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Mon, 24 Jul 2000 20:50:44 +0000 Subject: [PATCH 169/226] 346. [func] Add support for .digrc config file, in the user's current directory --- CHANGES | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGES b/CHANGES index 9513b9e2ed..2dfa2e4af3 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,6 @@ + 346. [func] Add support for .digrc config file, in the + user's current directory + 345. [bug] Large-scale changes/cleanups to dig: * Significantly improve structure handling * Don't pre-load entire batch files From a7c6c06fadd696512ff02f8ed29d9eb0c937824b Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Mon, 24 Jul 2000 22:05:16 +0000 Subject: [PATCH 170/226] removed 5-second sleep and unnecessary semicolon --- bin/tests/system/xfer/tests.sh | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/bin/tests/system/xfer/tests.sh b/bin/tests/system/xfer/tests.sh index 88c23c51c9..0510707a90 100644 --- a/bin/tests/system/xfer/tests.sh +++ b/bin/tests/system/xfer/tests.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: tests.sh,v 1.18 2000/07/07 18:25:18 bwelling Exp $ +# $Id: tests.sh,v 1.19 2000/07/24 22:05:16 gson Exp $ SYSTEMTESTTOP=.. . $SYSTEMTESTTOP/conf.sh @@ -24,9 +24,7 @@ SYSTEMTESTTOP=.. # Perform tests # -sleep 5 - -status=0; +status=0 $DIG +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example. \ @10.53.0.2 axfr -p 5300 > dig.out.ns2 || status=1 grep ";" dig.out.ns2 From c5272fb3303425f794dab68f734f6a2a45dce01e Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Mon, 24 Jul 2000 22:53:40 +0000 Subject: [PATCH 171/226] Merge update_test.pl into system test scripts --- bin/tests/system/nsupdate/clean.sh | 5 +- bin/tests/system/nsupdate/ns1/.cvsignore | 1 + bin/tests/system/nsupdate/ns1/named.conf | 9 +- bin/tests/system/nsupdate/ns1/update.orig | 28 ++ bin/tests/system/nsupdate/ns2/.cvsignore | 1 + bin/tests/system/nsupdate/ns2/named.conf | 9 +- bin/tests/system/nsupdate/setup.sh | 3 +- bin/tests/system/nsupdate/tests.sh | 14 +- bin/tests/system/nsupdate/update_test.pl | 398 ++++++++++++++++++++++ 9 files changed, 458 insertions(+), 10 deletions(-) create mode 100644 bin/tests/system/nsupdate/ns1/update.orig create mode 100644 bin/tests/system/nsupdate/update_test.pl diff --git a/bin/tests/system/nsupdate/clean.sh b/bin/tests/system/nsupdate/clean.sh index 3842562620..430e7c8a01 100644 --- a/bin/tests/system/nsupdate/clean.sh +++ b/bin/tests/system/nsupdate/clean.sh @@ -15,13 +15,14 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: clean.sh,v 1.1 2000/07/06 00:54:02 mws Exp $ +# $Id: clean.sh,v 1.2 2000/07/24 22:53:33 mws Exp $ # # Clean up after zone transfer tests. # -rm -f dig.out.ns1 dig.out.ns2 ns1/*.jnl ns2/*.jnl +rm -f dig.out.ns1 dig.out.ns2 ns1/*.jnl ns2/*.jnl ns1/*.db + diff --git a/bin/tests/system/nsupdate/ns1/.cvsignore b/bin/tests/system/nsupdate/ns1/.cvsignore index cbb42ee873..105706c29d 100644 --- a/bin/tests/system/nsupdate/ns1/.cvsignore +++ b/bin/tests/system/nsupdate/ns1/.cvsignore @@ -1,2 +1,3 @@ example.db named.run +update.db diff --git a/bin/tests/system/nsupdate/ns1/named.conf b/bin/tests/system/nsupdate/ns1/named.conf index a2e9eb15ce..a27abdadcd 100644 --- a/bin/tests/system/nsupdate/ns1/named.conf +++ b/bin/tests/system/nsupdate/ns1/named.conf @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: named.conf,v 1.1 2000/07/06 00:54:03 mws Exp $ */ +/* $Id: named.conf,v 1.2 2000/07/24 22:53:38 mws Exp $ */ options { query-source address 10.53.0.1; @@ -33,3 +33,10 @@ zone "example.nil" { allow-update { any; }; allow-transfer { any; }; }; + +zone "update.nil" { + type master; + file "update.db"; + allow-update { any; }; + allow-transfer { any; }; +}; diff --git a/bin/tests/system/nsupdate/ns1/update.orig b/bin/tests/system/nsupdate/ns1/update.orig new file mode 100644 index 0000000000..9ffd3cf84b --- /dev/null +++ b/bin/tests/system/nsupdate/ns1/update.orig @@ -0,0 +1,28 @@ +; Copyright (C) 2000 Internet Software Consortium. +; +; Permission to use, copy, modify, and distribute this software for any +; purpose with or without fee is hereby granted, provided that the above +; copyright notice and this permission notice appear in all copies. +; +; THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS +; ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES +; OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE +; CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL +; DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR +; PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS +; ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS +; SOFTWARE. + +; $Id: update.orig,v 1.1 2000/07/24 22:53:39 mws Exp $ + +$ORIGIN . +$TTL 300 ; 5 minutes +update.nil IN SOA ns1.example.nil. hostmaster.example.nil. ( + 1 ; serial + 2000 ; refresh (2000 seconds) + 2000 ; retry (2000 seconds) + 1814400 ; expire (3 weeks) + 3600 ; minimum (1 hour) + ) +update.nil. NS ns1.update.nil. +ns1.update.nil. A 10.53.0.2 diff --git a/bin/tests/system/nsupdate/ns2/.cvsignore b/bin/tests/system/nsupdate/ns2/.cvsignore index 68f882cc9a..70d94600a8 100644 --- a/bin/tests/system/nsupdate/ns2/.cvsignore +++ b/bin/tests/system/nsupdate/ns2/.cvsignore @@ -1,2 +1,3 @@ example.bk named.run +update.bk diff --git a/bin/tests/system/nsupdate/ns2/named.conf b/bin/tests/system/nsupdate/ns2/named.conf index 26aa1c647a..83523e3ff6 100644 --- a/bin/tests/system/nsupdate/ns2/named.conf +++ b/bin/tests/system/nsupdate/ns2/named.conf @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: named.conf,v 1.1 2000/07/06 00:54:03 mws Exp $ */ +/* $Id: named.conf,v 1.2 2000/07/24 22:53:40 mws Exp $ */ options { query-source address 10.53.0.2; @@ -35,4 +35,11 @@ zone "example.nil" { allow-transfer { any; }; }; +zone "update.nil" { + type slave; + masters { 10.53.0.1; }; + file "update.bk"; + allow-transfer { any; }; +}; + diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh index 1de5ce2fca..56db749c60 100644 --- a/bin/tests/system/nsupdate/setup.sh +++ b/bin/tests/system/nsupdate/setup.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: setup.sh,v 1.1 2000/07/06 00:54:02 mws Exp $ +# $Id: setup.sh,v 1.2 2000/07/24 22:53:34 mws Exp $ # # jnl and database files MUST be removed before we start @@ -23,5 +23,6 @@ rm -f ns1/*.jnl ns1/example.db ns2/*.jnl ns2/example.bk cp ns1/example.orig ns1/example.db +cp ns1/update.orig ns1/update.db diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh index c971cde2fc..e9a2b0870b 100644 --- a/bin/tests/system/nsupdate/tests.sh +++ b/bin/tests/system/nsupdate/tests.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: tests.sh,v 1.4 2000/07/09 16:27:30 tale Exp $ +# $Id: tests.sh,v 1.5 2000/07/24 22:53:35 mws Exp $ # # Perform tests @@ -29,12 +29,10 @@ status=0 echo "I:fetching first copy of zone before update" $DIG +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\ @10.53.0.1 axfr -p 5300 > dig.out.ns1 || status=1 -grep ";" dig.out.ns1 # XXXDCL Why is this here? echo "I:fetching second copy of zone before update" $DIG +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\ @10.53.0.1 axfr -p 5300 > dig.out.ns2 || status=1 -grep ";" dig.out.ns2 # XXXDCL Why is this here? echo "I:comparing pre-update copies to known good data" $PERL ../digcomp.pl knowngood.ns1.before dig.out.ns1 || status=1 @@ -49,16 +47,22 @@ sleep 15 echo "I:fetching first copy of zone after update" $DIG +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\ @10.53.0.1 axfr -p 5300 > dig.out.ns1 || status=1 -grep ";" dig.out.ns1 # XXXDCL Why is this here? echo "I:fetching second copy of zone after update" $DIG +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\ @10.53.0.1 axfr -p 5300 > dig.out.ns2 || status=1 -grep ";" dig.out.ns2 # XXXDCL Why is this here? echo "I:comparing post-update copies to known good data" $PERL ../digcomp.pl knowngood.ns1.after dig.out.ns1 || status=1 $PERL ../digcomp.pl knowngood.ns1.after dig.out.ns2 || status=1 +if $PERL -e 'use Net::DNS;' 2>/dev/null +then + echo "I:running update.pl test" + $PERL update_test.pl -s 10.53.0.1 -p 5300 update.nil. || status=1 +else + echo "I:The second part of this test requires the Net::DNS library." >&2 +fi + echo "I:exit status: $status" exit $status diff --git a/bin/tests/system/nsupdate/update_test.pl b/bin/tests/system/nsupdate/update_test.pl new file mode 100644 index 0000000000..8f25990d33 --- /dev/null +++ b/bin/tests/system/nsupdate/update_test.pl @@ -0,0 +1,398 @@ +#!/usr/bin/perl +# +# Copyright (C) 1999, 2000 Internet Software Consortium. +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS +# ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES +# OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE +# CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL +# DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR +# PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS +# ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS +# SOFTWARE. + +# +# Dynamic update test suite. +# +# Usage: +# +# perl update_test.pl [-s server] [-p port] zone +# +# The server defaults to 127.0.0.1. +# The port defaults to 53. +# +# The "Special NS rules" tests will only work correctly if the +# has no NS records to begin with, or alternatively has a +# single NS record pointing at the name "ns1" (relative to +# the zone name). +# +# Installation notes: +# +# This program uses the Net::DNS::Resolver module. +# You can install it by saying +# +# perl -MCPAN -e "install Net::DNS" +# +# $Id: update_test.pl,v 1.1 2000/07/24 22:53:36 mws Exp $ +# + +use Getopt::Std; +use Net::DNS; +use Net::DNS::Update; +use Net::DNS::Resolver; + +$opt_s = "127.0.0.1"; +$opt_p = 53; + +getopt('s:p:'); + +$res = new Net::DNS::Resolver; +$res->nameservers($opt_s); +$res->port($opt_p); +$res->defnames(0); # Do not append default domain. + +@ARGV == 1 or die + "usage: perl update_test.pl [-s server] [-p port] zone\n"; + +$zone = shift @ARGV; + +my $failures = 0; + +sub assert { + my ($cond, $explanation) = @_; + if (!$cond) { + print "I:Test Failed: $explanation ***\n"; + $failures++ + } +} + +sub test { + my ($expected, @records) = @_; + + my $update = new Net::DNS::Update("$zone"); + + foreach $rec (@records) { + $update->push(@$rec); + } + + $reply = $res->send($update); + + # Did it work? + if (defined $reply) { + my $rcode = $reply->header->rcode; + assert($rcode eq $expected, "expected $expected, got $rcode"); + } else { + print "I:Update failed: ", $res->errorstring, "\n"; + } +} + +sub section { + my ($msg) = @_; + print "I:$msg\n"; +} + +section("Delete any leftovers from previous tests"); +test("NOERROR", ["update", rr_del("a.$zone")]); +test("NOERROR", ["update", rr_del("b.$zone")]); +test("NOERROR", ["update", rr_del("c.$zone")]); +test("NOERROR", ["update", rr_del("d.$zone")]); +test("NOERROR", ["update", rr_del("e.$zone")]); +test("NOERROR", ["update", rr_del("f.$zone")]); +test("NOERROR", ["update", rr_del("ns.s.$zone")]); +test("NOERROR", ["update", rr_del("s.$zone")]); +test("NOERROR", ["update", rr_del("t.$zone")]); +test("NOERROR", ["update", rr_del("*.$zone")]); +test("NOERROR", ["update", rr_del("u.$zone")]); +test("NOERROR", ["update", rr_del("a.u.$zone")]); +test("NOERROR", ["update", rr_del("b.u.$zone")]); + +section("Simple prerequisites in the absence of data"); +# Name is in Use +test("NXDOMAIN", ["pre", yxdomain("a.$zone")]); +# RRset exists (value independent) +test("NXRRSET", ["pre", yxrrset("a.$zone A")]); +# Name is not in use +test("NOERROR", ["pre", nxdomain("a.$zone")]); +# RRset does not exist +test("NOERROR", ["pre", nxrrset("a.$zone A")]); +# RRset exists (value dependent) +test("NXRRSET", ["pre", yxrrset("a.$zone 300 A 73.80.65.49")]); + + +section ("Simple creation of data"); +test("NOERROR", ["update", rr_add("a.$zone 300 A 73.80.65.49")]); + +section ("Simple prerequisites in the presence of data"); +# Name is in use +test("NOERROR", ["pre", yxdomain("a.$zone")]); +# RRset exists (value independent) +test("NOERROR", ["pre", yxrrset("a.$zone A")]); +# Name is not in use +test("YXDOMAIN", ["pre", nxdomain("a.$zone")]); +# RRset does not exist +test("YXRRSET", ["pre", nxrrset("a.$zone A")]); +# RRset exists (value dependent) +test("NOERROR", ["pre", yxrrset("a.$zone 300 A 73.80.65.49")]); + +# +# Merging of RRsets +# +test("NOERROR", ["update", rr_add("a.$zone 300 A 73.80.65.50")]); + +section("Detailed tests of \"RRset exists (value dependent)\" prerequisites"); +test("NOERROR", ["pre", + yxrrset("a.$zone 300 A 73.80.65.49"), + yxrrset("a.$zone 300 A 73.80.65.50")]); +test("NOERROR", ["pre", + yxrrset("a.$zone 300 A 73.80.65.50"), + yxrrset("a.$zone 300 A 73.80.65.49")]); +test("NXRRSET", ["pre", yxrrset("a.$zone 300 A 73.80.65.49")]); +test("NXRRSET", ["pre", yxrrset("a.$zone 300 A 73.80.65.50")]); +test("NXRRSET", ["pre", + yxrrset("a.$zone 300 A 73.80.65.49"), + yxrrset("a.$zone 300 A 73.80.65.50"), + yxrrset("a.$zone 300 A 73.80.65.51")]); + + +section("Torture test of \"RRset exists (value dependent)\" prerequisites."); + +test("NOERROR", ["update", + rr_add("e.$zone 300 A 73.80.65.49"), + rr_add("e.$zone 300 TXT 'one'"), + rr_add("e.$zone 300 A 73.80.65.50")]); +test("NOERROR", ["update", + rr_add("e.$zone 300 A 73.80.65.52"), + rr_add("f.$zone 300 A 73.80.65.52"), + rr_add("e.$zone 300 A 73.80.65.51")]); +test("NOERROR", ["update", + rr_add("e.$zone 300 TXT 'three'"), + rr_add("e.$zone 300 TXT 'two'")]); +test("NOERROR", ["update", + rr_add("e.$zone 300 MX 10 mail.$zone")]); + +test("NOERROR", ["pre", + yxrrset("e.$zone 300 A 73.80.65.52"), + yxrrset("e.$zone 300 TXT 'two'"), + yxrrset("e.$zone 300 A 73.80.65.51"), + yxrrset("e.$zone 300 TXT 'three'"), + yxrrset("e.$zone 300 A 73.80.65.50"), + yxrrset("f.$zone 300 A 73.80.65.52"), + yxrrset("e.$zone 300 A 73.80.65.49"), + yxrrset("e.$zone 300 TXT 'one'")]); + + +section("Subtraction of RRsets"); +test("NOERROR", ["update", rr_del("a.$zone 300 A 73.80.65.49")]); +test("NOERROR", ["pre", + yxrrset("a.$zone 300 A 73.80.65.50")]); + +test("NOERROR", ["update", rr_del("a.$zone 300 A 73.80.65.50")]); +test("NOERROR", ["pre", nxrrset("a.$zone 300 A")]); +test("NOERROR", ["pre", nxdomain("a.$zone")]); + +section("Other forms of deletion"); +test("NOERROR", ["update", rr_add("a.$zone 300 A 73.80.65.49")]); +test("NOERROR", ["update", rr_add("a.$zone 300 A 73.80.65.50")]); +test("NOERROR", ["update", rr_add("a.$zone 300 MX 10 mail.$zone")]); +test("NOERROR", ["update", rr_del("a.$zone 300 A")]); +test("NOERROR", ["pre", nxrrset("a.$zone 300 A")]); +test("NOERROR", ["update", rr_add("a.$zone 300 A 73.80.65.49")]); +test("NOERROR", ["update", rr_add("a.$zone 300 A 73.80.65.50")]); +test("NOERROR", ["update", rr_del("a.$zone")]); +test("NOERROR", ["pre", nxdomain("a.$zone")]); + +section("Case insensitivity"); +test("NOERROR", ["update", rr_add("a.$zone 300 PTR foo.net.")]); +test("NOERROR", ["pre", yxrrset("A.$zone 300 PTR fOo.NeT.")]); + +section("Special CNAME rules"); +test("NOERROR", ["update", rr_add("b.$zone 300 CNAME foo.net.")]); +test("NOERROR", ["update", rr_add("b.$zone 300 A 73.80.65.49")]); +test("NOERROR", ["pre", yxrrset("b.$zone 300 CNAME foo.net.")]); +test("NOERROR", ["pre", nxrrset("b.$zone A")]); + +test("NOERROR", ["update", rr_add("c.$zone 300 A 73.80.65.49")]); +test("NOERROR", ["update", rr_add("c.$zone 300 CNAME foo.net.")]); +test("NOERROR", ["pre", yxrrset("c.$zone A")]); +test("NOERROR", ["pre", nxrrset("c.$zone CNAME")]); + +# XXX should test with SIG, KEY, NXT, too. + +# +# Currently commented out because Net::DNS does not properly +# support WKS records. +# +#section("Special WKS rules"); +#test("NOERROR", ["update", rr_add("c.$zone 300 WKS 73.80.65.49 TCP telnet ftp")]); +#test("NOERROR", ["update", rr_add("c.$zone 300 WKS 73.80.65.49 UDP telnet ftp")]); +#test("NOERROR", ["update", rr_add("c.$zone 300 WKS 73.80.65.50 TCP telnet ftp")]); +#test("NOERROR", ["update", rr_add("c.$zone 300 WKS 73.80.65.49 TCP smtp")]); +#test("NOERROR", ["pre", +# yxrrset("c.$zone 300 WKS 73.80.65.49 TCP smtp"), +# yxrrset("c.$zone 300 WKS 73.80.65.49 UDP telnet ftp"), +# yxrrset("c.$zone 300 WKS 73.80.65.50 TCP telnet ftp")]); + + +section("Special NS rules"); + +# Deleting the last NS record using "Delete an RR from an RRset" +# should fail at the zone apex and work elsewhere. The pseudocode +# in RFC2136 says it should fail everywhere, but this is in conflict +# with the actual text. + +# Apex +test("NOERROR", ["update", + rr_add("$zone 300 NS ns1.$zone"), + rr_add("$zone 300 NS ns2.$zone")]); +test("NOERROR", ["update", rr_del("$zone 300 NS ns1.$zone")]); +test("NOERROR", ["update", rr_del("$zone 300 NS ns2.$zone")]); +test("NOERROR", ["pre", + yxrrset("$zone 300 NS ns2.$zone")]); + +# Non-apex +test("NOERROR", ["update", rr_add("n.$zone 300 NS ns1.$zone")]); +test("NOERROR", ["update", rr_del("n.$zone 300 NS ns1.$zone")]); +test("NOERROR", ["pre", nxrrset("n.$zone 300 NS")]); + +# Other ways of deleting NS records should also fail at the apex +# and work elsewhere. + +# Non-apex +test("NOERROR", ["update", rr_add("n.$zone 300 NS ns1.$zone")]); +test("NOERROR", ["update", rr_del("n.$zone 300 NS")]); +test("NOERROR", ["pre", nxrrset("n.$zone 300 NS")]); + +test("NOERROR", ["update", rr_add("n.$zone 300 NS ns1.$zone")]); +test("NOERROR", ["pre", yxrrset("n.$zone 300 NS")]); +test("NOERROR", ["update", rr_del("n.$zone")]); +test("NOERROR", ["pre", nxrrset("n.$zone 300 NS")]); + +# Apex +test("NOERROR", ["update", rr_del("$zone NS")]); +test("NOERROR", ["pre", + yxrrset("$zone 300 NS ns2.$zone")]); + +test("NOERROR", ["update", rr_del("$zone")]); +test("NOERROR", ["pre", + yxrrset("$zone 300 NS ns2.$zone")]); + +# They should not touch the SOA, either. + +test("NOERROR", ["update", rr_del("$zone SOA")]); +test("NOERROR", ["pre", yxrrset("$zone SOA")]); + + +section("Idempotency"); + +test("NOERROR", ["update", rr_add("d.$zone 300 A 73.80.65.49")]); +test("NOERROR", ["pre", yxrrset("d.$zone 300 A 73.80.65.49")]); +test("NOERROR", ["update", + rr_add("d.$zone 300 A 73.80.65.49"), + rr_del("d.$zone A")]); +test("NOERROR", ["pre", nxrrset("d.$zone 300 A 73.80.65.49")]); + +test("NOERROR", ["update", rr_del("d.$zone 300 A 73.80.65.49")]); +test("NOERROR", ["pre", nxrrset("d.$zone 300 A")]); +test("NOERROR", ["update", + rr_del("d.$zone 300 A"), + rr_add("d.$zone 300 A 73.80.65.49")]); + +test("NOERROR", ["pre", yxrrset("d.$zone 300 A")]); + +section("Out-of-zone prerequisites and updates"); +test("NOTZONE", ["pre", yxrrset("a.somewhere.else. 300 A 73.80.65.49")]); +test("NOTZONE", ["update", rr_add("a.somewhere.else. 300 A 73.80.65.49")]); + + +section("Glue"); +test("NOERROR", ["update", rr_add("s.$zone 300 NS ns.s.$zone")]); +test("NOERROR", ["update", rr_add("ns.s.$zone 300 A 73.80.65.49")]); +test("NOERROR", ["pre", yxrrset("ns.s.$zone 300 A 73.80.65.49")]); + +section("Wildcards"); +test("NOERROR", ["update", rr_add("*.$zone 300 MX 10 mail.$zone")]); +test("NOERROR", ["pre", yxrrset("*.$zone 300 MX 10 mail.$zone")]); +test("NXRRSET", ["pre", yxrrset("w.$zone 300 MX 10 mail.$zone")]); +test("NOERROR", ["pre", nxrrset("w.$zone MX")]); +test("NOERROR", ["pre", nxdomain("w.$zone")]); + + +section("SOA serial handling"); + +my $soatimers = "20 20 1814400 3600"; + +# Get the current SOA serial number. +my $query = $res->query($zone, "SOA"); +my ($old_soa) = $query->answer; + +my $old_serial = $old_soa->serial; + +# Increment it by 10. +my $new_serial = $old_serial + 10; +if ($new_serial > 0xFFFFFFFF) { + $new_serial -= 0x80000000; + $new_serial -= 0x80000000; +} + +# Replace the SOA with a new one. +test("NOERROR", ["update", rr_add("$zone 300 SOA mname1. . $new_serial $soatimers")]); + +# Check that the SOA really got replaced. +($db_soa) = $res->query($zone, "SOA")->answer; +assert($db_soa->mname eq "mname1"); + +# Check that attempts to decrement the serial number are ignored. +$new_serial = $old_serial - 10; +if ($new_serial < 0) { + $new_serial += 0x80000000; + $new_serial += 0x80000000; +} +test("NOERROR", ["update", rr_add("$zone 300 SOA mname2. . $new_serial $soatimers")]); +assert($db_soa->mname eq "mname1"); + +# Check that attempts to leave the serial number unchanged are ignored. +($old_soa) = $res->query($zone, "SOA")->answer; +$old_serial = $old_soa->serial; +test("NOERROR", ["update", rr_add("$zone 300 SOA mname3. . $old_serial " . + $soatimers)]); +($db_soa) = $res->query($zone, "SOA")->answer; +assert($db_soa->mname eq "mname1"); + +# +# Currently commented out because Net::DNS does not properly +# support multiple strings in TXT records. +# +#section("Big data"); +#test("NOERROR", ["update", rr_add("a.$zone 300 TXT aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc")]); +#test("NOERROR", ["update", rr_del("a.$zone 300 TXT aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc")]); +test("NOERROR", ["update", rr_add("a.$zone 300 TXT " . ("foo " x 3))]); + +section("Updating TTLs only"); + +test("NOERROR", ["update", rr_add("t.$zone 300 A 73.80.65.49")]); +($a) = $res->query("t.$zone", "A")->answer; +assert($a->ttl == 300); +test("NOERROR", ["update", + rr_del("t.$zone 300 A 73.80.65.49"), + rr_add("t.$zone 301 A 73.80.65.49")]); +($a) = $res->query("t.$zone", "A")->answer; +assert($a->ttl == 301); + +section("Obscuring existing data by zone cut"); +test("NOERROR", ["update", rr_add("a.u.$zone 300 A 73.80.65.49")]); +test("NOERROR", ["update", rr_add("b.u.$zone 300 A 73.80.65.49")]); +test("NOERROR", ["update", rr_add("u.$zone 300 TXT txt-not-in-nxt")]); +test("NOERROR", ["update", rr_add("u.$zone 300 NS ns.u.$zone")]); + +test("NOERROR", ["update", rr_del("u.$zone 300 NS ns.u.$zone")]); + +if ($failures) { + print "$failures tests failed.\n"; +} else { + print "All tests successful.\n"; +} +exit $failures; From 998befa9f3a2f67577e3fc948fd9cc9f30b2ab6b Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Mon, 24 Jul 2000 22:53:54 +0000 Subject: [PATCH 172/226] Copyrights entry for update_test.pl stuff --- util/copyrights | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/util/copyrights b/util/copyrights index 7e4e8ceda6..abe25d133b 100644 --- a/util/copyrights +++ b/util/copyrights @@ -377,6 +377,17 @@ ./bin/tests/system/notify/ns3/root.hint ZONE 2000 ./bin/tests/system/notify/setup.sh SH 2000 ./bin/tests/system/notify/tests.sh SH 2000 +./bin/tests/system/nsupdate/knowngood.ns1.before X 2000 +./bin/tests/system/nsupdate/knowngood.ns1.after X 2000 +./bin/tests/system/nsupdate/clean.sh SH 2000 +./bin/tests/system/nsupdate/setup.sh SH 2000 +./bin/tests/system/nsupdate/tests.sh SH 2000 +./bin/tests/system/nsupdate/update.scp X 2000 +./bin/tests/system/nsupdate/update_test.pl PERL 2000 +./bin/tests/system/nsupdate/ns1/example.orig ZONE 2000 +./bin/tests/system/nsupdate/ns1/update.orig ZONE 2000 +./bin/tests/system/nsupdate/ns1/named.conf CONF-C +./bin/tests/system/nsupdate/ns2/named.conf CONF-C ./bin/tests/system/run.sh SH 2000 ./bin/tests/system/setup.sh SH 2000 ./bin/tests/system/start.sh SH 2000 From ef653fbdb122e9e251bdfbdd4609d03a208bb79d Mon Sep 17 00:00:00 2001 From: Michael Graff Date: Mon, 24 Jul 2000 22:59:44 +0000 Subject: [PATCH 173/226] implement 'notify [ yes | no | explicit ]' --- bin/named/zoneconf.c | 13 +++++----- lib/dns/config/confctx.c | 22 +++++++++++++---- lib/dns/config/confparser.y | 45 +++++++++++++++++++++++++++++++--- lib/dns/config/confview.c | 15 ++++++++---- lib/dns/config/confzone.c | 42 ++++++++++++++++++------------- lib/dns/include/dns/confctx.h | 8 +++--- lib/dns/include/dns/confview.h | 6 ++--- lib/dns/include/dns/confzone.h | 7 +++--- lib/dns/include/dns/types.h | 8 +++++- lib/dns/include/dns/zone.h | 8 +++++- lib/dns/zone.c | 21 +++++++++++++--- lib/dns/zoneconf.c | 13 +++++----- 12 files changed, 150 insertions(+), 58 deletions(-) diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c index 8fcf1357de..149848285f 100644 --- a/bin/named/zoneconf.c +++ b/bin/named/zoneconf.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: zoneconf.c,v 1.45 2000/07/21 23:13:59 mws Exp $ */ +/* $Id: zoneconf.c,v 1.46 2000/07/24 22:59:32 explorer Exp $ */ #include @@ -113,6 +113,7 @@ dns_zone_configure(dns_c_ctx_t *cctx, dns_c_view_t *cview, isc_result_t result; isc_boolean_t boolean; const char *filename = NULL; + dns_notifytype_t notifytype; #ifdef notyet dns_c_severity_t severity; #endif @@ -174,14 +175,14 @@ dns_zone_configure(dns_c_ctx_t *cctx, dns_c_view_t *cview, * acting as masters (type "slave"), but not to stubs. */ if (czone->ztype != dns_c_zone_stub) { - result = dns_c_zone_getnotify(czone, &boolean); + result = dns_c_zone_getnotify(czone, ¬ifytype); if (result != ISC_R_SUCCESS && cview != NULL) - result = dns_c_view_getnotify(cview, &boolean); + result = dns_c_view_getnotify(cview, ¬ifytype); if (result != ISC_R_SUCCESS) - result = dns_c_ctx_getnotify(cctx, &boolean); + result = dns_c_ctx_getnotify(cctx, ¬ifytype); if (result != ISC_R_SUCCESS) - boolean = ISC_TRUE; - dns_zone_setoption(zone, DNS_ZONEOPT_NOTIFY, boolean); + notifytype = dns_notifytype_yes; + dns_zone_setnotifytype(zone, notifytype); iplist = NULL; result = dns_c_zone_getalsonotify(czone, &iplist); diff --git a/lib/dns/config/confctx.c b/lib/dns/config/confctx.c index 169e3ffbf6..14a93258cd 100644 --- a/lib/dns/config/confctx.c +++ b/lib/dns/config/confctx.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confctx.c,v 1.73 2000/07/11 19:09:04 brister Exp $ */ +/* $Id: confctx.c,v 1.74 2000/07/24 22:59:34 explorer Exp $ */ #include @@ -33,6 +33,10 @@ #define GETBOOL(FUNC, FIELD) GETBYTYPE(isc_boolean_t, FUNC, FIELD) #define UNSETBOOL(FUNC, FIELD) UNSETBYTYPE(isc_boolean_t, FUNC, FIELD) +#define SETNOTIFYTYPE(FUNC, FIELD) SETBYTYPE(dns_notifytype_t, FUNC, FIELD) +#define GETNOTIFYTYPE(FUNC, FIELD) GETBYTYPE(dns_notifytype_t, FUNC, FIELD) +#define UNSETNOTIFYTYPE(FUNC, FIELD) UNSETBYTYPE(dns_notifytype_t, FUNC, FIELD) + #define SETINT32(FUNC, FIELD) SETBYTYPE(isc_int32_t, FUNC, FIELD) #define GETINT32(FUNC, FIELD) GETBYTYPE(isc_int32_t, FUNC, FIELD) #define UNSETINT32(FUNC, FIELD) UNSETBYTYPE(isc_int32_t, FUNC, FIELD) @@ -835,6 +839,12 @@ dns_c_ctx_optionsprint(FILE *fp, int indent, dns_c_options_t *options) (unsigned long)(*options->FIELD / 60)); \ } +#define PRINT_IF_EQUAL(VAL, STRVAL, FIELD, NAME) \ + if (options->FIELD != NULL) { \ + dns_c_printtabs(fp, indent + 1); \ + fprintf(fp, "%s %s;\n", NAME, STRVAL); \ + } + #define PRINT_AS_BOOLEAN(FIELD, NAME) \ if (options->FIELD != NULL) { \ dns_c_printtabs(fp, indent + 1); \ @@ -955,7 +965,9 @@ dns_c_ctx_optionsprint(FILE *fp, int indent, dns_c_options_t *options) PRINT_AS_BOOLEAN(fake_iquery, "fake-iquery"); PRINT_AS_BOOLEAN(recursion, "recursion"); PRINT_AS_BOOLEAN(fetch_glue, "fetch-glue"); - PRINT_AS_BOOLEAN(notify, "notify"); + PRINT_IF_EQUAL(dns_notifytype_no, "no", notify, "notify"); + PRINT_IF_EQUAL(dns_notifytype_yes, "yes", notify, "notify"); + PRINT_IF_EQUAL(dns_notifytype_explicit, "explicit", notify, "notify"); PRINT_AS_BOOLEAN(host_statistics, "host-statistics"); PRINT_AS_BOOLEAN(dealloc_on_exit, "deallocate-on-exit"); PRINT_AS_BOOLEAN(use_ixfr, "use-ixfr"); @@ -1887,9 +1899,9 @@ SETBOOL(fetchglue, fetch_glue) UNSETBOOL(fetchglue, fetch_glue) -GETBOOL(notify, notify) -SETBOOL(notify, notify) -UNSETBOOL(notify, notify) +GETNOTIFYTYPE(notify, notify) +SETNOTIFYTYPE(notify, notify) +UNSETNOTIFYTYPE(notify, notify) GETBOOL(hoststatistics, host_statistics) diff --git a/lib/dns/config/confparser.y b/lib/dns/config/confparser.y index 6ec5d2f6e1..a0ed8445f9 100644 --- a/lib/dns/config/confparser.y +++ b/lib/dns/config/confparser.y @@ -16,7 +16,7 @@ * SOFTWARE. */ -/* $Id: confparser.y,v 1.103 2000/07/21 21:24:57 brister Exp $ */ +/* $Id: confparser.y,v 1.104 2000/07/24 22:59:35 explorer Exp $ */ #include @@ -214,6 +214,7 @@ static isc_boolean_t int_too_big(isc_uint32_t base, isc_uint32_t mult); dns_severity_t severity; dns_c_trans_t transport; dns_transfer_format_t tformat; + dns_notifytype_t notifytype; dns_c_ipmatchelement_t *ime; dns_c_ipmatchlist_t *iml; @@ -394,11 +395,13 @@ static isc_boolean_t int_too_big(isc_uint32_t base, isc_uint32_t mult); %token L_WILDCARD %token L_YES %token L_ZONE +%token L_EXPLICIT %type additional_data %type grantp %type yea_or_nay +%type notify_setting %type forward_opt %type zone_forward_opt %type address_match_element @@ -755,7 +758,7 @@ option: /* Empty */ YYABORT; } } - | L_NOTIFY yea_or_nay + | L_NOTIFY notify_setting { tmpres = dns_c_ctx_setnotify(currcfg, $2); if (tmpres == ISC_R_EXISTS) { @@ -1912,6 +1915,39 @@ yea_or_nay: L_YES $$ = isc_boolean_true; } } + +notify_setting: L_YES + { + $$ = dns_notifytype_yes; + } + | L_TRUE + { + $$ = dns_notifytype_yes; + } + | L_NO + { + $$ = dns_notifytype_no; + } + | L_FALSE + { + $$ = dns_notifytype_no; + } + | L_EXPLICIT + { + $$ = dns_notifytype_explicit; + } + | L_INTEGER + { + if ($1 == 1) { + $$ = dns_notifytype_yes; + } else if ($1 == 0) { + $$ = dns_notifytype_no; + } else { + parser_warning(ISC_TRUE, + "number should be 0 or 1, assuming 1"); + $$ = dns_notifytype_yes; + } + } ; check_names_type: L_MASTER @@ -3613,7 +3649,7 @@ view_option: L_FORWARD zone_forward_opt YYABORT; } } - | L_NOTIFY yea_or_nay + | L_NOTIFY notify_setting { dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); @@ -4783,7 +4819,7 @@ zone_option: L_FILE L_QSTRING YYABORT; } } - | L_NOTIFY yea_or_nay + | L_NOTIFY notify_setting { dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); @@ -5312,6 +5348,7 @@ static struct token keyword_tokens [] = { { "warn", L_WARN }, { "yes", L_YES }, { "zone", L_ZONE }, + { "explicit", L_EXPLICIT }, { NULL, 0 } }; diff --git a/lib/dns/config/confview.c b/lib/dns/config/confview.c index d06a57ced1..0f4231f16e 100644 --- a/lib/dns/config/confview.c +++ b/lib/dns/config/confview.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confview.c,v 1.36 2000/06/09 22:13:23 brister Exp $ */ +/* $Id: confview.c,v 1.37 2000/07/24 22:59:37 explorer Exp $ */ #include @@ -43,6 +43,10 @@ #define GETBOOL(FUNC, FIELD) GETBYTYPE(isc_boolean_t, FUNC, FIELD) #define UNSETBOOL(FUNC, FIELD) UNSETBYTYPE(isc_boolean_t, FUNC, FIELD) +#define SETNOTIFYTYPE(FUNC, FIELD) SETBYTYPE(dns_notifytype_t, FUNC, FIELD) +#define GETNOTIFYTYPE(FUNC, FIELD) GETBYTYPE(dns_notifytype_t, FUNC, FIELD) +#define UNSETNOTIFYTYPE(FUNC, FIELD) UNSETBYTYPE(dns_notifytype_t, FUNC, FIELD) + #define SETUINT32(FUNC, FIELD) SETBYTYPE(isc_uint32_t, FUNC, FIELD) #define GETUINT32(FUNC, FIELD) GETBYTYPE(isc_uint32_t, FUNC, FIELD) #define UNSETUINT32(FUNC, FIELD) UNSETBYTYPE(isc_uint32_t, FUNC, FIELD) @@ -336,6 +340,7 @@ isc_result_t dns_c_viewtable_checkviews(dns_c_viewtable_t *viewtable) { dns_c_view_t *elem; isc_boolean_t bbval; + dns_notifytype_t notifytype; isc_uint32_t buival; isc_result_t result = ISC_R_SUCCESS; dns_c_rrsolist_t *boval; @@ -351,7 +356,7 @@ dns_c_viewtable_checkviews(dns_c_viewtable_t *viewtable) { "implemented"); - if (dns_c_view_getnotify(elem, &bbval) != ISC_R_NOTFOUND) + if (dns_c_view_getnotify(elem, ¬ifytype) != ISC_R_NOTFOUND) isc_log_write(dns_lctx,DNS_LOGCATEGORY_CONFIG, DNS_LOGMODULE_CONFIG, ISC_LOG_WARNING, "view 'notify' is not yet " @@ -1456,9 +1461,9 @@ SETBOOL(fetchglue, fetch_glue) GETBOOL(fetchglue, fetch_glue) UNSETBOOL(fetchglue, fetch_glue) -SETBOOL(notify, notify) -GETBOOL(notify, notify) -UNSETBOOL(notify, notify) +GETNOTIFYTYPE(notify, notify) +SETNOTIFYTYPE(notify, notify) +UNSETNOTIFYTYPE(notify, notify) SETBOOL(rfc2308type1, rfc2308_type1) GETBOOL(rfc2308type1, rfc2308_type1) diff --git a/lib/dns/config/confzone.c b/lib/dns/config/confzone.c index a5fddf7822..3f61c0de11 100644 --- a/lib/dns/config/confzone.c +++ b/lib/dns/config/confzone.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confzone.c,v 1.48 2000/07/21 21:24:59 brister Exp $ */ +/* $Id: confzone.c,v 1.49 2000/07/24 22:59:38 explorer Exp $ */ #include @@ -433,7 +433,7 @@ dns_c_zone_new(isc_mem_t *mem, case dns_c_zone_master: master_zone_init(&newzone->u.mzone); break; - + case dns_c_zone_slave: slave_zone_init(&newzone->u.szone); break; @@ -441,11 +441,11 @@ dns_c_zone_new(isc_mem_t *mem, case dns_c_zone_stub: stub_zone_init(&newzone->u.tzone); break; - + case dns_c_zone_hint: hint_zone_init(&newzone->u.hzone); break; - + case dns_c_zone_forward: forward_zone_init(&newzone->u.fzone); break; @@ -1475,7 +1475,7 @@ dns_c_zone_getdialup(dns_c_zone_t *zone, isc_boolean_t *retval) { */ isc_result_t -dns_c_zone_setnotify(dns_c_zone_t *zone, isc_boolean_t newval) { +dns_c_zone_setnotify(dns_c_zone_t *zone, dns_notifytype_t newval) { isc_boolean_t existed = ISC_FALSE; REQUIRE(DNS_C_ZONE_VALID(zone)); @@ -1523,12 +1523,12 @@ dns_c_zone_setnotify(dns_c_zone_t *zone, isc_boolean_t newval) { */ isc_result_t -dns_c_zone_getnotify(dns_c_zone_t *zone, isc_boolean_t *retval) { +dns_c_zone_getnotify(dns_c_zone_t *zone, dns_notifytype_t *retval) { isc_result_t res; dns_c_setbits_t *bits = NULL; - isc_boolean_t val = ISC_FALSE; + dns_notifytype_t val = dns_notifytype_no; int bit = 0; - + REQUIRE(DNS_C_ZONE_VALID(zone)); REQUIRE(retval != NULL); @@ -1538,25 +1538,25 @@ dns_c_zone_getnotify(dns_c_zone_t *zone, isc_boolean_t *retval) { bit = MZ_NOTIFY_BIT; bits = &zone->u.mzone.setflags; break; - + case dns_c_zone_slave: val = zone->u.szone.notify; bit = SZ_NOTIFY_BIT; bits = &zone->u.szone.setflags; break; - + case dns_c_zone_stub: isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, DNS_LOGMODULE_CONFIG, ISC_LOG_CRITICAL, "Stub zones do not have a notify field"); return (ISC_R_FAILURE); - + case dns_c_zone_hint: isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, DNS_LOGMODULE_CONFIG, ISC_LOG_CRITICAL, "Hint zones do not have a notify field"); return (ISC_R_FAILURE); - + case dns_c_zone_forward: isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, DNS_LOGMODULE_CONFIG, ISC_LOG_CRITICAL, @@ -1570,7 +1570,7 @@ dns_c_zone_getnotify(dns_c_zone_t *zone, isc_boolean_t *retval) { } else { res = ISC_R_NOTFOUND; } - + return (res); } @@ -3758,8 +3758,12 @@ master_zone_print(FILE *fp, int indent, dns_c_masterzone_t *mzone) { if (DNS_C_CHECKBIT(MZ_NOTIFY_BIT, &mzone->setflags)) { dns_c_printtabs(fp, indent); - fprintf(fp, "notify %s;\n", - (mzone->notify ? "true" : "false")); + if (mzone->notify == dns_notifytype_no) + fprintf(fp, "notify no;\n"); + if (mzone->notify == dns_notifytype_yes) + fprintf(fp, "notify yes;\n"); + if (mzone->notify == dns_notifytype_explicit) + fprintf(fp, "notify explicit;\n"); } if (mzone->also_notify != NULL) { @@ -3971,8 +3975,12 @@ slave_zone_print(FILE *fp, int indent, dns_c_slavezone_t *szone) { if (DNS_C_CHECKBIT(SZ_NOTIFY_BIT, &szone->setflags)) { dns_c_printtabs(fp, indent); - fprintf(fp, "notify %s;\n", - (szone->notify ? "true" : "false")); + if (szone->notify == dns_notifytype_no) + fprintf(fp, "notify no;\n"); + if (szone->notify == dns_notifytype_yes) + fprintf(fp, "notify yes;\n"); + if (szone->notify == dns_notifytype_explicit) + fprintf(fp, "notify explicit;\n"); } if (szone->also_notify != NULL) { diff --git a/lib/dns/include/dns/confctx.h b/lib/dns/include/dns/confctx.h index c310121b78..25f3899bd1 100644 --- a/lib/dns/include/dns/confctx.h +++ b/lib/dns/include/dns/confctx.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confctx.h,v 1.43 2000/06/22 21:55:20 tale Exp $ */ +/* $Id: confctx.h,v 1.44 2000/07/24 22:59:39 explorer Exp $ */ #ifndef DNS_CONFCTX_H #define DNS_CONFCTX_H 1 @@ -154,7 +154,6 @@ struct dns_c_options { isc_boolean_t *fake_iquery; isc_boolean_t *recursion; isc_boolean_t *fetch_glue; - isc_boolean_t *notify; isc_boolean_t *host_statistics; isc_boolean_t *dealloc_on_exit; isc_boolean_t *use_ixfr; @@ -182,6 +181,7 @@ struct dns_c_options { isc_uint32_t tkeydhkeyi; char *tkeydomain; + dns_notifytype_t *notify; dns_c_iplist_t *also_notify; dns_severity_t *check_names[DNS_C_TRANSCOUNT]; @@ -500,8 +500,8 @@ isc_result_t dns_c_ctx_getfetchglue(dns_c_ctx_t *cfg, isc_boolean_t *retval); isc_result_t dns_c_ctx_unsetfetchglue(dns_c_ctx_t *cfg); -isc_result_t dns_c_ctx_setnotify(dns_c_ctx_t *cfg, isc_boolean_t newval); -isc_result_t dns_c_ctx_getnotify(dns_c_ctx_t *cfg, isc_boolean_t *retval); +isc_result_t dns_c_ctx_setnotify(dns_c_ctx_t *cfg, dns_notifytype_t newval); +isc_result_t dns_c_ctx_getnotify(dns_c_ctx_t *cfg, dns_notifytype_t *retval); isc_result_t dns_c_ctx_unsetnotify(dns_c_ctx_t *cfg); diff --git a/lib/dns/include/dns/confview.h b/lib/dns/include/dns/confview.h index 6403bbe44c..44719150b9 100644 --- a/lib/dns/include/dns/confview.h +++ b/lib/dns/include/dns/confview.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confview.h,v 1.30 2000/06/22 21:55:30 tale Exp $ */ +/* $Id: confview.h,v 1.31 2000/07/24 22:59:41 explorer Exp $ */ #ifndef DNS_CONFVIEW_H #define DNS_CONFVIEW_H 1 @@ -336,8 +336,8 @@ isc_result_t dns_c_view_unsetfetchglue(dns_c_view_t *view); -isc_result_t dns_c_view_getnotify(dns_c_view_t *view, isc_boolean_t *retval); -isc_result_t dns_c_view_setnotify(dns_c_view_t *view, isc_boolean_t newval); +isc_result_t dns_c_view_getnotify(dns_c_view_t *view, dns_notifytype_t *retval); +isc_result_t dns_c_view_setnotify(dns_c_view_t *view, dns_notifytype_t newval); isc_result_t dns_c_view_unsetnotify(dns_c_view_t *view); diff --git a/lib/dns/include/dns/confzone.h b/lib/dns/include/dns/confzone.h index 7f18cebca3..b36af1ffa5 100644 --- a/lib/dns/include/dns/confzone.h +++ b/lib/dns/include/dns/confzone.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confzone.h,v 1.36 2000/07/21 21:25:01 brister Exp $ */ +/* $Id: confzone.h,v 1.37 2000/07/24 22:59:42 explorer Exp $ */ #ifndef DNS_CONFZONE_H #define DNS_CONFZONE_H 1 @@ -309,8 +309,9 @@ isc_result_t dns_c_zone_getdialup(dns_c_zone_t *zone, isc_boolean_t *retval); isc_result_t dns_c_zone_setnotify(dns_c_zone_t *zone, - isc_boolean_t newval); -isc_result_t dns_c_zone_getnotify(dns_c_zone_t *zone, isc_boolean_t *retval); + dns_notifytype_t newval); +isc_result_t dns_c_zone_getnotify(dns_c_zone_t *zone, + dns_notifytype_t *retval); isc_result_t dns_c_zone_setalsonotify(dns_c_zone_t *zone, diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h index cee0ca10f9..4dbd131e89 100644 --- a/lib/dns/include/dns/types.h +++ b/lib/dns/include/dns/types.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: types.h,v 1.88 2000/06/23 02:59:05 tale Exp $ */ +/* $Id: types.h,v 1.89 2000/07/24 22:59:43 explorer Exp $ */ #ifndef DNS_TYPES_H #define DNS_TYPES_H 1 @@ -135,6 +135,12 @@ typedef enum { dns_dbtype_zone = 0, dns_dbtype_cache = 1, dns_dbtype_stub = 3 } dns_dbtype_t; +typedef enum { + dns_notifytype_no = 0, + dns_notifytype_yes = 1, + dns_notifytype_explicit = 2 +} dns_notifytype_t; + /* * These are generated by gen.c. */ diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h index c6bfeb7d8a..e7d95216be 100644 --- a/lib/dns/include/dns/zone.h +++ b/lib/dns/include/dns/zone.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: zone.h,v 1.60 2000/07/21 18:47:23 mws Exp $ */ +/* $Id: zone.h,v 1.61 2000/07/24 22:59:44 explorer Exp $ */ #ifndef DNS_ZONE_H #define DNS_ZONE_H 1 @@ -897,6 +897,12 @@ dns_zone_getsigvalidityinterval(dns_zone_t *zone); * 'zone' to be a valid zone. */ +void +dns_zone_setnotifytype(dns_zone_t *zone, dns_notifytype_t notifytype); +/* + * Sets zone notify method to "notifytype" + */ + isc_result_t dns_zonemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr, isc_timermgr_t *timermgr, isc_socketmgr_t *socketmgr, diff --git a/lib/dns/zone.c b/lib/dns/zone.c index c44fa0e007..04b640efc2 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: zone.c,v 1.165 2000/07/22 00:40:39 mws Exp $ */ +/* $Id: zone.c,v 1.166 2000/07/24 22:59:31 explorer Exp $ */ #include @@ -126,6 +126,7 @@ struct dns_zone { unsigned int masterscnt; unsigned int curmaster; isc_sockaddr_t masteraddr; + dns_notifytype_t notifytype; isc_sockaddr_t *notify; unsigned int notifycnt; isc_sockaddr_t notifyfrom; @@ -355,6 +356,7 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) { zone->masterscnt = 0; zone->curmaster = 0; zone->notify = NULL; + zone->notifytype = dns_notifytype_yes; zone->notifycnt = 0; zone->task = NULL; zone->update_acl = NULL; @@ -475,6 +477,15 @@ dns_zone_getclass(dns_zone_t *zone){ return (zone->rdclass); } +void +dns_zone_setnotifytype(dns_zone_t *zone, dns_notifytype_t notifytype) { + REQUIRE(DNS_ZONE_VALID(zone)); + + LOCK(&zone->lock); + zone->notifytype = notifytype; + UNLOCK(&zone->lock); +} + /* * Single shot. */ @@ -1944,16 +1955,17 @@ dns_zone_notify(dns_zone_t *zone) { unsigned int i; isc_sockaddr_t dst; isc_boolean_t isqueued; + dns_notifytype_t notifytype; REQUIRE(DNS_ZONE_VALID(zone)); LOCK(&zone->lock); zone->flags &= ~DNS_ZONEFLG_NEEDNOTIFY; + notifytype = zone->notifytype; UNLOCK(&zone->lock); - if (!DNS_ZONE_OPTION(zone, DNS_ZONEOPT_NOTIFY)) { + if (notifytype == dns_notifytype_no) return; - } origin = &zone->origin; @@ -1983,6 +1995,9 @@ dns_zone_notify(dns_zone_t *zone) { } UNLOCK(&zone->lock); + if (notifytype == dns_notifytype_explicit) + return; + /* * Process NS RRset to generate notifies. */ diff --git a/lib/dns/zoneconf.c b/lib/dns/zoneconf.c index 8fcf1357de..149848285f 100644 --- a/lib/dns/zoneconf.c +++ b/lib/dns/zoneconf.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: zoneconf.c,v 1.45 2000/07/21 23:13:59 mws Exp $ */ +/* $Id: zoneconf.c,v 1.46 2000/07/24 22:59:32 explorer Exp $ */ #include @@ -113,6 +113,7 @@ dns_zone_configure(dns_c_ctx_t *cctx, dns_c_view_t *cview, isc_result_t result; isc_boolean_t boolean; const char *filename = NULL; + dns_notifytype_t notifytype; #ifdef notyet dns_c_severity_t severity; #endif @@ -174,14 +175,14 @@ dns_zone_configure(dns_c_ctx_t *cctx, dns_c_view_t *cview, * acting as masters (type "slave"), but not to stubs. */ if (czone->ztype != dns_c_zone_stub) { - result = dns_c_zone_getnotify(czone, &boolean); + result = dns_c_zone_getnotify(czone, ¬ifytype); if (result != ISC_R_SUCCESS && cview != NULL) - result = dns_c_view_getnotify(cview, &boolean); + result = dns_c_view_getnotify(cview, ¬ifytype); if (result != ISC_R_SUCCESS) - result = dns_c_ctx_getnotify(cctx, &boolean); + result = dns_c_ctx_getnotify(cctx, ¬ifytype); if (result != ISC_R_SUCCESS) - boolean = ISC_TRUE; - dns_zone_setoption(zone, DNS_ZONEOPT_NOTIFY, boolean); + notifytype = dns_notifytype_yes; + dns_zone_setnotifytype(zone, notifytype); iplist = NULL; result = dns_c_zone_getalsonotify(czone, &iplist); From 687d363deafb286c8ba9c77bc93893ea1f28a3a8 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Mon, 24 Jul 2000 23:10:50 +0000 Subject: [PATCH 174/226] The "Ensures" condition for dns_db_deleterdataset was obviously wrong. --- lib/dns/include/dns/db.h | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h index ae94e1ed67..bf01c18545 100644 --- a/lib/dns/include/dns/db.h +++ b/lib/dns/include/dns/db.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: db.h,v 1.50 2000/06/22 21:55:33 tale Exp $ */ +/* $Id: db.h,v 1.51 2000/07/24 23:10:50 bwelling Exp $ */ #ifndef DNS_DB_H #define DNS_DB_H 1 @@ -1109,10 +1109,6 @@ dns_db_deleterdataset(dns_db_t *db, dns_dbnode_t *node, * * If 'covers' != 0, 'type' must be SIG. * - * Ensures: - * - * On success, 'rdataset' is associated with the found rdataset. - * * Returns: * * ISC_R_SUCCESS From aa38fc9f67c2cd6f8e59941e7ed4b9b855a98d02 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Mon, 24 Jul 2000 23:13:44 +0000 Subject: [PATCH 175/226] Move .digrc to home dir, and hide behinf #ifndef NOPOSIX --- bin/dig/dig.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/bin/dig/dig.c b/bin/dig/dig.c index 87c1288bc2..0b78e6b47e 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.c,v 1.76 2000/07/24 20:46:55 mws Exp $ */ +/* $Id: dig.c,v 1.77 2000/07/24 23:13:44 mws Exp $ */ #include #include @@ -584,6 +584,10 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, int rc; char **rv; char *ptr; +#ifndef NOPOSIX + char *homedir; + char rcfile[132]; +#endif /* * The semantics for parsing the args is a bit complex; if @@ -601,11 +605,16 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, debug("making new lookup"); default_lookup = make_empty_lookup(); +#ifndef NOPOSIX /* * Treat .digrc as a special batchfile - * XXXMWS should check $HOME in some portable way */ - batchfp = fopen(".digrc", "r"); + homedir = getenv("HOME"); + if (homedir != NULL) + snprintf(rcfile, 132, "%s/.digrc", homedir); + else + strcpy(rcfile, ".digrc"); + batchfp = fopen(rcfile, "r"); if (batchfp != NULL) { while (fgets(batchline, sizeof(batchline), batchfp) != 0) { @@ -627,6 +636,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, } fclose(batchfp); } +#endif } lookup = default_lookup; From 516b9de0d9391bdd148c554ccc13d8e210e3f452 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Mon, 24 Jul 2000 23:32:31 +0000 Subject: [PATCH 176/226] eliminated needless code duplication between the yea_and_nay and notify_setting grammar rules --- lib/dns/config/confparser.y | 34 +++++++--------------------------- 1 file changed, 7 insertions(+), 27 deletions(-) diff --git a/lib/dns/config/confparser.y b/lib/dns/config/confparser.y index a0ed8445f9..b5704b6c88 100644 --- a/lib/dns/config/confparser.y +++ b/lib/dns/config/confparser.y @@ -16,7 +16,7 @@ * SOFTWARE. */ -/* $Id: confparser.y,v 1.104 2000/07/24 22:59:35 explorer Exp $ */ +/* $Id: confparser.y,v 1.105 2000/07/24 23:32:31 gson Exp $ */ #include @@ -1916,38 +1916,18 @@ yea_or_nay: L_YES } } -notify_setting: L_YES +notify_setting: yea_or_nay { - $$ = dns_notifytype_yes; - } - | L_TRUE - { - $$ = dns_notifytype_yes; - } - | L_NO - { - $$ = dns_notifytype_no; - } - | L_FALSE - { - $$ = dns_notifytype_no; + if ($1) + $$ = dns_notifytype_yes; + else + $$ = dns_notifytype_no; + } | L_EXPLICIT { $$ = dns_notifytype_explicit; } - | L_INTEGER - { - if ($1 == 1) { - $$ = dns_notifytype_yes; - } else if ($1 == 0) { - $$ = dns_notifytype_no; - } else { - parser_warning(ISC_TRUE, - "number should be 0 or 1, assuming 1"); - $$ = dns_notifytype_yes; - } - } ; check_names_type: L_MASTER From 6b9c29ec578de7fda057bd3b893ccda176378b1b Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Mon, 24 Jul 2000 23:54:59 +0000 Subject: [PATCH 177/226] Additional test in nsupdate test --- bin/tests/system/nsupdate/ns1/named.conf | 3 ++- bin/tests/system/nsupdate/tests.sh | 13 ++++++++++++- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/bin/tests/system/nsupdate/ns1/named.conf b/bin/tests/system/nsupdate/ns1/named.conf index a27abdadcd..a69c2c8b4c 100644 --- a/bin/tests/system/nsupdate/ns1/named.conf +++ b/bin/tests/system/nsupdate/ns1/named.conf @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: named.conf,v 1.2 2000/07/24 22:53:38 mws Exp $ */ +/* $Id: named.conf,v 1.3 2000/07/24 23:54:59 mws Exp $ */ options { query-source address 10.53.0.1; @@ -39,4 +39,5 @@ zone "update.nil" { file "update.db"; allow-update { any; }; allow-transfer { any; }; + also-notify { 10.53.0.2; }; }; diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh index e9a2b0870b..7523bd60d4 100644 --- a/bin/tests/system/nsupdate/tests.sh +++ b/bin/tests/system/nsupdate/tests.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: tests.sh,v 1.5 2000/07/24 22:53:35 mws Exp $ +# $Id: tests.sh,v 1.6 2000/07/24 23:54:57 mws Exp $ # # Perform tests @@ -64,5 +64,16 @@ else echo "I:The second part of this test requires the Net::DNS library." >&2 fi +echo "I:fetching first copy of test zone" +$DIG +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\ + @10.53.0.1 axfr -p 5300 > dig.out.ns1 || status=1 + +echo "I:fetching second copy of test zone" +$DIG +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\ + @10.53.0.1 axfr -p 5300 > dig.out.ns2 || status=1 + +echo "I:comparing zones" +$PERL ../digcomp.pl dig.out.ns1 dig.out.ns2 || status=1 + echo "I:exit status: $status" exit $status From 56f8b1c404df018fe3b458e1ff3187c5a702d57b Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Mon, 24 Jul 2000 23:55:19 +0000 Subject: [PATCH 178/226] the "done" variable reintroduced in the previous revision was not initialized --- lib/dns/resolver.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index edff8c49b1..a1bff420a7 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: resolver.c,v 1.151 2000/07/24 20:10:26 gson Exp $ */ +/* $Id: resolver.c,v 1.152 2000/07/24 23:55:19 gson Exp $ */ #include @@ -3276,6 +3276,7 @@ answer_response(fetchctx_t *fctx) { * part of the answer and should be cached. */ + done = ISC_FALSE; chaining = ISC_FALSE; have_answer = ISC_FALSE; want_chaining = ISC_FALSE; From dc9c461b27df798ba7c3d9ba1446840c5f85553b Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Tue, 25 Jul 2000 00:44:18 +0000 Subject: [PATCH 179/226] Test that the jnl file is properly recovered after a hard kill of the server --- bin/tests/system/nsupdate/tests.sh | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh index 7523bd60d4..2ebbd357c8 100644 --- a/bin/tests/system/nsupdate/tests.sh +++ b/bin/tests/system/nsupdate/tests.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: tests.sh,v 1.6 2000/07/24 23:54:57 mws Exp $ +# $Id: tests.sh,v 1.7 2000/07/25 00:44:18 mws Exp $ # # Perform tests @@ -75,5 +75,20 @@ $DIG +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\ echo "I:comparing zones" $PERL ../digcomp.pl dig.out.ns1 dig.out.ns2 || status=1 +echo "I:SIGKILL and restart server ns1" +cd ns1 +kill -SIGKILL `cat named.pid` +rm named.pid +sleep 2 +$NAMED -c named.conf -d 99 -g >> named.run 2>&1 & +cd .. + +echo "I:fetching ns1 after hard restart" +$DIG +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\ + @10.53.0.1 axfr -p 5300 > dig.out.ns1.after || status=1 + +echo "I:comparing zones" +$PERL ../digcomp.pl dig.out.ns1 dig.out.ns1.after || status=1 + echo "I:exit status: $status" exit $status From fcc6d71462cd427a475f9150ffa4fad8c44b7f50 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Tue, 25 Jul 2000 00:51:14 +0000 Subject: [PATCH 180/226] Don't crash if someone specifies an option (like -f) to dig without its argument. --- bin/dig/dig.c | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/bin/dig/dig.c b/bin/dig/dig.c index 0b78e6b47e..b7f2eac51f 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.c,v 1.77 2000/07/24 23:13:44 mws Exp $ */ +/* $Id: dig.c,v 1.78 2000/07/25 00:51:14 mws Exp $ */ #include #include @@ -836,6 +836,10 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, if (rv[0][2] != 0) { ptr = &rv[0][2]; } else { + if (rc <= 1) { + show_usage(); + exit (exitcode); + } ptr = rv[1]; rv++; rc--; @@ -854,6 +858,10 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, if (rv[0][2] != 0) { ptr = &rv[0][2]; } else { + if (rc <= 1) { + show_usage(); + exit (exitcode); + } ptr = rv[1]; rv++; rc--; @@ -879,6 +887,10 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, if (rv[0][2] != 0) { batchname = &rv[0][2]; } else { + if (rc <= 1) { + show_usage(); + exit (exitcode); + } batchname = rv[1]; rv++; rc--; @@ -887,6 +899,10 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, if (rv[0][2] != 0) ptr = &rv[0][2]; else { + if (rc <= 1) { + show_usage(); + exit (exitcode); + } ptr = rv[1]; rv++; rc--; @@ -907,6 +923,10 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, if (rv[0][2] != 0) ptr = &rv[0][2]; else { + if (rc <= 1) { + show_usage(); + exit (exitcode); + } ptr = rv[1]; rv++; rc--; @@ -916,6 +936,10 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, if (rv[0][2] != 0) { port = atoi(&rv[0][2]); } else { + if (rc <= 1) { + show_usage(); + exit (exitcode); + } port = atoi(rv[1]); rv++; rc--; @@ -925,6 +949,10 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only, strncpy(address, &rv[0][2], MXRD); } else { + if (rc <= 1) { + show_usage(); + exit (exitcode); + } strncpy(address, rv[1], MXRD); rv++; From 080a4fe83c3ad208073bffbce1a2af8fe444214f Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Tue, 25 Jul 2000 00:52:11 +0000 Subject: [PATCH 181/226] 347. [bug] Don't crash if when an argument is left off options in dig. --- CHANGES | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGES b/CHANGES index 2dfa2e4af3..31e1b05d29 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,6 @@ + 347. [bug] Don't crash if when an argument is left off + options in dig. + 346. [func] Add support for .digrc config file, in the user's current directory From 9037893f90d244a7e5c0d6c4cb3578bba68c5424 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Tue, 25 Jul 2000 01:06:01 +0000 Subject: [PATCH 182/226] add() assumed dns_trust_authsecure is the highest trust level, but this is no longer the case. Thus, the DNS_DBADD_FORCE option did not take effect if the existing data was at level dns_trust_ultimate. Since the DNS_DBADD_FORCE option is currently used only with cached data, no actual harm has been done. --- lib/dns/rbtdb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c index abbe357abc..a82eb6b64a 100644 --- a/lib/dns/rbtdb.c +++ b/lib/dns/rbtdb.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: rbtdb.c,v 1.109 2000/07/04 04:28:44 marka Exp $ */ +/* $Id: rbtdb.c,v 1.110 2000/07/25 01:06:01 gson Exp $ */ /* * Principal Author: Bob Halley @@ -3062,7 +3062,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion, merge = ISC_FALSE; if ((options & DNS_DBADD_FORCE) != 0) - trust = dns_trust_authsecure; + trust = dns_trust_ultimate; else trust = newheader->trust; From 5d9e3392b2e0e05a6ec9096c113aa39bf54e8de2 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 25 Jul 2000 01:06:18 +0000 Subject: [PATCH 183/226] Add support for the cd (checking disabled) bit. Setting the cd bit in a query still doesn't completely work, since the resolver needs to be modified also. Basically, if data is in the cache and trust == pending, it will now be returned when the cd bit is set. --- bin/named/query.c | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/bin/named/query.c b/bin/named/query.c index 5f4e79c641..be0a5262fc 100644 --- a/bin/named/query.c +++ b/bin/named/query.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: query.c,v 1.115 2000/07/18 22:24:45 bwelling Exp $ */ +/* $Id: query.c,v 1.116 2000/07/25 01:06:18 bwelling Exp $ */ #include @@ -1414,7 +1414,8 @@ query_addsoa(ns_client_t *client, dns_db_t *db) { /* * Find the SOA. */ - result = dns_db_find(db, name, NULL, dns_rdatatype_soa, 0, 0, &node, + result = dns_db_find(db, name, NULL, dns_rdatatype_soa, + client->query.dboptions, 0, &node, fname, rdataset, sigrdataset); if (result != ISC_R_SUCCESS) { /* @@ -1479,7 +1480,8 @@ query_addns(ns_client_t *client, dns_db_t *db) { * Find the NS rdataset. */ CTRACE("query_addns: calling dns_db_find"); - result = dns_db_find(db, name, NULL, dns_rdatatype_ns, 0, 0, &node, + result = dns_db_find(db, name, NULL, dns_rdatatype_ns, + client->query.dboptions, 0, &node, fname, rdataset, sigrdataset); CTRACE("query_addns: dns_db_find complete"); if (result != ISC_R_SUCCESS) { @@ -1621,7 +1623,7 @@ query_addbestns(ns_client_t *client) { */ if (is_zone) { result = dns_db_find(db, client->query.qname, version, - dns_rdatatype_ns, 0, + dns_rdatatype_ns, client->query.dboptions, client->now, &node, fname, rdataset, sigrdataset); if (result != DNS_R_DELEGATION) @@ -1640,7 +1642,8 @@ query_addbestns(ns_client_t *client) { goto db_find; } } else { - result = dns_db_findzonecut(db, client->query.qname, 0, + result = dns_db_findzonecut(db, client->query.qname, + client->query.dboptions, client->now, &node, fname, rdataset, sigrdataset); if (result == ISC_R_SUCCESS) { @@ -1681,7 +1684,7 @@ query_addbestns(ns_client_t *client) { zsigrdataset = NULL; } - if ((client->message->flags & DNS_MESSAGEFLAG_CD) == 0 && + if ((client->query.dboptions & DNS_DBFIND_PENDINGOK) == 0 && (rdataset->trust == dns_trust_pending || sigrdataset->trust == dns_trust_pending)) goto cleanup; @@ -1917,7 +1920,8 @@ query_findparentkey(ns_client_t *client, dns_name_t *name, goto cleanup; } - result = dns_db_find(pdb, name, pversion, dns_rdatatype_key, 0, + result = dns_db_find(pdb, name, pversion, dns_rdatatype_key, + client->query.dboptions, client->now, &pnode, dns_fixedname_name(&pfoundname), &prdataset, &psigrdataset); @@ -2151,9 +2155,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event) { /* * Now look for an answer in the database. */ - result = dns_db_find(db, client->query.qname, version, type, 0, - client->now, &node, fname, rdataset, - sigrdataset); + result = dns_db_find(db, client->query.qname, version, type, + client->query.dboptions, client->now, + &node, fname, rdataset, sigrdataset); /* * We interrupt our normal query processing to bring you this special @@ -2951,6 +2955,13 @@ ns_query_start(ns_client_t *client) { } } + /* + * If the client has requested that DNSSEC checking be disabled, + * allow lookups to return pending data. + */ + if (message->flags & DNS_MESSAGEFLAG_CD) + client->query.dboptions |= DNS_DBFIND_PENDINGOK; + /* * This is an ordinary query. */ @@ -2969,9 +2980,6 @@ ns_query_start(ns_client_t *client) { /* * Set AD. We need only clear it if we add "pending" data to * a response. - * - * Note: as currently written, the server does not return "pending" - * data even if a client says it's OK to do so. */ message->flags |= DNS_MESSAGEFLAG_AD; From 398bdb27100d98709da0e7796e5bb70e6acf7627 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Tue, 25 Jul 2000 01:19:51 +0000 Subject: [PATCH 184/226] in deleterdataset(), set the DNS_DBADD_FORCE flag when adding the deletion rdataset so that rdatasets can be deleted regardless of their trust level --- lib/dns/rbtdb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c index a82eb6b64a..d771d625e3 100644 --- a/lib/dns/rbtdb.c +++ b/lib/dns/rbtdb.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: rbtdb.c,v 1.110 2000/07/25 01:06:01 gson Exp $ */ +/* $Id: rbtdb.c,v 1.111 2000/07/25 01:19:51 gson Exp $ */ /* * Principal Author: Bob Halley @@ -3560,7 +3560,7 @@ deleterdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version, LOCK(&rbtdb->node_locks[rbtnode->locknum].lock); - result = add(rbtdb, rbtnode, rbtversion, newheader, 0, + result = add(rbtdb, rbtnode, rbtversion, newheader, DNS_DBADD_FORCE, ISC_FALSE, NULL, 0); UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock); From 60783293cc27f74a84ec93c95c5d46edd30bd8e0 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 25 Jul 2000 01:24:18 +0000 Subject: [PATCH 185/226] If a failed positive validation led us to try an insecurity proof, and the insecurity proof also failed, the validator event should normally contain the error from the positive validation. --- lib/dns/validator.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/lib/dns/validator.c b/lib/dns/validator.c index a45a68cee4..2910f1c91a 100644 --- a/lib/dns/validator.c +++ b/lib/dns/validator.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: validator.c,v 1.65 2000/07/13 23:52:04 bwelling Exp $ */ +/* $Id: validator.c,v 1.66 2000/07/25 01:24:18 bwelling Exp $ */ #include @@ -1271,6 +1271,8 @@ validator_start(isc_task_t *task, isc_event_t *event) { LOCK(&val->lock); if (val->event->rdataset != NULL && val->event->sigrdataset != NULL) { + isc_result_t saved_result; + /* * This looks like a simple validation. We say "looks like" * because we don't know if wildcards are involved yet so it @@ -1283,9 +1285,12 @@ validator_start(isc_task_t *task, isc_event_t *event) { if (result == DNS_R_NOVALIDSIG && (val->attributes & VALATTR_TRIEDVERIFY) == 0) { + saved_result = result; validator_log(val, ISC_LOG_DEBUG(3), "falling back to insecurity proof"); result = proveunsecure(val, ISC_FALSE); + if (result == DNS_R_NOTINSECURE) + result = saved_result; } } else if (val->event->rdataset != NULL) { /* From 81b94e091c5a8e9ded13a646d72241f9d18e8012 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Tue, 25 Jul 2000 17:03:21 +0000 Subject: [PATCH 186/226] added new fetch option DNS_FETCHOPT_NOVALIDATE --- lib/dns/include/dns/resolver.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h index c8ffe38502..33d24f9e6d 100644 --- a/lib/dns/include/dns/resolver.h +++ b/lib/dns/include/dns/resolver.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: resolver.h,v 1.28 2000/06/26 22:09:37 gson Exp $ */ +/* $Id: resolver.h,v 1.29 2000/07/25 17:03:21 gson Exp $ */ #ifndef DNS_RESOLVER_H #define DNS_RESOLVER_H 1 @@ -89,6 +89,7 @@ typedef struct dns_fetchevent { #define DNS_FETCHOPT_RECURSIVE 0x04 /* Set RD? */ #define DNS_FETCHOPT_NOEDNS0 0x08 /* Do not use EDNS. */ #define DNS_FETCHOPT_FORWARDONLY 0x10 /* Only use forwarders. */ +#define DNS_FETCHOPT_NOVALIDATE 0x20 /* Disable validation. */ /* * XXXRTH Should this API be made semi-private? (I.e. From 969f24b04c0c2c02c2d104933d21a18c14979e47 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 25 Jul 2000 17:12:00 +0000 Subject: [PATCH 187/226] dns_dnssec_verifymessage should make sure that it's verifying with the right key (which should be the case anyway, but it never hurts to check). Also fix a memory leak and change a few _tostruct() calls to not allocate memory. --- lib/dns/dnssec.c | 14 ++++++++++---- lib/dns/include/dns/dnssec.h | 4 +++- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c index e5db778701..1f8b6b0cd5 100644 --- a/lib/dns/dnssec.c +++ b/lib/dns/dnssec.c @@ -16,7 +16,7 @@ */ /* - * $Id: dnssec.c,v 1.43 2000/06/06 22:00:47 bwelling Exp $ + * $Id: dnssec.c,v 1.44 2000/07/25 17:11:58 bwelling Exp $ * Principal Author: Brian Wellington */ @@ -322,7 +322,7 @@ dns_dnssec_verify(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, REQUIRE(mctx != NULL); REQUIRE(sigrdata != NULL && sigrdata->type == dns_rdatatype_sig); - ret = dns_rdata_tostruct(sigrdata, &sig, mctx); + ret = dns_rdata_tostruct(sigrdata, &sig, NULL); if (ret != ISC_R_SUCCESS) return (ret); @@ -599,6 +599,7 @@ dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) { isc_buffer_init(&sigbuf, sig.signature, sig.siglen); RETERR(dst_context_sign(ctx, &sigbuf)); + dst_context_destroy(&ctx); rdata = NULL; RETERR(dns_message_gettemprdata(msg, &rdata)); @@ -671,7 +672,7 @@ dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg, RETERR(dns_rdataset_first(msg->sig0)); dns_rdataset_current(msg->sig0, &rdata); - RETERR(dns_rdata_tostruct(&rdata, &sig, mctx)); + RETERR(dns_rdata_tostruct(&rdata, &sig, NULL)); signeedsfree = ISC_TRUE; if (sig.labels != 0) { @@ -691,7 +692,11 @@ dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg, goto failure; } - /* XXXBEW ensure that sig.signer refers to this key */ + if (!dns_name_equal(dst_key_name(key), &sig.signer)) { + result = DNS_R_SIGINVALID; + msg->sig0status = dns_tsigerror_badkey; + goto failure; + } RETERR(dst_context_create(key, mctx, &ctx)); @@ -751,6 +756,7 @@ dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg, msg->verified_sig = 1; + dst_context_destroy(&ctx); dns_rdata_freestruct(&sig); return (ISC_R_SUCCESS); diff --git a/lib/dns/include/dns/dnssec.h b/lib/dns/include/dns/dnssec.h index 0b5fc371d7..ec65672aa3 100644 --- a/lib/dns/include/dns/dnssec.h +++ b/lib/dns/include/dns/dnssec.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dnssec.h,v 1.15 2000/06/22 21:55:37 tale Exp $ */ +/* $Id: dnssec.h,v 1.16 2000/07/25 17:12:00 bwelling Exp $ */ #ifndef DNS_DNSSEC_H #define DNS_DNSSEC_H 1 @@ -154,6 +154,8 @@ dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg, * ISC_R_SUCCESS * ISC_R_NOMEMORY * ISC_R_NOTFOUND - no SIG(0) was found + * DNS_R_SIGINVALID - the SIG record is not well-formed or + * was not generated by the key. * DST_R_* */ From 0759eb6a0dab024873df528b0ffad804ea31615d Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Tue, 25 Jul 2000 17:48:51 +0000 Subject: [PATCH 188/226] Olafer's patch to give the server time to start --- bin/tests/system/nsupdate/tests.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh index 2ebbd357c8..d91738f716 100644 --- a/bin/tests/system/nsupdate/tests.sh +++ b/bin/tests/system/nsupdate/tests.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: tests.sh,v 1.7 2000/07/25 00:44:18 mws Exp $ +# $Id: tests.sh,v 1.8 2000/07/25 17:48:51 mws Exp $ # # Perform tests @@ -82,6 +82,7 @@ rm named.pid sleep 2 $NAMED -c named.conf -d 99 -g >> named.run 2>&1 & cd .. +sleep 10 echo "I:fetching ns1 after hard restart" $DIG +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd example.nil.\ From d4ab9cd94f0fe0cf24ba36d21240215ae648c8d5 Mon Sep 17 00:00:00 2001 From: James Brister Date: Tue, 25 Jul 2000 17:55:43 +0000 Subject: [PATCH 189/226] 348. [func] New named.conf boolean values 'glue-from-auth' and 'glue-from-cache' now supported in view and global options statement. --- CHANGES | 4 ++ bin/tests/named.conf | 7 ++- lib/dns/config/confctx.c | 19 ++++++- lib/dns/config/confparser.y | 94 +++++++++++++++++++++++++++------- lib/dns/config/confview.c | 16 +++++- lib/dns/include/dns/confctx.h | 18 ++++++- lib/dns/include/dns/confview.h | 4 +- 7 files changed, 137 insertions(+), 25 deletions(-) diff --git a/CHANGES b/CHANGES index 31e1b05d29..ba4358db62 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ + 348. [func] New named.conf boolean values 'glue-from-auth' and + 'glue-from-cache' now supported in view and global + options statement. + 347. [bug] Don't crash if when an argument is left off options in dig. diff --git a/bin/tests/named.conf b/bin/tests/named.conf index 2e67ce21c2..60f62b17a2 100644 --- a/bin/tests/named.conf +++ b/bin/tests/named.conf @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: named.conf,v 1.42 2000/07/21 21:24:55 brister Exp $ */ +/* $Id: named.conf,v 1.43 2000/07/25 17:55:35 brister Exp $ */ /* * This is a worthless, nonrunnable example of a named.conf file that has @@ -34,6 +34,9 @@ // watch out for ";" -- it's important! options { + glue-from-auth true; + glue-from-cache false; + version "my version string"; random-device "/dev/random"; random-seed-file "/random/seed/file"; @@ -262,6 +265,8 @@ view "test-view" in { sig-validity-interval 45; max-cache-size 100000; allow-query { 10.0.0.30;}; + glue-from-cache false; + glue-from-auth no; match-clients { 10.0.0.1 ; }; check-names master warn; check-names slave ignore; diff --git a/lib/dns/config/confctx.c b/lib/dns/config/confctx.c index 14a93258cd..b6e26cbc3b 100644 --- a/lib/dns/config/confctx.c +++ b/lib/dns/config/confctx.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confctx.c,v 1.74 2000/07/24 22:59:34 explorer Exp $ */ +/* $Id: confctx.c,v 1.75 2000/07/25 17:55:37 brister Exp $ */ #include @@ -981,6 +981,8 @@ dns_c_ctx_optionsprint(FILE *fp, int indent, dns_c_options_t *options) PRINT_AS_BOOLEAN(request_ixfr, "request-ixfr"); PRINT_AS_BOOLEAN(provide_ixfr, "provide-ixfr"); PRINT_AS_BOOLEAN(treat_cr_as_space, "treat-cr-as-space"); + PRINT_AS_BOOLEAN(glue_from_auth, "glue-from-auth"); + PRINT_AS_BOOLEAN(glue_from_cache, "glue-from-cache"); if (options->transfer_format != NULL) { dns_c_printtabs(fp, indent + 1); @@ -1496,6 +1498,8 @@ dns_c_ctx_optionsnew(isc_mem_t *mem, dns_c_options_t **options) opts->request_ixfr = NULL; opts->provide_ixfr = NULL; opts->treat_cr_as_space = NULL; + opts->glue_from_auth = NULL; + opts->glue_from_cache = NULL; opts->transfer_source = NULL; opts->transfer_source_v6 = NULL; @@ -1602,7 +1606,8 @@ dns_c_ctx_optionsdelete(dns_c_options_t **opts) FREEFIELD(request_ixfr); FREEFIELD(provide_ixfr); FREEFIELD(treat_cr_as_space); - + FREEFIELD(glue_from_cache); + FREEFIELD(glue_from_auth); FREEFIELD(port); @@ -1969,6 +1974,16 @@ SETBOOL(treatcrasspace, treat_cr_as_space) UNSETBOOL(treatcrasspace, treat_cr_as_space) +GETBOOL(gluefromauth, glue_from_auth) +SETBOOL(gluefromauth, glue_from_auth) +UNSETBOOL(gluefromauth, glue_from_auth) + + +GETBOOL(gluefromcache, glue_from_cache) +SETBOOL(gluefromcache, glue_from_cache) +UNSETBOOL(gluefromcache, glue_from_cache) + + GETSOCKADDR(transfersource, transfer_source) SETSOCKADDR(transfersource, transfer_source) UNSETSOCKADDR(transfersource, transfer_source) diff --git a/lib/dns/config/confparser.y b/lib/dns/config/confparser.y index b5704b6c88..6b75756975 100644 --- a/lib/dns/config/confparser.y +++ b/lib/dns/config/confparser.y @@ -16,7 +16,7 @@ * SOFTWARE. */ -/* $Id: confparser.y,v 1.105 2000/07/24 23:32:31 gson Exp $ */ +/* $Id: confparser.y,v 1.106 2000/07/25 17:55:39 brister Exp $ */ #include @@ -283,6 +283,8 @@ static isc_boolean_t int_too_big(isc_uint32_t base, isc_uint32_t mult); %token L_FIRST %token L_FORWARD %token L_FORWARDERS +%token L_GLUE_FROM_AUTH +%token L_GLUE_FROM_CACHE %token L_GRANT %token L_GROUP %token L_HAS_OLD_CLIENTS @@ -886,6 +888,24 @@ option: /* Empty */ YYABORT; } } + | L_GLUE_FROM_CACHE yea_or_nay + { + tmpres = dns_c_ctx_setgluefromcache(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine glue-from-cache"); + YYABORT; + } + } + | L_GLUE_FROM_AUTH yea_or_nay + { + tmpres = dns_c_ctx_setgluefromauth(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine glue-from-auth"); + YYABORT; + } + } | L_LISTEN_ON maybe_port L_LBRACE address_match_list L_RBRACE { if ($4 == NULL) { @@ -3663,6 +3683,40 @@ view_option: L_FORWARD zone_forward_opt YYABORT; } } + | L_GLUE_FROM_CACHE yea_or_nay + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setgluefromcache(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view glue-from-cache"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view glue-from-cache"); + YYABORT; + } + } + | L_GLUE_FROM_AUTH yea_or_nay + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setgluefromauth(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view glue-from-auth"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view glue-from-auth"); + YYABORT; + } + } | L_QUERY_SOURCE query_source_v4 { dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); @@ -5181,19 +5235,18 @@ static struct token keyword_tokens [] = { { "algorithm", L_ALGID }, { "allow", L_ALLOW }, { "allow-query", L_ALLOW_QUERY }, - { "allow-transfer", L_ALLOW_TRANSFER }, { "allow-recursion", L_ALLOW_RECURSION }, + { "allow-transfer", L_ALLOW_TRANSFER }, { "allow-update", L_ALLOW_UPDATE }, { "allow-update-forwarding", L_ALLOW_UPDATE_FORWARDING }, { "also-notify", L_ALSO_NOTIFY }, { "auth-nxdomain", L_AUTH_NXDOMAIN }, { "blackhole", L_BLACKHOLE }, { "bogus", L_BOGUS }, - { "max-cache-size", L_MAX_CACHE_SIZE }, { "category", L_CATEGORY }, - { "class", L_CLASS }, { "channel", L_CHANNEL }, { "check-names", L_CHECK_NAMES }, + { "class", L_CLASS }, { "cleaning-interval", L_CLEAN_INTERVAL }, { "controls", L_CONTROLS }, { "coresize", L_CORESIZE }, @@ -5202,12 +5255,14 @@ static struct token keyword_tokens [] = { { "deallocate-on-exit", L_DEALLOC_ON_EXIT }, { "debug", L_DEBUG }, { "default", L_DEFAULT }, + { "deny", L_DENY }, { "dialup", L_DIALUP }, { "directory", L_DIRECTORY }, { "dump-file", L_DUMP_FILE }, { "dynamic", L_DYNAMIC }, { "enable-zone", L_ENABLE_ZONE }, { "expert-mode", L_EXPERT_MODE }, + { "explicit", L_EXPLICIT }, { "fail", L_FAIL }, { "fake-iquery", L_FAKE_IQUERY }, { "false", L_FALSE }, @@ -5217,11 +5272,9 @@ static struct token keyword_tokens [] = { { "first", L_FIRST }, { "forward", L_FORWARD }, { "forwarders", L_FORWARDERS }, + { "glue-from-auth", L_GLUE_FROM_AUTH }, + { "glue-from-cache", L_GLUE_FROM_CACHE }, { "grant", L_GRANT }, - { "deny", L_DENY }, - { "subdomain", L_SUBDOMAIN }, - { "self", L_SELF }, - { "wildcard", L_WILDCARD }, { "group", L_GROUP }, { "has-old-clients", L_HAS_OLD_CLIENTS }, { "heartbeat-interval", L_HEARTBEAT }, @@ -5247,18 +5300,19 @@ static struct token keyword_tokens [] = { { "master", L_MASTER }, { "masters", L_MASTERS }, { "match-clients", L_MATCH_CLIENTS }, - { "max-ixfr-log-size", L_MAX_LOG_SIZE_IXFR }, + { "max-cache-size", L_MAX_CACHE_SIZE }, { "max-cache-ttl", L_MAX_CACHE_TTL }, + { "max-ixfr-log-size", L_MAX_LOG_SIZE_IXFR }, { "max-ncache-ttl", L_MAX_NCACHE_TTL }, - { "max-transfer-time-in", L_MAX_TRANSFER_TIME_IN }, - { "max-transfer-time-out", L_MAX_TRANSFER_TIME_OUT }, { "max-transfer-idle-in", L_MAX_TRANSFER_IDLE_IN }, { "max-transfer-idle-out", L_MAX_TRANSFER_IDLE_OUT }, + { "max-transfer-time-in", L_MAX_TRANSFER_TIME_IN }, + { "max-transfer-time-out", L_MAX_TRANSFER_TIME_OUT }, { "maximal", L_MAXIMAL }, { "memstatistics-file", L_MEMSTATS_FILE }, - { "multiple-cnames", L_MULTIPLE_CNAMES }, { "min-roots", L_MIN_ROOTS }, { "minimal", L_MINIMAL }, + { "multiple-cnames", L_MULTIPLE_CNAMES }, { "name", L_NAME }, { "named-xfer", L_NAMED_XFER }, { "no", L_NO }, @@ -5266,8 +5320,8 @@ static struct token keyword_tokens [] = { { "null", L_NULL_OUTPUT }, { "one-answer", L_ONE_ANSWER }, { "only", L_ONLY }, - { "order", L_ORDER }, { "options", L_OPTIONS }, + { "order", L_ORDER }, { "owner", L_OWNER }, { "perm", L_PERM }, { "pid-file", L_PIDFILE }, @@ -5281,15 +5335,16 @@ static struct token keyword_tokens [] = { { "query-source-v6", L_QUERY_SOURCE_V6 }, { "random-device", L_RANDOM_DEVICE }, { "random-seed-file", L_RANDOM_SEED_FILE }, - { "request-ixfr", L_REQUEST_IXFR }, - { "rfc2308-type1", L_RFC2308_TYPE1 }, - { "rrset-order", L_RRSET_ORDER }, { "recursion", L_RECURSION }, { "recursive-clients", L_RECURSIVE_CLIENTS }, + { "request-ixfr", L_REQUEST_IXFR }, { "response", L_RESPONSE }, + { "rfc2308-type1", L_RFC2308_TYPE1 }, + { "rrset-order", L_RRSET_ORDER }, { "secret", L_SECRET }, - { "server", L_SERVER }, + { "self", L_SELF }, { "serial-queries", L_SERIAL_QUERIES }, + { "server", L_SERVER }, { "severity", L_SEVERITY }, { "sig-validity-interval", L_SIG_VALIDITY_INTERVAL }, { "size", L_SIZE }, @@ -5300,11 +5355,12 @@ static struct token keyword_tokens [] = { { "statistics-interval", L_STATS_INTERVAL }, { "stderr", L_STDERR }, { "stub", L_STUB }, + { "subdomain", L_SUBDOMAIN }, { "support-ixfr", L_SUPPORT_IXFR }, { "syslog", L_SYSLOG }, { "tcp-clients", L_TCP_CLIENTS }, - { "tkey-domain", L_TKEY_DOMAIN }, { "tkey-dhkey", L_TKEY_DHKEY }, + { "tkey-domain", L_TKEY_DOMAIN }, { "topology", L_TOPOLOGY }, { "transfer-format", L_TRANSFER_FORMAT }, { "transfer-source", L_TRANSFER_SOURCE }, @@ -5326,9 +5382,9 @@ static struct token keyword_tokens [] = { { "versions", L_VERSIONS }, { "view", L_VIEW }, { "warn", L_WARN }, + { "wildcard", L_WILDCARD }, { "yes", L_YES }, { "zone", L_ZONE }, - { "explicit", L_EXPLICIT }, { NULL, 0 } }; diff --git a/lib/dns/config/confview.c b/lib/dns/config/confview.c index 0f4231f16e..9e9bf2eb48 100644 --- a/lib/dns/config/confview.c +++ b/lib/dns/config/confview.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confview.c,v 1.37 2000/07/24 22:59:37 explorer Exp $ */ +/* $Id: confview.c,v 1.38 2000/07/25 17:55:40 brister Exp $ */ #include @@ -474,6 +474,8 @@ dns_c_view_new(isc_mem_t *mem, const char *name, dns_rdataclass_t viewclass, view->fetch_glue = NULL; view->notify = NULL; view->rfc2308_type1 = NULL; + view->glue_from_cache = NULL; + view->glue_from_auth = NULL; view->transfer_source = NULL; view->transfer_source_v6 = NULL; @@ -665,6 +667,8 @@ dns_c_view_print(FILE *fp, int indent, dns_c_view_t *view) { PRINT_AS_BOOLEAN(fetch_glue, "fetch-glue"); PRINT_AS_BOOLEAN(notify, "notify"); PRINT_AS_BOOLEAN(rfc2308_type1, "rfc2308-type1"); + PRINT_AS_BOOLEAN(glue_from_auth, "glue-from-auth"); + PRINT_AS_BOOLEAN(glue_from_cache, "glue-from-cache"); PRINT_IP(transfer_source, "transfer-source"); @@ -802,6 +806,8 @@ dns_c_view_delete(dns_c_view_t **viewptr) { FREEFIELD(fetch_glue); FREEFIELD(notify); FREEFIELD(rfc2308_type1); + FREEFIELD(glue_from_auth); + FREEFIELD(glue_from_cache); FREEFIELD(transfer_source); FREEFIELD(transfer_source_v6); @@ -1469,6 +1475,14 @@ SETBOOL(rfc2308type1, rfc2308_type1) GETBOOL(rfc2308type1, rfc2308_type1) UNSETBOOL(rfc2308type1, rfc2308_type1) +SETBOOL(gluefromcache, glue_from_cache) +GETBOOL(gluefromcache, glue_from_cache) +UNSETBOOL(gluefromcache, glue_from_cache) + +SETBOOL(gluefromauth, glue_from_auth) +GETBOOL(gluefromauth, glue_from_auth) +UNSETBOOL(gluefromauth, glue_from_auth) + GETSOCKADDR(transfersource, transfer_source) SETSOCKADDR(transfersource, transfer_source) UNSETSOCKADDR(transfersource, transfer_source) diff --git a/lib/dns/include/dns/confctx.h b/lib/dns/include/dns/confctx.h index 25f3899bd1..e329ec8f2d 100644 --- a/lib/dns/include/dns/confctx.h +++ b/lib/dns/include/dns/confctx.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confctx.h,v 1.44 2000/07/24 22:59:39 explorer Exp $ */ +/* $Id: confctx.h,v 1.45 2000/07/25 17:55:42 brister Exp $ */ #ifndef DNS_CONFCTX_H #define DNS_CONFCTX_H 1 @@ -167,6 +167,8 @@ struct dns_c_options { isc_boolean_t *request_ixfr; isc_boolean_t *provide_ixfr; isc_boolean_t *treat_cr_as_space; + isc_boolean_t *glue_from_cache; + isc_boolean_t *glue_from_auth; isc_sockaddr_t *transfer_source; isc_sockaddr_t *transfer_source_v6; @@ -585,6 +587,20 @@ isc_result_t dns_c_ctx_gettreatcrasspace(dns_c_ctx_t *cfg, isc_boolean_t *retval); +isc_result_t dns_c_ctx_getgluefromcache(dns_c_ctx_t *cfg, + isc_boolean_t *retval); +isc_result_t dns_c_ctx_setgluefromcache(dns_c_ctx_t *cfg, + isc_boolean_t newval); +isc_result_t dns_c_ctx_unsetgluefromcache(dns_c_ctx_t *ctx); + + +isc_result_t dns_c_ctx_getgluefromauth(dns_c_ctx_t *cfg, + isc_boolean_t *retval); +isc_result_t dns_c_ctx_setgluefromauth(dns_c_ctx_t *cfg, + isc_boolean_t newval); +isc_result_t dns_c_ctx_unsetgluefromauth(dns_c_ctx_t *ctx); + + isc_result_t dns_c_ctx_unsettreatcrasspace(dns_c_ctx_t *cfg); isc_result_t dns_c_ctx_settransfersource(dns_c_ctx_t *ctx, isc_sockaddr_t transfer_source); diff --git a/lib/dns/include/dns/confview.h b/lib/dns/include/dns/confview.h index 44719150b9..9ec7ca1a90 100644 --- a/lib/dns/include/dns/confview.h +++ b/lib/dns/include/dns/confview.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confview.h,v 1.31 2000/07/24 22:59:41 explorer Exp $ */ +/* $Id: confview.h,v 1.32 2000/07/25 17:55:43 brister Exp $ */ #ifndef DNS_CONFVIEW_H #define DNS_CONFVIEW_H 1 @@ -124,6 +124,8 @@ struct dns_c_view { isc_boolean_t *fetch_glue; isc_boolean_t *notify; isc_boolean_t *rfc2308_type1; + isc_boolean_t *glue_from_auth; + isc_boolean_t *glue_from_cache; isc_sockaddr_t *query_source; isc_sockaddr_t *query_source_v6; From 8cfe1a4846d356bd3c44705dfc8ecb783201db98 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Tue, 25 Jul 2000 19:29:00 +0000 Subject: [PATCH 190/226] Typo correction in DNS_MAX/MIN_RETRY usage Don't #define mins/maxes if they are already defined. (per MG) --- lib/dns/zone.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/lib/dns/zone.c b/lib/dns/zone.c index 04b640efc2..5f3a596bf0 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: zone.c,v 1.166 2000/07/24 22:59:31 explorer Exp $ */ +/* $Id: zone.c,v 1.167 2000/07/25 19:29:00 mws Exp $ */ #include @@ -69,11 +69,21 @@ /* * Implementation limits. */ +#ifndef DNS_MIN_REFRESH #define DNS_MIN_REFRESH 2 /* 2 seconds */ +#endif +#ifndef DNS_MAX_REFRESH #define DNS_MAX_REFRESH 2419200 /* 4 weeks */ +#endif +#ifndef DNS_MIN_RETRY #define DNS_MIN_RETRY 1 /* 1 second */ +#endif +#ifndef DNS_MAX_RETRY #define DNS_MAX_RETRY 1209600 /* 2 weeks */ +#endif +#ifndef DNS_MAX_EXPIRE #define DNS_MAX_EXPIRE 14515200 /* 24 weeks */ +#endif /* * Default values. @@ -769,7 +779,7 @@ dns_zone_load(dns_zone_t *zone) { zone->serial = serial; zone->refresh = RANGE(refresh, DNS_MIN_REFRESH, DNS_MAX_REFRESH); - zone->retry = RANGE(retry, DNS_MIN_REFRESH, DNS_MAX_REFRESH); + zone->retry = RANGE(retry, DNS_MIN_RETRY, DNS_MAX_RETRY); zone->expire = RANGE(expire, zone->refresh + zone->retry, DNS_MAX_EXPIRE); zone->minimum = minimum; @@ -3850,8 +3860,8 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) { zone->serial = serial; zone->refresh = RANGE(refresh, DNS_MIN_REFRESH, DNS_MAX_REFRESH); - zone->retry = RANGE(retry, DNS_MIN_REFRESH, - DNS_MAX_REFRESH); + zone->retry = RANGE(retry, DNS_MIN_RETRY, + DNS_MAX_RETRY); zone->expire = RANGE(expire, zone->refresh + zone->retry, DNS_MAX_EXPIRE); From 07919f7bb8b96b8ccc91a21bf6651fe32220c86b Mon Sep 17 00:00:00 2001 From: James Brister Date: Tue, 25 Jul 2000 20:16:00 +0000 Subject: [PATCH 191/226] Do a dns_c_iplist_attach first when returning the iplist from also-notify. --- lib/dns/config/confzone.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/dns/config/confzone.c b/lib/dns/config/confzone.c index 3f61c0de11..e1796128f1 100644 --- a/lib/dns/config/confzone.c +++ b/lib/dns/config/confzone.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confzone.c,v 1.49 2000/07/24 22:59:38 explorer Exp $ */ +/* $Id: confzone.c,v 1.50 2000/07/25 20:16:00 brister Exp $ */ #include @@ -1670,7 +1670,7 @@ dns_c_zone_getalsonotify(dns_c_zone_t *zone, dns_c_iplist_t **retval) { } if (p != NULL) { - *retval = p; + dns_c_iplist_attach(p, retval); res = ISC_R_SUCCESS; } else { res = ISC_R_NOTFOUND; From b28affc652da3bcea8a4ada5211c261a829b05ba Mon Sep 17 00:00:00 2001 From: James Brister Date: Tue, 25 Jul 2000 20:17:52 +0000 Subject: [PATCH 192/226] Added missing prototypes. --- lib/dns/include/dns/confview.h | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/lib/dns/include/dns/confview.h b/lib/dns/include/dns/confview.h index 9ec7ca1a90..ad9f85dd9c 100644 --- a/lib/dns/include/dns/confview.h +++ b/lib/dns/include/dns/confview.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confview.h,v 1.32 2000/07/25 17:55:43 brister Exp $ */ +/* $Id: confview.h,v 1.33 2000/07/25 20:17:52 brister Exp $ */ #ifndef DNS_CONFVIEW_H #define DNS_CONFVIEW_H 1 @@ -351,6 +351,20 @@ isc_result_t dns_c_view_setrfc2308type1(dns_c_view_t *view, isc_result_t dns_c_view_unsetrfc2308type1(dns_c_view_t *view); +isc_result_t dns_c_view_getgluefromauth(dns_c_view_t *view, + isc_boolean_t *retval); +isc_result_t dns_c_view_setgluefromauth(dns_c_view_t *view, + isc_boolean_t newval); +isc_result_t dns_c_view_unsetgluefromauth(dns_c_view_t *view); + + +isc_result_t dns_c_view_getgluefromcache(dns_c_view_t *view, + isc_boolean_t *retval); +isc_result_t dns_c_view_setgluefromcache(dns_c_view_t *view, + isc_boolean_t newval); +isc_result_t dns_c_view_unsetgluefromcache(dns_c_view_t *view); + + isc_result_t dns_c_view_settransfersource(dns_c_view_t *view, isc_sockaddr_t transfer_source); From 7e0d7323d73f31ceb678879ad3aca873dc382483 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 25 Jul 2000 20:26:11 +0000 Subject: [PATCH 193/226] Detach from the iplist obtained from *_getalsonotify. --- bin/named/zoneconf.c | 14 +++++++++----- lib/dns/zoneconf.c | 14 +++++++++----- 2 files changed, 18 insertions(+), 10 deletions(-) diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c index 149848285f..88da4f7745 100644 --- a/bin/named/zoneconf.c +++ b/bin/named/zoneconf.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: zoneconf.c,v 1.46 2000/07/24 22:59:32 explorer Exp $ */ +/* $Id: zoneconf.c,v 1.47 2000/07/25 20:26:11 bwelling Exp $ */ #include @@ -190,10 +190,14 @@ dns_zone_configure(dns_c_ctx_t *cctx, dns_c_view_t *cview, result = dns_c_view_getalsonotify(cview, &iplist); if (result != ISC_R_SUCCESS) result = dns_c_ctx_getalsonotify(cctx, &iplist); - if (result == ISC_R_SUCCESS) - RETERR(dns_zone_setalsonotify(zone, iplist->ips, - iplist->nextidx)); - else + if (result == ISC_R_SUCCESS) { + result = dns_zone_setalsonotify(zone, iplist->ips, + iplist->nextidx); + dns_c_iplist_detach(&iplist); + if (result != ISC_R_SUCCESS) + return (result); + + } else RETERR(dns_zone_setalsonotify(zone, NULL, 0)); RETERR(configure_zone_acl(czone, cctx, cview, ac, zone, diff --git a/lib/dns/zoneconf.c b/lib/dns/zoneconf.c index 149848285f..88da4f7745 100644 --- a/lib/dns/zoneconf.c +++ b/lib/dns/zoneconf.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: zoneconf.c,v 1.46 2000/07/24 22:59:32 explorer Exp $ */ +/* $Id: zoneconf.c,v 1.47 2000/07/25 20:26:11 bwelling Exp $ */ #include @@ -190,10 +190,14 @@ dns_zone_configure(dns_c_ctx_t *cctx, dns_c_view_t *cview, result = dns_c_view_getalsonotify(cview, &iplist); if (result != ISC_R_SUCCESS) result = dns_c_ctx_getalsonotify(cctx, &iplist); - if (result == ISC_R_SUCCESS) - RETERR(dns_zone_setalsonotify(zone, iplist->ips, - iplist->nextidx)); - else + if (result == ISC_R_SUCCESS) { + result = dns_zone_setalsonotify(zone, iplist->ips, + iplist->nextidx); + dns_c_iplist_detach(&iplist); + if (result != ISC_R_SUCCESS) + return (result); + + } else RETERR(dns_zone_setalsonotify(zone, NULL, 0)); RETERR(configure_zone_acl(czone, cctx, cview, ac, zone, From 1702f1a0fec50e754a033cf3271676373c6b4c15 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 25 Jul 2000 21:37:05 +0000 Subject: [PATCH 194/226] Add a 'fetchoptions' field to the query structure, which is currently 0 unless the query has the cd bit set. --- bin/named/include/named/query.h | 3 ++- bin/named/query.c | 14 +++++++++----- 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/bin/named/include/named/query.h b/bin/named/include/named/query.h index a67121032a..f0d7b9c71c 100644 --- a/bin/named/include/named/query.h +++ b/bin/named/include/named/query.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: query.h,v 1.17 2000/06/22 21:49:50 tale Exp $ */ +/* $Id: query.h,v 1.18 2000/07/25 21:37:05 bwelling Exp $ */ #ifndef NAMED_QUERY_H #define NAMED_QUERY_H 1 @@ -42,6 +42,7 @@ struct ns_query { dns_name_t * origqname; dns_rdataset_t * qrdataset; unsigned int dboptions; + unsigned int fetchoptions; dns_db_t * gluedb; dns_fetch_t * fetch; dns_a6context_t a6ctx; diff --git a/bin/named/query.c b/bin/named/query.c index be0a5262fc..8a0a00d9c1 100644 --- a/bin/named/query.c +++ b/bin/named/query.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: query.c,v 1.116 2000/07/25 01:06:18 bwelling Exp $ */ +/* $Id: query.c,v 1.117 2000/07/25 21:37:03 bwelling Exp $ */ #include @@ -169,6 +169,7 @@ query_reset(ns_client_t *client, isc_boolean_t everything) { client->query.qname = NULL; client->query.qrdataset = NULL; client->query.dboptions = 0; + client->query.fetchoptions = 0; client->query.gluedb = NULL; } @@ -1818,7 +1819,6 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qdomain, { isc_result_t result; dns_rdataset_t *rdataset, *sigrdataset; - unsigned int options = 0; /* * We are about to recurse, which means that this client will @@ -1860,7 +1860,8 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qdomain, result = dns_resolver_createfetch(client->view->resolver, client->query.qname, qtype, qdomain, nameservers, - NULL, options, client->task, + NULL, client->query.fetchoptions, + client->task, query_resume, client, rdataset, sigrdataset, &client->query.fetch); @@ -2957,10 +2958,13 @@ ns_query_start(ns_client_t *client) { /* * If the client has requested that DNSSEC checking be disabled, - * allow lookups to return pending data. + * allow lookups to return pending data and instruct the resolver + * to return data before validation has completed. */ - if (message->flags & DNS_MESSAGEFLAG_CD) + if (message->flags & DNS_MESSAGEFLAG_CD) { client->query.dboptions |= DNS_DBFIND_PENDINGOK; + client->query.fetchoptions |= DNS_FETCHOPT_NOVALIDATE; + } /* * This is an ordinary query. From 69a761838bc6ff2271627b6e735cfc7817fdd186 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 25 Jul 2000 22:03:25 +0000 Subject: [PATCH 195/226] Support for the cd (checking disabled) bit. Also remove data from the cache if validation fails. --- lib/dns/resolver.c | 71 +++++++++++++++++++++++++++++++++++++++------- 1 file changed, 60 insertions(+), 11 deletions(-) diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index a1bff420a7..7bb1df8b37 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: resolver.c,v 1.152 2000/07/24 23:55:19 gson Exp $ */ +/* $Id: resolver.c,v 1.153 2000/07/25 22:03:25 bwelling Exp $ */ #include @@ -2267,6 +2267,7 @@ validated(isc_task_t *task, isc_event_t *event) { dns_rdataset_t *asigrdataset = NULL; dns_dbnode_t *node = NULL; isc_boolean_t negative; + isc_boolean_t sentresponse; UNUSED(task); /* for now */ @@ -2289,19 +2290,23 @@ validated(isc_task_t *task, isc_event_t *event) { negative = ISC_TF(vevent->rdataset == NULL); + sentresponse = ISC_TF((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0); + /* * If shutting down, ignore the results. Check to see if we're * done waiting for validator completions and ADB pending events; if * so, destroy the fctx. */ - if (SHUTTINGDOWN(fctx)) { + if (SHUTTINGDOWN(fctx) && !sentresponse ) { maybe_destroy(fctx); goto cleanup_event; } /* - * We're not shutting down. - */ + * Either we're not shutting down, or we are shutting down but want + * to cache the result anyway (if this was a validation started by + * a query with cd set) + */ hevent = ISC_LIST_HEAD(fctx->events); if (hevent != NULL) { @@ -2320,6 +2325,22 @@ validated(isc_task_t *task, isc_event_t *event) { if (vevent->result != ISC_R_SUCCESS) { FCTXTRACE("validation failed"); + if (vevent->rdataset != NULL) { + result = dns_db_findnode(fctx->res->view->cachedb, + vevent->name, ISC_TRUE, + &node); + if (result != ISC_R_SUCCESS) + goto noanswer_response; + (void)dns_db_deleterdataset(fctx->res->view->cachedb, + node, NULL, + vevent->type, 0); + if (vevent->sigrdataset != NULL) + (void)dns_db_deleterdataset( + fctx->res->view->cachedb, + node, NULL, + dns_rdatatype_sig, + vevent->type); + } result = vevent->result; goto noanswer_response; } @@ -2381,6 +2402,17 @@ validated(isc_task_t *task, isc_event_t *event) { goto noanswer_response; } + if (sentresponse) { + /* + * If we only deferred the destroy because we wanted to cache + * the data, destroy now. + */ + if (SHUTTINGDOWN(fctx)) + maybe_destroy(fctx); + + goto cleanup_event; + } + if (fctx->validating > 0) { INSIST(!negative); INSIST(fctx->type == dns_rdatatype_any || @@ -2432,7 +2464,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) { dns_db_t **adbp; dns_name_t *aname; dns_resolver_t *res; - isc_boolean_t need_validation, have_answer; + isc_boolean_t need_validation, secure_domain, have_answer; isc_result_t result, eresult; dns_fetchevent_t *event; unsigned int options; @@ -2445,6 +2477,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) { res = fctx->res; need_validation = ISC_FALSE; + secure_domain = ISC_FALSE; have_answer = ISC_FALSE; eresult = ISC_R_SUCCESS; task = res->buckets[fctx->bucketnum].task; @@ -2453,10 +2486,15 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) { * Is DNSSEC validation required for this name? */ result = dns_keytable_issecuredomain(res->view->secroots, name, - &need_validation); + &secure_domain); if (result != ISC_R_SUCCESS) return (result); + if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0) + need_validation = ISC_FALSE; + else + need_validation = secure_domain; + adbp = NULL; aname = NULL; anodep = NULL; @@ -2509,7 +2547,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) { * If this rrset is in a secure domain, do DNSSEC validation * for it, unless it is glue. */ - if (need_validation && rdataset->trust != dns_trust_glue) { + if (secure_domain && rdataset->trust != dns_trust_glue) { /* * SIGs are validated as part of validating the * type they cover. @@ -2527,7 +2565,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) { break; } if (sigrdataset == NULL) { - if (!ANSWER(rdataset)) { + if (!ANSWER(rdataset) && need_validation) { /* * Ignore non-answer rdatasets that * are missing signatures. @@ -2552,23 +2590,34 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) { rdataset->trust = dns_trust_pending; if (sigrdataset != NULL) sigrdataset->trust = dns_trust_pending; + if (!need_validation) + addedrdataset = ardataset; + else + addedrdataset = NULL; result = dns_db_addrdataset(res->view->cachedb, node, NULL, now, - rdataset, 0, NULL); + rdataset, 0, + addedrdataset); if (result == DNS_R_UNCHANGED) result = ISC_R_SUCCESS; if (result != ISC_R_SUCCESS) break; if (sigrdataset != NULL) { + if (!need_validation) + addedrdataset = asigrdataset; + else + addedrdataset = NULL; result = dns_db_addrdataset(res->view->cachedb, node, NULL, now, sigrdataset, 0, - NULL); + addedrdataset); if (result == DNS_R_UNCHANGED) result = ISC_R_SUCCESS; if (result != ISC_R_SUCCESS) break; - } + } else + continue; + if (ANSWER(rdataset)) { if (fctx->type != dns_rdatatype_any && fctx->type != dns_rdatatype_sig) { From 94ec6e9a1a335c419b640bf875a6a052c3c5cbc2 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 25 Jul 2000 22:04:33 +0000 Subject: [PATCH 196/226] whitespace fixes --- lib/dns/resolver.c | 48 +++++++++++++++++++++++----------------------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 7bb1df8b37..c5d297a1b4 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: resolver.c,v 1.153 2000/07/25 22:03:25 bwelling Exp $ */ +/* $Id: resolver.c,v 1.154 2000/07/25 22:04:33 bwelling Exp $ */ #include @@ -2260,8 +2260,8 @@ validated(isc_task_t *task, isc_event_t *event) { isc_result_t result = ISC_R_SUCCESS; isc_result_t eresult = ISC_R_SUCCESS; isc_stdtime_t now; - fetchctx_t *fctx; - dns_validatorevent_t *vevent; + fetchctx_t *fctx; + dns_validatorevent_t *vevent; dns_fetchevent_t *hevent; dns_rdataset_t *ardataset = NULL; dns_rdataset_t *asigrdataset = NULL; @@ -2269,14 +2269,14 @@ validated(isc_task_t *task, isc_event_t *event) { isc_boolean_t negative; isc_boolean_t sentresponse; - UNUSED(task); /* for now */ + UNUSED(task); /* for now */ - REQUIRE(event->ev_type == DNS_EVENT_VALIDATORDONE); - fctx = event->ev_arg; - REQUIRE(VALID_FCTX(fctx)); - REQUIRE(fctx->validating > 0); + REQUIRE(event->ev_type == DNS_EVENT_VALIDATORDONE); + fctx = event->ev_arg; + REQUIRE(VALID_FCTX(fctx)); + REQUIRE(fctx->validating > 0); - vevent = (dns_validatorevent_t *)event; + vevent = (dns_validatorevent_t *)event; FCTXTRACE("received validation completion event"); @@ -2286,16 +2286,16 @@ validated(isc_task_t *task, isc_event_t *event) { */ dns_validator_destroy(&vevent->validator); - fctx->validating--; + fctx->validating--; negative = ISC_TF(vevent->rdataset == NULL); sentresponse = ISC_TF((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0); - /* - * If shutting down, ignore the results. Check to see if we're - * done waiting for validator completions and ADB pending events; if - * so, destroy the fctx. + /* + * If shutting down, ignore the results. Check to see if we're + * done waiting for validator completions and ADB pending events; if + * so, destroy the fctx. */ if (SHUTTINGDOWN(fctx) && !sentresponse ) { maybe_destroy(fctx); @@ -2323,7 +2323,7 @@ validated(isc_task_t *task, isc_event_t *event) { } } - if (vevent->result != ISC_R_SUCCESS) { + if (vevent->result != ISC_R_SUCCESS) { FCTXTRACE("validation failed"); if (vevent->rdataset != NULL) { result = dns_db_findnode(fctx->res->view->cachedb, @@ -2413,7 +2413,7 @@ validated(isc_task_t *task, isc_event_t *event) { goto cleanup_event; } - if (fctx->validating > 0) { + if (fctx->validating > 0) { INSIST(!negative); INSIST(fctx->type == dns_rdatatype_any || fctx->type == dns_rdatatype_sig); @@ -2876,15 +2876,15 @@ ncache_message(fetchctx_t *fctx, dns_rdatatype_t covers, isc_stdtime_t now) { * Do negative response validation. */ dns_validator_t *validator = NULL; - isc_task_t *task = res->buckets[fctx->bucketnum].task; - result = dns_validator_create(res->view, name, fctx->type, + isc_task_t *task = res->buckets[fctx->bucketnum].task; + result = dns_validator_create(res->view, name, fctx->type, NULL, NULL, - fctx->rmessage, 0, task, - validated, fctx, - &validator); - if (result != ISC_R_SUCCESS) - return (result); - fctx->validating++; + fctx->rmessage, 0, task, + validated, fctx, + &validator); + if (result != ISC_R_SUCCESS) + return (result); + fctx->validating++; return (ISC_R_SUCCESS); } From dc2c974dcf954a0a238d1afb886c445d06b1aa8b Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 25 Jul 2000 22:07:50 +0000 Subject: [PATCH 197/226] 349. [func] Processing a query with the CD bit set now works as expected. --- CHANGES | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGES b/CHANGES index ba4358db62..1606617c87 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ + + 349. [func] Processing a query with the CD bit set now works + as expected. + 348. [func] New named.conf boolean values 'glue-from-auth' and 'glue-from-cache' now supported in view and global options statement. From ec340150172e23c06ace7b8a3f111073195760d5 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Tue, 25 Jul 2000 22:38:29 +0000 Subject: [PATCH 198/226] dns_c_view_getalsonotify() should attach the list like both the global and per-zone counterparts now do --- lib/dns/config/confview.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/lib/dns/config/confview.c b/lib/dns/config/confview.c index 9e9bf2eb48..fec3f3aa06 100644 --- a/lib/dns/config/confview.c +++ b/lib/dns/config/confview.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confview.c,v 1.38 2000/07/25 17:55:40 brister Exp $ */ +/* $Id: confview.c,v 1.39 2000/07/25 22:38:29 gson Exp $ */ #include @@ -1063,10 +1063,12 @@ dns_c_view_getalsonotify(dns_c_view_t *view, { REQUIRE(DNS_C_VIEW_VALID(view)); REQUIRE(ipl != NULL); - - *ipl = view->also_notify; - return (*ipl == NULL ? ISC_R_NOTFOUND : ISC_R_SUCCESS); + if (view->also_notify == NULL) + return (ISC_R_NOTFOUND); + + dns_c_iplist_attach(view->also_notify, ipl); + return (ISC_R_SUCCESS); } From 49855f0856a0f6f9fed80af88faddf38f3e74eef Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Tue, 25 Jul 2000 22:46:18 +0000 Subject: [PATCH 199/226] 350. [bug] Also-notify lists specified in the global options block were not correctly reference counted, causing a memory leak. --- CHANGES | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGES b/CHANGES index 1606617c87..e280bf902e 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,8 @@ + 350. [bug] Also-notify lists specified in the global options + block were not correctly reference counted, causing + a memory leak. + 349. [func] Processing a query with the CD bit set now works as expected. From 6dc130c7c95107748fff5f767161c2bb742f9f87 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 25 Jul 2000 22:51:46 +0000 Subject: [PATCH 200/226] 351. [bug] Constructing a response with rcode SERVFAIL to a TSIG signed query could crash the server. --- CHANGES | 4 ++++ lib/dns/message.c | 5 +++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/CHANGES b/CHANGES index e280bf902e..5aae798ccd 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,8 @@ + 351. [bug] Constructing a response with rcode SERVFAIL to a TSIG + signed query could crash the server. + + block were not correctly reference counted, causing 350. [bug] Also-notify lists specified in the global options block were not correctly reference counted, causing a memory leak. diff --git a/lib/dns/message.c b/lib/dns/message.c index 1123b71e1f..2639c8f216 100644 --- a/lib/dns/message.c +++ b/lib/dns/message.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: message.c,v 1.135 2000/07/20 00:05:32 gson Exp $ */ +/* $Id: message.c,v 1.136 2000/07/25 22:51:45 bwelling Exp $ */ /*** *** Imports @@ -442,9 +442,10 @@ msgresetsigs(dns_message_t *msg, isc_boolean_t replying) { isc_mempool_put(msg->namepool, msg->tsigname); msg->tsig = NULL; msg->tsigname = NULL; - } else if (msg->querytsig != NULL) { + } else if (msg->querytsig != NULL && !replying) { dns_rdataset_disassociate(msg->querytsig); isc_mempool_put(msg->rdspool, msg->querytsig); + msg->querytsig = NULL; } if (msg->sig0 != NULL) { INSIST(dns_rdataset_isassociated(msg->sig0)); From 905e0c15332d3209dd73ff8b2334f6b80f7fe3a6 Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Tue, 25 Jul 2000 23:54:09 +0000 Subject: [PATCH 201/226] [RT #186] check for various networking items (eg, getaddrinfo) after Kame test --- configure | 1141 +++++++++++++++++++++++++------------------------- configure.in | 351 ++++++++-------- 2 files changed, 753 insertions(+), 739 deletions(-) diff --git a/configure b/configure index 287b4baf74..c8729e0236 100755 --- a/configure +++ b/configure @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# From configure.in Revision: 1.168 +# From configure.in Revision: 1.169 ## libtool.m4 - Configure libtool for the target system. -*-Shell-script-*- ## Copyright (C) 1996-1999 Free Software Foundation, Inc. @@ -2645,504 +2645,6 @@ fi # -# Networking specifics. -# -case "$host" in - *-dec-osf*) - # Turn on 4.4BSD style sa_len support. - cat >> confdefs.h <<\EOF -#define _SOCKADDR_LEN 1 -EOF - - ;; -esac - -# -# Look for a 4.4BSD-style sa_len member in struct sockaddr. -# -echo $ac_n "checking for sa_len in struct sockaddr""... $ac_c" 1>&6 -echo "configure:2665: checking for sa_len in struct sockaddr" >&5 -cat > conftest.$ac_ext < -#include -int main() { -struct sockaddr sa; sa.sa_len = 0; return (0); -; return 0; } -EOF -if { (eval echo configure:2676: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then - rm -rf conftest* - echo "$ac_t""yes" 1>&6 - ISC_PLATFORM_HAVESALEN="#define ISC_PLATFORM_HAVESALEN 1" - LWRES_PLATFORM_HAVESALEN="#define LWRES_PLATFORM_HAVESALEN 1" -else - echo "configure: failed program was:" >&5 - cat conftest.$ac_ext >&5 - rm -rf conftest* - echo "$ac_t""no" 1>&6 - ISC_PLATFORM_HAVESALEN="#undef ISC_PLATFORM_HAVESALEN" - LWRES_PLATFORM_HAVESALEN="#undef LWRES_PLATFORM_HAVESALEN" -fi -rm -f conftest* - - - -# -# Look for a 4.4BSD or 4.3BSD struct msghdr -# -echo $ac_n "checking for struct msghdr flavor""... $ac_c" 1>&6 -echo "configure:2697: checking for struct msghdr flavor" >&5 -cat > conftest.$ac_ext < -#include -int main() { -struct msghdr msg; msg.msg_flags = 0; return (0); -; return 0; } -EOF -if { (eval echo configure:2708: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then - rm -rf conftest* - echo "$ac_t""4.4BSD" 1>&6 - ISC_PLATFORM_MSGHDRFLAVOR="#define ISC_NET_BSD44MSGHDR 1" -else - echo "configure: failed program was:" >&5 - cat conftest.$ac_ext >&5 - rm -rf conftest* - echo "$ac_t""4.3BSD" 1>&6 - ISC_PLATFORM_MSGHDRFLAVOR="#define ISC_NET_BSD43MSGHDR 1" -fi -rm -f conftest* - - -# -# Look for in_port_t. -# -echo $ac_n "checking for type in_port_t""... $ac_c" 1>&6 -echo "configure:2726: checking for type in_port_t" >&5 -cat > conftest.$ac_ext < -#include -int main() { -in_port_t port = 25; return (0); -; return 0; } -EOF -if { (eval echo configure:2737: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then - rm -rf conftest* - echo "$ac_t""yes" 1>&6 - ISC_PLATFORM_NEEDPORTT="#undef ISC_PLATFORM_NEEDPORTT" -else - echo "configure: failed program was:" >&5 - cat conftest.$ac_ext >&5 - rm -rf conftest* - echo "$ac_t""no" 1>&6 - ISC_PLATFORM_NEEDPORTT="#define ISC_PLATFORM_NEEDPORTT 1" -fi -rm -f conftest* - - -# -# Check for addrinfo -# -echo $ac_n "checking for struct addrinfo""... $ac_c" 1>&6 -echo "configure:2755: checking for struct addrinfo" >&5 -cat > conftest.$ac_ext < -int main() { -struct addrinfo a; return (0); -; return 0; } -EOF -if { (eval echo configure:2765: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then - rm -rf conftest* - echo "$ac_t""yes" 1>&6 - ISC_LWRES_NEEDADDRINFO="#undef ISC_LWRES_NEEDADDRINFO" - cat >> confdefs.h <<\EOF -#define HAVE_ADDRINFO 1 -EOF - -else - echo "configure: failed program was:" >&5 - cat conftest.$ac_ext >&5 - rm -rf conftest* - echo "$ac_t""no" 1>&6 - ISC_LWRES_NEEDADDRINFO="#define ISC_LWRES_NEEDADDRINFO 1" -fi -rm -f conftest* - - -echo $ac_n "checking for int sethostent""... $ac_c" 1>&6 -echo "configure:2784: checking for int sethostent" >&5 -cat > conftest.$ac_ext < -int main() { -int i = sethostent(0); return(0); -; return 0; } -EOF -if { (eval echo configure:2794: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then - rm -rf conftest* - echo "$ac_t""yes" 1>&6 - ISC_LWRES_SETHOSTENTINT="#define ISC_LWRES_SETHOSTENTINT 1" -else - echo "configure: failed program was:" >&5 - cat conftest.$ac_ext >&5 - rm -rf conftest* - echo "$ac_t""no" 1>&6 - ISC_LWRES_SETHOSTENTINT="#undef ISC_LWRES_SETHOSTENTINT" -fi -rm -f conftest* - - -echo $ac_n "checking for int endhostent""... $ac_c" 1>&6 -echo "configure:2809: checking for int endhostent" >&5 -cat > conftest.$ac_ext < -int main() { -int i = endhostent(); return(0); -; return 0; } -EOF -if { (eval echo configure:2819: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then - rm -rf conftest* - echo "$ac_t""yes" 1>&6 - ISC_LWRES_ENDHOSTENTINT="#define ISC_LWRES_ENDHOSTENTINT 1" -else - echo "configure: failed program was:" >&5 - cat conftest.$ac_ext >&5 - rm -rf conftest* - echo "$ac_t""no" 1>&6 - ISC_LWRES_ENDHOSTENTINT="#undef ISC_LWRES_ENDHOSTENTINT" -fi -rm -f conftest* - - -echo $ac_n "checking for getnetbyaddr(in_addr_t, ...)""... $ac_c" 1>&6 -echo "configure:2834: checking for getnetbyaddr(in_addr_t, ...)" >&5 -cat > conftest.$ac_ext < -struct netent *getnetbyaddr(in_addr_t, int); -int main() { - -; return 0; } -EOF -if { (eval echo configure:2845: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then - rm -rf conftest* - echo "$ac_t""yes" 1>&6 - ISC_LWRES_GETNETBYADDRINADDR="#define ISC_LWRES_GETNETBYADDRINADDR 1" -else - echo "configure: failed program was:" >&5 - cat conftest.$ac_ext >&5 - rm -rf conftest* - echo "$ac_t""no" 1>&6 - ISC_LWRES_GETNETBYADDRINADDR="#undef ISC_LWRES_GETNETBYADDRINADDR" -fi -rm -f conftest* - - -echo $ac_n "checking for int setnetent""... $ac_c" 1>&6 -echo "configure:2860: checking for int setnetent" >&5 -cat > conftest.$ac_ext < -int main() { -int i = setnetent(0); return(0); -; return 0; } -EOF -if { (eval echo configure:2870: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then - rm -rf conftest* - echo "$ac_t""yes" 1>&6 - ISC_LWRES_SETNETENTINT="#define ISC_LWRES_SETNETENTINT 1" -else - echo "configure: failed program was:" >&5 - cat conftest.$ac_ext >&5 - rm -rf conftest* - echo "$ac_t""no" 1>&6 - ISC_LWRES_SETNETENTINT="#undef ISC_LWRES_SETNETENTINT" -fi -rm -f conftest* - - -echo $ac_n "checking for int endnetent""... $ac_c" 1>&6 -echo "configure:2885: checking for int endnetent" >&5 -cat > conftest.$ac_ext < -int main() { -int i = endnetent(); return(0); -; return 0; } -EOF -if { (eval echo configure:2895: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then - rm -rf conftest* - echo "$ac_t""yes" 1>&6 - ISC_LWRES_ENDNETENTINT="#define ISC_LWRES_ENDNETENTINT 1" -else - echo "configure: failed program was:" >&5 - cat conftest.$ac_ext >&5 - rm -rf conftest* - echo "$ac_t""no" 1>&6 - ISC_LWRES_ENDNETENTINT="#undef ISC_LWRES_ENDNETENTINT" -fi -rm -f conftest* - - -echo $ac_n "checking for gethostbyadd(const void *, size_t, ...)""... $ac_c" 1>&6 -echo "configure:2910: checking for gethostbyadd(const void *, size_t, ...)" >&5 -cat > conftest.$ac_ext < -struct hostent *gethostbyaddr(const void *, size_t, int); -int main() { -return(0); -; return 0; } -EOF -if { (eval echo configure:2921: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then - rm -rf conftest* - echo "$ac_t""yes" 1>&6 - ISC_LWRES_GETHOSTBYADDRVOID="#define ISC_LWRES_GETHOSTBYADDRVOID 1" -else - echo "configure: failed program was:" >&5 - cat conftest.$ac_ext >&5 - rm -rf conftest* - echo "$ac_t""no" 1>&6 - ISC_LWRES_GETHOSTBYADDRVOID="#undef ISC_LWRES_GETHOSTBYADDRVOID" -fi -rm -f conftest* - - -echo $ac_n "checking for h_errno in netdb.h""... $ac_c" 1>&6 -echo "configure:2936: checking for h_errno in netdb.h" >&5 -cat > conftest.$ac_ext < -int main() { -h_errno = 1; return(0); -; return 0; } -EOF -if { (eval echo configure:2946: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then - rm -rf conftest* - echo "$ac_t""yes" 1>&6 - ISC_LWRES_NEEDHERRNO="#undef ISC_LWRES_NEEDHERRNO" -else - echo "configure: failed program was:" >&5 - cat conftest.$ac_ext >&5 - rm -rf conftest* - echo "$ac_t""no" 1>&6 - ISC_LWRES_NEEDHERRNO="#define ISC_LWRES_NEEDHERRNO 1" -fi -rm -f conftest* - - -echo $ac_n "checking for getipnodebyname""... $ac_c" 1>&6 -echo "configure:2961: checking for getipnodebyname" >&5 -if eval "test \"`echo '$''{'ac_cv_func_getipnodebyname'+set}'`\" = set"; then - echo $ac_n "(cached) $ac_c" 1>&6 -else - cat > conftest.$ac_ext < -/* Override any gcc2 internal prototype to avoid an error. */ -/* We use char because int might match the return type of a gcc2 - builtin and then its argument prototype would still apply. */ -char getipnodebyname(); - -int main() { - -/* The GNU C library defines this for functions which it implements - to always fail with ENOSYS. Some functions are actually named - something starting with __ and the normal name is an alias. */ -#if defined (__stub_getipnodebyname) || defined (__stub___getipnodebyname) -choke me -#else -getipnodebyname(); -#endif - -; return 0; } -EOF -if { (eval echo configure:2989: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then - rm -rf conftest* - eval "ac_cv_func_getipnodebyname=yes" -else - echo "configure: failed program was:" >&5 - cat conftest.$ac_ext >&5 - rm -rf conftest* - eval "ac_cv_func_getipnodebyname=no" -fi -rm -f conftest* -fi - -if eval "test \"`echo '$ac_cv_func_'getipnodebyname`\" = yes"; then - echo "$ac_t""yes" 1>&6 - ISC_LWRES_GETIPNODEPROTO="#undef ISC_LWRES_GETIPNODEPROTO" -else - echo "$ac_t""no" 1>&6 -ISC_LWRES_GETIPNODEPROTO="#define ISC_LWRES_GETIPNODEPROTO 1" -fi - -echo $ac_n "checking for getnameinfo""... $ac_c" 1>&6 -echo "configure:3010: checking for getnameinfo" >&5 -if eval "test \"`echo '$''{'ac_cv_func_getnameinfo'+set}'`\" = set"; then - echo $ac_n "(cached) $ac_c" 1>&6 -else - cat > conftest.$ac_ext < -/* Override any gcc2 internal prototype to avoid an error. */ -/* We use char because int might match the return type of a gcc2 - builtin and then its argument prototype would still apply. */ -char getnameinfo(); - -int main() { - -/* The GNU C library defines this for functions which it implements - to always fail with ENOSYS. Some functions are actually named - something starting with __ and the normal name is an alias. */ -#if defined (__stub_getnameinfo) || defined (__stub___getnameinfo) -choke me -#else -getnameinfo(); -#endif - -; return 0; } -EOF -if { (eval echo configure:3038: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then - rm -rf conftest* - eval "ac_cv_func_getnameinfo=yes" -else - echo "configure: failed program was:" >&5 - cat conftest.$ac_ext >&5 - rm -rf conftest* - eval "ac_cv_func_getnameinfo=no" -fi -rm -f conftest* -fi - -if eval "test \"`echo '$ac_cv_func_'getnameinfo`\" = yes"; then - echo "$ac_t""yes" 1>&6 - ISC_LWRES_GETNAMEINFOPROTO="#undef ISC_LWRES_GETNAMEINFOPROTO" -else - echo "$ac_t""no" 1>&6 -ISC_LWRES_GETNAMEINFOPROTO="#define ISC_LWRES_GETNAMEINFOPROTO 1" -fi - -echo $ac_n "checking for getaddrinfo""... $ac_c" 1>&6 -echo "configure:3059: checking for getaddrinfo" >&5 -if eval "test \"`echo '$''{'ac_cv_func_getaddrinfo'+set}'`\" = set"; then - echo $ac_n "(cached) $ac_c" 1>&6 -else - cat > conftest.$ac_ext < -/* Override any gcc2 internal prototype to avoid an error. */ -/* We use char because int might match the return type of a gcc2 - builtin and then its argument prototype would still apply. */ -char getaddrinfo(); - -int main() { - -/* The GNU C library defines this for functions which it implements - to always fail with ENOSYS. Some functions are actually named - something starting with __ and the normal name is an alias. */ -#if defined (__stub_getaddrinfo) || defined (__stub___getaddrinfo) -choke me -#else -getaddrinfo(); -#endif - -; return 0; } -EOF -if { (eval echo configure:3087: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then - rm -rf conftest* - eval "ac_cv_func_getaddrinfo=yes" -else - echo "configure: failed program was:" >&5 - cat conftest.$ac_ext >&5 - rm -rf conftest* - eval "ac_cv_func_getaddrinfo=no" -fi -rm -f conftest* -fi - -if eval "test \"`echo '$ac_cv_func_'getaddrinfo`\" = yes"; then - echo "$ac_t""yes" 1>&6 - ISC_LWRES_GETADDRINFOPROTO="#undef ISC_LWRES_GETADDRINFOPROTO" - cat >> confdefs.h <<\EOF -#define HAVE_GETADDRINFO 1 -EOF - -else - echo "$ac_t""no" 1>&6 -ISC_LWRES_GETADDRINFOPROTO="#define ISC_LWRES_GETADDRINFOPROTO 1" -fi - - - - - -# -# Look for a sysctl call to get the list of network interfaces. -# -echo $ac_n "checking for interface list sysctl""... $ac_c" 1>&6 -echo "configure:3119: checking for interface list sysctl" >&5 -cat > conftest.$ac_ext < -#include -#include -#ifdef NET_RT_IFLIST -found_rt_iflist -#endif - -EOF -if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | - egrep "found_rt_iflist" >/dev/null 2>&1; then - rm -rf conftest* - echo "$ac_t""yes" 1>&6 - cat >> confdefs.h <<\EOF -#define HAVE_IFLIST_SYSCTL 1 -EOF - -else - rm -rf conftest* - echo "$ac_t""no" 1>&6 -fi -rm -f conftest* - - # # GNU libtool support # @@ -3227,7 +2729,7 @@ else fi echo $ac_n "checking build system type""... $ac_c" 1>&6 -echo "configure:3231: checking build system type" >&5 +echo "configure:2733: checking build system type" >&5 build_alias=$build case "$build_alias" in @@ -3256,7 +2758,7 @@ ac_prog=ld if test "$ac_cv_prog_gcc" = yes; then # Check if gcc -print-prog-name=ld gives a path. echo $ac_n "checking for ld used by GCC""... $ac_c" 1>&6 -echo "configure:3260: checking for ld used by GCC" >&5 +echo "configure:2762: checking for ld used by GCC" >&5 ac_prog=`($CC -print-prog-name=ld) 2>&5` case "$ac_prog" in # Accept absolute paths. @@ -3280,10 +2782,10 @@ echo "configure:3260: checking for ld used by GCC" >&5 esac elif test "$with_gnu_ld" = yes; then echo $ac_n "checking for GNU ld""... $ac_c" 1>&6 -echo "configure:3284: checking for GNU ld" >&5 +echo "configure:2786: checking for GNU ld" >&5 else echo $ac_n "checking for non-GNU ld""... $ac_c" 1>&6 -echo "configure:3287: checking for non-GNU ld" >&5 +echo "configure:2789: checking for non-GNU ld" >&5 fi if eval "test \"`echo '$''{'ac_cv_path_LD'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 @@ -3319,7 +2821,7 @@ fi test -z "$LD" && { echo "configure: error: no acceptable ld found in \$PATH" 1>&2; exit 1; } echo $ac_n "checking if the linker ($LD) is GNU ld""... $ac_c" 1>&6 -echo "configure:3323: checking if the linker ($LD) is GNU ld" >&5 +echo "configure:2825: checking if the linker ($LD) is GNU ld" >&5 if eval "test \"`echo '$''{'ac_cv_prog_gnu_ld'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else @@ -3335,7 +2837,7 @@ echo "$ac_t""$ac_cv_prog_gnu_ld" 1>&6 echo $ac_n "checking for BSD-compatible nm""... $ac_c" 1>&6 -echo "configure:3339: checking for BSD-compatible nm" >&5 +echo "configure:2841: checking for BSD-compatible nm" >&5 if eval "test \"`echo '$''{'ac_cv_path_NM'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else @@ -3372,7 +2874,7 @@ echo "$ac_t""$NM" 1>&6 echo $ac_n "checking whether ln -s works""... $ac_c" 1>&6 -echo "configure:3376: checking whether ln -s works" >&5 +echo "configure:2878: checking whether ln -s works" >&5 if eval "test \"`echo '$''{'ac_cv_prog_LN_S'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else @@ -3416,8 +2918,8 @@ test x"$silent" = xyes && libtool_flags="$libtool_flags --silent" case "$host" in *-*-irix6*) # Find out which ABI we are using. - echo '#line 3420 "configure"' > conftest.$ac_ext - if { (eval echo configure:3421: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then + echo '#line 2922 "configure"' > conftest.$ac_ext + if { (eval echo configure:2923: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then case "`/usr/bin/file conftest.o`" in *32-bit*) LD="${LD-ld} -32" @@ -3438,19 +2940,19 @@ case "$host" in SAVE_CFLAGS="$CFLAGS" CFLAGS="$CFLAGS -belf" echo $ac_n "checking whether the C compiler needs -belf""... $ac_c" 1>&6 -echo "configure:3442: checking whether the C compiler needs -belf" >&5 +echo "configure:2944: checking whether the C compiler needs -belf" >&5 if eval "test \"`echo '$''{'lt_cv_cc_needs_belf'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext <&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then +if { (eval echo configure:2956: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then rm -rf conftest* lt_cv_cc_needs_belf=yes else @@ -3570,6 +3072,11 @@ SA=a +# +# Here begins a very long section to determine the system's networking +# capabilities. The order of the tests is signficant. +# + # # IPv6 # @@ -3587,9 +3094,9 @@ fi case "$enable_ipv6" in yes|''|autodetect) echo $ac_n "checking for IPv6 structures""... $ac_c" 1>&6 -echo "configure:3591: checking for IPv6 structures" >&5 +echo "configure:3098: checking for IPv6 structures" >&5 cat > conftest.$ac_ext < @@ -3599,7 +3106,7 @@ int main() { struct sockaddr_in6 sin6; return (0); ; return 0; } EOF -if { (eval echo configure:3603: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then +if { (eval echo configure:3110: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* echo "$ac_t""yes" 1>&6 found_ipv6=yes @@ -3622,7 +3129,7 @@ esac # This is done before other IPv6 linking tests to LIBS is properly set. # echo $ac_n "checking for Kame IPv6 support""... $ac_c" 1>&6 -echo "configure:3626: checking for Kame IPv6 support" >&5 +echo "configure:3133: checking for Kame IPv6 support" >&5 # Check whether --with-kame or --without-kame was given. if test "${with_kame+set}" = set; then withval="$with_kame" @@ -3710,9 +3217,9 @@ case "$found_ipv6" in LWRES_PLATFORM_HAVEIPV6="#define LWRES_PLATFORM_HAVEIPV6 1" echo $ac_n "checking for in6addr_any""... $ac_c" 1>&6 -echo "configure:3714: checking for in6addr_any" >&5 +echo "configure:3221: checking for in6addr_any" >&5 cat > conftest.$ac_ext < @@ -3723,7 +3230,7 @@ int main() { struct in6_addr in6; in6 = in6addr_any; return (0); ; return 0; } EOF -if { (eval echo configure:3727: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then +if { (eval echo configure:3234: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then rm -rf conftest* echo "$ac_t""yes" 1>&6 ISC_PLATFORM_NEEDIN6ADDRANY="#undef ISC_PLATFORM_NEEDIN6ADDRANY" @@ -3739,9 +3246,9 @@ fi rm -f conftest* echo $ac_n "checking for sin6_scope_id in struct sockaddr_in6""... $ac_c" 1>&6 -echo "configure:3743: checking for sin6_scope_id in struct sockaddr_in6" >&5 +echo "configure:3250: checking for sin6_scope_id in struct sockaddr_in6" >&5 cat > conftest.$ac_ext < @@ -3754,7 +3261,7 @@ int main() { struct sockaddr_in6 xyzzy; xyzzy.sin6_scope_id = 0; return (0); ; return 0; } EOF -if { (eval echo configure:3758: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then +if { (eval echo configure:3265: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* echo "$ac_t""yes" 1>&6 result="#define LWRES_HAVE_SIN6_SCOPE_ID 1" @@ -3769,9 +3276,9 @@ rm -f conftest* LWRES_HAVE_SIN6_SCOPE_ID="$result" echo $ac_n "checking for in6_pktinfo""... $ac_c" 1>&6 -echo "configure:3773: checking for in6_pktinfo" >&5 +echo "configure:3280: checking for in6_pktinfo" >&5 cat > conftest.$ac_ext < @@ -3784,7 +3291,7 @@ int main() { struct in6_pktinfo xyzzy; return (0); ; return 0; } EOF -if { (eval echo configure:3788: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then +if { (eval echo configure:3295: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* echo "$ac_t""yes" 1>&6 ISC_PLATFORM_HAVEIN6PKTINFO="#define ISC_PLATFORM_HAVEIN6PKTINFO 1" @@ -3825,15 +3332,17 @@ esac + # # Check for network functions that are often missing. We do this # after the libtool checking, so we can put the right suffix on -# the files. +# the files. It also needs to come after checking for a Kame add-on, +# which provides some (all?) of the desired functions. # echo $ac_n "checking for inet_ntop""... $ac_c" 1>&6 -echo "configure:3835: checking for inet_ntop" >&5 +echo "configure:3344: checking for inet_ntop" >&5 cat > conftest.$ac_ext < @@ -3843,7 +3352,7 @@ int main() { inet_ntop(0, 0, 0, 0); return (0); ; return 0; } EOF -if { (eval echo configure:3847: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then +if { (eval echo configure:3356: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then rm -rf conftest* echo "$ac_t""yes" 1>&6 ISC_PLATFORM_NEEDNTOP="#undef ISC_PLATFORM_NEEDNTOP" @@ -3858,9 +3367,9 @@ else fi rm -f conftest* echo $ac_n "checking for inet_pton""... $ac_c" 1>&6 -echo "configure:3862: checking for inet_pton" >&5 +echo "configure:3371: checking for inet_pton" >&5 cat > conftest.$ac_ext < @@ -3870,7 +3379,7 @@ int main() { inet_pton(0, 0, 0); return (0); ; return 0; } EOF -if { (eval echo configure:3874: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then +if { (eval echo configure:3383: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then rm -rf conftest* echo "$ac_t""yes" 1>&6 ISC_PLATFORM_NEEDPTON="#undef ISC_PLATFORM_NEEDPTON" @@ -3885,9 +3394,9 @@ else fi rm -f conftest* echo $ac_n "checking for inet_aton""... $ac_c" 1>&6 -echo "configure:3889: checking for inet_aton" >&5 +echo "configure:3398: checking for inet_aton" >&5 cat > conftest.$ac_ext < @@ -3897,7 +3406,7 @@ int main() { struct in_addr in; inet_aton(0, &in); return (0); ; return 0; } EOF -if { (eval echo configure:3901: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then +if { (eval echo configure:3410: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then rm -rf conftest* echo "$ac_t""yes" 1>&6 ISC_PLATFORM_NEEDATON="#undef ISC_PLATFORM_NEEDATON" @@ -3916,14 +3425,512 @@ rm -f conftest* +# +# Look for a 4.4BSD-style sa_len member in struct sockaddr. +# +case "$host" in + *-dec-osf*) + # Turn on 4.4BSD style sa_len support. + cat >> confdefs.h <<\EOF +#define _SOCKADDR_LEN 1 +EOF + + ;; +esac + +echo $ac_n "checking for sa_len in struct sockaddr""... $ac_c" 1>&6 +echo "configure:3443: checking for sa_len in struct sockaddr" >&5 +cat > conftest.$ac_ext < +#include +int main() { +struct sockaddr sa; sa.sa_len = 0; return (0); +; return 0; } +EOF +if { (eval echo configure:3454: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then + rm -rf conftest* + echo "$ac_t""yes" 1>&6 + ISC_PLATFORM_HAVESALEN="#define ISC_PLATFORM_HAVESALEN 1" + LWRES_PLATFORM_HAVESALEN="#define LWRES_PLATFORM_HAVESALEN 1" +else + echo "configure: failed program was:" >&5 + cat conftest.$ac_ext >&5 + rm -rf conftest* + echo "$ac_t""no" 1>&6 + ISC_PLATFORM_HAVESALEN="#undef ISC_PLATFORM_HAVESALEN" + LWRES_PLATFORM_HAVESALEN="#undef LWRES_PLATFORM_HAVESALEN" +fi +rm -f conftest* + + + +# +# Look for a 4.4BSD or 4.3BSD struct msghdr +# +echo $ac_n "checking for struct msghdr flavor""... $ac_c" 1>&6 +echo "configure:3475: checking for struct msghdr flavor" >&5 +cat > conftest.$ac_ext < +#include +int main() { +struct msghdr msg; msg.msg_flags = 0; return (0); +; return 0; } +EOF +if { (eval echo configure:3486: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then + rm -rf conftest* + echo "$ac_t""4.4BSD" 1>&6 + ISC_PLATFORM_MSGHDRFLAVOR="#define ISC_NET_BSD44MSGHDR 1" +else + echo "configure: failed program was:" >&5 + cat conftest.$ac_ext >&5 + rm -rf conftest* + echo "$ac_t""4.3BSD" 1>&6 + ISC_PLATFORM_MSGHDRFLAVOR="#define ISC_NET_BSD43MSGHDR 1" +fi +rm -f conftest* + + +# +# Look for in_port_t. +# +echo $ac_n "checking for type in_port_t""... $ac_c" 1>&6 +echo "configure:3504: checking for type in_port_t" >&5 +cat > conftest.$ac_ext < +#include +int main() { +in_port_t port = 25; return (0); +; return 0; } +EOF +if { (eval echo configure:3515: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then + rm -rf conftest* + echo "$ac_t""yes" 1>&6 + ISC_PLATFORM_NEEDPORTT="#undef ISC_PLATFORM_NEEDPORTT" +else + echo "configure: failed program was:" >&5 + cat conftest.$ac_ext >&5 + rm -rf conftest* + echo "$ac_t""no" 1>&6 + ISC_PLATFORM_NEEDPORTT="#define ISC_PLATFORM_NEEDPORTT 1" +fi +rm -f conftest* + + +# +# Check for addrinfo +# +echo $ac_n "checking for struct addrinfo""... $ac_c" 1>&6 +echo "configure:3533: checking for struct addrinfo" >&5 +cat > conftest.$ac_ext < +int main() { +struct addrinfo a; return (0); +; return 0; } +EOF +if { (eval echo configure:3543: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then + rm -rf conftest* + echo "$ac_t""yes" 1>&6 + ISC_LWRES_NEEDADDRINFO="#undef ISC_LWRES_NEEDADDRINFO" + cat >> confdefs.h <<\EOF +#define HAVE_ADDRINFO 1 +EOF + +else + echo "configure: failed program was:" >&5 + cat conftest.$ac_ext >&5 + rm -rf conftest* + echo "$ac_t""no" 1>&6 + ISC_LWRES_NEEDADDRINFO="#define ISC_LWRES_NEEDADDRINFO 1" +fi +rm -f conftest* + + +echo $ac_n "checking for int sethostent""... $ac_c" 1>&6 +echo "configure:3562: checking for int sethostent" >&5 +cat > conftest.$ac_ext < +int main() { +int i = sethostent(0); return(0); +; return 0; } +EOF +if { (eval echo configure:3572: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then + rm -rf conftest* + echo "$ac_t""yes" 1>&6 + ISC_LWRES_SETHOSTENTINT="#define ISC_LWRES_SETHOSTENTINT 1" +else + echo "configure: failed program was:" >&5 + cat conftest.$ac_ext >&5 + rm -rf conftest* + echo "$ac_t""no" 1>&6 + ISC_LWRES_SETHOSTENTINT="#undef ISC_LWRES_SETHOSTENTINT" +fi +rm -f conftest* + + +echo $ac_n "checking for int endhostent""... $ac_c" 1>&6 +echo "configure:3587: checking for int endhostent" >&5 +cat > conftest.$ac_ext < +int main() { +int i = endhostent(); return(0); +; return 0; } +EOF +if { (eval echo configure:3597: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then + rm -rf conftest* + echo "$ac_t""yes" 1>&6 + ISC_LWRES_ENDHOSTENTINT="#define ISC_LWRES_ENDHOSTENTINT 1" +else + echo "configure: failed program was:" >&5 + cat conftest.$ac_ext >&5 + rm -rf conftest* + echo "$ac_t""no" 1>&6 + ISC_LWRES_ENDHOSTENTINT="#undef ISC_LWRES_ENDHOSTENTINT" +fi +rm -f conftest* + + +echo $ac_n "checking for getnetbyaddr(in_addr_t, ...)""... $ac_c" 1>&6 +echo "configure:3612: checking for getnetbyaddr(in_addr_t, ...)" >&5 +cat > conftest.$ac_ext < +struct netent *getnetbyaddr(in_addr_t, int); +int main() { + +; return 0; } +EOF +if { (eval echo configure:3623: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then + rm -rf conftest* + echo "$ac_t""yes" 1>&6 + ISC_LWRES_GETNETBYADDRINADDR="#define ISC_LWRES_GETNETBYADDRINADDR 1" +else + echo "configure: failed program was:" >&5 + cat conftest.$ac_ext >&5 + rm -rf conftest* + echo "$ac_t""no" 1>&6 + ISC_LWRES_GETNETBYADDRINADDR="#undef ISC_LWRES_GETNETBYADDRINADDR" +fi +rm -f conftest* + + +echo $ac_n "checking for int setnetent""... $ac_c" 1>&6 +echo "configure:3638: checking for int setnetent" >&5 +cat > conftest.$ac_ext < +int main() { +int i = setnetent(0); return(0); +; return 0; } +EOF +if { (eval echo configure:3648: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then + rm -rf conftest* + echo "$ac_t""yes" 1>&6 + ISC_LWRES_SETNETENTINT="#define ISC_LWRES_SETNETENTINT 1" +else + echo "configure: failed program was:" >&5 + cat conftest.$ac_ext >&5 + rm -rf conftest* + echo "$ac_t""no" 1>&6 + ISC_LWRES_SETNETENTINT="#undef ISC_LWRES_SETNETENTINT" +fi +rm -f conftest* + + +echo $ac_n "checking for int endnetent""... $ac_c" 1>&6 +echo "configure:3663: checking for int endnetent" >&5 +cat > conftest.$ac_ext < +int main() { +int i = endnetent(); return(0); +; return 0; } +EOF +if { (eval echo configure:3673: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then + rm -rf conftest* + echo "$ac_t""yes" 1>&6 + ISC_LWRES_ENDNETENTINT="#define ISC_LWRES_ENDNETENTINT 1" +else + echo "configure: failed program was:" >&5 + cat conftest.$ac_ext >&5 + rm -rf conftest* + echo "$ac_t""no" 1>&6 + ISC_LWRES_ENDNETENTINT="#undef ISC_LWRES_ENDNETENTINT" +fi +rm -f conftest* + + +echo $ac_n "checking for gethostbyadd(const void *, size_t, ...)""... $ac_c" 1>&6 +echo "configure:3688: checking for gethostbyadd(const void *, size_t, ...)" >&5 +cat > conftest.$ac_ext < +struct hostent *gethostbyaddr(const void *, size_t, int); +int main() { +return(0); +; return 0; } +EOF +if { (eval echo configure:3699: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then + rm -rf conftest* + echo "$ac_t""yes" 1>&6 + ISC_LWRES_GETHOSTBYADDRVOID="#define ISC_LWRES_GETHOSTBYADDRVOID 1" +else + echo "configure: failed program was:" >&5 + cat conftest.$ac_ext >&5 + rm -rf conftest* + echo "$ac_t""no" 1>&6 + ISC_LWRES_GETHOSTBYADDRVOID="#undef ISC_LWRES_GETHOSTBYADDRVOID" +fi +rm -f conftest* + + +echo $ac_n "checking for h_errno in netdb.h""... $ac_c" 1>&6 +echo "configure:3714: checking for h_errno in netdb.h" >&5 +cat > conftest.$ac_ext < +int main() { +h_errno = 1; return(0); +; return 0; } +EOF +if { (eval echo configure:3724: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then + rm -rf conftest* + echo "$ac_t""yes" 1>&6 + ISC_LWRES_NEEDHERRNO="#undef ISC_LWRES_NEEDHERRNO" +else + echo "configure: failed program was:" >&5 + cat conftest.$ac_ext >&5 + rm -rf conftest* + echo "$ac_t""no" 1>&6 + ISC_LWRES_NEEDHERRNO="#define ISC_LWRES_NEEDHERRNO 1" +fi +rm -f conftest* + + +echo $ac_n "checking for getipnodebyname""... $ac_c" 1>&6 +echo "configure:3739: checking for getipnodebyname" >&5 +if eval "test \"`echo '$''{'ac_cv_func_getipnodebyname'+set}'`\" = set"; then + echo $ac_n "(cached) $ac_c" 1>&6 +else + cat > conftest.$ac_ext < +/* Override any gcc2 internal prototype to avoid an error. */ +/* We use char because int might match the return type of a gcc2 + builtin and then its argument prototype would still apply. */ +char getipnodebyname(); + +int main() { + +/* The GNU C library defines this for functions which it implements + to always fail with ENOSYS. Some functions are actually named + something starting with __ and the normal name is an alias. */ +#if defined (__stub_getipnodebyname) || defined (__stub___getipnodebyname) +choke me +#else +getipnodebyname(); +#endif + +; return 0; } +EOF +if { (eval echo configure:3767: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then + rm -rf conftest* + eval "ac_cv_func_getipnodebyname=yes" +else + echo "configure: failed program was:" >&5 + cat conftest.$ac_ext >&5 + rm -rf conftest* + eval "ac_cv_func_getipnodebyname=no" +fi +rm -f conftest* +fi + +if eval "test \"`echo '$ac_cv_func_'getipnodebyname`\" = yes"; then + echo "$ac_t""yes" 1>&6 + ISC_LWRES_GETIPNODEPROTO="#undef ISC_LWRES_GETIPNODEPROTO" +else + echo "$ac_t""no" 1>&6 +ISC_LWRES_GETIPNODEPROTO="#define ISC_LWRES_GETIPNODEPROTO 1" +fi + +echo $ac_n "checking for getnameinfo""... $ac_c" 1>&6 +echo "configure:3788: checking for getnameinfo" >&5 +if eval "test \"`echo '$''{'ac_cv_func_getnameinfo'+set}'`\" = set"; then + echo $ac_n "(cached) $ac_c" 1>&6 +else + cat > conftest.$ac_ext < +/* Override any gcc2 internal prototype to avoid an error. */ +/* We use char because int might match the return type of a gcc2 + builtin and then its argument prototype would still apply. */ +char getnameinfo(); + +int main() { + +/* The GNU C library defines this for functions which it implements + to always fail with ENOSYS. Some functions are actually named + something starting with __ and the normal name is an alias. */ +#if defined (__stub_getnameinfo) || defined (__stub___getnameinfo) +choke me +#else +getnameinfo(); +#endif + +; return 0; } +EOF +if { (eval echo configure:3816: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then + rm -rf conftest* + eval "ac_cv_func_getnameinfo=yes" +else + echo "configure: failed program was:" >&5 + cat conftest.$ac_ext >&5 + rm -rf conftest* + eval "ac_cv_func_getnameinfo=no" +fi +rm -f conftest* +fi + +if eval "test \"`echo '$ac_cv_func_'getnameinfo`\" = yes"; then + echo "$ac_t""yes" 1>&6 + ISC_LWRES_GETNAMEINFOPROTO="#undef ISC_LWRES_GETNAMEINFOPROTO" +else + echo "$ac_t""no" 1>&6 +ISC_LWRES_GETNAMEINFOPROTO="#define ISC_LWRES_GETNAMEINFOPROTO 1" +fi + +echo $ac_n "checking for getaddrinfo""... $ac_c" 1>&6 +echo "configure:3837: checking for getaddrinfo" >&5 +if eval "test \"`echo '$''{'ac_cv_func_getaddrinfo'+set}'`\" = set"; then + echo $ac_n "(cached) $ac_c" 1>&6 +else + cat > conftest.$ac_ext < +/* Override any gcc2 internal prototype to avoid an error. */ +/* We use char because int might match the return type of a gcc2 + builtin and then its argument prototype would still apply. */ +char getaddrinfo(); + +int main() { + +/* The GNU C library defines this for functions which it implements + to always fail with ENOSYS. Some functions are actually named + something starting with __ and the normal name is an alias. */ +#if defined (__stub_getaddrinfo) || defined (__stub___getaddrinfo) +choke me +#else +getaddrinfo(); +#endif + +; return 0; } +EOF +if { (eval echo configure:3865: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then + rm -rf conftest* + eval "ac_cv_func_getaddrinfo=yes" +else + echo "configure: failed program was:" >&5 + cat conftest.$ac_ext >&5 + rm -rf conftest* + eval "ac_cv_func_getaddrinfo=no" +fi +rm -f conftest* +fi + +if eval "test \"`echo '$ac_cv_func_'getaddrinfo`\" = yes"; then + echo "$ac_t""yes" 1>&6 + ISC_LWRES_GETADDRINFOPROTO="#undef ISC_LWRES_GETADDRINFOPROTO" + cat >> confdefs.h <<\EOF +#define HAVE_GETADDRINFO 1 +EOF + +else + echo "$ac_t""no" 1>&6 +ISC_LWRES_GETADDRINFOPROTO="#define ISC_LWRES_GETADDRINFOPROTO 1" +fi + + + + + +# +# Look for a sysctl call to get the list of network interfaces. +# +echo $ac_n "checking for interface list sysctl""... $ac_c" 1>&6 +echo "configure:3897: checking for interface list sysctl" >&5 +cat > conftest.$ac_ext < +#include +#include +#ifdef NET_RT_IFLIST +found_rt_iflist +#endif + +EOF +if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | + egrep "found_rt_iflist" >/dev/null 2>&1; then + rm -rf conftest* + echo "$ac_t""yes" 1>&6 + cat >> confdefs.h <<\EOF +#define HAVE_IFLIST_SYSCTL 1 +EOF + +else + rm -rf conftest* + echo "$ac_t""no" 1>&6 +fi +rm -f conftest* + + +# # Check for some other useful functions that are not ever-present. +# echo $ac_n "checking for strsep""... $ac_c" 1>&6 -echo "configure:3922: checking for strsep" >&5 +echo "configure:3929: checking for strsep" >&5 if eval "test \"`echo '$''{'ac_cv_func_strsep'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext <&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then +if { (eval echo configure:3957: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then rm -rf conftest* eval "ac_cv_func_strsep=yes" else @@ -3967,12 +3974,12 @@ ISC_PLATFORM_NEEDSTRSEP="#define ISC_PLATFORM_NEEDSTRSEP 1" fi echo $ac_n "checking for vsnprintf""... $ac_c" 1>&6 -echo "configure:3971: checking for vsnprintf" >&5 +echo "configure:3978: checking for vsnprintf" >&5 if eval "test \"`echo '$''{'ac_cv_func_vsnprintf'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext <&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then +if { (eval echo configure:4006: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then rm -rf conftest* eval "ac_cv_func_vsnprintf=yes" else @@ -4024,17 +4031,17 @@ fi echo $ac_n "checking for sizeof(long long int) == sizeof(long int)""... $ac_c" 1>&6 -echo "configure:4028: checking for sizeof(long long int) == sizeof(long int)" >&5 +echo "configure:4035: checking for sizeof(long long int) == sizeof(long int)" >&5 if test "$cross_compiling" = yes; then echo "$ac_t""default yes" 1>&6 ISC_PLATFORM_LONGLONGEQUALLONG="#define ISC_PLATFORM_LONGLONGEQUALLONG 1" else cat > conftest.$ac_ext <&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null +if { (eval echo configure:4045: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null then echo "$ac_t""yes" 1>&6 ISC_PLATFORM_LONGLONGEQUALLONG="#define ISC_PLATFORM_LONGLONGEQUALLONG 1" @@ -4054,12 +4061,12 @@ fi # Security Stuff # echo $ac_n "checking for chroot""... $ac_c" 1>&6 -echo "configure:4058: checking for chroot" >&5 +echo "configure:4065: checking for chroot" >&5 if eval "test \"`echo '$''{'ac_cv_func_chroot'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext <&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then +if { (eval echo configure:4093: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then rm -rf conftest* eval "ac_cv_func_chroot=yes" else @@ -4108,17 +4115,17 @@ for ac_hdr in linux/capability.h do ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'` echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6 -echo "configure:4112: checking for $ac_hdr" >&5 +echo "configure:4119: checking for $ac_hdr" >&5 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < EOF ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out" -{ (eval echo configure:4122: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } +{ (eval echo configure:4129: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"` if test -z "$ac_err"; then rm -rf conftest* @@ -4148,17 +4155,17 @@ for ac_hdr in linux/prctl.h do ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'` echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6 -echo "configure:4152: checking for $ac_hdr" >&5 +echo "configure:4159: checking for $ac_hdr" >&5 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < EOF ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out" -{ (eval echo configure:4162: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } +{ (eval echo configure:4169: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"` if test -z "$ac_err"; then rm -rf conftest* @@ -4525,21 +4532,6 @@ s%@MKDEPCC@%$MKDEPCC%g s%@MKDEPCFLAGS@%$MKDEPCFLAGS%g s%@MKDEPPROG@%$MKDEPPROG%g s%@IRIX_DNSSEC_WARNINGS_HACK@%$IRIX_DNSSEC_WARNINGS_HACK%g -s%@ISC_PLATFORM_HAVESALEN@%$ISC_PLATFORM_HAVESALEN%g -s%@LWRES_PLATFORM_HAVESALEN@%$LWRES_PLATFORM_HAVESALEN%g -s%@ISC_PLATFORM_MSGHDRFLAVOR@%$ISC_PLATFORM_MSGHDRFLAVOR%g -s%@ISC_PLATFORM_NEEDPORTT@%$ISC_PLATFORM_NEEDPORTT%g -s%@ISC_LWRES_NEEDADDRINFO@%$ISC_LWRES_NEEDADDRINFO%g -s%@ISC_LWRES_SETHOSTENTINT@%$ISC_LWRES_SETHOSTENTINT%g -s%@ISC_LWRES_ENDHOSTENTINT@%$ISC_LWRES_ENDHOSTENTINT%g -s%@ISC_LWRES_GETNETBYADDRINADDR@%$ISC_LWRES_GETNETBYADDRINADDR%g -s%@ISC_LWRES_SETNETENTINT@%$ISC_LWRES_SETNETENTINT%g -s%@ISC_LWRES_ENDNETENTINT@%$ISC_LWRES_ENDNETENTINT%g -s%@ISC_LWRES_GETHOSTBYADDRVOID@%$ISC_LWRES_GETHOSTBYADDRVOID%g -s%@ISC_LWRES_NEEDHERRNO@%$ISC_LWRES_NEEDHERRNO%g -s%@ISC_LWRES_GETIPNODEPROTO@%$ISC_LWRES_GETIPNODEPROTO%g -s%@ISC_LWRES_GETADDRINFOPROTO@%$ISC_LWRES_GETADDRINFOPROTO%g -s%@ISC_LWRES_GETNAMEINFOPROTO@%$ISC_LWRES_GETNAMEINFOPROTO%g s%@build@%$build%g s%@build_alias@%$build_alias%g s%@build_cpu@%$build_cpu%g @@ -4569,6 +4561,21 @@ s%@LWRES_HAVE_SIN6_SCOPE_ID@%$LWRES_HAVE_SIN6_SCOPE_ID%g s%@ISC_PLATFORM_NEEDNTOP@%$ISC_PLATFORM_NEEDNTOP%g s%@ISC_PLATFORM_NEEDPTON@%$ISC_PLATFORM_NEEDPTON%g s%@ISC_PLATFORM_NEEDATON@%$ISC_PLATFORM_NEEDATON%g +s%@ISC_PLATFORM_HAVESALEN@%$ISC_PLATFORM_HAVESALEN%g +s%@LWRES_PLATFORM_HAVESALEN@%$LWRES_PLATFORM_HAVESALEN%g +s%@ISC_PLATFORM_MSGHDRFLAVOR@%$ISC_PLATFORM_MSGHDRFLAVOR%g +s%@ISC_PLATFORM_NEEDPORTT@%$ISC_PLATFORM_NEEDPORTT%g +s%@ISC_LWRES_NEEDADDRINFO@%$ISC_LWRES_NEEDADDRINFO%g +s%@ISC_LWRES_SETHOSTENTINT@%$ISC_LWRES_SETHOSTENTINT%g +s%@ISC_LWRES_ENDHOSTENTINT@%$ISC_LWRES_ENDHOSTENTINT%g +s%@ISC_LWRES_GETNETBYADDRINADDR@%$ISC_LWRES_GETNETBYADDRINADDR%g +s%@ISC_LWRES_SETNETENTINT@%$ISC_LWRES_SETNETENTINT%g +s%@ISC_LWRES_ENDNETENTINT@%$ISC_LWRES_ENDNETENTINT%g +s%@ISC_LWRES_GETHOSTBYADDRVOID@%$ISC_LWRES_GETHOSTBYADDRVOID%g +s%@ISC_LWRES_NEEDHERRNO@%$ISC_LWRES_NEEDHERRNO%g +s%@ISC_LWRES_GETIPNODEPROTO@%$ISC_LWRES_GETIPNODEPROTO%g +s%@ISC_LWRES_GETADDRINFOPROTO@%$ISC_LWRES_GETADDRINFOPROTO%g +s%@ISC_LWRES_GETNAMEINFOPROTO@%$ISC_LWRES_GETNAMEINFOPROTO%g s%@ISC_PLATFORM_NEEDSTRSEP@%$ISC_PLATFORM_NEEDSTRSEP%g s%@ISC_PLATFORM_NEEDVSNPRINTF@%$ISC_PLATFORM_NEEDVSNPRINTF%g s%@ISC_EXTRA_OBJS@%$ISC_EXTRA_OBJS%g diff --git a/configure.in b/configure.in index 3d90e259cf..65886a4abe 100644 --- a/configure.in +++ b/configure.in @@ -18,7 +18,7 @@ AC_DIVERT_PUSH(AC_DIVERSION_NOTICE)dnl esyscmd([sed "s/^/# /" COPYRIGHT])dnl AC_DIVERT_POP()dnl -AC_REVISION($Revision: 1.168 $) +AC_REVISION($Revision: 1.169 $) AC_INIT(lib/dns/name.c) AC_PREREQ(2.13) @@ -432,176 +432,6 @@ AC_SUBST(MKDEPPROG) AC_SUBST(IRIX_DNSSEC_WARNINGS_HACK) # -# Networking specifics. -# -case "$host" in - *-dec-osf*) - # Turn on 4.4BSD style sa_len support. - AC_DEFINE(_SOCKADDR_LEN) - ;; -esac - -# -# Look for a 4.4BSD-style sa_len member in struct sockaddr. -# -AC_MSG_CHECKING(for sa_len in struct sockaddr) -AC_TRY_COMPILE([ -#include -#include ], -[struct sockaddr sa; sa.sa_len = 0; return (0);], - [AC_MSG_RESULT(yes) - ISC_PLATFORM_HAVESALEN="#define ISC_PLATFORM_HAVESALEN 1" - LWRES_PLATFORM_HAVESALEN="#define LWRES_PLATFORM_HAVESALEN 1"], - [AC_MSG_RESULT(no) - ISC_PLATFORM_HAVESALEN="#undef ISC_PLATFORM_HAVESALEN" - LWRES_PLATFORM_HAVESALEN="#undef LWRES_PLATFORM_HAVESALEN"]) -AC_SUBST(ISC_PLATFORM_HAVESALEN) -AC_SUBST(LWRES_PLATFORM_HAVESALEN) - -# -# Look for a 4.4BSD or 4.3BSD struct msghdr -# -AC_MSG_CHECKING(for struct msghdr flavor) -AC_TRY_COMPILE([ -#include -#include ], -[struct msghdr msg; msg.msg_flags = 0; return (0);], - [AC_MSG_RESULT(4.4BSD) - ISC_PLATFORM_MSGHDRFLAVOR="#define ISC_NET_BSD44MSGHDR 1"], - [AC_MSG_RESULT(4.3BSD) - ISC_PLATFORM_MSGHDRFLAVOR="#define ISC_NET_BSD43MSGHDR 1"]) -AC_SUBST(ISC_PLATFORM_MSGHDRFLAVOR) - -# -# Look for in_port_t. -# -AC_MSG_CHECKING(for type in_port_t) -AC_TRY_COMPILE([ -#include -#include ], -[in_port_t port = 25; return (0);], - [AC_MSG_RESULT(yes) - ISC_PLATFORM_NEEDPORTT="#undef ISC_PLATFORM_NEEDPORTT"], - [AC_MSG_RESULT(no) - ISC_PLATFORM_NEEDPORTT="#define ISC_PLATFORM_NEEDPORTT 1"]) -AC_SUBST(ISC_PLATFORM_NEEDPORTT) - -# -# Check for addrinfo -# -AC_MSG_CHECKING(for struct addrinfo) -AC_TRY_COMPILE([ -#include ], -[struct addrinfo a; return (0);], - [AC_MSG_RESULT(yes) - ISC_LWRES_NEEDADDRINFO="#undef ISC_LWRES_NEEDADDRINFO" - AC_DEFINE(HAVE_ADDRINFO)], - [AC_MSG_RESULT(no) - ISC_LWRES_NEEDADDRINFO="#define ISC_LWRES_NEEDADDRINFO 1"]) -AC_SUBST(ISC_LWRES_NEEDADDRINFO) - -AC_MSG_CHECKING(for int sethostent) -AC_TRY_COMPILE([ -#include ], -[int i = sethostent(0); return(0);], - [AC_MSG_RESULT(yes) - ISC_LWRES_SETHOSTENTINT="#define ISC_LWRES_SETHOSTENTINT 1"], - [AC_MSG_RESULT(no) - ISC_LWRES_SETHOSTENTINT="#undef ISC_LWRES_SETHOSTENTINT"]) -AC_SUBST(ISC_LWRES_SETHOSTENTINT) - -AC_MSG_CHECKING(for int endhostent) -AC_TRY_COMPILE([ -#include ], -[int i = endhostent(); return(0);], - [AC_MSG_RESULT(yes) - ISC_LWRES_ENDHOSTENTINT="#define ISC_LWRES_ENDHOSTENTINT 1"], - [AC_MSG_RESULT(no) - ISC_LWRES_ENDHOSTENTINT="#undef ISC_LWRES_ENDHOSTENTINT"]) -AC_SUBST(ISC_LWRES_ENDHOSTENTINT) - -AC_MSG_CHECKING(for getnetbyaddr(in_addr_t, ...)) -AC_TRY_COMPILE([ -#include -struct netent *getnetbyaddr(in_addr_t, int);], -[], - [AC_MSG_RESULT(yes) - ISC_LWRES_GETNETBYADDRINADDR="#define ISC_LWRES_GETNETBYADDRINADDR 1"], - [AC_MSG_RESULT(no) - ISC_LWRES_GETNETBYADDRINADDR="#undef ISC_LWRES_GETNETBYADDRINADDR"]) -AC_SUBST(ISC_LWRES_GETNETBYADDRINADDR) - -AC_MSG_CHECKING(for int setnetent) -AC_TRY_COMPILE([ -#include ], -[int i = setnetent(0); return(0);], - [AC_MSG_RESULT(yes) - ISC_LWRES_SETNETENTINT="#define ISC_LWRES_SETNETENTINT 1"], - [AC_MSG_RESULT(no) - ISC_LWRES_SETNETENTINT="#undef ISC_LWRES_SETNETENTINT"]) -AC_SUBST(ISC_LWRES_SETNETENTINT) - -AC_MSG_CHECKING(for int endnetent) -AC_TRY_COMPILE([ -#include ], -[int i = endnetent(); return(0);], - [AC_MSG_RESULT(yes) - ISC_LWRES_ENDNETENTINT="#define ISC_LWRES_ENDNETENTINT 1"], - [AC_MSG_RESULT(no) - ISC_LWRES_ENDNETENTINT="#undef ISC_LWRES_ENDNETENTINT"]) -AC_SUBST(ISC_LWRES_ENDNETENTINT) - -AC_MSG_CHECKING(for gethostbyadd(const void *, size_t, ...)) -AC_TRY_COMPILE([ -#include -struct hostent *gethostbyaddr(const void *, size_t, int);], -[return(0);], - [AC_MSG_RESULT(yes) - ISC_LWRES_GETHOSTBYADDRVOID="#define ISC_LWRES_GETHOSTBYADDRVOID 1"], - [AC_MSG_RESULT(no) - ISC_LWRES_GETHOSTBYADDRVOID="#undef ISC_LWRES_GETHOSTBYADDRVOID"]) -AC_SUBST(ISC_LWRES_GETHOSTBYADDRVOID) - -AC_MSG_CHECKING(for h_errno in netdb.h) -AC_TRY_COMPILE([ -#include ], -[h_errno = 1; return(0);], - [AC_MSG_RESULT(yes) - ISC_LWRES_NEEDHERRNO="#undef ISC_LWRES_NEEDHERRNO"], - [AC_MSG_RESULT(no) - ISC_LWRES_NEEDHERRNO="#define ISC_LWRES_NEEDHERRNO 1"]) -AC_SUBST(ISC_LWRES_NEEDHERRNO) - -AC_CHECK_FUNC(getipnodebyname, - [ISC_LWRES_GETIPNODEPROTO="#undef ISC_LWRES_GETIPNODEPROTO"], - [ISC_LWRES_GETIPNODEPROTO="#define ISC_LWRES_GETIPNODEPROTO 1"]) -AC_CHECK_FUNC(getnameinfo, - [ISC_LWRES_GETNAMEINFOPROTO="#undef ISC_LWRES_GETNAMEINFOPROTO"], - [ISC_LWRES_GETNAMEINFOPROTO="#define ISC_LWRES_GETNAMEINFOPROTO 1"]) -AC_CHECK_FUNC(getaddrinfo, - [ISC_LWRES_GETADDRINFOPROTO="#undef ISC_LWRES_GETADDRINFOPROTO" - AC_DEFINE(HAVE_GETADDRINFO)], - [ISC_LWRES_GETADDRINFOPROTO="#define ISC_LWRES_GETADDRINFOPROTO 1"]) -AC_SUBST(ISC_LWRES_GETIPNODEPROTO) -AC_SUBST(ISC_LWRES_GETADDRINFOPROTO) -AC_SUBST(ISC_LWRES_GETNAMEINFOPROTO) - -# -# Look for a sysctl call to get the list of network interfaces. -# -AC_MSG_CHECKING(for interface list sysctl) -AC_EGREP_CPP(found_rt_iflist, [ -#include -#include -#include -#ifdef NET_RT_IFLIST -found_rt_iflist -#endif -], - [AC_MSG_RESULT(yes) - AC_DEFINE(HAVE_IFLIST_SYSCTL)], - [AC_MSG_RESULT(no)]) - # # GNU libtool support # @@ -631,6 +461,11 @@ AC_SUBST(O) AC_SUBST(A) AC_SUBST(SA) +# +# Here begins a very long section to determine the system's networking +# capabilities. The order of the tests is signficant. +# + # # IPv6 # @@ -816,10 +651,12 @@ AC_SUBST(ISC_IPV6_O) AC_SUBST(ISC_ISCIPV6_O) AC_SUBST(ISC_IPV6_C) AC_SUBST(LWRES_HAVE_SIN6_SCOPE_ID) + # # Check for network functions that are often missing. We do this # after the libtool checking, so we can put the right suffix on -# the files. +# the files. It also needs to come after checking for a Kame add-on, +# which provides some (all?) of the desired functions. # AC_MSG_CHECKING([for inet_ntop]) AC_TRY_LINK([ @@ -865,7 +702,177 @@ AC_SUBST(ISC_PLATFORM_NEEDNTOP) AC_SUBST(ISC_PLATFORM_NEEDPTON) AC_SUBST(ISC_PLATFORM_NEEDATON) +# +# Look for a 4.4BSD-style sa_len member in struct sockaddr. +# +case "$host" in + *-dec-osf*) + # Turn on 4.4BSD style sa_len support. + AC_DEFINE(_SOCKADDR_LEN) + ;; +esac + +AC_MSG_CHECKING(for sa_len in struct sockaddr) +AC_TRY_COMPILE([ +#include +#include ], +[struct sockaddr sa; sa.sa_len = 0; return (0);], + [AC_MSG_RESULT(yes) + ISC_PLATFORM_HAVESALEN="#define ISC_PLATFORM_HAVESALEN 1" + LWRES_PLATFORM_HAVESALEN="#define LWRES_PLATFORM_HAVESALEN 1"], + [AC_MSG_RESULT(no) + ISC_PLATFORM_HAVESALEN="#undef ISC_PLATFORM_HAVESALEN" + LWRES_PLATFORM_HAVESALEN="#undef LWRES_PLATFORM_HAVESALEN"]) +AC_SUBST(ISC_PLATFORM_HAVESALEN) +AC_SUBST(LWRES_PLATFORM_HAVESALEN) + +# +# Look for a 4.4BSD or 4.3BSD struct msghdr +# +AC_MSG_CHECKING(for struct msghdr flavor) +AC_TRY_COMPILE([ +#include +#include ], +[struct msghdr msg; msg.msg_flags = 0; return (0);], + [AC_MSG_RESULT(4.4BSD) + ISC_PLATFORM_MSGHDRFLAVOR="#define ISC_NET_BSD44MSGHDR 1"], + [AC_MSG_RESULT(4.3BSD) + ISC_PLATFORM_MSGHDRFLAVOR="#define ISC_NET_BSD43MSGHDR 1"]) +AC_SUBST(ISC_PLATFORM_MSGHDRFLAVOR) + +# +# Look for in_port_t. +# +AC_MSG_CHECKING(for type in_port_t) +AC_TRY_COMPILE([ +#include +#include ], +[in_port_t port = 25; return (0);], + [AC_MSG_RESULT(yes) + ISC_PLATFORM_NEEDPORTT="#undef ISC_PLATFORM_NEEDPORTT"], + [AC_MSG_RESULT(no) + ISC_PLATFORM_NEEDPORTT="#define ISC_PLATFORM_NEEDPORTT 1"]) +AC_SUBST(ISC_PLATFORM_NEEDPORTT) + +# +# Check for addrinfo +# +AC_MSG_CHECKING(for struct addrinfo) +AC_TRY_COMPILE([ +#include ], +[struct addrinfo a; return (0);], + [AC_MSG_RESULT(yes) + ISC_LWRES_NEEDADDRINFO="#undef ISC_LWRES_NEEDADDRINFO" + AC_DEFINE(HAVE_ADDRINFO)], + [AC_MSG_RESULT(no) + ISC_LWRES_NEEDADDRINFO="#define ISC_LWRES_NEEDADDRINFO 1"]) +AC_SUBST(ISC_LWRES_NEEDADDRINFO) + +AC_MSG_CHECKING(for int sethostent) +AC_TRY_COMPILE([ +#include ], +[int i = sethostent(0); return(0);], + [AC_MSG_RESULT(yes) + ISC_LWRES_SETHOSTENTINT="#define ISC_LWRES_SETHOSTENTINT 1"], + [AC_MSG_RESULT(no) + ISC_LWRES_SETHOSTENTINT="#undef ISC_LWRES_SETHOSTENTINT"]) +AC_SUBST(ISC_LWRES_SETHOSTENTINT) + +AC_MSG_CHECKING(for int endhostent) +AC_TRY_COMPILE([ +#include ], +[int i = endhostent(); return(0);], + [AC_MSG_RESULT(yes) + ISC_LWRES_ENDHOSTENTINT="#define ISC_LWRES_ENDHOSTENTINT 1"], + [AC_MSG_RESULT(no) + ISC_LWRES_ENDHOSTENTINT="#undef ISC_LWRES_ENDHOSTENTINT"]) +AC_SUBST(ISC_LWRES_ENDHOSTENTINT) + +AC_MSG_CHECKING(for getnetbyaddr(in_addr_t, ...)) +AC_TRY_COMPILE([ +#include +struct netent *getnetbyaddr(in_addr_t, int);], +[], + [AC_MSG_RESULT(yes) + ISC_LWRES_GETNETBYADDRINADDR="#define ISC_LWRES_GETNETBYADDRINADDR 1"], + [AC_MSG_RESULT(no) + ISC_LWRES_GETNETBYADDRINADDR="#undef ISC_LWRES_GETNETBYADDRINADDR"]) +AC_SUBST(ISC_LWRES_GETNETBYADDRINADDR) + +AC_MSG_CHECKING(for int setnetent) +AC_TRY_COMPILE([ +#include ], +[int i = setnetent(0); return(0);], + [AC_MSG_RESULT(yes) + ISC_LWRES_SETNETENTINT="#define ISC_LWRES_SETNETENTINT 1"], + [AC_MSG_RESULT(no) + ISC_LWRES_SETNETENTINT="#undef ISC_LWRES_SETNETENTINT"]) +AC_SUBST(ISC_LWRES_SETNETENTINT) + +AC_MSG_CHECKING(for int endnetent) +AC_TRY_COMPILE([ +#include ], +[int i = endnetent(); return(0);], + [AC_MSG_RESULT(yes) + ISC_LWRES_ENDNETENTINT="#define ISC_LWRES_ENDNETENTINT 1"], + [AC_MSG_RESULT(no) + ISC_LWRES_ENDNETENTINT="#undef ISC_LWRES_ENDNETENTINT"]) +AC_SUBST(ISC_LWRES_ENDNETENTINT) + +AC_MSG_CHECKING(for gethostbyadd(const void *, size_t, ...)) +AC_TRY_COMPILE([ +#include +struct hostent *gethostbyaddr(const void *, size_t, int);], +[return(0);], + [AC_MSG_RESULT(yes) + ISC_LWRES_GETHOSTBYADDRVOID="#define ISC_LWRES_GETHOSTBYADDRVOID 1"], + [AC_MSG_RESULT(no) + ISC_LWRES_GETHOSTBYADDRVOID="#undef ISC_LWRES_GETHOSTBYADDRVOID"]) +AC_SUBST(ISC_LWRES_GETHOSTBYADDRVOID) + +AC_MSG_CHECKING(for h_errno in netdb.h) +AC_TRY_COMPILE([ +#include ], +[h_errno = 1; return(0);], + [AC_MSG_RESULT(yes) + ISC_LWRES_NEEDHERRNO="#undef ISC_LWRES_NEEDHERRNO"], + [AC_MSG_RESULT(no) + ISC_LWRES_NEEDHERRNO="#define ISC_LWRES_NEEDHERRNO 1"]) +AC_SUBST(ISC_LWRES_NEEDHERRNO) + +AC_CHECK_FUNC(getipnodebyname, + [ISC_LWRES_GETIPNODEPROTO="#undef ISC_LWRES_GETIPNODEPROTO"], + [ISC_LWRES_GETIPNODEPROTO="#define ISC_LWRES_GETIPNODEPROTO 1"]) +AC_CHECK_FUNC(getnameinfo, + [ISC_LWRES_GETNAMEINFOPROTO="#undef ISC_LWRES_GETNAMEINFOPROTO"], + [ISC_LWRES_GETNAMEINFOPROTO="#define ISC_LWRES_GETNAMEINFOPROTO 1"]) +AC_CHECK_FUNC(getaddrinfo, + [ISC_LWRES_GETADDRINFOPROTO="#undef ISC_LWRES_GETADDRINFOPROTO" + AC_DEFINE(HAVE_GETADDRINFO)], + [ISC_LWRES_GETADDRINFOPROTO="#define ISC_LWRES_GETADDRINFOPROTO 1"]) +AC_SUBST(ISC_LWRES_GETIPNODEPROTO) +AC_SUBST(ISC_LWRES_GETADDRINFOPROTO) +AC_SUBST(ISC_LWRES_GETNAMEINFOPROTO) + +# +# Look for a sysctl call to get the list of network interfaces. +# +AC_MSG_CHECKING(for interface list sysctl) +AC_EGREP_CPP(found_rt_iflist, [ +#include +#include +#include +#ifdef NET_RT_IFLIST +found_rt_iflist +#endif +], + [AC_MSG_RESULT(yes) + AC_DEFINE(HAVE_IFLIST_SYSCTL)], + [AC_MSG_RESULT(no)]) + +# # Check for some other useful functions that are not ever-present. +# AC_CHECK_FUNC(strsep, [ISC_PLATFORM_NEEDSTRSEP="#undef ISC_PLATFORM_NEEDSTRSEP"], [ISC_PLATFORM_NEEDSTRSEP="#define ISC_PLATFORM_NEEDSTRSEP 1"]) From 53dc771403d2c1683123b8664204249df14af5e9 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Wed, 26 Jul 2000 00:03:18 +0000 Subject: [PATCH 202/226] The CD bit changes broke insecurity proofs. They work again. --- lib/dns/resolver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index c5d297a1b4..f87f0fefc8 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: resolver.c,v 1.154 2000/07/25 22:04:33 bwelling Exp $ */ +/* $Id: resolver.c,v 1.155 2000/07/26 00:03:18 bwelling Exp $ */ #include @@ -2615,7 +2615,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) { result = ISC_R_SUCCESS; if (result != ISC_R_SUCCESS) break; - } else + } else if (!ANSWER(rdataset)) continue; if (ANSWER(rdataset)) { From 15ba758c3a721b0ebe132f207a3d905d6fe3487f Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Wed, 26 Jul 2000 00:47:17 +0000 Subject: [PATCH 203/226] minor tweaks --- bin/dnssec/dnssec-keygen.8 | 35 ++++++++++--------- bin/dnssec/dnssec-makekeyset.8 | 14 ++++---- bin/dnssec/dnssec-signkey.8 | 55 +++++++++++++++--------------- bin/dnssec/dnssec-signzone.8 | 47 ++++++++++++------------- doc/man/dnssec/dnssec-keygen.8 | 35 ++++++++++--------- doc/man/dnssec/dnssec-makekeyset.8 | 14 ++++---- doc/man/dnssec/dnssec-signkey.8 | 55 +++++++++++++++--------------- doc/man/dnssec/dnssec-signzone.8 | 47 ++++++++++++------------- 8 files changed, 156 insertions(+), 146 deletions(-) diff --git a/bin/dnssec/dnssec-keygen.8 b/bin/dnssec/dnssec-keygen.8 index 09cedeb2fe..8d186c5a78 100644 --- a/bin/dnssec/dnssec-keygen.8 +++ b/bin/dnssec/dnssec-keygen.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-keygen.8,v 1.3 2000/06/28 23:40:58 jim Exp $ +.\" $Id: dnssec-keygen.8,v 1.4 2000/07/26 00:47:13 bwelling Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-KEYGEN 8 @@ -25,12 +25,12 @@ .Nd key generation tool for DNSSEC .Sh SYNOPSIS .Nm dnssec-keygen -.Op Fl a Ar algorithm -.Op Fl b Ar keysize +.Fl a Ar algorithm +.Fl b Ar keysize .Op Fl e .Op Fl g Ar generator .Op Fl h -.Op Fl n Ar nametype +.Fl n Ar nametype .Op Fl p Ar protocol-value .Op Fl r Ar randomdev .Op Fl s Ar strength-value @@ -42,11 +42,13 @@ generates keys for DNSSEC, Secure DNS, as defined in RFC2535. It also generates keys for use in Transaction Signatures, TSIG, which is defined in RFC2845. +.Pp A short summary of the options and arguments to .Nm dnssec-keygen is printed by the .Fl h (help) option. +.Pp The .Fl a , .Fl b , @@ -62,7 +64,7 @@ option to .Nm dnssec-keygen . .Ar algorithm must be one of -.Dv RSAMD5 +.Dv RSAMD5 , .Dv DH , .Dv DSA or @@ -71,8 +73,7 @@ to indicate that an RSA, Diffie-Hellman, Digital Signature Algorithm or HMAC-MD5 key is required. An argument of .Dv RSA -can also be given. -It is equivalent to +can also be given, which is equivalent to .Dv RSAMD5 . The argument identifying the encryption algorithm is case-insensitive. DNSSEC specifies DSA as a mandatory algorithm and RSA as a recommended one. @@ -85,7 +86,7 @@ argument following the option. The choice of key size depends on the algorithm that is used. RSA keys must be between 512 and 2048 bits. -Diffie-Hellman keys have to be between 128 and 4096 bits. +Diffie-Hellman keys must be between 128 and 4096 bits. For DSA, the key size must be between 512 and 1024 bits and a multiple of 64. The length of an HMAC-MD5 key can be between 1 and 512 bits. @@ -124,7 +125,7 @@ that is to be used. The only supported values value of .Ar generator are 2 and 5. -If no Diffie-Hellman generator is supplied a known prime +If no Diffie-Hellman generator is supplied, a known prime from RFC2539 will be used if possible; otherwise 2 will be used as the generator. .Pp @@ -141,12 +142,12 @@ successors. .Nm dnssec-keygen uses random numbers to seed the process of generating keys. -If the system does not have a pseudo-device like +If the system does not have a .Pa /dev/random -for generating random numbers, +device that can be used for generating random numbers, .Nm dnssec-keygen -will prompt for some keyboard input and use the time intervals between -keystrokes to provide some randomness. +will prompt for keyboard input and use the time intervals between +keystrokes to provide randomness. The .Fl r option overrides this behaviour, making @@ -259,10 +260,12 @@ The private part of the key is used by .Xr dnssec-signzone 8 to generate signatures and the public part is used to verify the signatures. -A +Both +.Ar .key +and .Ar .private -key file is generated for a symmetric encryption algorithm such as -HDMAC-MD5, even though it has no private key. +key files are generated for symmetric encryption algorithm such as +HMAC-MD5, even though the public and private key are equivalent. .Sh EXAMPLE To generate a 768-bit DSA key for the domain .Dv example.com , diff --git a/bin/dnssec/dnssec-makekeyset.8 b/bin/dnssec/dnssec-makekeyset.8 index ec66c37771..9998174666 100644 --- a/bin/dnssec/dnssec-makekeyset.8 +++ b/bin/dnssec/dnssec-makekeyset.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-makekeyset.8,v 1.3 2000/06/28 23:40:59 jim Exp $ +.\" $Id: dnssec-makekeyset.8,v 1.4 2000/07/26 00:47:14 bwelling Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-MAKEKEYSET 8 @@ -30,7 +30,7 @@ .Op Fl e Ar end-time .Op Fl t Ar TTL .Op Fl r Ar randomdev -.Op Fl v level +.Op Fl v Ar level .Ar keyfile .... .Sh DESCRIPTION .Nm dnssec-makekeyset @@ -125,8 +125,7 @@ If no .Fl t option is provided, .Nm dnssec-makekeyset -prints a warning and assumes that a default TTL of -3600 seconds was required. +prints a warning and uses a default TTL of 3600 seconds. .Pp The .Fl v @@ -139,9 +138,10 @@ increases, .Nm dnssec-makekeyset generates increasingly detailed reports about what it is doing. The default level is zero. -An option of +.Pp +The .Fl h -gets +option makes .Nm dnssec-makekeyset to print a short summary of its options and arguments. .Pp @@ -178,7 +178,7 @@ will create a file called .Pa example.com.keyset containing a SIG and KEY record for .Dv example.com. -These records will have a TTL of 1 day: 86400 seconds. +These records will have a TTL of 86400 seconds (1 day). The SIG record becomes valid at noon UTC on July 1st 2000 and expires 30 days (2592000 seconds) later. .Pp diff --git a/bin/dnssec/dnssec-signkey.8 b/bin/dnssec/dnssec-signkey.8 index 2bbefaca20..f7f80dc170 100644 --- a/bin/dnssec/dnssec-signkey.8 +++ b/bin/dnssec/dnssec-signkey.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signkey.8,v 1.3 2000/06/28 23:41:00 jim Exp $ +.\" $Id: dnssec-signkey.8,v 1.4 2000/07/26 00:47:16 bwelling Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-SIGNKEY 8 @@ -55,31 +55,38 @@ This allows the child's keys to be signed by more than 1 parent zone key if these exist. .Pp The +.Fl h +option makes +.Nm dnssec-signkey +print a short summary of its command line options +and arguments. +.Pp +The .Fl p option instructs .Nm dnssec-signkey -to use pseudo-random data when signing the keys which is faster, but +to use pseudo-random data when signing the keys. This is faster, but less secure, than using genuinely random data for signing. This option may be useful when there are many child zone keysets to -sign of if the entropy source is limited. +sign or if the entropy source is limited. It could also be used for short-lived keys and signatures that don't -require strengthening against cryptanalysis: for instance when the key +require as much protection against cryptanalysis, such as when the key will be discarded long before it could be compromised. -.Pp -An alternate file for obtaining random data can be used with the -.Fl r -option. -.Ar filename -is the name of the file to use. -If no -.Fl r -option is used and the default file for random data -.Pa /dev/random -does not exist, .Nm dnssec-signkey -will prompt for input from the keyboard. -The time between keystrokes will be measured and used to derive random -data. +may need random numbers in the process of generating keys. +If the system does not have a +.Pa /dev/random +device that can be used for generating random numbers, +.Nm dnssec-signkey +will prompt for keyboard input and use the time intervals between +keystrokes to provide randomness. +The +.Fl r +option overrides this behaviour, making +.Nm dnssec-signkey +use +.Ar randomdev +as a source of random data. .Pp The .Fl v @@ -93,13 +100,6 @@ increases, generates increasingly detailed reports about what it is doing. The default level is zero. .Pp -An option of -.Fl h -makes -.Nm dnssec-signkey -print a short summary of its command line options -and arguments. -.Pp When .Nm dnssec-signkey completes successfully, it generates a file called @@ -129,13 +129,14 @@ sign the file for .Dv example.com created in the example shown in the man page for -.Nm dnssec-makekeyset : +.Xr dnssec-makekeyset 8 : +.Pp .Dl # dnssec-signkey example.com.keyset Kcom.+003+51944 .Pp where .Dv Kcom.+003+51944 was a key file identifier that was produced when -.Nm dnssec-keygen +.Xr dnssec-keygen 8 generated a key for the .Dv .com zone. diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8 index 3d69f65534..c0081f1b53 100644 --- a/bin/dnssec/dnssec-signzone.8 +++ b/bin/dnssec/dnssec-signzone.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signzone.8,v 1.3 2000/06/28 23:41:01 jim Exp $ +.\" $Id: dnssec-signzone.8,v 1.4 2000/07/26 00:47:17 bwelling Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-SIGNZONE 8 @@ -46,8 +46,8 @@ files for the zone to be signed should be present in the current directory, along with the keys that will be used to sign the zone. If no .Ar keyfile -arguments are supplied, the default behaviour is to use all the zone's -keys. +arguments are supplied, the default behaviour is to use all of the zone's +keys that are present in the current directory. Providing specific .Ar keyfile arguments constrains @@ -182,29 +182,30 @@ determine when fresh SIG records should be generated. The .Fl p option instructs -.Nm dnssec-signzone -to use pseudo-random data when signing the zone's resource records. -This is faster but less secure than using genuinely random data for signing. -This option may be useful when the zone has many resource records to be -signed and the entropy source is limited. +.Nm dnssec-signkey +to use pseudo-random data when signing the keys. This is faster, but +less secure, than using genuinely random data for signing. +This option may be useful when there are many child zone keysets to +sign or if the entropy source is limited. It could also be used for short-lived keys and signatures that don't -require strengthening against cryptanalysis: for instance when the signatures -will be discarded long before the signed data could be compromised. +require as much protection against cryptanalysis, such as when the key +will be discarded long before it could be compromised. .Pp -An alternate source of random data can be specified with the -.Fl r -option. -.Ar randomdev -is the name of the file to use to obtain random data. -By default -.Pa /dev/random -is used if this device is available. -If it is not provided by the operating system and no -.Fl r -option is used, .Nm dnssec-signzone -will prompt the user for input from the keyboard and use the time -between keystrokes to derive some random data. +may need random numbers in the process of signing the zone. +If the system does not have a +.Pa /dev/random +device that can be used for generating random numbers, +.Nm dnssec-signzone +will prompt for keyboard input and use the time intervals between +keystrokes to provide randomness. +The +.Fl r +option overrides this behaviour, making +.Nm dnssec-signzone +use +.Ar randomdev +as a source of random data. .Pp An option of .Fl h diff --git a/doc/man/dnssec/dnssec-keygen.8 b/doc/man/dnssec/dnssec-keygen.8 index 09cedeb2fe..8d186c5a78 100644 --- a/doc/man/dnssec/dnssec-keygen.8 +++ b/doc/man/dnssec/dnssec-keygen.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-keygen.8,v 1.3 2000/06/28 23:40:58 jim Exp $ +.\" $Id: dnssec-keygen.8,v 1.4 2000/07/26 00:47:13 bwelling Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-KEYGEN 8 @@ -25,12 +25,12 @@ .Nd key generation tool for DNSSEC .Sh SYNOPSIS .Nm dnssec-keygen -.Op Fl a Ar algorithm -.Op Fl b Ar keysize +.Fl a Ar algorithm +.Fl b Ar keysize .Op Fl e .Op Fl g Ar generator .Op Fl h -.Op Fl n Ar nametype +.Fl n Ar nametype .Op Fl p Ar protocol-value .Op Fl r Ar randomdev .Op Fl s Ar strength-value @@ -42,11 +42,13 @@ generates keys for DNSSEC, Secure DNS, as defined in RFC2535. It also generates keys for use in Transaction Signatures, TSIG, which is defined in RFC2845. +.Pp A short summary of the options and arguments to .Nm dnssec-keygen is printed by the .Fl h (help) option. +.Pp The .Fl a , .Fl b , @@ -62,7 +64,7 @@ option to .Nm dnssec-keygen . .Ar algorithm must be one of -.Dv RSAMD5 +.Dv RSAMD5 , .Dv DH , .Dv DSA or @@ -71,8 +73,7 @@ to indicate that an RSA, Diffie-Hellman, Digital Signature Algorithm or HMAC-MD5 key is required. An argument of .Dv RSA -can also be given. -It is equivalent to +can also be given, which is equivalent to .Dv RSAMD5 . The argument identifying the encryption algorithm is case-insensitive. DNSSEC specifies DSA as a mandatory algorithm and RSA as a recommended one. @@ -85,7 +86,7 @@ argument following the option. The choice of key size depends on the algorithm that is used. RSA keys must be between 512 and 2048 bits. -Diffie-Hellman keys have to be between 128 and 4096 bits. +Diffie-Hellman keys must be between 128 and 4096 bits. For DSA, the key size must be between 512 and 1024 bits and a multiple of 64. The length of an HMAC-MD5 key can be between 1 and 512 bits. @@ -124,7 +125,7 @@ that is to be used. The only supported values value of .Ar generator are 2 and 5. -If no Diffie-Hellman generator is supplied a known prime +If no Diffie-Hellman generator is supplied, a known prime from RFC2539 will be used if possible; otherwise 2 will be used as the generator. .Pp @@ -141,12 +142,12 @@ successors. .Nm dnssec-keygen uses random numbers to seed the process of generating keys. -If the system does not have a pseudo-device like +If the system does not have a .Pa /dev/random -for generating random numbers, +device that can be used for generating random numbers, .Nm dnssec-keygen -will prompt for some keyboard input and use the time intervals between -keystrokes to provide some randomness. +will prompt for keyboard input and use the time intervals between +keystrokes to provide randomness. The .Fl r option overrides this behaviour, making @@ -259,10 +260,12 @@ The private part of the key is used by .Xr dnssec-signzone 8 to generate signatures and the public part is used to verify the signatures. -A +Both +.Ar .key +and .Ar .private -key file is generated for a symmetric encryption algorithm such as -HDMAC-MD5, even though it has no private key. +key files are generated for symmetric encryption algorithm such as +HMAC-MD5, even though the public and private key are equivalent. .Sh EXAMPLE To generate a 768-bit DSA key for the domain .Dv example.com , diff --git a/doc/man/dnssec/dnssec-makekeyset.8 b/doc/man/dnssec/dnssec-makekeyset.8 index ec66c37771..9998174666 100644 --- a/doc/man/dnssec/dnssec-makekeyset.8 +++ b/doc/man/dnssec/dnssec-makekeyset.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-makekeyset.8,v 1.3 2000/06/28 23:40:59 jim Exp $ +.\" $Id: dnssec-makekeyset.8,v 1.4 2000/07/26 00:47:14 bwelling Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-MAKEKEYSET 8 @@ -30,7 +30,7 @@ .Op Fl e Ar end-time .Op Fl t Ar TTL .Op Fl r Ar randomdev -.Op Fl v level +.Op Fl v Ar level .Ar keyfile .... .Sh DESCRIPTION .Nm dnssec-makekeyset @@ -125,8 +125,7 @@ If no .Fl t option is provided, .Nm dnssec-makekeyset -prints a warning and assumes that a default TTL of -3600 seconds was required. +prints a warning and uses a default TTL of 3600 seconds. .Pp The .Fl v @@ -139,9 +138,10 @@ increases, .Nm dnssec-makekeyset generates increasingly detailed reports about what it is doing. The default level is zero. -An option of +.Pp +The .Fl h -gets +option makes .Nm dnssec-makekeyset to print a short summary of its options and arguments. .Pp @@ -178,7 +178,7 @@ will create a file called .Pa example.com.keyset containing a SIG and KEY record for .Dv example.com. -These records will have a TTL of 1 day: 86400 seconds. +These records will have a TTL of 86400 seconds (1 day). The SIG record becomes valid at noon UTC on July 1st 2000 and expires 30 days (2592000 seconds) later. .Pp diff --git a/doc/man/dnssec/dnssec-signkey.8 b/doc/man/dnssec/dnssec-signkey.8 index 2bbefaca20..f7f80dc170 100644 --- a/doc/man/dnssec/dnssec-signkey.8 +++ b/doc/man/dnssec/dnssec-signkey.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signkey.8,v 1.3 2000/06/28 23:41:00 jim Exp $ +.\" $Id: dnssec-signkey.8,v 1.4 2000/07/26 00:47:16 bwelling Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-SIGNKEY 8 @@ -55,31 +55,38 @@ This allows the child's keys to be signed by more than 1 parent zone key if these exist. .Pp The +.Fl h +option makes +.Nm dnssec-signkey +print a short summary of its command line options +and arguments. +.Pp +The .Fl p option instructs .Nm dnssec-signkey -to use pseudo-random data when signing the keys which is faster, but +to use pseudo-random data when signing the keys. This is faster, but less secure, than using genuinely random data for signing. This option may be useful when there are many child zone keysets to -sign of if the entropy source is limited. +sign or if the entropy source is limited. It could also be used for short-lived keys and signatures that don't -require strengthening against cryptanalysis: for instance when the key +require as much protection against cryptanalysis, such as when the key will be discarded long before it could be compromised. -.Pp -An alternate file for obtaining random data can be used with the -.Fl r -option. -.Ar filename -is the name of the file to use. -If no -.Fl r -option is used and the default file for random data -.Pa /dev/random -does not exist, .Nm dnssec-signkey -will prompt for input from the keyboard. -The time between keystrokes will be measured and used to derive random -data. +may need random numbers in the process of generating keys. +If the system does not have a +.Pa /dev/random +device that can be used for generating random numbers, +.Nm dnssec-signkey +will prompt for keyboard input and use the time intervals between +keystrokes to provide randomness. +The +.Fl r +option overrides this behaviour, making +.Nm dnssec-signkey +use +.Ar randomdev +as a source of random data. .Pp The .Fl v @@ -93,13 +100,6 @@ increases, generates increasingly detailed reports about what it is doing. The default level is zero. .Pp -An option of -.Fl h -makes -.Nm dnssec-signkey -print a short summary of its command line options -and arguments. -.Pp When .Nm dnssec-signkey completes successfully, it generates a file called @@ -129,13 +129,14 @@ sign the file for .Dv example.com created in the example shown in the man page for -.Nm dnssec-makekeyset : +.Xr dnssec-makekeyset 8 : +.Pp .Dl # dnssec-signkey example.com.keyset Kcom.+003+51944 .Pp where .Dv Kcom.+003+51944 was a key file identifier that was produced when -.Nm dnssec-keygen +.Xr dnssec-keygen 8 generated a key for the .Dv .com zone. diff --git a/doc/man/dnssec/dnssec-signzone.8 b/doc/man/dnssec/dnssec-signzone.8 index 3d69f65534..c0081f1b53 100644 --- a/doc/man/dnssec/dnssec-signzone.8 +++ b/doc/man/dnssec/dnssec-signzone.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signzone.8,v 1.3 2000/06/28 23:41:01 jim Exp $ +.\" $Id: dnssec-signzone.8,v 1.4 2000/07/26 00:47:17 bwelling Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-SIGNZONE 8 @@ -46,8 +46,8 @@ files for the zone to be signed should be present in the current directory, along with the keys that will be used to sign the zone. If no .Ar keyfile -arguments are supplied, the default behaviour is to use all the zone's -keys. +arguments are supplied, the default behaviour is to use all of the zone's +keys that are present in the current directory. Providing specific .Ar keyfile arguments constrains @@ -182,29 +182,30 @@ determine when fresh SIG records should be generated. The .Fl p option instructs -.Nm dnssec-signzone -to use pseudo-random data when signing the zone's resource records. -This is faster but less secure than using genuinely random data for signing. -This option may be useful when the zone has many resource records to be -signed and the entropy source is limited. +.Nm dnssec-signkey +to use pseudo-random data when signing the keys. This is faster, but +less secure, than using genuinely random data for signing. +This option may be useful when there are many child zone keysets to +sign or if the entropy source is limited. It could also be used for short-lived keys and signatures that don't -require strengthening against cryptanalysis: for instance when the signatures -will be discarded long before the signed data could be compromised. +require as much protection against cryptanalysis, such as when the key +will be discarded long before it could be compromised. .Pp -An alternate source of random data can be specified with the -.Fl r -option. -.Ar randomdev -is the name of the file to use to obtain random data. -By default -.Pa /dev/random -is used if this device is available. -If it is not provided by the operating system and no -.Fl r -option is used, .Nm dnssec-signzone -will prompt the user for input from the keyboard and use the time -between keystrokes to derive some random data. +may need random numbers in the process of signing the zone. +If the system does not have a +.Pa /dev/random +device that can be used for generating random numbers, +.Nm dnssec-signzone +will prompt for keyboard input and use the time intervals between +keystrokes to provide randomness. +The +.Fl r +option overrides this behaviour, making +.Nm dnssec-signzone +use +.Ar randomdev +as a source of random data. .Pp An option of .Fl h From 5b0413f993b1c1ed837d23641e9f696cda1ee293 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Wed, 26 Jul 2000 00:50:02 +0000 Subject: [PATCH 204/226] Call isc_log_wouldlog to potentially avoid extra work in validator_log. --- lib/dns/validator.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/dns/validator.c b/lib/dns/validator.c index 2910f1c91a..05eec8d584 100644 --- a/lib/dns/validator.c +++ b/lib/dns/validator.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: validator.c,v 1.66 2000/07/25 01:24:18 bwelling Exp $ */ +/* $Id: validator.c,v 1.67 2000/07/26 00:50:02 bwelling Exp $ */ #include @@ -1525,6 +1525,10 @@ static void validator_log(dns_validator_t *val, int level, const char *fmt, ...) { va_list ap; + + if (! isc_log_wouldlog(dns_lctx, level)) + return; + va_start(ap, fmt); validator_logv(val, DNS_LOGCATEGORY_DNSSEC, DNS_LOGMODULE_VALIDATOR, level, fmt, ap); From a0b608fd1afbb220b05f49a84ef7131da25fd4ad Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 26 Jul 2000 01:19:43 +0000 Subject: [PATCH 205/226] not all messages were prefixed with I: --- bin/tests/system/nsupdate/update_test.pl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/bin/tests/system/nsupdate/update_test.pl b/bin/tests/system/nsupdate/update_test.pl index 8f25990d33..9dc3402d80 100644 --- a/bin/tests/system/nsupdate/update_test.pl +++ b/bin/tests/system/nsupdate/update_test.pl @@ -37,7 +37,7 @@ # # perl -MCPAN -e "install Net::DNS" # -# $Id: update_test.pl,v 1.1 2000/07/24 22:53:36 mws Exp $ +# $Id: update_test.pl,v 1.2 2000/07/26 01:19:43 gson Exp $ # use Getopt::Std; @@ -391,8 +391,8 @@ test("NOERROR", ["update", rr_add("u.$zone 300 NS ns.u.$zone")]); test("NOERROR", ["update", rr_del("u.$zone 300 NS ns.u.$zone")]); if ($failures) { - print "$failures tests failed.\n"; + print "I:$failures tests failed.\n"; } else { - print "All tests successful.\n"; + print "I:All tests successful.\n"; } exit $failures; From 6e1de1f55bba5c6b7dcdc5d587a8fd37d58194b7 Mon Sep 17 00:00:00 2001 From: James Brister Date: Wed, 26 Jul 2000 15:21:04 +0000 Subject: [PATCH 206/226] When unsetting option strings pointer wasn't being NULLed. --- lib/dns/config/confctx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/dns/config/confctx.c b/lib/dns/config/confctx.c index b6e26cbc3b..dcb7cd180e 100644 --- a/lib/dns/config/confctx.c +++ b/lib/dns/config/confctx.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confctx.c,v 1.75 2000/07/25 17:55:37 brister Exp $ */ +/* $Id: confctx.c,v 1.76 2000/07/26 15:21:04 brister Exp $ */ #include @@ -198,6 +198,7 @@ PVT_CONCAT(dns_c_ctx_unset, FUNC)(dns_c_ctx_t *cfg) \ } \ \ isc_mem_free(cfg->options->mem, cfg->options->FIELD); \ + cfg->options->FIELD = NULL; \ \ return (ISC_R_SUCCESS); \ } From 97684ed87defc42320a400537f676bfbbac7953b Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 26 Jul 2000 17:11:14 +0000 Subject: [PATCH 207/226] new functions isc_task_getname() and isc_task_gettag(), to be used for debugging --- lib/isc/include/isc/task.h | 32 +++++++++++++++++++++++++++++++- lib/isc/task.c | 13 ++++++++++++- 2 files changed, 43 insertions(+), 2 deletions(-) diff --git a/lib/isc/include/isc/task.h b/lib/isc/include/isc/task.h index 983bf0615c..45b4dcc8a1 100644 --- a/lib/isc/include/isc/task.h +++ b/lib/isc/include/isc/task.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: task.h,v 1.44 2000/06/22 21:58:08 tale Exp $ */ +/* $Id: task.h,v 1.45 2000/07/26 17:11:14 gson Exp $ */ #ifndef ISC_TASK_H #define ISC_TASK_H 1 @@ -457,6 +457,36 @@ isc_task_setname(isc_task_t *task, const char *name, void *tag); * 'task' is a valid task. */ +const char * +isc_task_getname(isc_task_t *task); +/* + * Get the name of 'task', as previously set using isc_task_setname(). + * + * Notes: + * This function is for debugging purposes only. + * + * Requires: + * 'task' is a valid task. + * + * Returns: + * A non-NULL pointer to a null-terminated string. + * If the task has not been named, the string is + * empty. + * + */ + +void * +isc_task_gettag(isc_task_t *task); +/* + * Get the tag value for 'task', as previously set using isc_task_settag(). + * + * Notes: + * This function is for debugging purposes only. + * + * Requires: + * 'task' is a valid task. + */ + /***** ***** Task Manager. *****/ diff --git a/lib/isc/task.c b/lib/isc/task.c index 60834b5ce7..baa83171da 100644 --- a/lib/isc/task.c +++ b/lib/isc/task.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: task.c,v 1.65 2000/06/22 21:57:16 tale Exp $ */ +/* $Id: task.c,v 1.66 2000/07/26 17:11:13 gson Exp $ */ /* * Principal Author: Bob Halley @@ -681,6 +681,17 @@ isc_task_setname(isc_task_t *task, const char *name, void *tag) { } +const char * +isc_task_getname(isc_task_t *task) { + return (task->name); +} + +void * +isc_task_gettag(isc_task_t *task) { + return (task->tag); +} + + /*** *** Task Manager. ***/ From 0b7ce4ace9f445dbbd643a9b3013f7ce90f7ab37 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 26 Jul 2000 17:36:42 +0000 Subject: [PATCH 208/226] removed duplicated line --- CHANGES | 1 - 1 file changed, 1 deletion(-) diff --git a/CHANGES b/CHANGES index 5aae798ccd..c1a5363971 100644 --- a/CHANGES +++ b/CHANGES @@ -2,7 +2,6 @@ 351. [bug] Constructing a response with rcode SERVFAIL to a TSIG signed query could crash the server. - block were not correctly reference counted, causing 350. [bug] Also-notify lists specified in the global options block were not correctly reference counted, causing a memory leak. From a32738e3e4ed9619c8ace22cd119e6769176b22c Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 26 Jul 2000 17:39:12 +0000 Subject: [PATCH 209/226] 352. [bug] Race condition in dns_client_t startup could cause an assertion failure. --- CHANGES | 3 ++ bin/named/client.c | 73 +++++++++++++++++++++++--------- bin/named/include/named/client.h | 3 +- lib/dns/include/dns/events.h | 3 +- 4 files changed, 59 insertions(+), 23 deletions(-) diff --git a/CHANGES b/CHANGES index c1a5363971..2cf052c588 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,7 @@ + 352. [bug] Race condition in dns_client_t startup could cause + an assertion failure. + 351. [bug] Constructing a response with rcode SERVFAIL to a TSIG signed query could crash the server. diff --git a/bin/named/client.c b/bin/named/client.c index 3df33b3bec..65958be8cd 100644 --- a/bin/named/client.c +++ b/bin/named/client.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: client.c,v 1.102 2000/07/17 23:19:14 gson Exp $ */ +/* $Id: client.c,v 1.103 2000/07/26 17:39:09 gson Exp $ */ #include @@ -163,6 +163,8 @@ static void clientmgr_destroy(ns_clientmgr_t *manager); static isc_boolean_t exit_check(ns_client_t *client); static void ns_client_endrequest(ns_client_t *client); static void ns_client_checkactive(ns_client_t *client); +static void client_start(isc_task_t *task, isc_event_t *event); +static void client_request(isc_task_t *task, isc_event_t *event); /* * Enter the inactive state. @@ -431,6 +433,45 @@ exit_check(ns_client_t *client) { return (ISC_TRUE); } +/* + * The client's task has received the client's control event + * as part of the startup process. + */ +static void +client_start(isc_task_t *task, isc_event_t *event) { + ns_client_t *client = (ns_client_t *) event->ev_arg; + isc_result_t result; + + INSIST(task == client->task); + + UNUSED(task); + + if (TCP_CLIENT(client)) { + client_accept(client); + } else { + result = dns_dispatch_addrequest(client->dispatch, + client->task, + client_request, + client, + &client->dispentry); + + if (result != ISC_R_SUCCESS) { + ns_client_log(client, + DNS_LOGCATEGORY_SECURITY, + NS_LOGMODULE_CLIENT, + ISC_LOG_DEBUG(3), + "dns_dispatch_addrequest() " + "failed: %s", + isc_result_totext(result)); + /* + * Not much we can do here but log the failure; + * the client will effectively go idle. + */ + } + } +} + + /* * The client's task has received a shutdown event. */ @@ -565,14 +606,14 @@ client_senddone(isc_task_t *task, isc_event_t *event) { ns_client_t *client; isc_socketevent_t *sevent = (isc_socketevent_t *) event; - UNUSED(task); - REQUIRE(sevent != NULL); REQUIRE(sevent->ev_type == ISC_SOCKEVENT_SENDDONE); client = sevent->ev_arg; REQUIRE(NS_CLIENT_VALID(client)); REQUIRE(task == client->task); + UNUSED(task); + CTRACE("senddone"); if (sevent->result != ISC_R_SUCCESS) @@ -1195,6 +1236,9 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp) client->recursionquota = NULL; client->interface = NULL; client->peeraddr_valid = ISC_FALSE; + ISC_EVENT_INIT(&client->ctlevent, sizeof(client->ctlevent), 0, NULL, + DNS_EVENT_CLIENTCONTROL, client_start, client, client, + NULL, NULL); ISC_LINK_INIT(client, link); client->list = NULL; @@ -1272,7 +1316,7 @@ client_newconn(isc_task_t *task, isc_event_t *event) { UNUSED(task); INSIST(client->state == NS_CLIENTSTATE_READY); - + INSIST(client->naccepts == 1); client->naccepts--; @@ -1529,6 +1573,7 @@ ns_clientmgr_createclients(ns_clientmgr_t *manager, unsigned int n, LOCK(&manager->lock); for (i = 0; i < n; i++) { + isc_event_t *ev; /* * Allocate a client. First try to get a recycled one; * if that fails, make a new one. @@ -1553,30 +1598,16 @@ ns_clientmgr_createclients(ns_clientmgr_t *manager, unsigned int n, client->attributes |= NS_CLIENTATTR_TCP; isc_socket_attach(ifp->tcpsocket, &client->tcplistener); - client_accept(client); } else { dns_dispatch_attach(ifp->udpdispatch, &client->dispatch); - result = dns_dispatch_addrequest(client->dispatch, - client->task, - client_request, - client, - &client->dispentry); - if (result != ISC_R_SUCCESS) { - ns_client_log(client, - DNS_LOGCATEGORY_SECURITY, - NS_LOGMODULE_CLIENT, - ISC_LOG_DEBUG(3), - "dns_dispatch_addrequest() " - "failed: %s", - isc_result_totext(result)); - isc_task_shutdown(client->task); - break; - } } client->manager = manager; ISC_LIST_APPEND(manager->active, client, link); client->list = &manager->active; + + ev = &client->ctlevent; + isc_task_send(client->task, &ev); } if (i != 0) { /* diff --git a/bin/named/include/named/client.h b/bin/named/include/named/client.h index 922ce2ad3c..d1cb7750ec 100644 --- a/bin/named/include/named/client.h +++ b/bin/named/include/named/client.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: client.h,v 1.37 2000/06/22 21:49:38 tale Exp $ */ +/* $Id: client.h,v 1.38 2000/07/26 17:39:11 gson Exp $ */ #ifndef NAMED_CLIENT_H #define NAMED_CLIENT_H 1 @@ -122,6 +122,7 @@ struct ns_client { isc_sockaddr_t peeraddr; isc_boolean_t peeraddr_valid; struct in6_pktinfo pktinfo; + isc_event_t ctlevent; ISC_LINK(ns_client_t) link; /* * The list 'link' is part of, or NULL if not on any list. diff --git a/lib/dns/include/dns/events.h b/lib/dns/include/dns/events.h index d49dc5cbed..da179433f2 100644 --- a/lib/dns/include/dns/events.h +++ b/lib/dns/include/dns/events.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: events.h,v 1.24 2000/06/22 21:55:38 tale Exp $ */ +/* $Id: events.h,v 1.25 2000/07/26 17:39:12 gson Exp $ */ #ifndef DNS_EVENTS_H #define DNS_EVENTS_H 1 @@ -52,6 +52,7 @@ #define DNS_EVENT_NOTIFYSENDTOADDR (ISC_EVENTCLASS_DNS + 23) #define DNS_EVENT_ZONE (ISC_EVENTCLASS_DNS + 24) #define DNS_EVENT_ZONESTARTXFRIN (ISC_EVENTCLASS_DNS + 25) +#define DNS_EVENT_CLIENTCONTROL (ISC_EVENTCLASS_DNS + 26) #define DNS_EVENT_FIRSTEVENT (ISC_EVENTCLASS_DNS + 0) #define DNS_EVENT_LASTEVENT (ISC_EVENTCLASS_DNS + 65535) From 222ad9086c2fd4082b4ea3b02b7449384b0bf848 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Wed, 26 Jul 2000 17:56:37 +0000 Subject: [PATCH 210/226] Typo --- bin/tests/system/nsupdate/tests.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh index d91738f716..7291ea9aa3 100644 --- a/bin/tests/system/nsupdate/tests.sh +++ b/bin/tests/system/nsupdate/tests.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: tests.sh,v 1.8 2000/07/25 17:48:51 mws Exp $ +# $Id: tests.sh,v 1.9 2000/07/26 17:56:37 mws Exp $ # # Perform tests @@ -77,7 +77,7 @@ $PERL ../digcomp.pl dig.out.ns1 dig.out.ns2 || status=1 echo "I:SIGKILL and restart server ns1" cd ns1 -kill -SIGKILL `cat named.pid` +kill -KILL `cat named.pid` rm named.pid sleep 2 $NAMED -c named.conf -d 99 -g >> named.run 2>&1 & From 761a1c3761dc4e83a5d11765a42fab2970c5352b Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Wed, 26 Jul 2000 18:47:43 +0000 Subject: [PATCH 211/226] Add sanitizer and hide per-master key code behind sanitizing #ifdefs --- bin/named/zoneconf.c | 7 +- lib/dns/config/Makefile.in | 11 +- lib/dns/config/confip.c | 41 +- lib/dns/config/confparser.y | 4 +- lib/dns/config/confparser.y.dirty | 6161 +++++++++++++++++++++++++++++ lib/dns/include/dns/confip.h | 11 +- lib/dns/include/dns/zone.h | 8 +- lib/dns/zone.c | 35 +- lib/dns/zoneconf.c | 7 +- util/sanitize.pl | 163 + util/sanitize_all.sh | 30 + 11 files changed, 6459 insertions(+), 19 deletions(-) create mode 100644 lib/dns/config/confparser.y.dirty create mode 100644 util/sanitize.pl create mode 100755 util/sanitize_all.sh diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c index 88da4f7745..7fcfcdc6df 100644 --- a/bin/named/zoneconf.c +++ b/bin/named/zoneconf.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: zoneconf.c,v 1.47 2000/07/25 20:26:11 bwelling Exp $ */ +/* $Id: zoneconf.c,v 1.48 2000/07/26 18:47:34 mws Exp $ */ #include @@ -272,10 +272,15 @@ dns_zone_configure(dns_c_ctx_t *cctx, dns_c_view_t *cview, iplist = NULL; result = dns_c_zone_getmasterips(czone, &iplist); if (result == ISC_R_SUCCESS) +#ifndef NOMINUM_PUBLIC result = dns_zone_setmasterswithkeys(zone, iplist->ips, iplist->keys, iplist->nextidx); +#else /* NOMINUM_PUBLIC */ + result = dns_zone_setmasters(zone, iplist->ips, + iplist->nextidx); +#endif /* NOMINUM_PUBLIC */ else result = dns_zone_setmasters(zone, NULL, 0); RETERR(result); diff --git a/lib/dns/config/Makefile.in b/lib/dns/config/Makefile.in index b47278d3ab..caabdba7be 100644 --- a/lib/dns/config/Makefile.in +++ b/lib/dns/config/Makefile.in @@ -13,13 +13,14 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: Makefile.in,v 1.13 2000/06/22 21:55:00 tale Exp $ +# $Id: Makefile.in,v 1.14 2000/07/26 18:47:35 mws Exp $ srcdir = @srcdir@ VPATH = @srcdir@ top_srcdir = @top_srcdir@ YACC = @YACC@ +PERL = @PERL@ @BIND9_VERSION@ @@ -65,6 +66,14 @@ confparser.c: confparser.y chmod a-w confparser.c mv y.tab.h confparser_p.h +#ifndef NOMINUM_PUBLIC +## This rule is here only for Nominum internal use. The above "comment" +## will cause the sanitizer to remove it +confparser.y: confparser.y.dirty + ${PERL} ../../../util/sanitize.pl -i - < confparser.y.dirty \ + > confparser.y +#endif NOMINUM_PUBLIC + depend: confparser.c distclean:: diff --git a/lib/dns/config/confip.c b/lib/dns/config/confip.c index fbac6d7ded..d65f459131 100644 --- a/lib/dns/config/confip.c +++ b/lib/dns/config/confip.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confip.c,v 1.28 2000/07/21 21:24:56 brister Exp $ */ +/* $Id: confip.c,v 1.29 2000/07/26 18:47:36 mws Exp $ */ #include @@ -775,8 +775,9 @@ isc_result_t dns_c_iplist_new(isc_mem_t *mem, int length, dns_c_iplist_t **newlist) { dns_c_iplist_t *list; size_t bytes; +#ifndef NOMINUM_PUBLIC int i; - +#endif /* NOMINUM_PUBLIC */ REQUIRE(mem != NULL); REQUIRE(length > 0); REQUIRE(newlist != NULL); @@ -796,6 +797,7 @@ dns_c_iplist_new(isc_mem_t *mem, int length, dns_c_iplist_t **newlist) { bytes = sizeof (dns_name_t *) * length; +#ifndef NOMINUM_PUBLIC list->keys = isc_mem_get(mem, bytes); if (list->keys == NULL) { isc_mem_put(mem, list->ips, sizeof (isc_sockaddr_t) * length); @@ -804,7 +806,7 @@ dns_c_iplist_new(isc_mem_t *mem, int length, dns_c_iplist_t **newlist) { } for (i = 0 ; i < length ; i++) list->keys[i] = NULL; - +#endif /* NOMINUM_PUBLIC */ list->magic = DNS_C_IPLIST_MAGIC; list->size = length; @@ -834,6 +836,7 @@ dns_c_iplist_detach(dns_c_iplist_t **list) { l->refcount--; if (l->refcount == 0) { +#ifndef NOMINUM_PUBLIC for (i = 0 ; i < l->size ; i++) { if (l->keys[i] != NULL) { dns_name_free(l->keys[i], l->mem); @@ -842,8 +845,8 @@ dns_c_iplist_detach(dns_c_iplist_t **list) { l->keys[i] = NULL; } } - isc_mem_put(l->mem, l->keys, sizeof (dns_name_t *) * l->size); +#endif /* NOMINUM_PUBLIC */ isc_mem_put(l->mem, l->ips, sizeof (isc_sockaddr_t) * l->size); isc_mem_put(l->mem, l, sizeof *l); } @@ -853,7 +856,7 @@ dns_c_iplist_detach(dns_c_iplist_t **list) { return (ISC_R_SUCCESS); } - +#ifndef NOMINUM_PUBLIC isc_boolean_t dns_c_iplist_haskeys(dns_c_iplist_t *list) { @@ -871,7 +874,7 @@ dns_c_iplist_haskeys(dns_c_iplist_t *list) return (ISC_FALSE); } - +#endif /* NOMINUM_PUBLIC */ void dns_c_iplist_attach(dns_c_iplist_t *source, dns_c_iplist_t **target) { @@ -898,6 +901,7 @@ dns_c_iplist_copy(isc_mem_t *mem, dns_c_iplist_t **dest, dns_c_iplist_t *src) { for (i = 0 ; i < src->nextidx ; i++) { newl->ips[i] = src->ips[i]; +#ifndef NOMINUM_PUBLIC if (src->keys[i] != NULL) { newl->keys[i] = isc_mem_get(mem, sizeof (dns_name_t)); if (newl->keys[i] == NULL) { @@ -912,6 +916,7 @@ dns_c_iplist_copy(isc_mem_t *mem, dns_c_iplist_t **dest, dns_c_iplist_t *src) { } } } +#endif /* NOMINUM_PUBLIC */ } newl->nextidx = src->nextidx; @@ -935,6 +940,7 @@ dns_c_iplist_equal(dns_c_iplist_t *list1, dns_c_iplist_t *list2) { if (!isc_sockaddr_equal(&list1->ips[i], &list2->ips[i])) return (ISC_FALSE); +#ifndef NOMINUM_PUBLIC if ((list1->keys[i] == NULL && list2->keys[i] != NULL) || (list1->keys[i] != NULL && list2->keys[i] == NULL)) return (ISC_FALSE); @@ -942,6 +948,7 @@ dns_c_iplist_equal(dns_c_iplist_t *list1, dns_c_iplist_t *list2) { if (list1->keys[i] != NULL && !dns_name_equal(list1->keys[i], list2->keys[i])) return (ISC_FALSE); +#endif /* NOMINUM_PUBLIC */ } return (ISC_TRUE); @@ -951,7 +958,9 @@ void dns_c_iplist_printfully(FILE *fp, int indent, isc_boolean_t porttoo, dns_c_iplist_t *list) { +#ifndef NOMINUM_PUBLIC isc_uint32_t i; +#endif /* NOMINUM_PUBLIC */ in_port_t port; in_port_t tmpport; isc_boolean_t athead = ISC_TRUE; @@ -991,11 +1000,13 @@ dns_c_iplist_printfully(FILE *fp, int indent, isc_boolean_t porttoo, fprintf(fp, " port %d", isc_sockaddr_getport(&list->ips[i])); } +#ifndef NOMINUM_PUBLIC if (list->keys[i] != NULL) { fprintf(fp, " key \""); dns_name_print(list->keys[i], fp); fprintf(fp, "\" "); } +#endif /* NOMINUM_PUBLIC */ fprintf(fp, ";\n"); } dns_c_printtabs(fp, indent - 1); @@ -1010,9 +1021,15 @@ dns_c_iplist_print(FILE *fp, int indent, dns_c_iplist_t *list) { dns_c_iplist_printfully(fp, indent, ISC_FALSE, list); } +#ifndef NOMINUM_PUBLIC isc_result_t dns_c_iplist_append(dns_c_iplist_t *list, isc_sockaddr_t newaddr, - const char *key) { + const char *key) +{ +#else /* NOMINUM_PUBLIC */ +isc_result_t +dns_c_iplist_append(dns_c_iplist_t *list, isc_sockaddr_t newaddr) { +#endif /* NOMINUM_PUBLIC */ isc_uint32_t i; isc_result_t res; @@ -1030,7 +1047,9 @@ dns_c_iplist_append(dns_c_iplist_t *list, isc_sockaddr_t newaddr, if (list->nextidx == list->size) { isc_sockaddr_t *newlist; +#ifndef NOMINUM_PUBLIC dns_name_t **newkeys; +#endif /* NOMINUM_PUBLIC */ size_t newbytes; size_t oldbytes = list->size * sizeof (list->ips[0]); size_t newsize = list->size + 10; @@ -1047,6 +1066,7 @@ dns_c_iplist_append(dns_c_iplist_t *list, isc_sockaddr_t newaddr, isc_mem_put(list->mem, list->ips, oldbytes); list->ips = newlist; +#ifndef NOMINUM_PUBLIC oldbytes = list->size * sizeof(list->keys[0]); newbytes = sizeof (list->ips[0]) * newsize; newkeys = isc_mem_get(list->mem, newbytes); @@ -1059,6 +1079,7 @@ dns_c_iplist_append(dns_c_iplist_t *list, isc_sockaddr_t newaddr, list->keys[i] = NULL; isc_mem_put(list->mem, list->keys, oldbytes); list->keys = newkeys; +#endif /* NOMINUM_PUBLIC */ i = list->size; list->size = newsize; @@ -1070,6 +1091,7 @@ dns_c_iplist_append(dns_c_iplist_t *list, isc_sockaddr_t newaddr, res = ISC_R_SUCCESS; +#ifndef NOMINUM_PUBLIC if (key != NULL) { if (list->keys[i] != NULL) { dns_name_free(list->keys[i], list->mem); @@ -1080,6 +1102,7 @@ dns_c_iplist_append(dns_c_iplist_t *list, isc_sockaddr_t newaddr, res = dns_c_charptoname(list->mem, key, &list->keys[i]); } +#endif /* NOMINUM_PUBLIC */ return (res); } @@ -1104,11 +1127,13 @@ dns_c_iplist_remove(dns_c_iplist_t *list, isc_sockaddr_t newaddr) { list->nextidx--; +#ifndef NOMINUM_PUBLIC if (list->keys[i] != NULL) { dns_name_reset(list->keys[i]); isc_mem_put(list->mem, list->keys[i], sizeof (dns_name_t)); } - +#endif /* NOMINUM_PUBLIC */ + for ( /* nothing */ ; i < list->nextidx ; i++) { list->ips[i] = list->ips[i + 1]; list->keys[i] = list->keys[i + 1]; diff --git a/lib/dns/config/confparser.y b/lib/dns/config/confparser.y index 6b75756975..c3811cda87 100644 --- a/lib/dns/config/confparser.y +++ b/lib/dns/config/confparser.y @@ -16,7 +16,7 @@ * SOFTWARE. */ -/* $Id: confparser.y,v 1.106 2000/07/25 17:55:39 brister Exp $ */ +/* $Id: confparser.y,v 1.107 2000/07/26 18:47:38 mws Exp $ */ #include @@ -1817,7 +1817,7 @@ ip_and_port_list: ip_and_port_element maybe_key L_EOS if ($3 != NULL) { isc_mem_free(memctx, $3); } - + $$ = $1; } ; diff --git a/lib/dns/config/confparser.y.dirty b/lib/dns/config/confparser.y.dirty new file mode 100644 index 0000000000..7698cdcba4 --- /dev/null +++ b/lib/dns/config/confparser.y.dirty @@ -0,0 +1,6161 @@ +%{ +/* + * Copyright (C) 1996-2000 Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS + * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE + * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL + * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR + * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS + * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS + * SOFTWARE. + */ + +/* $Id: confparser.y.dirty,v 1.1 2000/07/26 18:47:40 mws Exp $ */ + +#include + +#include +#include +#include +#include +#include +#include +#include + +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + + +/* Type keys for symtab lookup */ +#define KEYWORD_SYM_TYPE 0x1 +#define CLASS_SYM_TYPE 0x2 +#define ACL_SYM_TYPE 0x3 + + +/* used for holding a list of dns_rdatatype_t on the stack */ +struct confrdtype_s { + dns_rdatatype_t *types; + isc_uint32_t idx; +}; + +/* used for holding ssu data on the stack */ +struct confssu_s { + isc_boolean_t grant; + dns_name_t *ident; + unsigned int matchtype; + dns_name_t *name; + struct confrdtype_s rdatatypes; +}; + +struct keydetails_s { + char *algorithm; + char *secret; +}; + + +static isc_mutex_t yacc_mutex; + +/* All these statics are protected by the above yacc_mutex */ +static dns_c_ctx_t *currcfg; +static isc_mem_t *memctx; /* used for internal allocations */ +static isc_lex_t *mylexer; +static isc_symtab_t *keywords; +static dns_c_cbks_t *callbacks; +static isc_lexspecials_t specials; + + +/* + * XXXJAB The #define for the default OMAPI port is not available + * to us, so we make our own. + */ + +#define OMAPI_DEFAULT_PORT 953 + +#define CONF_MAX_IDENT 1024 + +/* This should be sufficient to permit multiple parsers and lexers if needed */ +#define yyparse dns__yyparse + +#define YYDEBUG 1 + +/* + * Specify a small parser stack size. This is needed when + * using bison the generate the parser, because it puts + * the parser stack in a local variable, and the default + * initial stack size of 200 is big enough to cause a + * thread stack overflow. Berkeley yacc does not suffer + * from this problem as it allocates the parser stack + * using malloc. + */ + +#define YYMAXDEPTH 200 +#define YYINITDEPTH 200 + + +static isc_result_t tmpres; +static in_port_t default_port; + +int yyparse(void); +static int yylex(void); +static void parser_error(isc_boolean_t lasttoken, + const char *fmt, ...); +static void parser_warning(isc_boolean_t lasttoken, + const char *fmt, ...); +static void parser_complain(isc_boolean_t is_warning, + isc_boolean_t last_token, + const char *format, va_list args); +static isc_result_t unit_to_uint32(char *in, isc_uint32_t *out); +static const char * token_to_keyword(int token); +static void yyerror(const char *); +static dns_peerlist_t *currentpeerlist(dns_c_ctx_t *cfg, + isc_boolean_t createIfNeeded); +static isc_boolean_t keydefinedinscope(dns_c_ctx_t *cfg, + const char *name); + + + +/* returns true if (base * mult) would be too big.*/ +static isc_boolean_t int_too_big(isc_uint32_t base, isc_uint32_t mult); + +/* + * #define global symbols that various versions of YACC export into our + * namespace. This won't work for all versions, but we hope to cover + * the popular ones. + */ + +/* + * All YACCs + */ +#define yychar dns__yychar +#define yydebug dns__yydebug +#define yylval dns__yylval +#define yynerrs dns__yynerrs +/* + * BYACC + */ +#define yyerrflag dns__yyerrflag +#define yyss dns__yyss +#define yyssp dns__yyssp +#define yyval dns__yyval +#define yyvs dns__yyvs +#define yyvsp dns__yyvsp +/* + * AIX + */ +#define yyps dns__yyps +#define yypv dns__yypv +#define yypvt dns__yypvt +#define yys dns__yys +#define yystate dns__yystate +#define yytmp dns__yytmp +#define yyv dns__yyv +#define yyval dns__yyval +#define yyact dns__yyact +#define yychk dns__yychk +#define yydef dns__yydef +#define yyexca dns__yyexca +#define yypact dns__yypact +#define yypgo dns__yypgo +#define yyr1 dns__yyr1 +#define yyr2 dns__yyr2 +#define yyreds dns__yyreds +#define yytoks dns__yytoks + +%} + +%union { + char *text; + int number; + isc_int32_t l_int; + isc_uint32_t ul_int; + isc_uint16_t port_int; + dns_c_zonetype_t ztype; + struct in_addr ip4_addr; + struct in6_addr ip6_addr; + isc_sockaddr_t ipaddress; + + struct keydetails_s keydetails; + struct confssu_s ssu; + struct confrdtype_s rdatatypelist; + dns_rdatatype_t rdatatype; + dns_c_addata_t addata; + + isc_boolean_t boolean; + dns_rdataclass_t rrclass; + dns_severity_t severity; + dns_c_trans_t transport; + dns_transfer_format_t tformat; + dns_notifytype_t notifytype; + + dns_c_ipmatchelement_t *ime; + dns_c_ipmatchlist_t *iml; + + dns_c_forw_t forward; + dns_c_rrso_t *rrorder; + dns_c_rrsolist_t *rrolist; + dns_rdatatype_t ordertype; + dns_rdataclass_t orderclass; + dns_c_ordering_t ordering; + dns_c_iplist_t *iplist; + dns_c_kidlist_t *kidlist; +} + +/* Misc */ +%token L_STRING +%token L_QSTRING +%token L_INTEGER +%token L_IP4ADDR +%token L_IP6ADDR + +%token L_ACL +%token L_ADDITIONAL_DATA +%token L_ADDRESS +%token L_ALGID +%token L_ALLOW +%token L_ALLOW_QUERY +%token L_ALLOW_RECURSION +%token L_ALLOW_TRANSFER +%token L_ALLOW_UPDATE +%token L_ALLOW_UPDATE_FORWARDING +%token L_ALSO_NOTIFY +%token L_AUTH_NXDOMAIN +%token L_BANG +%token L_BLACKHOLE +%token L_BOGUS +%token L_MAX_CACHE_SIZE +%token L_CATEGORY +%token L_CHANNEL +%token L_CHECK_NAMES +%token L_CLASS +%token L_CLEAN_INTERVAL +%token L_CONTROLS +%token L_CORESIZE +%token L_DATASIZE +%token L_DATABASE +%token L_DEALLOC_ON_EXIT +%token L_DEBUG +%token L_DEFAULT +%token L_DENY +%token L_DIALUP +%token L_DIRECTORY +%token L_DUMP_FILE +%token L_DYNAMIC +%token L_ENABLE_ZONE +%token L_END_INCLUDE +%token L_EOS +%token L_EXPERT_MODE +%token L_FAIL +%token L_FAKE_IQUERY +%token L_FALSE +%token L_FETCH_GLUE +%token L_FILE +%token L_FILES +%token L_FILE_IXFR +%token L_FIRST +%token L_FORWARD +%token L_FORWARDERS +%token L_GLUE_FROM_AUTH +%token L_GLUE_FROM_CACHE +%token L_GRANT +%token L_GROUP +%token L_HAS_OLD_CLIENTS +%token L_HEARTBEAT +%token L_HINT +%token L_HOSTSTATS +%token L_IF_NO_ANSWER +%token L_IF_NO_DOMAIN +%token L_IGNORE +%token L_INCLUDE +%token L_INET +%token L_INTERFACE_INTERVAL +%token L_INTERNAL +%token L_IXFR_TMP +%token L_KEYS +%token L_LAME_TTL +%token L_LBRACE +%token L_LISTEN_ON +%token L_LISTEN_ON_V6 +%token L_LOGGING +%token L_MAINTAIN_IXFR_BASE +%token L_MANY_ANSWERS +%token L_MASTER +%token L_MASTERS +%token L_MATCH_CLIENTS +%token L_MAX_LOG_SIZE_IXFR +%token L_MAX_CACHE_TTL +%token L_MAX_NCACHE_TTL +%token L_MAX_TRANSFER_IDLE_IN +%token L_MAX_TRANSFER_IDLE_OUT +%token L_MAX_TRANSFER_TIME_IN +%token L_MAX_TRANSFER_TIME_OUT +%token L_MAXIMAL +%token L_MEMSTATS_FILE +%token L_MIN_ROOTS +%token L_MINIMAL +%token L_MULTIPLE_CNAMES +%token L_NAME +%token L_NAMED_XFER +%token L_NO +%token L_NOTIFY +%token L_NULL_OUTPUT +%token L_ONE_ANSWER +%token L_ONLY +%token L_OPTIONS +%token L_ORDER +%token L_OWNER +%token L_RANDOM_DEVICE +%token L_RANDOM_SEED_FILE +%token L_PERM +%token L_PIDFILE +%token L_PORT +%token L_PRINT_CATEGORY +%token L_PRINT_SEVERITY +%token L_PRINT_TIME +%token L_PROVIDE_IXFR +%token L_PUBKEY +%token L_QUERY_SOURCE +%token L_QUERY_SOURCE_V6 +%token L_RBRACE +%token L_RECURSION +%token L_RECURSIVE_CLIENTS +%token L_REQUEST_IXFR +%token L_RESPONSE +%token L_RFC2308_TYPE1 +%token L_RRSET_ORDER +%token L_SECRET +%token L_SEC_KEY +%token L_SELF +%token L_SERIAL_QUERIES +%token L_SERVER +%token L_SEVERITY +%token L_SIG_VALIDITY_INTERVAL +%token L_SIZE +%token L_SLASH +%token L_SLAVE +%token L_SORTLIST +%token L_STACKSIZE +%token L_STATS_FILE +%token L_STATS_INTERVAL +%token L_STDERR +%token L_STUB +%token L_SUBDOMAIN +%token L_SUPPORT_IXFR +%token L_SYSLOG +%token L_TCP_CLIENTS +%token L_TKEY_DHKEY +%token L_TKEY_DOMAIN +%token L_TOPOLOGY +%token L_TRANSFERS +%token L_TRANSFERS_IN +%token L_TRANSFERS_OUT +%token L_TRANSFERS_PER_NS +%token L_TRANSFER_FORMAT +%token L_TRANSFER_SOURCE +%token L_TRANSFER_SOURCE_V6 +%token L_TREAT_CR_AS_SPACE +%token L_TRUE +%token L_TRUSTED_KEYS +%token L_TYPE +%token L_UNIX +%token L_UNLIMITED +%token L_UPDATE_POLICY +%token L_USE_ID_POOL +%token L_USE_IXFR +%token L_VERSION +%token L_VERSIONS +%token L_VIEW +%token L_WARN +%token L_WILDCARD +%token L_YES +%token L_ZONE +%token L_EXPLICIT + + +%type additional_data +%type grantp +%type yea_or_nay +%type notify_setting +%type forward_opt +%type zone_forward_opt +%type address_match_element +%type address_match_simple +%type address_name +%type address_match_list +%type in_addr_elem +%type ip4_address +%type ip6_address +%type ip_address +%type maybe_wild_addr +%type maybe_wild_ip4_only_addr +%type maybe_wild_ip6_only_addr +%type query_source_v4 +%type query_source_v6 +%type ip_and_port_element +%type in_addr_list +%type opt_in_addr_list +%type opt_zone_forwarders_list +%type port_ip_list +%type ip_and_port_list +%type facility_name +%type maybe_syslog_facility +%type ordering_class +%type ordering_type +%type in_port +%type maybe_port +%type maybe_wild_port +%type maybe_zero_port +%type control_port +%type rdatatype +%type rdatatype_list +%type class_name +%type wild_class_name +%type optional_class +%type check_names_opt +%type key_definition +%type grant_stmt +%type algorithm_id +%type any_string +%type category_name +%type channel_name +%type domain_name +%type key_value +#ifndef NOMINUM_PUBLIC +%type maybe_key +#endif /* NOMINUM_PUBLIC */ +%type control_keys +%type keyid_list +%type ordering_name +%type secret +%type transfer_format +%type check_names_type; +%type grant_match_type +%type size_spec +%type zone_type + +/* Miscellaneous items (used in several places): */ + +%% + +config_file: /* nothing */ + | statement_list + ; + +statement_list: statement + | statement_list statement + ; + +statement: include_stmt + | options_stmt L_EOS + | controls_stmt L_EOS + | logging_stmt L_EOS + | server_stmt L_EOS + | zone_stmt L_EOS + | trusted_keys_stmt L_EOS + | acl_stmt L_EOS + | key_stmt L_EOS + | view_stmt L_EOS + | L_END_INCLUDE + ; + +/* + * Note that we must consume the semicolon ending the + * include statement before switching input streams. + */ +include_stmt: L_INCLUDE L_QSTRING L_EOS + { + tmpres = isc_lex_openfile(mylexer, $2); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "can't open file %s: %s", + $2, isc_result_totext(tmpres)); + YYABORT; + } + + isc_mem_free(memctx, $2); + } + ; + +options_stmt: L_OPTIONS + { + dns_c_options_t *options; + + if (currcfg->zlist != NULL || currcfg->views != NULL) { + parser_error(ISC_FALSE, + "options must come before all " + "zones and views"); + YYABORT; + } + + tmpres = dns_c_ctx_getoptions(currcfg, &options); + if (tmpres == ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "cannot redefine options"); + + /* + * Clean out options so rest of config won't fail + * or issue extra error messages + */ + dns_c_ctx_optionsdelete(&currcfg->options); + } + + tmpres = dns_c_ctx_optionsnew(currcfg->mem, &currcfg->options); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create options structure: %s", + isc_result_totext(tmpres)); + YYABORT; + } + + } L_LBRACE options L_RBRACE { + if (callbacks != NULL && callbacks->optscbk != NULL) { + tmpres = callbacks->optscbk(currcfg, + callbacks->optscbkuap); + if (tmpres != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, + DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, + ISC_LOG_ERROR, + "options configuration " + "failed: %s", + isc_result_totext(tmpres)); + YYABORT; + } + } + } + ; + + +options_list: option L_EOS + | options_list option L_EOS + ; + +options: /* nothin */ + | options_list + ; + + +option: /* Empty */ + | L_VERSION L_QSTRING + { + tmpres = dns_c_ctx_setversion(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine version"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "set version error %s: %s", + isc_result_totext(tmpres), $2); + YYABORT; + } + + isc_mem_free(memctx, $2); + } + | L_DIRECTORY L_QSTRING + { + tmpres = dns_c_ctx_setdirectory(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine directory"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "error setting directory: %s: %s", + isc_result_totext(tmpres), $2); + YYABORT; + } + + isc_mem_free(memctx, $2); + } + | L_NAMED_XFER L_QSTRING + { + tmpres = dns_c_ctx_setnamedxfer(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine named-xfer"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "set named-xfer error: %s: %s", + isc_result_totext(tmpres), $2); + YYABORT; + } + + isc_mem_free(memctx, $2); + } + | L_RANDOM_DEVICE L_QSTRING + { + tmpres = dns_c_ctx_setrandomdevice(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine random-device"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "error setting random-device: %s: %s", + isc_result_totext(tmpres), $2); + YYABORT; + } + + isc_mem_free(memctx, $2); + } + | L_RANDOM_SEED_FILE L_QSTRING + { + tmpres = dns_c_ctx_setrandomseedfile(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine random-seed-file"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "error setting random-seed-file: %s: %s", + isc_result_totext(tmpres), $2); + YYABORT; + } + + isc_mem_free(memctx, $2); + } + | L_TKEY_DOMAIN L_QSTRING + { + tmpres = dns_c_ctx_settkeydomain(currcfg, $2); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine tkey-domain"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "set tkey-domain error: %s: %s", + isc_result_totext(tmpres), $2); + YYABORT; + } + + isc_mem_free(memctx, $2); + } + | L_TKEY_DHKEY L_QSTRING L_INTEGER + { + tmpres = dns_c_ctx_settkeydhkey(currcfg, $2, $3); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine tkey-dhkey"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "set tkey-dhkey error: %s: %s", + isc_result_totext(tmpres), $2); + YYABORT; + } + + isc_mem_free(memctx, $2); + } + | L_PIDFILE L_QSTRING + { + tmpres = dns_c_ctx_setpidfilename(currcfg, $2); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine pid-file"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "set pidfile error %s: %s", + isc_result_totext(tmpres), $2); + YYABORT; + } + + isc_mem_free(memctx, $2); + } + | L_STATS_FILE L_QSTRING + { + tmpres = dns_c_ctx_setstatsfilename(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine statistics-file"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "set statsfile error %s: %s", + isc_result_totext(tmpres), $2); + YYABORT; + } + + isc_mem_free(memctx, $2); + } + | L_MEMSTATS_FILE L_QSTRING + { + tmpres = dns_c_ctx_setmemstatsfilename(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine memstatistics-file"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "set memstatsfile error %s: %s", + isc_result_totext(tmpres), $2); + YYABORT; + } + + isc_mem_free(memctx, $2); + } + | L_DUMP_FILE L_QSTRING + { + tmpres = dns_c_ctx_setdumpfilename(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine dump-file"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "set dumpfile error %s: %s", + isc_result_totext(tmpres), $2); + YYABORT; + } + + isc_mem_free(memctx, $2); + } + | L_EXPERT_MODE yea_or_nay + { + tmpres = dns_c_ctx_setexpertmode(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine expert-mode"); + YYABORT; + } + } + | L_FAKE_IQUERY yea_or_nay + { + tmpres = dns_c_ctx_setfakeiquery(currcfg, ISC_FALSE); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine fake-iquery"); + YYABORT; + } + } + | L_RECURSION yea_or_nay + { + tmpres = dns_c_ctx_setrecursion(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine recursion"); + YYABORT; + } + } + | L_FETCH_GLUE yea_or_nay + { + tmpres = dns_c_ctx_setfetchglue(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine fetch-glue"); + YYABORT; + } + } + | L_NOTIFY notify_setting + { + tmpres = dns_c_ctx_setnotify(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine notify"); + YYABORT; + } + } + | L_HOSTSTATS yea_or_nay + { + tmpres = dns_c_ctx_sethoststatistics(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine host-statistics"); + YYABORT; + } + } + | L_DEALLOC_ON_EXIT yea_or_nay + { + tmpres = dns_c_ctx_setdealloconexit(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine deallocate-on-exit"); + YYABORT; + } + } + | L_USE_IXFR yea_or_nay + { + tmpres = dns_c_ctx_setuseixfr(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine use-ixfr"); + YYABORT; + } + } + | L_MAINTAIN_IXFR_BASE yea_or_nay + { + /* + * Backwards compatibility, treated as + * equivalent to provide-ixfr. + */ + tmpres = dns_c_ctx_setprovideixfr(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine provide-ixfr"); + YYABORT; + } + } + | L_HAS_OLD_CLIENTS yea_or_nay + { + tmpres = dns_c_ctx_sethasoldclients(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine has-old-clients"); + YYABORT; + } + } + | L_AUTH_NXDOMAIN yea_or_nay + { + tmpres = dns_c_ctx_setauthnxdomain(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine auth-nxdomain"); + YYABORT; + } + } + | L_MULTIPLE_CNAMES yea_or_nay + { + tmpres = dns_c_ctx_setmultiplecnames(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine multiple-cnames"); + YYABORT; + } + } + | L_CHECK_NAMES check_names_type check_names_opt + { + tmpres = dns_c_ctx_setchecknames(currcfg, $2, $3); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine check-names"); + YYABORT; + } + } + | L_USE_ID_POOL yea_or_nay + { + tmpres = dns_c_ctx_setuseidpool(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine use-id-pool"); + YYABORT; + } + } + | L_RFC2308_TYPE1 yea_or_nay + { + tmpres = dns_c_ctx_setrfc2308type1(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine rfc2308-type"); + YYABORT; + } + } + | L_PROVIDE_IXFR yea_or_nay + { + tmpres = dns_c_ctx_setprovideixfr(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine provide-ixfr"); + YYABORT; + } + } + | L_REQUEST_IXFR yea_or_nay + { + tmpres = dns_c_ctx_setrequestixfr(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine request-ixfr"); + YYABORT; + } + } + | L_TREAT_CR_AS_SPACE yea_or_nay + { + tmpres = dns_c_ctx_settreatcrasspace(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine treat-cr-as-space"); + YYABORT; + } + } + | L_GLUE_FROM_CACHE yea_or_nay + { + tmpres = dns_c_ctx_setgluefromcache(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine glue-from-cache"); + YYABORT; + } + } + | L_GLUE_FROM_AUTH yea_or_nay + { + tmpres = dns_c_ctx_setgluefromauth(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine glue-from-auth"); + YYABORT; + } + } + | L_LISTEN_ON maybe_port L_LBRACE address_match_list L_RBRACE + { + if ($4 == NULL) { + parser_warning(ISC_FALSE, + "address-match-list empty implies" + "listen statement ignored"); + } else { + tmpres = dns_c_ctx_addlisten_on(currcfg, $2, $4, + ISC_FALSE); + + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to add listen statement"); + YYABORT; + } + } + } + | L_LISTEN_ON_V6 maybe_port L_LBRACE address_match_list L_RBRACE + { + if ($4 == NULL) { + parser_warning(ISC_FALSE, + "address-match-list empty implies" + "listen statement ignored"); + } else { + tmpres = dns_c_ctx_addv6listen_on(currcfg, $2, $4, + ISC_FALSE); + + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to add " + "v6listen statement"); + YYABORT; + } + } + } + | L_FORWARD forward_opt + { + tmpres = dns_c_ctx_setforward(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine forward"); + YYABORT; + } + } + | L_FORWARDERS { + dns_c_iplist_t *forwarders; + + tmpres = dns_c_ctx_getforwarders(currcfg, &forwarders); + if (tmpres != ISC_R_NOTFOUND) { + parser_warning(ISC_FALSE, + "cannot redefine options forwarders"); + dns_c_iplist_detach(&forwarders); + } + + tmpres = dns_c_iplist_new(currcfg->mem, 5, &forwarders); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create forwarders list"); + YYABORT; + } + + tmpres = dns_c_ctx_setforwarders(currcfg, ISC_FALSE, + forwarders); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set forwarders list"); + YYABORT; + } + } L_LBRACE opt_forwarders_list L_RBRACE + | L_QUERY_SOURCE query_source_v4 + { + tmpres = dns_c_ctx_setquerysource(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine query-source"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set query-source"); + YYABORT; + } + } + | L_QUERY_SOURCE_V6 query_source_v6 + { + tmpres = dns_c_ctx_setquerysourcev6(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine query-source-v6"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set query-source-v6"); + YYABORT; + } + } + | L_TRANSFER_SOURCE maybe_wild_ip4_only_addr + { + tmpres = dns_c_ctx_settransfersource(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine transfer-source"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set transfer-source"); + YYABORT; + } + } + | L_TRANSFER_SOURCE_V6 maybe_wild_ip6_only_addr + { + tmpres = dns_c_ctx_settransfersourcev6(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine transfer-source-v6"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set transfer-source-v6"); + YYABORT; + } + } + | L_ALLOW_QUERY L_LBRACE address_match_list L_RBRACE + { + if ($3 == NULL) + YYABORT; + + tmpres = dns_c_ctx_setallowquery(currcfg, $3); + dns_c_ipmatchlist_detach(&$3); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine allow-query list"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to set allow-query"); + YYABORT; + } + } + | L_ALLOW_TRANSFER L_LBRACE address_match_list L_RBRACE + { + tmpres = dns_c_ctx_setallowtransfer(currcfg, $3); + dns_c_ipmatchlist_detach(&$3); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine allow-transfer list"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set allow-transfer"); + YYABORT; + } + } + | L_ALLOW_RECURSION L_LBRACE address_match_list L_RBRACE + { + tmpres = dns_c_ctx_setallowrecursion(currcfg, $3); + dns_c_ipmatchlist_detach(&$3); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine allow-recursion list"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set allow-recursion"); + YYABORT; + } + } + | L_SORTLIST L_LBRACE address_match_list L_RBRACE + { + tmpres = dns_c_ctx_setsortlist(currcfg, $3); + dns_c_ipmatchlist_detach(&$3); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine sortlist"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to set sortlist"); + YYABORT; + } + } + | L_ALSO_NOTIFY port_ip_list + { + tmpres = dns_c_ctx_setalsonotify(currcfg, $2); + dns_c_iplist_detach(&$2); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine also-notify"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to set also-notify"); + YYABORT; + } + } + | L_BLACKHOLE L_LBRACE address_match_list L_RBRACE + { + tmpres = dns_c_ctx_setblackhole(currcfg, $3); + dns_c_ipmatchlist_detach(&$3); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine blackhole"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to set blackhole"); + YYABORT; + } + } + | L_TOPOLOGY L_LBRACE address_match_list L_RBRACE + { + tmpres = dns_c_ctx_settopology(currcfg, $3); + dns_c_ipmatchlist_detach(&$3); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine topology"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to set topology"); + YYABORT; + } + } + | size_clause + | transfer_clause + | L_TRANSFER_FORMAT transfer_format + { + tmpres = dns_c_ctx_settransferformat(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine transfer-format"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set transfer-format"); + YYABORT; + } + } + | L_MAX_TRANSFER_TIME_IN L_INTEGER + { + if ( int_too_big($2, 60) ) { + parser_error(ISC_FALSE, + "integer value too big: %u", $2); + YYABORT; + } + + tmpres = dns_c_ctx_setmaxtransfertimein(currcfg, $2 * 60); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine max-transfer-time-in"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set max-transfer-time-in"); + YYABORT; + } + } + | L_PORT in_port + { + tmpres = dns_c_ctx_setport(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine port"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set port"); + YYABORT; + } + default_port = $2; + } + | L_MAX_TRANSFER_TIME_OUT L_INTEGER + { + if ( int_too_big($2, 60) ) { + parser_error(ISC_FALSE, + "integer value too big: %u", $2); + YYABORT; + } + + tmpres = dns_c_ctx_setmaxtransfertimeout(currcfg, $2 * 60); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine max-transfer-time-out"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set max-transfer-time-out"); + YYABORT; + } + } + | L_MAX_TRANSFER_IDLE_IN L_INTEGER + { + if ( int_too_big($2, 60) ) { + parser_error(ISC_FALSE, + "integer value too big: %u", $2); + YYABORT; + } + + tmpres = dns_c_ctx_setmaxtransferidlein(currcfg, $2 * 60); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine max-transfer-idle-in"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set max-transfer-idle-in"); + YYABORT; + } + } + | L_MAX_TRANSFER_IDLE_OUT L_INTEGER + { + if ( int_too_big($2, 60) ) { + parser_error(ISC_FALSE, + "integer value too big: %u", $2); + YYABORT; + } + + tmpres = dns_c_ctx_setmaxtransferidleout(currcfg, $2 * 60); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine max-transfer-idle-out"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set max-transfer-idle-out"); + YYABORT; + } + } + | L_TCP_CLIENTS L_INTEGER + { + tmpres = dns_c_ctx_settcpclients(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine tcp-clients"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set tcp-clients"); + YYABORT; + } + } + | L_SIG_VALIDITY_INTERVAL L_INTEGER + { + tmpres = dns_c_ctx_setsigvalidityinterval(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine sig-validity-interval"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set sig-validity-interval"); + YYABORT; + } + } + | L_LAME_TTL L_INTEGER + { + tmpres = dns_c_ctx_setlamettl(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine lame-ttl"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to set lame-ttl"); + YYABORT; + } + } + | L_RECURSIVE_CLIENTS L_INTEGER + { + tmpres = dns_c_ctx_setrecursiveclients(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine recursive-clients"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set recursive-clients"); + YYABORT; + } + } + | L_MIN_ROOTS L_INTEGER + { + tmpres = dns_c_ctx_setminroots(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine min-roots"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set min-roots"); + YYABORT; + } + } + | L_SERIAL_QUERIES L_INTEGER + { + tmpres = dns_c_ctx_setserialqueries(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine serial-queries"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set serial-queries"); + YYABORT; + } + } + | L_CLEAN_INTERVAL L_INTEGER + { + if ( int_too_big($2, 60) ) { + parser_error(ISC_FALSE, + "integer value too big: %u", $2); + YYABORT; + } + + tmpres = dns_c_ctx_setcleaninterval(currcfg, $2 * 60); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine cleaning-interval"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set cleaning-interval"); + YYABORT; + } + } + | L_INTERFACE_INTERVAL L_INTEGER + { + if ( int_too_big($2, 60) ) { + parser_error(ISC_FALSE, + "integer value too big: %u", $2); + YYABORT; + } + + tmpres = dns_c_ctx_setinterfaceinterval(currcfg, $2 * 60); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine interface-interval"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set interface-interval"); + YYABORT; + } + } + | L_STATS_INTERVAL L_INTEGER + { + if ( int_too_big($2, 60) ) { + parser_error(ISC_FALSE, + "integer value too big: %u", $2); + YYABORT; + } + + tmpres = dns_c_ctx_setstatsinterval(currcfg, $2 * 60); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine statistics-interval"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set statistics-interval"); + YYABORT; + } + } + | L_MAX_LOG_SIZE_IXFR L_INTEGER + { + tmpres = dns_c_ctx_setmaxlogsizeixfr(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine max-ixfr-log-size"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set max-ixfr-log-size"); + YYABORT; + } + } + | L_MAX_NCACHE_TTL L_INTEGER + { + tmpres = dns_c_ctx_setmaxncachettl(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine max-ncache-ttl"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set max-ncache-ttl"); + YYABORT; + } + } + | L_MAX_CACHE_TTL L_INTEGER + { + tmpres = dns_c_ctx_setmaxcachettl(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine max-cache-ttl"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set max-cache-ttl"); + YYABORT; + } + } + | L_HEARTBEAT L_INTEGER + { + if ( int_too_big($2, 60) ) { + parser_error(ISC_FALSE, + "integer value too big: %u", $2); + YYABORT; + } + + tmpres = dns_c_ctx_setheartbeatinterval(currcfg, $2 * 60); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine heartbeat-interval"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set heartbeat-interval"); + YYABORT; + } + } + | L_DIALUP yea_or_nay + { + tmpres = dns_c_ctx_setdialup(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine dialup"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to set dialup"); + YYABORT; + } + } + | L_RRSET_ORDER + { + dns_c_rrsolist_t *ordering; + + tmpres = dns_c_ctx_getrrsetorderlist(currcfg, &ordering); + if (tmpres != ISC_R_NOTFOUND) { + parser_warning(ISC_FALSE, + "cannot redefine rrset-order list"); + dns_c_rrsolist_clear(ordering); + } else { + tmpres = dns_c_rrsolist_new(currcfg->mem, &ordering); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create rrset-order " + "list"); + YYABORT; + } + tmpres = dns_c_ctx_setrrsetorderlist(currcfg, + ISC_FALSE, + ordering); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set rrset-order"); + YYABORT; + } + } + } L_LBRACE rrset_ordering_list L_RBRACE + | L_ALLOW_UPDATE_FORWARDING L_LBRACE address_match_list L_RBRACE + { + tmpres = dns_c_ctx_setallowupdateforwarding(currcfg, $3); + dns_c_ipmatchlist_detach(&$3); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine " + "allow-update-forwarding"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set allow-update-forwarding"); + YYABORT; + } + } + | L_ADDITIONAL_DATA additional_data + { + tmpres = dns_c_ctx_setadditionaldata(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine additional-data"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set additional-data"); + YYABORT; + } + } + ; + + +/* + * Controls. + */ +controls_stmt: L_CONTROLS + { + if (currcfg->controls != NULL) { + parser_warning(ISC_FALSE, "cannot redefine controls"); + dns_c_ctrllist_delete(&currcfg->controls); + } + + tmpres = dns_c_ctrllist_new(currcfg->mem, + &currcfg->controls); + if (tmpres != ISC_R_SUCCESS) { + YYABORT; + } + } L_LBRACE controls L_RBRACE + ; + +controls: control L_EOS + | controls control L_EOS + ; + +control: /* Empty */ + | L_INET maybe_wild_addr control_port + L_ALLOW L_LBRACE address_match_list L_RBRACE control_keys + { + dns_c_ctrl_t *control; + + tmpres = dns_c_ctrlinet_new(currcfg->mem, &control, + $2, $3, $6, $8, ISC_FALSE); + + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to build inet control structure"); + YYABORT; + } + + ISC_LIST_APPEND(currcfg->controls->elements, control, next); + } + | L_UNIX L_QSTRING L_PERM L_INTEGER L_OWNER L_INTEGER L_GROUP L_INTEGER + { + dns_c_ctrl_t *control; + + tmpres = dns_c_ctrlunix_new(currcfg->mem, &control, + $2, $4, $6, $8); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to build unix control structure"); + YYABORT; + } + + ISC_LIST_APPEND(currcfg->controls->elements, control, next); + + isc_mem_free(memctx, $2); + } + ; + + +control_keys: /* nothing */ + { + $$ = NULL; + } + | L_KEYS L_LBRACE keyid_list L_RBRACE + { + $$ = $3; + }; + + + +control_port: /* nothing */ + { + $$ = OMAPI_DEFAULT_PORT; + } + | L_PORT in_port + { + $$ = $2; + }; + + +rrset_ordering_list: rrset_ordering_element L_EOS + | rrset_ordering_list rrset_ordering_element L_EOS + ; + +ordering_class: /* nothing */ + { + $$ = dns_rdataclass_any; + } + | L_CLASS wild_class_name + { + $$ = $2; + } + ; + +ordering_type: /* nothing */ + { + $$ = dns_rdatatype_any; + } + | L_TYPE any_string + { + isc_textregion_t reg; + dns_rdatatype_t ty; + + if (strcmp($2, "*") == 0) { + ty = dns_rdatatype_any; + } else { + reg.base = $2; + reg.length = strlen($2); + + tmpres = dns_rdatatype_fromtext(&ty, ®); + if (tmpres != ISC_R_SUCCESS) { + parser_warning(ISC_TRUE, + "unknown type, assuming '*'"); + ty = dns_rdatatype_any; + } + } + + isc_mem_free(memctx, $2); + $$ = ty; + } + ; + + +ordering_name: /* nothing */ + { + $$ = isc_mem_strdup(memctx, "*"); + } + | L_NAME domain_name + { + if (strcmp($2, ".") == 0 || strcmp($2, "*.") == 0) { + $$ = isc_mem_strdup(memctx, "*"); + isc_mem_free(memctx, $2); + } else { + $$ = $2; + } + } + + +rrset_ordering_element: ordering_class ordering_type ordering_name + L_ORDER L_STRING + { + dns_c_rrso_t *orderelem; + dns_c_ordering_t o; + + tmpres = dns_c_string2ordering($5, &o); + if (tmpres != ISC_R_SUCCESS) { + parser_warning(ISC_FALSE, + "unknown ordering type '%s'" + " using default", $5); + o = DNS_DEFAULT_ORDERING; + } + + tmpres = dns_c_rrso_new(currcfg->mem, + &orderelem, $1, $2, $3, o); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create rrset-order element"); + YYABORT; + } + + ISC_LIST_APPEND(currcfg->options->ordering->elements, + orderelem, next); + + isc_mem_free(memctx, $5); + isc_mem_free(memctx, $3); + } + + +transfer_format: L_ONE_ANSWER + { + $$ = dns_one_answer; + } + | L_MANY_ANSWERS + { + $$ = dns_many_answers; + } + ; + +#ifndef NOMINUM_PUBLIC + +maybe_key: /* nothing */ + { + $$ = NULL; + } + | L_SEC_KEY any_string + { + $$ = $2; + }; +#endif /* NOMINUM_PUBLIC */ + +maybe_wild_addr: ip4_address + | ip6_address + | L_STRING + { + isc_sockaddr_any(&$$); + + if (strcmp($1, "*") != 0) + parser_error(ISC_TRUE, + "bad IP address, using IPv4 '*'"); + + isc_mem_free(memctx, $1); + } + ; + +maybe_wild_ip4_only_addr: ip4_address + { + $$ = $1; + } + | ip6_address + { + parser_error(ISC_FALSE, + "cannot have an IPv6 address in this context"); + YYABORT; + } + | L_STRING + { + isc_sockaddr_any(&$$); + + if (strcmp($1, "*") != 0) + parser_error(ISC_TRUE, + "bad IPv4 address, using '*'"); + + isc_mem_free(memctx, $1); + } + ; + +maybe_wild_ip6_only_addr: ip6_address + { + $$ = $1; + } + | ip4_address + { + parser_error(ISC_FALSE, + "cannot have an IPv4 address in this context"); + YYABORT; + } + | L_STRING + { + isc_sockaddr_any6(&$$); + + if (strcmp($1, "*") != 0) + parser_error(ISC_TRUE, + "bad IPv6 address, using '*'"); + + isc_mem_free(memctx, $1); + } + ; + +maybe_wild_port: in_port + { + $$ = $1; + } + | L_STRING + { + $$ = 0; + + if (strcmp ($1, "*") != 0) { + parser_error(ISC_TRUE, + "bad port specification using '*'"); + } + + isc_mem_free(memctx, $1); + } + ; + + +port_ip_list: maybe_zero_port L_LBRACE ip_and_port_list L_RBRACE + { + in_port_t port = $1; + dns_c_iplist_t *list = $3; + unsigned int i; + + if (port == 0) + port = default_port; + + for (i = 0 ; i < list->nextidx ; i++) { + if (isc_sockaddr_getport(&list->ips[i]) == 0) { + isc_sockaddr_setport(&list->ips[i], port); + } + } + + $$ = list; + }; + + +ip_and_port_element: ip_address maybe_zero_port + { + isc_sockaddr_setport(&$1, $2); + $$ = $1; + }; + + +#ifndef NOMINUM_PUBLIC +ip_and_port_list: ip_and_port_element maybe_key L_EOS +#else /* NOMINUM_PUBLIC */ +ip_and_port_list: ip_and_port_element L_EOS +#endif /* NOMINUM_PUBLIC */ + { + dns_c_iplist_t *list; + + tmpres = dns_c_iplist_new(currcfg->mem, 5, &list); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_TRUE, + "failed to create new iplist"); + YYABORT; + } + +#ifndef NOMINUM_PUBLIC + tmpres = dns_c_iplist_append(list, $1, $2); +#else /* NOMINUM_PUBLIC */ + tmpres = dns_c_iplist_append(list, $1); +#endif /* NOMINUM_PUBLIC */ + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_TRUE, + "failed to append master address"); + YYABORT; + } + +#ifndef NOMINUM_PUBLIC + if ($2 != NULL) { + isc_mem_free(memctx, $2); + } +#endif /* NOMINUM_PUBLIC */ + + $$ = list; + } +#ifndef NOMINUM_PUBLIC + | ip_and_port_list ip_and_port_element maybe_key L_EOS +#else /* NOMINUM_PUBLIC */ + | ip_and_port_list ip_and_port_element L_EOS +#endif /* NOMINUM_PUBLIC */ + { +#ifndef NOMINUM_PUBLIC + tmpres = dns_c_iplist_append($1, $2, $3); +#else /* NOMINUM_PUBLIC */ + tmpres = dns_c_iplist_append($1, $2); +#endif /* NOMINUM_PUBLIC */ + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_TRUE, + "failed to append master address"); + YYABORT; + } + +#ifndef NOMINUM_PUBLIC + if ($3 != NULL) { + isc_mem_free(memctx, $3); + } +#endif /* NOMINUM_PUBLIC */ + + $$ = $1; + } + ; + + + +query_source_v6: L_ADDRESS maybe_wild_ip6_only_addr + { + isc_sockaddr_setport(&$2, 0); /* '0' is wild port */ + $$ = $2; + } + | L_ADDRESS maybe_wild_ip6_only_addr L_PORT maybe_wild_port + { + isc_sockaddr_setport(&$2, $4); + $$ = $2; + } + | L_PORT maybe_wild_port + { + isc_sockaddr_t addr; + isc_sockaddr_fromin6(&addr, &in6addr_any, $2); + $$ = addr; + } + | L_PORT maybe_wild_port L_ADDRESS maybe_wild_ip6_only_addr + { + isc_sockaddr_setport(&$4, $2); + $$ = $4; + } + ; + +query_source_v4: L_ADDRESS maybe_wild_ip4_only_addr + { + isc_sockaddr_setport(&$2, 0); /* '0' is wild port */ + $$ = $2; + } + | L_ADDRESS maybe_wild_ip4_only_addr L_PORT maybe_wild_port + { + isc_sockaddr_setport(&$2, $4); + $$ = $2; + } + | L_PORT maybe_wild_port + { + struct in_addr any; + isc_sockaddr_t addr; + + memset(&any, 0x0, sizeof any); + any.s_addr = htonl(INADDR_ANY); + isc_sockaddr_fromin(&addr, &any, $2); + $$ = addr; + } + | L_PORT maybe_wild_port L_ADDRESS maybe_wild_ip4_only_addr + { + isc_sockaddr_setport(&$4, $2); + $$ = $4; + } + ; + +maybe_port: /* nothing */ + { + $$ = default_port; + } + | L_PORT in_port + { + $$ = $2; + } + ; + +maybe_zero_port : /* nothing */ + { + $$ = 0; + } + | L_PORT in_port + { + $$ = $2; + } + ; + +additional_data: L_INTERNAL + { + $$ = dns_c_ad_internal; + } + | L_MINIMAL + { + $$ = dns_c_ad_minimal; + } + | L_MAXIMAL + { + $$ = dns_c_ad_maximal; + }; + +yea_or_nay: L_YES + { + $$ = isc_boolean_true; + } + | L_TRUE + { + $$ = isc_boolean_true; + } + | L_NO + { + $$ = isc_boolean_false; + } + | L_FALSE + { + $$ = isc_boolean_false; + } + | L_INTEGER + { + if ($1 == 1) { + $$ = isc_boolean_true; + } else if ($1 == 0) { + $$ = isc_boolean_false; + } else { + parser_warning(ISC_TRUE, + "number should be 0 or 1, assuming 1"); + $$ = isc_boolean_true; + } + } + +notify_setting: yea_or_nay + { + if ($1) + $$ = dns_notifytype_yes; + else + $$ = dns_notifytype_no; + + } + | L_EXPLICIT + { + $$ = dns_notifytype_explicit; + } + ; + +check_names_type: L_MASTER + { + $$ = dns_trans_primary; + } + | L_SLAVE + { + $$ = dns_trans_secondary; + } + | L_RESPONSE + { + $$ = dns_trans_response; + } + ; + +check_names_opt: L_WARN + { + $$ = dns_severity_warn; + } + | L_FAIL + { + $$ = dns_severity_fail; + } + | L_IGNORE + { + $$ = dns_severity_ignore; + } + ; + +forward_opt: L_ONLY + { + $$ = dns_c_forw_only; + } + | L_FIRST + { + $$ = dns_c_forw_first; + } + | L_IF_NO_ANSWER + { + $$ = dns_c_forw_noanswer; + } + | L_IF_NO_DOMAIN + { + $$ = dns_c_forw_nodomain; + } + ; + + + +size_clause: L_DATASIZE size_spec + { + tmpres = dns_c_ctx_setdatasize(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine datasize"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to set datasize"); + YYABORT; + } + } + | L_STACKSIZE size_spec + { + tmpres = dns_c_ctx_setstacksize(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine stacksize"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to set stacksize"); + YYABORT; + } + } + | L_CORESIZE size_spec + { + tmpres = dns_c_ctx_setcoresize(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine coresize"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to set coresize"); + YYABORT; + } + } + | L_FILES size_spec + { + tmpres = dns_c_ctx_setfiles(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine files"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to set files"); + YYABORT; + } + } + | L_MAX_CACHE_SIZE size_spec + { + if ($2 == DNS_C_SIZE_SPEC_DEFAULT) { + parser_error(ISC_FALSE, + "cannot specific 'default' for " + "'max-cache-size'"); + YYABORT; + } + + tmpres = dns_c_ctx_setmaxcachesize(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine max-cache-size"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set max-cache-size"); + YYABORT; + } + } + ; + + +size_spec: any_string + { + isc_uint32_t result; + + tmpres = unit_to_uint32($1, &result); + if (tmpres == ISC_R_SUCCESS) { + $$ = result; + } else if (tmpres == ISC_R_RANGE) { + $$ = DNS_C_SIZE_SPEC_UNLIM; + parser_warning(ISC_FALSE, + "invalid value %s: using 'unlimited'", + $1); + } else if (tmpres == ISC_R_FAILURE) { + parser_warning(ISC_FALSE, + "invalid unit string '%s', Using " + "'default'", $1); + $$ = DNS_C_SIZE_SPEC_DEFAULT; + } else { + parser_warning(ISC_FALSE, + "unknown result: %s: using 'default'", + isc_result_totext(tmpres)); + $$ = DNS_C_SIZE_SPEC_DEFAULT; + } + + isc_mem_free(memctx, $1); + } + | L_INTEGER + { + $$ = (isc_uint32_t)$1; + if ($$ == DNS_C_SIZE_SPEC_DEFAULT) { + isc_uint32_t newi = DNS_C_SIZE_SPEC_DEFAULT - 1; + parser_warning(ISC_FALSE, + "value (%lu) too big, Reducing to %lu", + (unsigned long) $$, + (unsigned long) newi); + $$ = newi; + } + } + | L_DEFAULT + { + $$ = DNS_C_SIZE_SPEC_DEFAULT; + } + | L_UNLIMITED + { + $$ = DNS_C_SIZE_SPEC_UNLIM; + } + ; + + + +transfer_clause: L_TRANSFERS_IN L_INTEGER + { + tmpres = dns_c_ctx_settransfersin(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine transfers-in"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to set transfers-in"); + YYABORT; + } + } + | L_TRANSFERS_OUT L_INTEGER + { + tmpres = dns_c_ctx_settransfersout(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine transfers-out"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set transfers-out"); + YYABORT; + } + } + | L_TRANSFERS_PER_NS L_INTEGER + { + tmpres = dns_c_ctx_settransfersperns(currcfg, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine transfers-per-ns"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set transfers-per-ns"); + YYABORT; + } + } + ; + + +opt_forwarders_list: /* nothing */ { + } + | forwarders_in_addr_list + ; + +forwarders_in_addr_list: forwarders_in_addr L_EOS + | forwarders_in_addr_list forwarders_in_addr L_EOS + ; + +forwarders_in_addr: ip_address + { +#ifndef NOMINUM_PUBLIC + tmpres = dns_c_iplist_append(currcfg->options->forwarders, + $1, NULL); +#else /* NOMINUM_PUBLIC */ + tmpres = dns_c_iplist_append(currcfg->options->forwarders, + $1); +#endif /* NOMINUM_PUBLIC */ + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to add forwarders " + "address element"); + YYABORT; + } + } + ; + + +/* + * Logging + */ + +logging_stmt: L_LOGGING + { + /* initialized in logging_init() */ + INSIST(currcfg->logging != NULL); + } + L_LBRACE logging_opts_list L_RBRACE + ; + +logging_opts_list: logging_opt L_EOS + | logging_opts_list logging_opt L_EOS + ; + +logging_opt: category_stmt + | channel_stmt + ; + + +channel_stmt: + L_CHANNEL channel_name L_LBRACE L_FILE L_QSTRING { + dns_c_logchan_t *newc; + + tmpres = dns_c_ctx_addfile_channel(currcfg, + $2, &newc); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "redefing channel %s", $2); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to add new file channel"); + YYABORT; + } + + INSIST(newc != NULL); + + tmpres = dns_c_logchan_setpath(newc, $5); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to add file channel's path"); + YYABORT; + } + + isc_mem_free(memctx, $2); + isc_mem_free(memctx, $5); + } maybe_file_modifiers L_EOS optional_channel_opt_list L_RBRACE + | L_CHANNEL channel_name L_LBRACE L_SYSLOG maybe_syslog_facility { + dns_c_logchan_t *newc; + + tmpres = dns_c_ctx_addsyslogchannel(currcfg, + $2, &newc); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine channel %s", $2); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to add new syslog channel"); + YYABORT; + } + + tmpres = dns_c_logchan_setfacility(newc, $5); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get set channel facility"); + YYABORT; + } + isc_mem_free(memctx, $2); + } L_EOS optional_channel_opt_list L_RBRACE + | L_CHANNEL channel_name L_LBRACE L_NULL_OUTPUT { + dns_c_logchan_t *newc; + + tmpres = dns_c_ctx_addnullchannel(currcfg, + $2, &newc); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine channel %s", $2); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to add new channel '%s'", $2); + YYABORT; + } + + isc_mem_free(memctx, $2); + } L_EOS optional_channel_opt_list L_RBRACE + | L_CHANNEL channel_name L_LBRACE L_STDERR { + dns_c_logchan_t *newc; + + tmpres = dns_c_ctx_addstderrchannel(currcfg, + $2, &newc); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine channel %s", $2); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to add new channel '%s'", $2); + YYABORT; + } + + isc_mem_free(memctx, $2); + } L_EOS optional_channel_opt_list L_RBRACE + | L_CHANNEL channel_name L_LBRACE logging_non_type_keywords { + parser_error(ISC_FALSE, + "first statment inside a channel definition " + "must be 'file' or 'syslog' or 'null'"); + YYABORT; + } + ; + + +logging_non_type_keywords: L_SEVERITY | L_PRINT_TIME | L_PRINT_CATEGORY | + L_PRINT_SEVERITY + ; + + +optional_channel_opt_list: /* empty */ + | channel_opt_list + ; + +category_stmt: L_CATEGORY category_name { + dns_c_logcat_t *cat; + + tmpres = dns_c_ctx_addcategory(currcfg, $2, &cat); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine category '%s'", $2); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to add new logging category"); + isc_mem_free(memctx, $2); + YYABORT; + } + isc_mem_free(memctx, $2); + } L_LBRACE channel_list L_RBRACE + ; + + +channel_severity: any_string + { + dns_c_logseverity_t severity; + dns_c_logchan_t *chan; + + tmpres = dns_c_string2logseverity($1, &severity); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "unknown severity '%s'", $1); + YYABORT; + } + + tmpres = dns_c_ctx_currchannel(currcfg, &chan); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get current channel"); + YYABORT; + } + + tmpres = dns_c_logchan_setseverity(chan, severity); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine severity"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get set channel severity"); + YYABORT; + } + + isc_mem_free(memctx, $1); + } + | L_DEBUG + { + dns_c_logchan_t *chan; + + tmpres = dns_c_ctx_currchannel(currcfg, &chan); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get current channel"); + YYABORT; + } + + tmpres = dns_c_logchan_setseverity(chan, + dns_c_log_debug); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine severity"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get set channel severity(debug)"); + YYABORT; + } + } + | L_DEBUG L_INTEGER + { + dns_c_logchan_t *chan; + + tmpres = dns_c_ctx_currchannel(currcfg, &chan); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get current channel"); + YYABORT; + } + + tmpres = dns_c_logchan_setseverity(chan, + dns_c_log_debug); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine severity"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get set channel " + "severity (debug)"); + YYABORT; + } + + tmpres = dns_c_logchan_setdebuglevel(chan, $2); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get set channel " + "severity debug level"); + YYABORT; + } + } + | L_DYNAMIC + { + dns_c_logchan_t *chan; + + tmpres = dns_c_ctx_currchannel(currcfg, &chan); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get current channel"); + YYABORT; + } + + tmpres = dns_c_logchan_setseverity(chan, + dns_c_log_dynamic); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine severity"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get set channel " + "severity (dynamic)"); + YYABORT; + } + } + ; + +version_modifier: L_VERSIONS L_INTEGER + { + dns_c_logchan_t *chan; + + tmpres = dns_c_ctx_currchannel(currcfg, &chan); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get current channel"); + YYABORT; + } + + tmpres = dns_c_logchan_setversions(chan, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine versions"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get set channel versions"); + YYABORT; + } + } + | L_VERSIONS L_UNLIMITED + { + dns_c_logchan_t *chan; + + tmpres = dns_c_ctx_currchannel(currcfg, &chan); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get current channel"); + YYABORT; + } + + tmpres = dns_c_logchan_setversions(chan, 0xffffffffU); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine versions"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get set channel " + "versions (unlimited)"); + YYABORT; + } + } + ; + +size_modifier: L_SIZE size_spec + { + dns_c_logchan_t *chan; + + tmpres = dns_c_ctx_currchannel(currcfg, &chan); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get current channel"); + YYABORT; + } + + tmpres = dns_c_logchan_setsize(chan, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine size"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get set channel size"); + YYABORT; + } + } + ; + +maybe_file_modifiers: /* nothing */ + | version_modifier + | size_modifier + | version_modifier size_modifier + | size_modifier version_modifier + ; + +facility_name: any_string + { + tmpres = dns_c_string2facility($1, &$$); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_TRUE, "unknown syslog facility"); + $$ = LOG_DAEMON; + } + + isc_mem_free(memctx, $1); + } + | L_SYSLOG + { + $$ = LOG_SYSLOG; + } + ; + +maybe_syslog_facility: /* nothing */ + { + $$ = LOG_DAEMON; + } + | facility_name + { + $$ = $1; + } + ; + + +channel_opt_list: channel_opt L_EOS + | channel_opt_list channel_opt L_EOS + ; + + +channel_opt: L_SEVERITY channel_severity { /* nothing to do */ } + | L_PRINT_TIME yea_or_nay + { + dns_c_logchan_t *chan; + + tmpres = dns_c_ctx_currchannel(currcfg, &chan); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "can't get current channel"); + YYABORT; + } + + tmpres = dns_c_logchan_setprinttime(chan, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, "cannot redefine print-time"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get set channel print-time"); + YYABORT; + } + } + | L_PRINT_CATEGORY yea_or_nay + { + dns_c_logchan_t *chan; + + tmpres = dns_c_ctx_currchannel(currcfg, &chan); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "can't get current channel"); + YYABORT; + } + + tmpres = dns_c_logchan_setprintcat(chan, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine print-category"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get set channel print-category"); + YYABORT; + } + } + | L_PRINT_SEVERITY yea_or_nay + { + dns_c_logchan_t *chan; + + tmpres = dns_c_ctx_currchannel(currcfg, &chan); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "can't get current channel"); + YYABORT; + } + + tmpres = dns_c_logchan_setprintsev(chan, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine print-severity"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't get set channel print-severity"); + YYABORT; + } + } + ; + + +channel_name: any_string + | L_NULL_OUTPUT + { + $$ = isc_mem_strdup(memctx, "null"); + } + ; + + +channel: channel_name + { + dns_c_logcat_t *cat; + + /* + * XXX validate the channel name refers to a previously + * defined channel + */ + tmpres = dns_c_ctx_currcategory(currcfg, &cat); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "can't get current category"); + YYABORT; + } + + tmpres = dns_c_logcat_addname(cat, $1); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "can't add new name to category"); + YYABORT; + } + + isc_mem_free(memctx, $1); + } + ; + + +channel_list: channel L_EOS + | channel_list channel L_EOS + ; + + +category_name: any_string + { + $$ = $1; + } + | L_DEFAULT + { + const char *name = token_to_keyword(L_DEFAULT); + + REQUIRE(name != NULL); + + $$ = isc_mem_strdup(memctx, name); + } + | L_NOTIFY + { + const char *name = token_to_keyword(L_NOTIFY); + + REQUIRE(name != NULL); + + $$ = isc_mem_strdup(memctx, name); + } + ; + +/* + * Server Information + */ + +server_stmt: L_SERVER ip_address + { + isc_netaddr_t netaddr; + dns_peer_t *peer = NULL; + dns_peerlist_t *peers = currentpeerlist(currcfg, ISC_TRUE); + + isc_netaddr_fromsockaddr(&netaddr, &$2); + + /* + * Check that this IP hasn't already been used. + */ + tmpres = dns_peerlist_peerbyaddr(peers, &netaddr, &peer); + if (tmpres == ISC_R_SUCCESS) { + dns_peer_detach(&peer); + parser_error(ISC_TRUE, "cannot redefine peer"); + YYABORT; + } + + tmpres = dns_peer_new(currcfg->mem, &netaddr, &peer); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create peer structure"); + YYABORT; + } + + dns_peerlist_addpeer(peers, peer); + dns_peerlist_detach(&peers); + dns_peer_detach(&peer); + } + L_LBRACE server_info_list L_RBRACE + ; + +server_info_list: server_info L_EOS + | server_info_list server_info L_EOS + ; + +server_info: L_BOGUS yea_or_nay + { + dns_peer_t *peer = NULL; + dns_peerlist_t *peerlist = currentpeerlist(currcfg, ISC_FALSE); + + REQUIRE(peerlist != NULL); + + dns_peerlist_currpeer(peerlist, &peer); + + INSIST(peer != NULL); + + tmpres = dns_peer_setbogus(peer, $2); + dns_peer_detach(&peer); + dns_peerlist_detach(&peerlist); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine server bogus value"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "error setting server bogus value"); + YYABORT; + } + + } + | L_SUPPORT_IXFR yea_or_nay + { + /* + * Backwards compatibility, equivalent to request-ixfr. + */ + dns_peer_t *peer = NULL; + dns_peerlist_t *peerlist = currentpeerlist(currcfg, ISC_FALSE); + + REQUIRE(peerlist != NULL); + + dns_peerlist_currpeer(peerlist, &peer); + + INSIST(peer != NULL); + + tmpres = dns_peer_setrequestixfr(peer, $2); + dns_peer_detach(&peer); + dns_peerlist_detach(&peerlist); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine peer " + "request-ixfr value"); + YYABORT; + } else if(tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "error setting peer " + "request-ixfr value"); + YYABORT; + } + } + | L_PROVIDE_IXFR yea_or_nay + { + dns_peer_t *peer = NULL; + dns_peerlist_t *peerlist = currentpeerlist(currcfg, ISC_FALSE); + + REQUIRE(peerlist != NULL); + + dns_peerlist_currpeer(peerlist, &peer); + + INSIST(peer != NULL); + + tmpres = dns_peer_setprovideixfr(peer, $2); + dns_peer_detach(&peer); + dns_peerlist_detach(&peerlist); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine peer " + "provide-ixfr value"); + YYABORT; + } else if(tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "error setting peer " + "provide-ixfr value"); + YYABORT; + } + } + | L_REQUEST_IXFR yea_or_nay + { + dns_peer_t *peer = NULL; + dns_peerlist_t *peerlist = currentpeerlist(currcfg, ISC_FALSE); + + REQUIRE(peerlist != NULL); + + dns_peerlist_currpeer(peerlist, &peer); + + INSIST(peer != NULL); + + tmpres = dns_peer_setrequestixfr(peer, $2); + dns_peer_detach(&peer); + dns_peerlist_detach(&peerlist); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine peer " + "request-ixfr value"); + YYABORT; + } else if(tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "error setting peer " + "request-ixfr value"); + YYABORT; + } + } + | L_TRANSFERS L_INTEGER + { + dns_peer_t *peer = NULL; + dns_peerlist_t *peerlist = currentpeerlist(currcfg, ISC_FALSE); + + REQUIRE(peerlist != NULL); + + dns_peerlist_currpeer(peerlist, &peer); + + INSIST(peer != NULL); + + tmpres = dns_peer_settransfers(peer, $2); + dns_peer_detach(&peer); + dns_peerlist_detach(&peerlist); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine peer transfers value"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "error setting peer transfers value"); + YYABORT; + } + } + | L_TRANSFER_FORMAT transfer_format + { + dns_peer_t *peer = NULL; + dns_peerlist_t *peerlist = currentpeerlist(currcfg, ISC_FALSE); + + REQUIRE(peerlist != NULL); + + dns_peerlist_currpeer(peerlist, &peer); + + INSIST(peer != NULL); + + tmpres = dns_peer_settransferformat(peer, $2); + dns_peer_detach(&peer); + dns_peerlist_detach(&peerlist); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine peer transfer-format " + "value"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "error setting peer transfer-format " + "value"); + YYABORT; + } + } + | L_KEYS key_value { + dns_name_t *name = NULL; + dns_peer_t *peer = NULL; + dns_peerlist_t *peerlist = currentpeerlist(currcfg, ISC_FALSE); + + REQUIRE(peerlist != NULL); + + dns_peerlist_currpeer(peerlist, &peer); + + INSIST(peer != NULL); + + if (!keydefinedinscope(currcfg, $2)) { + parser_error(ISC_FALSE, + "undefined key '%s' referenced", $2); + YYABORT; + } + + tmpres = dns_c_charptoname(peer->mem, $2, &name); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "error creating key name value"); + YYABORT; + } + + tmpres = dns_peer_setkey(peer, &name); + isc_mem_free(memctx, $2); + dns_peer_detach(&peer); + dns_peerlist_detach(&peerlist); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine peer key value"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "error setting peer key value"); + YYABORT; + } + } + ; + + +key_value: L_LBRACE any_string maybe_eos L_RBRACE + { + $$ = $2; + } + | any_string + { + $$ = $1; + }; + + +keyid_list: /* nothing */ + { + dns_c_kidlist_t *kidlist = NULL; + + tmpres = dns_c_kidlist_new(currcfg->mem, &kidlist); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to create kidlist"); + YYABORT; + } + + $$ = kidlist; + } + | keyid_list any_string L_EOS + { + dns_c_kid_t *kid = NULL; + + tmpres = dns_c_kid_new($$->mem, $2, &kid); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to create key id"); + dns_c_kidlist_delete(&$$); + $$ = NULL; + YYABORT; + } + + isc_mem_free(memctx, $2); + + dns_c_kidlist_append($$, kid); + }; + + +/* + * Address Matching + */ + +address_match_list: address_match_element L_EOS + { + dns_c_ipmatchlist_t *ml = 0; + + if ($1 != NULL) { + tmpres = dns_c_ipmatchlist_new(currcfg->mem, &ml); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "insufficient memory"); + dns_c_ipmatchelement_delete(currcfg->mem, + &$1); + YYABORT; + } + + ISC_LIST_APPEND(ml->elements, $1, next); + } + + $$ = ml; + } + | address_match_list address_match_element L_EOS + { + dns_c_ipmatchlist_t *ml = $1; + + if (ml == NULL && $2 != NULL) { + tmpres = dns_c_ipmatchlist_new(currcfg->mem, &ml); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "insufficient memory"); + dns_c_ipmatchelement_delete(currcfg->mem, + &$2); + YYABORT; + } + } + + if ($2 != NULL) { + ISC_LIST_APPEND(ml->elements, $2, next); + } + + $$ = ml; + } + ; + +address_match_element: address_match_simple + | L_BANG address_match_simple + { + if ($2 != NULL) { + dns_c_ipmatch_negate($2); + } + $$ = $2; + } + | L_SEC_KEY L_STRING + { + dns_c_ipmatchelement_t *ime = NULL; + + if (!keydefinedinscope(currcfg, $2)) { + parser_error(ISC_FALSE, + "address match key element (%s) " + "referenced before defined", $2); + YYABORT; + } else { + tmpres = dns_c_ipmatchkey_new(currcfg->mem, &ime, $2); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_TRUE, + "failed to create address match " + "key element for %s", $2); + YYABORT; + } + } + + isc_mem_free(memctx, $2); + $$ = ime; + } + ; + +address_match_simple: ip_address + { + dns_c_ipmatchelement_t *ime = NULL; + unsigned int prefixlen = 0; + + switch ($1.type.sa.sa_family) { + case AF_INET: + prefixlen = 32; + break; + case AF_INET6: + prefixlen = 128; + break; + default: + INSIST(0); + break; + } + tmpres = dns_c_ipmatchpattern_new(currcfg->mem, &ime, $1, + prefixlen); + switch (tmpres) { + case ISC_R_FAILURE: + parser_error(ISC_FALSE, "bad address match element"); + YYABORT; + break; + + case ISC_R_NOMEMORY: + parser_error(ISC_FALSE, + "insufficient memory available"); + YYABORT; + break; + + case ISC_R_SUCCESS: + break; + } + + $$ = ime; + } + | ip_address L_SLASH L_INTEGER + { + dns_c_ipmatchelement_t *ime = NULL; + + if ($3 < 0 || + ($1.type.sa.sa_family == AF_INET && $3 > 32) || + ($1.type.sa.sa_family == AF_INET6 && $3 > 128)) { + parser_warning(ISC_FALSE, + "mask bits (%d) out of range: " + "skipping", (int)$3); + $$ = NULL; + } else { + tmpres = dns_c_ipmatchpattern_new(currcfg->mem, &ime, + $1, $3); + switch (tmpres) { + case ISC_R_FAILURE: + parser_error(ISC_FALSE, + "bad address match element"); + YYABORT; + break; + + case ISC_R_NOMEMORY: + parser_error(ISC_FALSE, + "insufficient memory available"); + YYABORT; + break; + + case ISC_R_SUCCESS: + break; + } + } + + $$ = ime; + } + | L_INTEGER L_SLASH L_INTEGER + { + struct in_addr ia; + dns_c_ipmatchelement_t *ime = NULL; + isc_sockaddr_t address; + + if ($1 > 255) { + parser_error(ISC_FALSE, + "address out of range; skipping"); + YYABORT; + } else { + if ($3 < 0 || $3 > 32) { + parser_warning(ISC_FALSE, + "mask bits out of range; " + "skipping"); + $$ = NULL; + } else { + ia.s_addr = htonl(($1 & 0xff) << 24); + isc_sockaddr_fromin(&address, &ia, 0); + + tmpres = + dns_c_ipmatchpattern_new(currcfg->mem, + &ime, + address, + $3); + switch (tmpres) { + case ISC_R_FAILURE: + parser_error(ISC_FALSE, + "bad address match " + "element"); + YYABORT; + break; + + case ISC_R_NOMEMORY: + parser_error(ISC_FALSE, + "insufficient memory " + "available"); + YYABORT; + break; + + case ISC_R_SUCCESS: + break; + } + } + } + + $$ = ime; + } + | address_name + | L_LBRACE address_match_list L_RBRACE + { + dns_c_ipmatchelement_t *ime = NULL; + + if ($2 != NULL) { + tmpres = dns_c_ipmatchindirect_new(currcfg->mem, &ime, + $2, NULL); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create indirect " + "ipmatch list"); + YYABORT; + } + } + + dns_c_ipmatchlist_detach(&$2); + + $$ = ime; + } + ; + +address_name: any_string + { + dns_c_ipmatchelement_t *elem; + dns_c_acl_t *acl; + + if (strcmp($1, "any") == 0) { + tmpres = dns_c_ipmatchany_new(currcfg->mem, &elem); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create 'any'" + " ipmatch element"); + YYABORT; + } + } else if (strcmp($1, "none") == 0) { + tmpres = dns_c_ipmatchany_new(currcfg->mem, &elem); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create 'none'" + " ipmatch element"); + YYABORT; + } + dns_c_ipmatch_negate(elem); + } else if (strcmp($1, "localhost") == 0) { + tmpres = dns_c_ipmatchlocalhost_new(currcfg->mem, + &elem); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create 'localhost'" + " ipmatch element"); + YYABORT; + } + } else if (strcmp($1, "localnets") == 0) { + tmpres = dns_c_ipmatchlocalnets_new(currcfg->mem, + &elem); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create 'localnets'" + " ipmatch element"); + YYABORT; + } + } else { + tmpres = dns_c_acltable_getacl(currcfg->acls, + $1, &acl); + if (tmpres == ISC_R_NOTFOUND) { + parser_warning(ISC_FALSE, + "undefined acl '%s' " + "referenced", $1); + elem = NULL; + } else { + tmpres = dns_c_ipmatch_aclnew(currcfg->mem, + &elem, $1); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create " + "IPE-ACL"); + YYABORT; + } + } + } + + isc_mem_free(memctx, $1); + $$ = elem; + } + ; + +/* + * Keys + */ + + +key_stmt: L_SEC_KEY any_string L_LBRACE key_definition L_RBRACE + { + dns_c_kdef_t *keydef; + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + dns_c_kdeflist_t *list = NULL; + + if (view == NULL) { + tmpres = dns_c_ctx_getkdeflist(currcfg, &list); + } else { + tmpres = dns_c_view_getkeydefs(view, &list); + } + + if (tmpres == ISC_R_NOTFOUND) { + tmpres = dns_c_kdeflist_new(currcfg->mem, + &list); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create keylist"); + isc_mem_free(memctx, $2); + isc_mem_free(memctx, $4.algorithm); + isc_mem_free(memctx, $4.secret); + + YYABORT; + } + + if (view == NULL) { + tmpres = dns_c_ctx_setkdeflist(currcfg, + list, + ISC_FALSE); + } else { + tmpres = dns_c_view_setkeydefs(view, list); + } + + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set keylist"); + dns_c_kdeflist_delete(&list); + isc_mem_free(memctx, $2); + isc_mem_free(memctx, $4.algorithm); + isc_mem_free(memctx, $4.secret); + + YYABORT; + } + } + + tmpres = dns_c_kdef_new(currcfg->mem, $2, &keydef); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to create key"); + isc_mem_free(memctx, $2); + isc_mem_free(memctx, $4.algorithm); + isc_mem_free(memctx, $4.secret); + YYABORT; + } + + tmpres = dns_c_kdef_setalgorithm(keydef, $4.algorithm); + if (tmpres == ISC_R_SUCCESS) { + tmpres = dns_c_kdef_setsecret(keydef, $4.secret); + } + + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set key details"); + isc_mem_free(memctx, $2); + isc_mem_free(memctx, $4.algorithm); + isc_mem_free(memctx, $4.secret); + } + + dns_c_kdeflist_append(list, keydef, ISC_FALSE); + + isc_mem_free(memctx, $2); + isc_mem_free(memctx, $4.algorithm); + isc_mem_free(memctx, $4.secret); + } + ; + +key_definition: algorithm_id secret + { + $$.algorithm = $1; + $$.secret = $2; + } + | secret algorithm_id + { + $$.algorithm = $2; + $$.secret = $1; + } + ; + +algorithm_id: L_ALGID any_string L_EOS + { + $$ = $2; + } + ; + +secret: L_SECRET any_string L_EOS + { + $$ = $2; + } + ; + + +/* + * Views + */ + + +view_stmt: L_VIEW any_string optional_class L_LBRACE + { + dns_c_view_t *view; + + if (currcfg->views == NULL) { + tmpres = dns_c_viewtable_new(currcfg->mem, + &currcfg->views); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create viewtable"); + YYABORT; + } + } + + tmpres = dns_c_view_new(currcfg->mem, $2, $3, &view); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create view %s", $2); + YYABORT; + } + + dns_c_viewtable_addview(currcfg->views, view); + dns_c_ctx_setcurrview(currcfg, view); + + isc_mem_free(memctx, $2); + } optional_view_options_list L_RBRACE { + dns_c_ctx_setcurrview(currcfg, NULL); + }; + +optional_view_options_list: + | view_options_list + ; + +view_options_list: view_option L_EOS + | view_options_list view_option L_EOS; + + +view_option: L_FORWARD zone_forward_opt + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setforward(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view forward"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view forward"); + YYABORT; + } + } + | L_FORWARDERS L_LBRACE opt_in_addr_list L_RBRACE + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setforwarders(view, + $3, ISC_FALSE); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view forwarders"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view forwarders"); + YYABORT; + } + } + | L_ALLOW_QUERY L_LBRACE address_match_list L_RBRACE + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setallowquery(view, $3); + dns_c_ipmatchlist_detach(&$3); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view allow-query"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view allow-query"); + YYABORT; + } + } + | L_ALLOW_UPDATE_FORWARDING L_LBRACE address_match_list L_RBRACE + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setallowupdateforwarding(view, $3); + dns_c_ipmatchlist_detach(&$3); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view " + "allow-update-forwarding"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view " + "allow-update-forwarding"); + YYABORT; + } + } + | L_ALLOW_TRANSFER L_LBRACE address_match_list L_RBRACE + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_settransferacl(view, $3); + dns_c_ipmatchlist_detach(&$3); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view allow-transfer"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view allow-transfer"); + YYABORT; + } + } + | L_ALLOW_RECURSION L_LBRACE address_match_list L_RBRACE + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setrecursionacl(view, $3); + dns_c_ipmatchlist_detach(&$3); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view allow-recursion"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view allow-recursion"); + YYABORT; + } + } + | L_SORTLIST L_LBRACE address_match_list L_RBRACE + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setsortlist(view, $3); + dns_c_ipmatchlist_detach(&$3); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view sortlist"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view sortlist"); + YYABORT; + } + } + | L_TOPOLOGY L_LBRACE address_match_list L_RBRACE + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_settopology(view, $3); + dns_c_ipmatchlist_detach(&$3); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view topology"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view topology"); + YYABORT; + } + } + | L_MATCH_CLIENTS L_LBRACE address_match_list L_RBRACE + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setmatchclients(view, $3); + dns_c_ipmatchlist_detach(&$3); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view match-clients"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view match-clients"); + YYABORT; + } + } + | L_CHECK_NAMES check_names_type check_names_opt + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setchecknames(view, $2, $3); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view check-names"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view check-names"); + YYABORT; + } + } + | L_AUTH_NXDOMAIN yea_or_nay + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setauthnxdomain(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view auth-nxdomain"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view auth-nxdomain"); + YYABORT; + } + } + | L_RECURSION yea_or_nay + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setrecursion(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view recursion"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view recursion"); + YYABORT; + } + } + | L_PROVIDE_IXFR yea_or_nay + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setprovideixfr(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view provide-ixfr"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view provide-ixfr"); + YYABORT; + } + } + | L_REQUEST_IXFR yea_or_nay + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setrequestixfr(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view request-ixfr"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view request-ixfr"); + YYABORT; + } + } + | L_FETCH_GLUE yea_or_nay + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setfetchglue(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view fetch-glue"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view fetch-glue"); + YYABORT; + } + } + | L_NOTIFY notify_setting + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setnotify(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view notify"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view notify"); + YYABORT; + } + } + | L_RFC2308_TYPE1 yea_or_nay + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setrfc2308type1(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view rfc2308-type1"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view rfc2308-type1"); + YYABORT; + } + } + | L_GLUE_FROM_CACHE yea_or_nay + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setgluefromcache(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view glue-from-cache"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view glue-from-cache"); + YYABORT; + } + } + | L_GLUE_FROM_AUTH yea_or_nay + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setgluefromauth(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view glue-from-auth"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view glue-from-auth"); + YYABORT; + } + } + | L_QUERY_SOURCE query_source_v4 + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setquerysource(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view query-source"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view query-source"); + YYABORT; + } + } + | L_QUERY_SOURCE_V6 query_source_v6 + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setquerysourcev6(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view query-source-v6"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view query-source-v6"); + YYABORT; + } + } + | L_TRANSFER_SOURCE maybe_wild_ip4_only_addr + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_settransfersource(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view transfer-source"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view transfer-source"); + YYABORT; + } + } + | L_TRANSFER_SOURCE_V6 maybe_wild_ip6_only_addr + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_settransfersourcev6(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view " + "transfer-source-v6"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view transfer-source-v6"); + YYABORT; + } + } + | L_MAX_TRANSFER_TIME_OUT L_INTEGER + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + if ( int_too_big($2, 60) ) { + parser_error(ISC_FALSE, + "integer value too big: %u", $2); + YYABORT; + } + + tmpres = dns_c_view_setmaxtransfertimeout(view, $2 * 60); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view " + "max-transfer-time-out"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view " + "max-transfer-time-out"); + YYABORT; + } + } + | L_MAX_TRANSFER_IDLE_OUT L_INTEGER + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + if ( int_too_big($2, 60) ) { + parser_error(ISC_FALSE, + "integer value too big: %u", $2); + YYABORT; + } + + tmpres = dns_c_view_setmaxtransferidleout(view, $2 * 60); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view " + "max-transfer-idle-out"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view " + "max-transfer-idle-out"); + YYABORT; + } + } + | L_CLEAN_INTERVAL L_INTEGER + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + if ( int_too_big($2, 60) ) { + parser_error(ISC_FALSE, + "integer value too big: %u", $2); + YYABORT; + } + + tmpres = dns_c_view_setcleaninterval(view, $2 * 60); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view " + "cleaning-interval"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view cleaning-interval"); + YYABORT; + } + } + | L_MIN_ROOTS L_INTEGER + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setminroots(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view min-roots"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view min-roots"); + YYABORT; + } + } + | L_LAME_TTL L_INTEGER + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setlamettl(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view lame-ttl"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view lame-ttl"); + YYABORT; + } + } + | L_MAX_NCACHE_TTL L_INTEGER + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setmaxncachettl(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view max-ncache-ttl"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view max-ncache-ttl"); + YYABORT; + } + } + | L_MAX_CACHE_TTL L_INTEGER + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setmaxcachettl(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view max-cache-ttl"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view max-cache-ttl"); + YYABORT; + } + } + | L_SIG_VALIDITY_INTERVAL L_INTEGER + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setsigvalidityinterval(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view " + "sig-validity-interval"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view " + "sig-validity-interval"); + YYABORT; + } + } + | L_ADDITIONAL_DATA additional_data + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setadditionaldata(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view additional-data"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view additional-data"); + YYABORT; + } + } + | L_TRANSFER_FORMAT transfer_format + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_settransferformat(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view transfer-format"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view transfer-format"); + YYABORT; + } + } + | L_ALSO_NOTIFY port_ip_list + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + tmpres = dns_c_view_setalsonotify(view, $2); + dns_c_iplist_detach(&$2); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view also-notify"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view also-notify"); + YYABORT; + } + } + | L_MAX_CACHE_SIZE size_spec + { + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + INSIST(view != NULL); + + if ($2 == DNS_C_SIZE_SPEC_DEFAULT) { + parser_error(ISC_FALSE, + "cannot specific 'default' for " + "'max-cache-size'"); + YYABORT; + } + + tmpres = dns_c_view_setmaxcachesize(view, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine view max-cache-size"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set view max-cache-size"); + YYABORT; + } + } + | key_stmt + | zone_stmt + | server_stmt + | trusted_keys_stmt + ; + + +zone_update_policy: L_UPDATE_POLICY L_LBRACE { + + } zone_grant_stmt_list L_RBRACE; + +zone_grant_stmt_list: /* nothing */ | zone_grant_stmt_list zone_ssu_stmt L_EOS; + +zone_ssu_stmt: grant_stmt { + dns_ssutable_t *ssutable = NULL; + isc_boolean_t ok = ISC_TRUE; + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + REQUIRE(zone != NULL); + + switch(zone->ztype) { + case dns_c_zone_hint: + parser_error(ISC_FALSE, + "hint zones do not have grant/deny " + "statements"); + ok = ISC_FALSE; + break; + + case dns_c_zone_forward: + parser_error(ISC_FALSE, + "forward zones do not have grant/deny " + "statements"); + ok = ISC_FALSE; + break; + + default: + /* nothing */ + break; + } + + if (ok) { + tmpres = dns_c_zone_getssuauth(zone, &ssutable); + if (tmpres == ISC_R_NOTFOUND) { + REQUIRE(ssutable == NULL); + + tmpres = dns_ssutable_create(currcfg->mem, + &ssutable); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create " + "ssutable"); + ok = ISC_FALSE; + } + } + + if (ok) { + dns_c_zone_setssuauth(zone, ssutable); + } + } + + tmpres = dns_ssutable_addrule(ssutable, $1.grant, + $1.ident, $1.matchtype, + $1.name, + $1.rdatatypes.idx, + $1.rdatatypes.types); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "error creating ssu " + "identity value"); + ok = ISC_FALSE; + } + + dns_name_free($1.ident, memctx); + dns_name_free($1.name, memctx); + + isc_mem_put(memctx, $1.rdatatypes.types, + sizeof ($1.rdatatypes.types[0]) * 256); + + isc_mem_put(memctx, $1.ident, sizeof (*$1.ident)); + isc_mem_put(memctx, $1.name, sizeof (*$1.name)); + + if (!ok) { + YYABORT; + } + }; + +grant_stmt: grantp any_string grant_match_type any_string rdatatype_list + { + dns_name_t *name = NULL; + dns_name_t *identity = NULL; + isc_boolean_t ok = ISC_TRUE; + + tmpres = dns_c_charptoname(memctx, $4, &name); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "error creating ssu name value"); + ok = ISC_FALSE; + } + + if (ok) { + tmpres = dns_c_charptoname(memctx, $2, &identity); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "error creating ssu " + "identity value"); + ok = ISC_FALSE; + } + } + + if (ok) { + if (!dns_name_isabsolute(identity)) { + parser_error(ISC_FALSE, + "identity (%s) must be an " + "absolute (not relative) name", + $2); + ok = ISC_FALSE; + } + + if (!dns_name_isabsolute(name)) { + parser_error(ISC_FALSE, + "name (%s) must be an " + "absolute (not relative) name", + $4); + ok = ISC_FALSE; + } + + if ($3 == DNS_SSUMATCHTYPE_WILDCARD && + !dns_name_iswildcard(name)) { + parser_error(ISC_FALSE, + "name (%s) has no wildcard " + "character ", + $4); + ok = ISC_FALSE; + } + } + + isc_mem_free(memctx, $2); + isc_mem_free(memctx, $4); + + if (ok) { + $$.grant = $1; + $$.ident = identity; + $$.matchtype = $3; + $$.name = name; + $$.rdatatypes = $5; + } else { + if (identity != NULL) { + dns_name_free(identity, memctx); + isc_mem_put(memctx, identity, + sizeof *identity); + } + + if (name != NULL) { + dns_name_free(name, memctx); + isc_mem_put(memctx, name, sizeof *name); + } + + REQUIRE($5.types != NULL); + + isc_mem_put(memctx, $5.types, + sizeof (dns_rdatatype_t) * 256); + + YYABORT; + } + }; + +grantp: L_GRANT { + $$ = ISC_TRUE; + } + | L_DENY { + $$ = ISC_FALSE; + }; + +grant_match_type: L_NAME { + $$ = DNS_SSUMATCHTYPE_NAME; + } + | L_SUBDOMAIN { + $$ = DNS_SSUMATCHTYPE_SUBDOMAIN; + } + | L_WILDCARD { + $$ = DNS_SSUMATCHTYPE_WILDCARD; + } + | L_SELF { + $$ = DNS_SSUMATCHTYPE_SELF; + }; + +rdatatype_list: /* nothing */ + { + $$.types = isc_mem_get(memctx, sizeof(dns_rdatatype_t) * 256); + $$.idx = 0; + } + | rdatatype_list rdatatype { + $1.types[$1.idx++] = $2; + $$ = $1; + }; + +rdatatype: any_string { + isc_textregion_t reg; + dns_rdatatype_t ty; + + reg.base = $1; + reg.length = strlen($1); + + tmpres = dns_rdatatype_fromtext(&ty, ®); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_TRUE, "unknown rdatatype"); + YYABORT; + } + + isc_mem_free(memctx, $1); + $$ = ty; + }; + + + +/* + * ACLs + */ + +acl_stmt: L_ACL any_string L_LBRACE address_match_list L_RBRACE + { + dns_c_acl_t *acl; + + INSIST(currcfg->acls != NULL); + + tmpres = dns_c_acl_new(currcfg->acls, + $2, ISC_FALSE, &acl); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to create acl %s", $2); + YYABORT; + } + + dns_c_acl_setipml(acl, $4, ISC_FALSE); + + isc_mem_free(memctx, $2); + } + ; + + +/* + * Zones + */ + +domain_name: L_QSTRING + { + $$ = $1; + } + ; + +/* + * 'type' is no longer optional and must be the first statement in the + * zone block. + */ +zone_stmt: L_ZONE domain_name optional_class L_LBRACE L_TYPE zone_type L_EOS + { + dns_c_zone_t *zone; + + if (currcfg->zlist == NULL) { + tmpres = dns_c_zonelist_new(currcfg->mem, + &currcfg->zlist); + if (tmpres != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, + DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, + ISC_LOG_ERROR, + "Failed to create zone list"); + YYABORT; + } + } + + /* XXX internal name support needed! */ + tmpres = dns_c_zone_new(currcfg->mem, + $6, $3, $2, $2, &zone); + if (tmpres != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, + ISC_LOG_ERROR, + "Error creating new zone"); + YYABORT; + } + + tmpres = dns_c_zonelist_addzone(currcfg->zlist, zone); + if (tmpres != ISC_R_SUCCESS) { + dns_c_zone_detach(&zone); + isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, + ISC_LOG_ERROR, + "Error adding new zone to list"); + YYABORT; + } + + dns_c_ctx_setcurrzone(currcfg, zone); + + isc_mem_free(memctx, $2); + } optional_zone_options_list L_RBRACE { + dns_c_zone_t *zone; + dns_c_view_t *view; + + zone = dns_c_ctx_getcurrzone(currcfg); + view = dns_c_ctx_getcurrview(currcfg); + + zone->view = view; + + if (view != NULL) { + dns_c_view_addzone(view, zone); + } + + dns_c_ctx_setcurrzone(currcfg, NULL); + + if (zone != NULL && + callbacks != NULL && callbacks->zonecbk != NULL) { + tmpres = dns_c_zone_validate(zone); + if (tmpres != ISC_R_SUCCESS) { + YYABORT; + } + + tmpres = callbacks->zonecbk(currcfg, + zone, + view, + callbacks->zonecbkuap); + if (tmpres != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, + ISC_LOG_ERROR, + "zone configuration " + "for '%s' failed: %s", + zone->name, + isc_result_totext(tmpres)); + YYABORT; + } + + dns_c_zonelist_rmzone(currcfg->zlist, zone); + } + } + | L_ZONE domain_name optional_class L_LBRACE zone_non_type_keywords + { + parser_error(ISC_FALSE, + "first statement in a zone definition must " + "be 'type'"); + YYABORT; + } + | L_ZONE domain_name + { + parser_warning(ISC_FALSE, + "references to zones not implemented yet"); + } + ; + +optional_zone_options_list: /* Empty */ + | zone_option_list + ; + +class_name: any_string + { + isc_textregion_t reg; + dns_rdataclass_t cl; + + reg.base = $1; + reg.length = strlen($1); + + tmpres = dns_rdataclass_fromtext(&cl, ®); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_TRUE, "unknown class"); + YYABORT; + } + + isc_mem_free(memctx, $1); + $$ = cl; + } + +wild_class_name: any_string + { + isc_textregion_t reg; + dns_rdataclass_t cl; + + if (strcmp($1, "*") == 0) { + cl = dns_rdataclass_any; + } else { + reg.base = $1; + reg.length = strlen($1); + + tmpres = dns_rdataclass_fromtext(&cl, ®); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_TRUE, + "unknown class, assuming '*'"); + cl = dns_rdataclass_any; + } + } + + isc_mem_free(memctx, $1); + $$ = cl; + } + +optional_class: /* Empty */ + { + $$ = dns_rdataclass_in; + } + | class_name + ; + +zone_type: L_MASTER + { + $$ = dns_c_zone_master; + } + | L_SLAVE + { + $$ = dns_c_zone_slave; + } + | L_HINT + { + $$ = dns_c_zone_hint; + } + | L_STUB + { + $$ = dns_c_zone_stub; + } + | L_FORWARD + { + $$ = dns_c_zone_forward; + } + ; + + + +zone_option_list: zone_option L_EOS + | zone_option_list zone_option L_EOS + ; + + +/* + * This rule is used in enforcing the requirement that zone_type must be + * the first element in a zone statement + */ +zone_non_type_keywords: L_FILE | L_FILE_IXFR | L_IXFR_TMP | L_MASTERS | + L_TRANSFER_SOURCE | L_CHECK_NAMES | L_ALLOW_UPDATE | + L_ALLOW_UPDATE_FORWARDING | L_ALLOW_QUERY | + L_ALLOW_TRANSFER | L_FORWARD | L_FORWARDERS | L_MAX_TRANSFER_TIME_IN | + L_TCP_CLIENTS | L_RECURSIVE_CLIENTS | L_UPDATE_POLICY | L_DENY | + L_MAX_TRANSFER_TIME_OUT | L_MAX_TRANSFER_IDLE_IN | + L_MAX_TRANSFER_IDLE_OUT | L_MAX_LOG_SIZE_IXFR | L_NOTIFY | + L_MAINTAIN_IXFR_BASE | L_PUBKEY | L_ALSO_NOTIFY | L_DIALUP | + L_ENABLE_ZONE | L_DATABASE | L_PORT + ; + + +zone_option: L_FILE L_QSTRING + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setfile(zone, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone filename"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone file name"); + YYABORT; + } + isc_mem_free(memctx, $2); + } + | L_FILE_IXFR L_QSTRING + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setixfrbase(zone, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine ixfr-base"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone ixfr_base"); + YYABORT; + } + isc_mem_free(memctx, $2); + } + | L_IXFR_TMP L_QSTRING + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setixfrtmp(zone, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine ixfr-tmp-file"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone ixfr_tmp-file"); + YYABORT; + } + isc_mem_free(memctx, $2); + } + | L_MASTERS port_ip_list + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setmasterips(zone, $2, ISC_FALSE); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone masters ips"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone masters ips"); + YYABORT; + } + } + | L_TRANSFER_SOURCE maybe_wild_ip4_only_addr + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_settransfersource(zone, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone transfer-source"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone transfer-source"); + YYABORT; + } + } + | L_TRANSFER_SOURCE_V6 maybe_wild_ip6_only_addr + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_settransfersourcev6(zone, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone " + "transfer-source-v6"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone transfer-source-v6"); + YYABORT; + } + } + | L_CHECK_NAMES check_names_opt + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setchecknames(zone, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone check-names"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone check-names"); + YYABORT; + } + } + | L_ALLOW_UPDATE L_LBRACE address_match_list L_RBRACE + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setallowupd(zone, + $3, ISC_FALSE); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone allow-update"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone allow-update"); + YYABORT; + } + } + | L_ALLOW_UPDATE_FORWARDING L_LBRACE address_match_list L_RBRACE + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setallowupdateforwarding(zone, + $3, ISC_FALSE); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone " + "allow-update-forwarding"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone " + "allow-update-forwarding"); + YYABORT; + } + } + | L_ALLOW_QUERY L_LBRACE address_match_list L_RBRACE + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setallowquery(zone, + $3, ISC_FALSE); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone allow-query"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone allow-query"); + YYABORT; + } + } + | L_ALLOW_TRANSFER L_LBRACE address_match_list L_RBRACE + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setallowtransfer(zone, + $3, ISC_FALSE); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone allow-transfer"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone allow-transfer"); + YYABORT; + } + } + | L_FORWARD zone_forward_opt + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setforward(zone, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone forward"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone forward"); + YYABORT; + } + } + | L_FORWARDERS L_LBRACE opt_zone_forwarders_list L_RBRACE + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + dns_c_iplist_t *iplist; + + INSIST(zone != NULL); + + if ($3 == NULL) { /* user defined empty list */ + tmpres = dns_c_iplist_new(currcfg->mem, + 5, &iplist); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_TRUE, + "failed to create new zone " + "iplist"); + YYABORT; + } + } else { + iplist = $3; + } + + tmpres = dns_c_zone_setforwarders(zone, + iplist, ISC_FALSE); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone forwarders"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone forwarders"); + YYABORT; + } + } + | L_MAX_TRANSFER_TIME_IN L_INTEGER + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + if ( int_too_big($2, 60) ) { + parser_error(ISC_FALSE, + "integer value too big: %u", $2); + YYABORT; + } + + tmpres = dns_c_zone_setmaxtranstimein(zone, $2 * 60); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone " + "max-transfer-time-in"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone " + "max-transfer-time-in"); + YYABORT; + } + } + | L_MAX_TRANSFER_TIME_OUT L_INTEGER + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + if ( int_too_big($2, 60) ) { + parser_error(ISC_FALSE, + "integer value too big: %u", $2); + YYABORT; + } + + tmpres = dns_c_zone_setmaxtranstimeout(zone, $2 * 60); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone " + "max-transfer-time-out"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone " + "max-transfer-time-out"); + YYABORT; + } + } + | L_MAX_TRANSFER_IDLE_IN L_INTEGER + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + if ( int_too_big($2, 60) ) { + parser_error(ISC_FALSE, + "integer value too big: %u", $2); + YYABORT; + } + + tmpres = dns_c_zone_setmaxtransidlein(zone, $2 * 60); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone " + "max-transfer-idle-in"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone " + "max-transfer-idle-in"); + YYABORT; + } + } + | L_MAX_TRANSFER_IDLE_OUT L_INTEGER + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + if ( int_too_big($2, 60) ) { + parser_error(ISC_FALSE, + "integer value too big: %u", $2); + YYABORT; + } + + tmpres = dns_c_zone_setmaxtransidleout(zone, $2 * 60); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone " + "max-transfer-idle-out"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone " + "max-transfer-idle-out"); + YYABORT; + } + } + | L_SIG_VALIDITY_INTERVAL L_INTEGER + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setsigvalidityinterval(zone, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone " + "sig-validity-interval"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone " + "sig-validity-interval"); + YYABORT; + } + } + | L_MAX_LOG_SIZE_IXFR L_INTEGER + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setmaxixfrlog(zone, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone " + "max-ixfr-log-size"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone max-ixfr-log-size"); + YYABORT; + } + } + | L_NOTIFY notify_setting + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setnotify(zone, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone notify"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone notify"); + YYABORT; + } + } + | L_MAINTAIN_IXFR_BASE yea_or_nay + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setmaintixfrbase(zone, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone " + "maintain-ixfr-base"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone maintain-ixfr-base"); + YYABORT; + } + } + | L_PUBKEY L_INTEGER L_INTEGER L_INTEGER L_QSTRING + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + dns_c_pubkey_t *pubkey; + + INSIST(zone != NULL); + + tmpres = dns_c_pubkey_new(currcfg->mem, $2, + $3, $4, $5, &pubkey); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_TRUE, + "failed to create a zone pubkey"); + YYABORT; + } + + tmpres = dns_c_zone_addpubkey(zone, pubkey, + ISC_FALSE); + if (tmpres != ISC_R_SUCCESS) { + dns_c_pubkey_delete(&pubkey); + parser_error(ISC_FALSE, + "failed to add a zone pubkey"); + YYABORT; + } + + isc_mem_free(memctx, $5); + } + | L_ALSO_NOTIFY port_ip_list + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setalsonotify(zone, $2, ISC_FALSE); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone also-notify"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone also-notify"); + YYABORT; + } + } + | L_DIALUP yea_or_nay + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setdialup(zone, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone dialup"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone dialup"); + YYABORT; + } + } + | L_ENABLE_ZONE yea_or_nay + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setenabled(zone, $2); + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine enable-zone"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set enable-zone"); + YYABORT; + } + } + | L_DATABASE L_QSTRING + { + dns_c_zone_t *zone = dns_c_ctx_getcurrzone(currcfg); + + INSIST(zone != NULL); + + tmpres = dns_c_zone_setdatabase(zone, $2); + isc_mem_free(memctx, $2); + + if (tmpres == ISC_R_EXISTS) { + parser_error(ISC_FALSE, + "cannot redefine zone database"); + YYABORT; + } else if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, + "failed to set zone database"); + YYABORT; + } + + } + | zone_update_policy + ; + + +ip4_address: L_IP4ADDR + { + isc_sockaddr_fromin(&$$, &$1, 0); + } + ; + +ip6_address: L_IP6ADDR + { + isc_sockaddr_fromin6(&$$, &$1, 0); + }; + + +ip_address: ip4_address | ip6_address + ; + +in_addr_elem: ip_address + ; + +opt_in_addr_list: /* nothing */ + { + dns_c_iplist_t *list; + + tmpres = dns_c_iplist_new(currcfg->mem, 5, &list); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_TRUE, + "failed to create new iplist"); + YYABORT; + } + + $$ = list; + } + | in_addr_list + ; + +in_addr_list: in_addr_elem L_EOS + { + dns_c_iplist_t *list; + + tmpres = dns_c_iplist_new(currcfg->mem, 5, &list); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_TRUE, + "failed to create new iplist"); + YYABORT; + } + +#ifndef NOMINUM_PUBLIC + tmpres = dns_c_iplist_append(list, $1, NULL); +#else /* NOMINUM_PUBLIC */ + tmpres = dns_c_iplist_append(list, $1); +#endif /* NOMINUM_PUBLIC */ + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_TRUE, + "failed to append master address"); + YYABORT; + } + + $$ = list; + } + | in_addr_list in_addr_elem L_EOS + { +#ifndef NOMINUM_PUBLIC + tmpres = dns_c_iplist_append($1, $2, NULL); +#else /* NOMINUM_PUBLIC */ + tmpres = dns_c_iplist_append($1, $2, NULL); +#endif /* NOMINUM_PUBLIC */ + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_TRUE, + "failed to append master address"); + YYABORT; + } + + $$ = $1; + } + ; + +zone_forward_opt: L_ONLY + { + $$ = dns_c_forw_only; + } + | L_FIRST + { + $$ = dns_c_forw_first; + } + ; + +opt_zone_forwarders_list: opt_in_addr_list + ; + +/* + * Trusted Key statement + */ + +trusted_keys_stmt: L_TRUSTED_KEYS + { + dns_c_tkeylist_t *newlist; + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + + if (view == NULL) { + tmpres = dns_c_ctx_gettrustedkeys(currcfg, + &newlist); + } else { + tmpres = dns_c_view_gettrustedkeys(view, &newlist); + } + + if (tmpres == ISC_R_NOTFOUND) { + tmpres = dns_c_tkeylist_new(currcfg->mem, &newlist); + if (tmpres != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, + ISC_LOG_ERROR, + "Failed to create trusted key" + " list"); + YYABORT; + } + + if (view == NULL) { + tmpres = dns_c_ctx_settrustedkeys(currcfg, + newlist, + ISC_FALSE); + } else { + tmpres = dns_c_view_settrustedkeys(view, + newlist, + ISC_FALSE); + } + + if (tmpres != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, + ISC_LOG_ERROR, + "Failed to set trusted keys"); + YYABORT; + } + } + } L_LBRACE trusted_keys_list L_RBRACE + ; + +trusted_keys_list: trusted_key L_EOS + | trusted_keys_list trusted_key L_EOS + ; + + +trusted_key: any_string L_INTEGER L_INTEGER L_INTEGER L_QSTRING + { + dns_c_tkey_t *tkey; + dns_c_tkeylist_t *list; + dns_c_view_t *view = dns_c_ctx_getcurrview(currcfg); + isc_mem_t *mem; + + if (view == NULL) { + tmpres = dns_c_ctx_gettrustedkeys(currcfg, &list); + mem = currcfg->mem; + } else { + tmpres = dns_c_view_gettrustedkeys(view, &list); + mem = view->mem; + } + + if (tmpres != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, + ISC_LOG_ERROR, + "No trusted key list defined!"); + YYABORT; + } + + tmpres = dns_c_tkey_new(mem, $1, $2, $3, + $4, $5, &tkey); + if (tmpres != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, + ISC_LOG_ERROR, + "Failed to create trusted key"); + YYABORT; + } + + tmpres = dns_c_tkeylist_append(list, + tkey, ISC_FALSE); + if (tmpres != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, + ISC_LOG_ERROR, + "Failed to append trusted key"); + YYABORT; + } + + isc_mem_free(memctx, $1); + isc_mem_free(memctx, $5); + } + ; + + + +/* + * Misc. + */ + +in_port: L_INTEGER + { + if ($1 < 0 || $1 > 65535) { + parser_warning(ISC_TRUE, + "invalid IP port number '%d'; " + "setting port to 0", (int)$1); + $1 = 0; + } else { + $$ = $1; + } + } + ; + + +any_string: L_STRING + | L_QSTRING + ; + +maybe_eos: | L_EOS ; + +%% + +static int intuit_token(const char *string); + +static isc_boolean_t is_ip4addr(const char *string, struct in_addr *addr); +static isc_boolean_t is_ip6addr(const char *string, struct in6_addr *addr); +static isc_result_t keyword_init(void); +static char * token_to_text(int token, YYSTYPE lval); +static int token_value(isc_token_t *token, + isc_symtab_t *symtable); +static void init_action(void); + +static YYSTYPE lastyylval; +static int lasttoken; + + +/* + * Definition of all unique keyword tokens to be recognised by the + * lexer. All the 'L_' tokens defined in parser.y must be defined here too. + */ +struct token +{ + const char *token; + int yaccval; +}; + +static struct token keyword_tokens [] = { + { "{", L_LBRACE }, + { "}", L_RBRACE }, + { ";", L_EOS }, + { "/", L_SLASH }, + { "!", L_BANG }, + + { "acl", L_ACL }, + { "additional-data", L_ADDITIONAL_DATA }, + { "address", L_ADDRESS }, + { "algorithm", L_ALGID }, + { "allow", L_ALLOW }, + { "allow-query", L_ALLOW_QUERY }, + { "allow-recursion", L_ALLOW_RECURSION }, + { "allow-transfer", L_ALLOW_TRANSFER }, + { "allow-update", L_ALLOW_UPDATE }, + { "allow-update-forwarding", L_ALLOW_UPDATE_FORWARDING }, + { "also-notify", L_ALSO_NOTIFY }, + { "auth-nxdomain", L_AUTH_NXDOMAIN }, + { "blackhole", L_BLACKHOLE }, + { "bogus", L_BOGUS }, + { "category", L_CATEGORY }, + { "channel", L_CHANNEL }, + { "check-names", L_CHECK_NAMES }, + { "class", L_CLASS }, + { "cleaning-interval", L_CLEAN_INTERVAL }, + { "controls", L_CONTROLS }, + { "coresize", L_CORESIZE }, + { "database", L_DATABASE }, + { "datasize", L_DATASIZE }, + { "deallocate-on-exit", L_DEALLOC_ON_EXIT }, + { "debug", L_DEBUG }, + { "default", L_DEFAULT }, + { "deny", L_DENY }, + { "dialup", L_DIALUP }, + { "directory", L_DIRECTORY }, + { "dump-file", L_DUMP_FILE }, + { "dynamic", L_DYNAMIC }, + { "enable-zone", L_ENABLE_ZONE }, + { "expert-mode", L_EXPERT_MODE }, + { "explicit", L_EXPLICIT }, + { "fail", L_FAIL }, + { "fake-iquery", L_FAKE_IQUERY }, + { "false", L_FALSE }, + { "fetch-glue", L_FETCH_GLUE }, + { "file", L_FILE }, + { "files", L_FILES }, + { "first", L_FIRST }, + { "forward", L_FORWARD }, + { "forwarders", L_FORWARDERS }, + { "glue-from-auth", L_GLUE_FROM_AUTH }, + { "glue-from-cache", L_GLUE_FROM_CACHE }, + { "grant", L_GRANT }, + { "group", L_GROUP }, + { "has-old-clients", L_HAS_OLD_CLIENTS }, + { "heartbeat-interval", L_HEARTBEAT }, + { "hint", L_HINT }, + { "host-statistics", L_HOSTSTATS }, + { "if-no-answer", L_IF_NO_ANSWER }, + { "if-no-domain", L_IF_NO_DOMAIN }, + { "ignore", L_IGNORE }, + { "include", L_INCLUDE }, + { "inet", L_INET }, + { "interface-interval", L_INTERFACE_INTERVAL }, + { "internal", L_INTERNAL }, + { "ixfr-base", L_FILE_IXFR }, + { "ixfr-tmp-file", L_IXFR_TMP }, + { "key", L_SEC_KEY }, + { "keys", L_KEYS }, + { "lame-ttl", L_LAME_TTL }, + { "listen-on", L_LISTEN_ON }, + { "listen-on-v6", L_LISTEN_ON_V6 }, + { "logging", L_LOGGING }, + { "maintain-ixfr-base", L_MAINTAIN_IXFR_BASE }, + { "many-answers", L_MANY_ANSWERS }, + { "master", L_MASTER }, + { "masters", L_MASTERS }, + { "match-clients", L_MATCH_CLIENTS }, + { "max-cache-size", L_MAX_CACHE_SIZE }, + { "max-cache-ttl", L_MAX_CACHE_TTL }, + { "max-ixfr-log-size", L_MAX_LOG_SIZE_IXFR }, + { "max-ncache-ttl", L_MAX_NCACHE_TTL }, + { "max-transfer-idle-in", L_MAX_TRANSFER_IDLE_IN }, + { "max-transfer-idle-out", L_MAX_TRANSFER_IDLE_OUT }, + { "max-transfer-time-in", L_MAX_TRANSFER_TIME_IN }, + { "max-transfer-time-out", L_MAX_TRANSFER_TIME_OUT }, + { "maximal", L_MAXIMAL }, + { "memstatistics-file", L_MEMSTATS_FILE }, + { "min-roots", L_MIN_ROOTS }, + { "minimal", L_MINIMAL }, + { "multiple-cnames", L_MULTIPLE_CNAMES }, + { "name", L_NAME }, + { "named-xfer", L_NAMED_XFER }, + { "no", L_NO }, + { "notify", L_NOTIFY }, + { "null", L_NULL_OUTPUT }, + { "one-answer", L_ONE_ANSWER }, + { "only", L_ONLY }, + { "options", L_OPTIONS }, + { "order", L_ORDER }, + { "owner", L_OWNER }, + { "perm", L_PERM }, + { "pid-file", L_PIDFILE }, + { "port", L_PORT }, + { "print-category", L_PRINT_CATEGORY }, + { "print-severity", L_PRINT_SEVERITY }, + { "print-time", L_PRINT_TIME }, + { "provide-ixfr", L_PROVIDE_IXFR }, + { "pubkey", L_PUBKEY }, + { "query-source", L_QUERY_SOURCE }, + { "query-source-v6", L_QUERY_SOURCE_V6 }, + { "random-device", L_RANDOM_DEVICE }, + { "random-seed-file", L_RANDOM_SEED_FILE }, + { "recursion", L_RECURSION }, + { "recursive-clients", L_RECURSIVE_CLIENTS }, + { "request-ixfr", L_REQUEST_IXFR }, + { "response", L_RESPONSE }, + { "rfc2308-type1", L_RFC2308_TYPE1 }, + { "rrset-order", L_RRSET_ORDER }, + { "secret", L_SECRET }, + { "self", L_SELF }, + { "serial-queries", L_SERIAL_QUERIES }, + { "server", L_SERVER }, + { "severity", L_SEVERITY }, + { "sig-validity-interval", L_SIG_VALIDITY_INTERVAL }, + { "size", L_SIZE }, + { "slave", L_SLAVE }, + { "sortlist", L_SORTLIST }, + { "stacksize", L_STACKSIZE }, + { "statistics-file", L_STATS_FILE }, + { "statistics-interval", L_STATS_INTERVAL }, + { "stderr", L_STDERR }, + { "stub", L_STUB }, + { "subdomain", L_SUBDOMAIN }, + { "support-ixfr", L_SUPPORT_IXFR }, + { "syslog", L_SYSLOG }, + { "tcp-clients", L_TCP_CLIENTS }, + { "tkey-dhkey", L_TKEY_DHKEY }, + { "tkey-domain", L_TKEY_DOMAIN }, + { "topology", L_TOPOLOGY }, + { "transfer-format", L_TRANSFER_FORMAT }, + { "transfer-source", L_TRANSFER_SOURCE }, + { "transfer-source-v6", L_TRANSFER_SOURCE_V6 }, + { "transfers", L_TRANSFERS }, + { "transfers-in", L_TRANSFERS_IN }, + { "transfers-out", L_TRANSFERS_OUT }, + { "transfers-per-ns", L_TRANSFERS_PER_NS }, + { "treat-cr-as-space", L_TREAT_CR_AS_SPACE }, + { "true", L_TRUE }, + { "trusted-keys", L_TRUSTED_KEYS }, + { "type", L_TYPE }, + { "unix", L_UNIX }, + { "unlimited", L_UNLIMITED }, + { "update-policy", L_UPDATE_POLICY }, + { "use-id-pool", L_USE_ID_POOL }, + { "use-ixfr", L_USE_IXFR }, + { "version", L_VERSION }, + { "versions", L_VERSIONS }, + { "view", L_VIEW }, + { "warn", L_WARN }, + { "wildcard", L_WILDCARD }, + { "yes", L_YES }, + { "zone", L_ZONE }, + + { NULL, 0 } +}; + + +static struct token class_symbol_tokens[] = { + { "IN", dns_rdataclass_in }, +#if 0 /* XXX expand */ + { "CHAOS", dns_rdataclass_chaos }, + { "HS", dns_rdataclass_hs }, + { "HESIOD", dns_rdataclass_hs }, +#endif + { "ANY", dns_rdataclass_any }, + { "NONE", dns_rdataclass_none }, + { NULL, 0 } +}; + + +static isc_once_t once = ISC_ONCE_INIT; + + +static void +init_action(void) +{ + isc_mutex_init(&yacc_mutex); +} + + +/* + * XXX Need a parameter to specify where error messages should go (syslog, + * FILE, /dev/null etc.) Also some way to tell the function to obey logging + * statments as appropriate. + */ + +isc_result_t +dns_c_parse_namedconf(const char *filename, isc_mem_t *mem, + dns_c_ctx_t **configctx, dns_c_cbks_t *cbks) +{ + isc_result_t res; + const char *funcname = "dns_parse_namedconf"; + + RUNTIME_CHECK(isc_once_do(&once, init_action) == ISC_R_SUCCESS); + + /* Lock down whole parser. */ + if (isc_mutex_lock(&yacc_mutex) != ISC_R_SUCCESS) { + return (ISC_R_UNEXPECTED); + } + + REQUIRE(currcfg == NULL); + REQUIRE(filename != NULL); + REQUIRE(*filename != '\0'); + REQUIRE(configctx != NULL); + INSIST(mylexer == NULL); + INSIST(memctx == NULL); + INSIST(keywords == NULL); + INSIST(callbacks == NULL); + + specials['{'] = 1; + specials['}'] = 1; + specials[';'] = 1; + specials['/'] = 1; + specials['"'] = 1; + specials['!'] = 1; + + default_port = DNS_C_DEFAULTPORT; + + /* + * This memory context is only used by the lexer routines (and must + * stay that way). Any memory that must live past the return of + * yyparse() must be allocated via the 'mem' parameter to this + * function. + */ + res = isc_mem_create(0, 0, &memctx); + if (res != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, ISC_LOG_CRITICAL, + "%s: Error creating mem context", + funcname); + goto done; + } + + res = keyword_init(); + if (res != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, ISC_LOG_CRITICAL, + "%s: Error initializing keywords", + funcname); + goto done; + } + + res = dns_c_ctx_new(mem, &currcfg); + if (res != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, ISC_LOG_CRITICAL, + "%s: Error creating config context", + funcname); + goto done; + } + + res = isc_lex_create(memctx, CONF_MAX_IDENT, &mylexer); + if (res != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, ISC_LOG_CRITICAL, + "%s: Error creating lexer", + funcname); + goto done; + } + + isc_lex_setspecials(mylexer, specials); + isc_lex_setcomments(mylexer, (ISC_LEXCOMMENT_C | + ISC_LEXCOMMENT_CPLUSPLUS | + ISC_LEXCOMMENT_SHELL)); + + res = isc_lex_openfile(mylexer, filename); + if (res != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, ISC_LOG_CRITICAL, + "%s: open: %s", filename, + isc_result_totext(res)); + goto done; + } + + callbacks = cbks; + + if (yyparse() != 0) { + res = ISC_R_FAILURE; + + /* + * Syntax errors in the config file make it very difficult + * to clean up memory properly (which causes assertion + * failure when the memory manager is destroyed). + */ + isc_mem_setdestroycheck(memctx, ISC_FALSE); + + dns_c_ctx_delete(&currcfg); + currcfg = NULL; + } else { + res = ISC_R_SUCCESS; + } + + + done: + if (mylexer != NULL) + isc_lex_destroy(&mylexer); + + isc_symtab_destroy(&keywords); + + isc_mem_destroy(&memctx); + + if (res == ISC_R_SUCCESS) { + res = dns_c_checkconfig(currcfg); + if (res != ISC_R_SUCCESS) { + dns_c_ctx_delete(&currcfg); + } + } + + *configctx = currcfg; + + callbacks = NULL; + currcfg = NULL; + memctx = NULL; + mylexer = NULL; + + RUNTIME_CHECK(isc_mutex_unlock(&yacc_mutex) == ISC_R_SUCCESS); + + return (res); +} + + + +/*** + *** PRIVATE + ***/ + +static isc_result_t +keyword_init(void) +{ + struct token *tok; + isc_symvalue_t symval; + + RUNTIME_CHECK(isc_symtab_create(memctx, 97 /* prime < 100 */, + NULL, NULL, ISC_FALSE, + &keywords) == ISC_R_SUCCESS); + + + /* Stick all the keywords into the main symbol table. */ + for (tok = &keyword_tokens[0] ; tok->token != NULL ; tok++) { + symval.as_integer = tok->yaccval; + RUNTIME_CHECK(isc_symtab_define(keywords, tok->token, + KEYWORD_SYM_TYPE, symval, + isc_symexists_reject) == + ISC_R_SUCCESS); + } + + /* Now the class names */ + for (tok = &class_symbol_tokens[0] ; tok->token != NULL ; tok++) { + symval.as_integer = tok->yaccval; + RUNTIME_CHECK(isc_symtab_define(keywords, tok->token, + CLASS_SYM_TYPE, symval, + isc_symexists_reject) == + ISC_R_SUCCESS); + } + + return (ISC_R_SUCCESS); +} + + + +static int +yylex(void) +{ + isc_token_t token; + isc_result_t res; + int options = (ISC_LEXOPT_EOF | + ISC_LEXOPT_NUMBER | + ISC_LEXOPT_CNUMBER | + ISC_LEXOPT_QSTRING | + ISC_LEXOPT_NOMORE); + + INSIST(mylexer != NULL); + + res = isc_lex_gettoken(mylexer, options, &token); + + switch(res) { + case ISC_R_SUCCESS: + res = token_value(&token, keywords); /* modifies yylval */ + break; + + case ISC_R_EOF: + res = 0; + break; + + case ISC_R_UNBALANCED: + parser_error(ISC_TRUE, + "%s: %lu: unbalanced parentheses", + isc_lex_getsourcename(mylexer), + isc_lex_getsourceline(mylexer)); + res = -1; + break; + + case ISC_R_NOSPACE: + parser_error(ISC_TRUE, + "%s: %lu: token too big", + isc_lex_getsourcename(mylexer), + isc_lex_getsourceline(mylexer)); + res = -1; + break; + + case ISC_R_UNEXPECTEDEND: + parser_error(ISC_TRUE, + "%s: %lu: unexpected EOF", + isc_lex_getsourcename(mylexer), + isc_lex_getsourceline(mylexer)); + res = -1; + break; + + default: + parser_error(ISC_TRUE, + "%s: %lu unknown lexer error (%d)", + isc_lex_getsourcename(mylexer), + isc_lex_getsourceline(mylexer), + (int)res); + res = -1; + break; + } + + + lastyylval = yylval; + lasttoken = res; + + return (res); +} + + + +static char * +token_to_text(int token, YYSTYPE lval) { + static char buffer[1024]; + const char *tk; + + /* + * Yacc keeps token numbers above 128, it seems. + */ + if (token < 128) { + if (token == 0) + strncpy(buffer, "", sizeof buffer); + else + if ((unsigned int) sprintf(buffer, "'%c'", token) + >= sizeof buffer) { + abort(); + } + } else { + switch (token) { + case L_STRING: + if ((unsigned int) sprintf(buffer, "'%s'", + lval.text) >= + sizeof buffer) { + abort(); + } + break; + case L_QSTRING: + if ((unsigned int) sprintf(buffer, "\"%s\"", + lval.text) >= + sizeof buffer) { + abort(); + } + break; + case L_IP6ADDR: + strcpy(buffer, "UNAVAILABLE-IPV6-ADDRESS"); + inet_ntop(AF_INET6, lval.ip6_addr.s6_addr, + buffer, sizeof buffer); + break; + case L_IP4ADDR: + strcpy(buffer, "UNAVAILABLE-IPV4-ADDRESS"); + inet_ntop(AF_INET, &lval.ip4_addr.s_addr, + buffer, sizeof buffer); + break; + case L_INTEGER: + sprintf(buffer, "%lu", (unsigned long)lval.ul_int); + break; + case L_END_INCLUDE: + strcpy (buffer, ""); + break; + default: + tk = token_to_keyword(token); + if (tk == NULL) { + sprintf(buffer, "UNKNOWN-TOKEN-TYPE (%d)", + (int)token); + } else { + strncpy(buffer, tk, sizeof buffer - 1); + buffer[sizeof buffer - 1] = '\0'; + } + break; + } + } + + return (buffer); +} + +static const char * +token_to_keyword(int token) { + int i; + + for (i = 0 ; keyword_tokens[i].token != NULL ; i++) { + if (keyword_tokens[i].yaccval == token) { + break; + } + } + + return (keyword_tokens[i].token); +} + + + +static void +parser_complain(isc_boolean_t is_warning, isc_boolean_t print_last_token, + const char *format, va_list args) +{ + static char where[ISC_DIR_PATHMAX + 100]; + static char message[2048]; + int level = ISC_LOG_ERROR; + const char *filename = isc_lex_getsourcename(mylexer); + unsigned long lineno = isc_lex_getsourceline(mylexer); + + /* + * We can't get a trace of the include files we may be nested in + * (lex.c has the structures hidden). So we only report the current + * file. + */ + if (filename == NULL) { + filename = "(none)"; + } + + if (is_warning) { + level = ISC_LOG_WARNING; + } + + sprintf(where, "%s:%lu: ", filename, lineno); + if ((unsigned int)vsprintf(message, format, args) >= sizeof message) + FATAL_ERROR(__FILE__, __LINE__, + "error message would overflow"); + + if (print_last_token) { + if (dns_lctx != NULL) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, level, + "%s%s near '%s'", where, message, + token_to_text(lasttoken, lastyylval)); + } else { + fprintf(stderr, "%s%s near '%s'\n", where, message, + token_to_text(lasttoken, lastyylval)); + } + } else { + if (dns_lctx != NULL) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_CONFIG, + DNS_LOGMODULE_CONFIG, level, + "%s%s", where, message); + } else { + fprintf(stderr, "%s%s\n", where, message); + } + } +} + + + + +/* + * For reporting items that are semantic, but not syntactic errors + */ +static void +parser_error(isc_boolean_t lasttoken, const char *fmt, ...) +{ + va_list args; + + va_start(args, fmt); + parser_complain(ISC_TRUE, lasttoken, fmt, args); + va_end(args); + + currcfg->errors++; +} + + +static void +parser_warning(isc_boolean_t lasttoken, const char *fmt, ...) +{ + va_list args; + + va_start(args, fmt); + parser_complain(ISC_FALSE, lasttoken, fmt, args); + va_end(args); + + currcfg->warnings++; +} + + +static isc_boolean_t +int_too_big(isc_uint32_t base, isc_uint32_t mult) { + isc_uint32_t max = UINT_MAX; + + if ((max / mult) < base) { + return ISC_TRUE; + } else { + return ISC_FALSE; + } +} + + +static void +yyerror(const char *string) +{ + parser_error(ISC_TRUE, string); +} + + + +static int +token_value(isc_token_t *token, isc_symtab_t *symtable) +{ + int res = -1; + const char *tokstring; + char tmpident [2]; + isc_symvalue_t keywordtok; + + switch (token->type) { + case isc_tokentype_unknown: + res = -1; + break; + + case isc_tokentype_special: + case isc_tokentype_string: + if (token->type == isc_tokentype_special) { + tmpident[0] = token->value.as_char; + tmpident[1] = '\0'; + tokstring = tmpident; + } else { + tokstring = token->value.as_textregion.base; + } + + res = isc_symtab_lookup(symtable, tokstring, + KEYWORD_SYM_TYPE, &keywordtok); + + if (res != ISC_R_SUCCESS) { + res = intuit_token(tokstring); + } else { + res = keywordtok.as_integer; + } + break; + + case isc_tokentype_number: + yylval.ul_int = (isc_uint32_t)token->value.as_ulong; + res = L_INTEGER; + break; + + case isc_tokentype_qstring: + yylval.text = isc_mem_strdup(memctx, + token->value.as_textregion.base); + if (yylval.text == NULL) { + res = -1; + } else { + res = L_QSTRING; + } + break; + + case isc_tokentype_eof: + res = isc_lex_close(mylexer); + INSIST(res == ISC_R_NOMORE || res == ISC_R_SUCCESS); + + if (isc_lex_getsourcename(mylexer) == NULL) { + /* the only way to tell that we + * closed the main file and not an included file + */ + res = 0; + } else { + res = L_END_INCLUDE; + } + break; + + case isc_tokentype_initialws: + res = -1; + break; + + case isc_tokentype_eol: + res = -1; + break; + + case isc_tokentype_nomore: + res = -1; + break; + } + + return (res); +} + + + + +static int +intuit_token(const char *string) +{ + int resval; + + if (is_ip4addr(string, &yylval.ip4_addr)) { + resval = L_IP4ADDR; + } else if (is_ip6addr(string, &yylval.ip6_addr)) { + resval = L_IP6ADDR; + } else { + yylval.text = isc_mem_strdup(memctx, string); + if (yylval.text == NULL) { + resval = -1; + } else { + resval = L_STRING; + } + } + + return (resval); +} + + +/* + * Conversion Routines + */ + +static isc_result_t +unit_to_uint32(char *in, isc_uint32_t *out) { + char *start = in; + int c, units_done = 0; + isc_uint32_t result = 0L; + isc_uint32_t maxK = 4194304; /* 2^32 / 1024 */ + isc_uint32_t maxM = 4096; /* 2^32 / (1024 * 1024) */ + isc_uint32_t maxG = 4; /* 2^32 / (1024 * 1024 * 1024) */ + + INSIST(in != NULL); + + for (; (c = *in) != '\0'; in++) { + if (units_done) + return (ISC_R_FAILURE); + if (isdigit((unsigned char)c)) { + result *= 10; + result += (c - '0'); + } else { + if (start == in) { + return (ISC_R_FAILURE); + } + switch (c) { + case 'k': + case 'K': + if (result > maxK) { + return (ISC_R_RANGE); + } + result *= 1024; + units_done = 1; + break; + case 'm': + case 'M': + if (result > maxM) { + return (ISC_R_RANGE); + } + result *= (1024*1024); + units_done = 1; + break; + case 'g': + case 'G': + if (result > maxG) { + return (ISC_R_RANGE); + } + result *= (1024*1024*1024); + units_done = 1; + break; + default: + return (ISC_R_FAILURE); + } + } + } + + *out = result; + return (ISC_R_SUCCESS); +} + + +static isc_boolean_t +is_ip6addr(const char *string, struct in6_addr *addr) +{ + if (inet_pton(AF_INET6, string, addr) != 1) { + return ISC_FALSE; + } + return ISC_TRUE; +} + + + +static isc_boolean_t +is_ip4addr(const char *string, struct in_addr *addr) +{ + char addrbuf[sizeof "xxx.xxx.xxx.xxx" + 1]; + const char *p = string; + int dots = 0; + char dot = '.'; + + while (*p) { + if (!isdigit(*p & 0xff) && *p != dot) { + return (ISC_FALSE); + } else if (!isdigit(*p & 0xff)) { + dots++; + } + p++; + } + + if (dots > 3) { + return (ISC_FALSE); + } else if (dots < 3) { + if (dots == 1) { + if (strlen(string) + 5 <= sizeof (addrbuf)) { + strcpy(addrbuf, string); + strcat(addrbuf, ".0.0"); + } else { + return (ISC_FALSE); + } + } else if (dots == 2) { + if (strlen(string) + 3 <= sizeof (addrbuf)) { + strcpy(addrbuf, string); + strcat(addrbuf, ".0"); + } else { + return (ISC_FALSE); + } + } + } else if (strlen(string) < sizeof addrbuf) { + strcpy (addrbuf, string); + } else { + return (ISC_FALSE); + } + + if (inet_pton(AF_INET, addrbuf, addr) != 1) { + return ISC_FALSE; + } + return ISC_TRUE; +} + + + +static dns_peerlist_t * +currentpeerlist(dns_c_ctx_t *cfg, isc_boolean_t createIfNeeded) +{ + dns_peerlist_t *peers = NULL; + dns_c_view_t *view = NULL; + isc_result_t result; + + view = dns_c_ctx_getcurrview(cfg); + + if (view == NULL) { + result = dns_c_ctx_getpeerlist(cfg, &peers); + } else { + result = dns_c_view_getpeerlist(view, &peers); + } + + if (result == ISC_R_NOTFOUND && createIfNeeded) { + result = dns_peerlist_new(currcfg->mem, &peers); + if (tmpres != ISC_R_SUCCESS) { + parser_error(ISC_FALSE, "failed to create peer list"); + return NULL; + } + + if (view == NULL) { + dns_c_ctx_setpeerlist(currcfg, peers); + } else { + dns_c_view_setpeerlist(view, peers); + } + } else if (result == ISC_R_NOTFOUND) { + /* nothing */ + } else if (result != ISC_R_SUCCESS) { + REQUIRE(result == ISC_R_SUCCESS); + } + + return peers; +} + + + +static isc_boolean_t +keydefinedinscope(dns_c_ctx_t *cfg, const char *name) +{ + dns_c_view_t *view = dns_c_ctx_getcurrview(cfg); + isc_boolean_t rval = ISC_FALSE; + + if (view != NULL) { + rval = dns_c_view_keydefinedp(view, name); + } + + if (!rval) { + rval = dns_c_ctx_keydefinedp(cfg, name); + } + + return (rval); +} + + + + diff --git a/lib/dns/include/dns/confip.h b/lib/dns/include/dns/confip.h index 4d6833f239..93b4aadfa7 100644 --- a/lib/dns/include/dns/confip.h +++ b/lib/dns/include/dns/confip.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confip.h,v 1.23 2000/07/21 21:25:00 brister Exp $ */ +/* $Id: confip.h,v 1.24 2000/07/26 18:47:41 mws Exp $ */ #ifndef DNS_CONFIP_H #define DNS_CONFIP_H 1 @@ -95,7 +95,9 @@ struct dns_c_iplist { isc_mem_t *mem; int refcount; isc_sockaddr_t *ips; +#ifndef NOMINUM_PUBLIC dns_name_t **keys; +#endif /* NOMINUM_PUBLIC */ isc_uint32_t size; isc_uint32_t nextidx; }; @@ -227,12 +229,19 @@ isc_result_t dns_c_iplist_detach(dns_c_iplist_t **list); isc_result_t dns_c_iplist_copy(isc_mem_t *mem, dns_c_iplist_t **dest, dns_c_iplist_t *src); +#ifndef NOMINUM_PUBLIC isc_boolean_t dns_c_iplist_haskeys(dns_c_iplist_t *list); +#endif /* NOMINUM_PUBLIC */ void dns_c_iplist_attach(dns_c_iplist_t *source, dns_c_iplist_t **target); +#ifndef NOMINUM_PUBLIC isc_result_t dns_c_iplist_append(dns_c_iplist_t *list, isc_sockaddr_t newaddr, const char *key); +#else /* NOMINUM_PUBLIC */ +isc_result_t dns_c_iplist_append(dns_c_iplist_t *list, + isc_sockaddr_t newaddr, const char *key); +#endif /* NOMINUM_PUBLIC */ isc_result_t dns_c_iplist_remove(dns_c_iplist_t *list, isc_sockaddr_t newaddr); diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h index e7d95216be..676032f983 100644 --- a/lib/dns/include/dns/zone.h +++ b/lib/dns/include/dns/zone.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: zone.h,v 1.61 2000/07/24 22:59:44 explorer Exp $ */ +/* $Id: zone.h,v 1.62 2000/07/26 18:47:42 mws Exp $ */ #ifndef DNS_ZONE_H #define DNS_ZONE_H 1 @@ -351,9 +351,11 @@ dns_zone_maintenance(dns_zone_t *zone); isc_result_t dns_zone_setmasters(dns_zone_t *zone, isc_sockaddr_t *masters, isc_uint32_t count); +#ifndef NOMINUM_PUBLIC isc_result_t dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters, dns_name_t **keynames, isc_uint32_t count); +#endif /* NOMINUM_PUBLIC */ /* * Set the list of master servers for the zone. * @@ -361,17 +363,21 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters, * 'zone' to be a valid zone. * 'masters' array of isc_sockaddr_t with port set or NULL. * 'count' the number of masters. +#ifndef NOMINUM_PUBLIC * 'keynames' array of dns_name_t's for tsig keys or NULL. * * dns_zone_setmasters() is just a wrapper to setmasterswithkeys(), * passing NULL in the keynames field. +#endif NOMINUM_PUBLIC * * If 'masters' is NULL then 'count' must be zero. * * Returns: * ISC_R_SUCCESS * ISC_R_NOMEMORY +#ifndef NOMINUM_PUBLIC * Any result dns_name_dup() can return, if keynames!=NULL +#endif NOMINUM_PUBLIC */ isc_result_t diff --git a/lib/dns/zone.c b/lib/dns/zone.c index 5f3a596bf0..788dbbdddc 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: zone.c,v 1.167 2000/07/25 19:29:00 mws Exp $ */ +/* $Id: zone.c,v 1.168 2000/07/26 18:47:32 mws Exp $ */ #include @@ -132,7 +132,9 @@ struct dns_zone { isc_uint32_t expire; isc_uint32_t minimum; isc_sockaddr_t *masters; +#ifndef NOMINUM_PUBLIC dns_name_t **masterkeynames; +#endif /* NOMINUM_PUBLIC */ unsigned int masterscnt; unsigned int curmaster; isc_sockaddr_t masteraddr; @@ -362,7 +364,9 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) { zone->expire = 0; zone->minimum = 0; zone->masters = NULL; +#ifndef NOMINUM_PUBLIC zone->masterkeynames = NULL; +#endif /* NOMINUM_PUBLIC */ zone->masterscnt = 0; zone->curmaster = 0; zone->notify = NULL; @@ -439,7 +443,11 @@ zone_free(dns_zone_t *zone) { if (zone->db != NULL) dns_db_detach(&zone->db); dns_zone_cleardbargs(zone); +#ifndef NOMINUM_PUBLIC dns_zone_setmasterswithkeys(zone, NULL, NULL, 0); +#else /* NOMINUM_PUBLIC */ + dns_zone_setmasters(zone, NULL, 0); +#endif /* NOMINUM_PUBLIC */ dns_zone_setalsonotify(zone, NULL, 0); zone->check_names = dns_severity_ignore; if (zone->update_acl != NULL) @@ -1271,6 +1279,7 @@ dns_zone_setalsonotify(dns_zone_t *zone, isc_sockaddr_t *notify, return (ISC_R_SUCCESS); } +#ifndef NOMINUM_PUBLIC isc_result_t dns_zone_setmasters(dns_zone_t *zone, isc_sockaddr_t *masters, isc_uint32_t count) @@ -1284,24 +1293,34 @@ dns_zone_setmasters(dns_zone_t *zone, isc_sockaddr_t *masters, isc_result_t dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters, dns_name_t **keynames, isc_uint32_t count) +#else /* NOMINUM_PUBLIC */ +isc_result_t +dns_zone_setmasters(dns_zone_t *zone, isc_sockaddr_t *masters, + isc_uint32_t count) +#endif /* NOMINUM_PUBLIC */ { isc_sockaddr_t *new; - dns_name_t **newname; isc_result_t result = ISC_R_SUCCESS; +#ifndef NOMINUM_PUBLIC + dns_name_t **newname; unsigned int i; +#endif /* NOMINUM_PUBLIC */ REQUIRE(DNS_ZONE_VALID(zone)); REQUIRE(count == 0 || masters != NULL); +#ifndef NOMINUM_PUBLIC if (keynames != NULL) { REQUIRE(count != 0); } - +#endif /* NOMINUM_PUBLIC */ + LOCK(&zone->lock); if (zone->masters != NULL) { isc_mem_put(zone->mctx, zone->masters, zone->masterscnt * sizeof *new); zone->masters = NULL; } +#ifndef NOMINUM_PUBLIC if (zone->masterkeynames != NULL) { for (i = 0; i < zone->masterscnt; i++) { if (zone->masterkeynames[i] != NULL) { @@ -1317,6 +1336,7 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters, zone->masterscnt * sizeof(dns_name_t *)); zone->masterkeynames = NULL; } +#endif /* NOMINUM_PUBLIC */ zone->masterscnt = 0; /* * If count == 0, don't allocate any space for masters or keynames @@ -1339,6 +1359,7 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters, zone->masterscnt = count; zone->flags &= ~DNS_ZONEFLG_NOMASTERS; +#ifndef NOMINUM_PUBLIC /* * if keynames is non-NULL, it must contain count elements! */ @@ -1379,6 +1400,7 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters, } zone->masterkeynames = newname; } +#endif /* NOMINUM_PUBLIC */ unlock: UNLOCK(&zone->lock); return (result); @@ -4044,6 +4066,9 @@ got_transfer_quota(isc_task_t *task, isc_event_t *event) { /* * Determine if we should attempt to sign the request with TSIG. + */ +#ifndef NOMINUM_PUBLIC + /* * First, look for a tsig key in the master statement, then * try for a server key. */ @@ -4053,7 +4078,9 @@ got_transfer_quota(isc_task_t *task, isc_event_t *event) { keyname = zone->masterkeynames[zone->curmaster]; gotkey = ISC_TRUE; } - else if (peer != NULL && + else +#endif /* NOMINUM_PUBLIC */ + if (peer != NULL && dns_peer_getkey(peer, &keyname) == ISC_R_SUCCESS) { view = dns_zone_getview(zone); gotkey = ISC_TRUE; diff --git a/lib/dns/zoneconf.c b/lib/dns/zoneconf.c index 88da4f7745..7fcfcdc6df 100644 --- a/lib/dns/zoneconf.c +++ b/lib/dns/zoneconf.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: zoneconf.c,v 1.47 2000/07/25 20:26:11 bwelling Exp $ */ +/* $Id: zoneconf.c,v 1.48 2000/07/26 18:47:34 mws Exp $ */ #include @@ -272,10 +272,15 @@ dns_zone_configure(dns_c_ctx_t *cctx, dns_c_view_t *cview, iplist = NULL; result = dns_c_zone_getmasterips(czone, &iplist); if (result == ISC_R_SUCCESS) +#ifndef NOMINUM_PUBLIC result = dns_zone_setmasterswithkeys(zone, iplist->ips, iplist->keys, iplist->nextidx); +#else /* NOMINUM_PUBLIC */ + result = dns_zone_setmasters(zone, iplist->ips, + iplist->nextidx); +#endif /* NOMINUM_PUBLIC */ else result = dns_zone_setmasters(zone, NULL, 0); RETERR(result); diff --git a/util/sanitize.pl b/util/sanitize.pl new file mode 100644 index 0000000000..3fc9b3154e --- /dev/null +++ b/util/sanitize.pl @@ -0,0 +1,163 @@ +#!/usr/bin/perl +# +# Copyright (C) 1999, 2000 Internet Software Consortium. +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS +# ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES +# OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE +# CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL +# DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR +# PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS +# ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS +# SOFTWARE. + +# $Id: sanitize.pl,v 1.1 2000/07/26 18:47:43 mws Exp $ + +# Don't try and sanitize this file: NOMINUM_IGNORE + +# Go through the directory tree and make sure that all of the files are +# sanitized. +# +# In normal mode, check file, removing code between +# #ifndef NOMINUM_PUBLIC +# and the accompanying #else or #endif. Similarly, code in an #else +# clause after an #ifndef test will be removed. The #else or #endif's +# must appear as: +# #else /* NOMINUM_PUBLIC */ +# #endif /* NOMINUM_PUBLIC */ +# Balance is tested. +# Non-.c/.h files are tested for the existance of NOMINUM_PUBLIC anywhere +# in the file, and a warning is generated, unless the string +# NOMINUM_IGNORE appears before NOMINUM_PUBLIC. + +# Usage: +# ./sanitize.pl -c - Check syntax only, don't change anything +# ./sanitize.pl -i - Reverse sense of sanitize. +# ./sanitize.pl - - Work as a pipe, sanitizing stdin to stdout. +# ./sanitize.pl file - Sanitize the specified file. + +$makechange = 1; +$state = 0; +$showon = 1; +$debug = 0; + +# States: +# 0 - Outside of test, include code +# 1 - Inside NOMINUM_PUBLIC +# 2 - Inside !NOMINUM_PUBLIC + +foreach $arg (@ARGV) { + $_ = $arg; + if (/^-c$/i) { + $makechange = 0; + } + elsif (/^-i$/i) { + $showon = 2; + } + elsif (/^-$/i) { + &runfile("-","-"); + } +# elsif (/^-a$/i) { +# &rundir(); +# } + elsif (/^-d$/i) { + $debug = 1; + } + else { + &runfile($arg, $arg.".sanitize"); + } +} +exit(0); + + +sub runfile($) { + $state = 0; + open(INFILE, $_[0]) || die ("$_[0]"); + open(OUTFILE, ">$_[1]") || die ("$_[1]") + if ($makechange); + while () { + if (/NOMINUM_IGNORE/) { + close(INFILE); + close(OUTFILE); + unlink($_[1]); + break; + } + if (/\#ifdef.+NOMINUM_PUBLIC/) { + if ($state != 0) { + print(STDERR "*** ERROR in file $_[0]: ". + "Found #ifdef without matching ". + "#endif.\n"); + close(INFILE); + close(OUTFILE) if ($makechange); + unlink($_[1]); + break; + } + $state = 1; + } + elsif (/\#ifndef.+NOMINUM_PUBLIC/) { + if ($state != 0) { + print(STDERR "*** ERROR in file $_[0]: ". + "Found #ifndef without matching ". + "#endif.\n"); + close(INFILE); + close(OUTFILE) if ($makechange); + unlink($_[1]); + break; + } + $state = 2; + } + elsif (/\#else.+NOMINUM_PUBLIC/) { + if ($state == 0) { + print(STDERR "*** ERROR in file $_[0]: ". + "Found #else without matching ". + "#if[n]def.\n"); + close(INFILE); + close(OUTFILE) if ($makechange); + unlink($_[1]); + break; + } + if ($state == 1) { + $state = 2; + } else { + $state = 1; + } + } + elsif (/\#endif.+NOMINUM_PUBLIC/) { + if ($state == 0) { + print(STDERR "*** ERROR in file $_[0]: ". + "Found #else without matching ". + "#if[n]def.\n"); + close(INFILE); + close(OUTFILE) if ($makechange); + unlink($_[1]); + break; + } + $state = 0; + } + elsif (/NOMINUM_PUBLIC/) { + print(STDERR "*** WARNING in file $_[0]: ". + "Found NOMINUM_PUBLIC outside of ". + "#ifdef/#else/#endif.\n"); + } + else { + if (($state == 0) || ($state == $showon)) { + print(OUTFILE) if ($makechange); + } + } + } + if ($state != 0) { + print(STDERR "*** ERROR in file $_[0]: ". + "File ended with unterminated test.\n"); + } else { + close(INFILE); + close(OUTFILE) if ($makechange); + if (($_[0] ne "-") && ($makechange)) { + unlink($_[0]) || die "Unlink $_[0]:"; + rename($_[1], $_[0]) || die "Rename $_[1] to $_[0]:"; + } + } +} diff --git a/util/sanitize_all.sh b/util/sanitize_all.sh new file mode 100755 index 0000000000..55f385e5fe --- /dev/null +++ b/util/sanitize_all.sh @@ -0,0 +1,30 @@ +#!/bin/sh +# +# Copyright (C) 2000 Internet Software Consortium. +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS +# ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES +# OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE +# CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL +# DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR +# PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS +# ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS +# SOFTWARE. + +# $Id: sanitize_all.sh,v 1.1 2000/07/26 18:47:43 mws Exp $ + +# Run this shell script from a CVS export'ed source tree, and it will +# sanitize all of the files in that tree. + +find . -name '*.[ch]' | xargs perl util/sanitize.pl $* +find . -name '*.in' | xargs perl util/sanitize.pl $* +for file in `find . -name '*.dirty'` +do + perl util/sanitize.pl - < $file > ${file/.dirty/} + rm $file +done + From 4a9b6178ba641a9aa192cd50042f6f1378f311b1 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 26 Jul 2000 18:52:05 +0000 Subject: [PATCH 212/226] incorrect use of plural --- bin/dnssec/dnssec-keygen.8 | 4 ++-- doc/man/dnssec/dnssec-keygen.8 | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/bin/dnssec/dnssec-keygen.8 b/bin/dnssec/dnssec-keygen.8 index 8d186c5a78..899d865ebf 100644 --- a/bin/dnssec/dnssec-keygen.8 +++ b/bin/dnssec/dnssec-keygen.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-keygen.8,v 1.4 2000/07/26 00:47:13 bwelling Exp $ +.\" $Id: dnssec-keygen.8,v 1.5 2000/07/26 18:52:05 gson Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-KEYGEN 8 @@ -79,7 +79,7 @@ The argument identifying the encryption algorithm is case-insensitive. DNSSEC specifies DSA as a mandatory algorithm and RSA as a recommended one. Implementations of TSIG must support HMAC-MD5. .Pp -The number of bits in the key are determined by the +The number of bits in the key is determined by the .Ar keysize argument following the .Fl b diff --git a/doc/man/dnssec/dnssec-keygen.8 b/doc/man/dnssec/dnssec-keygen.8 index 8d186c5a78..899d865ebf 100644 --- a/doc/man/dnssec/dnssec-keygen.8 +++ b/doc/man/dnssec/dnssec-keygen.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-keygen.8,v 1.4 2000/07/26 00:47:13 bwelling Exp $ +.\" $Id: dnssec-keygen.8,v 1.5 2000/07/26 18:52:05 gson Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-KEYGEN 8 @@ -79,7 +79,7 @@ The argument identifying the encryption algorithm is case-insensitive. DNSSEC specifies DSA as a mandatory algorithm and RSA as a recommended one. Implementations of TSIG must support HMAC-MD5. .Pp -The number of bits in the key are determined by the +The number of bits in the key is determined by the .Ar keysize argument following the .Fl b From bfab56849df65a2d4295b256808a66985cfa9d98 Mon Sep 17 00:00:00 2001 From: Michael Graff Date: Wed, 26 Jul 2000 19:06:20 +0000 Subject: [PATCH 213/226] Revamp memory stuff. Now, if you define ISC_MEM_TRACKLINES, and set isc_mem_debugging = 2 first thing in main(), isc_mem_stats() will dump the file/line where any leaking allocations were made. --- lib/isc/include/isc/mem.h | 159 +++++++------- lib/isc/mem.c | 434 +++++++++++++++++++------------------- 2 files changed, 305 insertions(+), 288 deletions(-) diff --git a/lib/isc/include/isc/mem.h b/lib/isc/include/isc/mem.h index 6d30252da6..f445d94d11 100644 --- a/lib/isc/include/isc/mem.h +++ b/lib/isc/include/isc/mem.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: mem.h,v 1.37 2000/06/28 03:46:37 tale Exp $ */ +/* $Id: mem.h,v 1.38 2000/07/26 19:06:20 explorer Exp $ */ #ifndef ISC_MEM_H #define ISC_MEM_H 1 @@ -37,28 +37,82 @@ typedef void (*isc_memfree_t)(void *, void *); #if !defined(ISC_MEM_DEBUG) && !defined(ISC_MEM_DEBUGOFF) #define ISC_MEM_DEBUG #endif -extern isc_boolean_t isc_mem_debugging; + +/* + * Define ISC_MEM_TRACKLINES to turn on detailed tracing of memory allocation + * and freeing by file and line number. + */ +#if 0 +#define ISC_MEM_TRACKLINES +#endif + +/* + * Define ISC_MEM_CHECKOVERRUN to turn on checks for using memory outside + * the requested space. This will increase the size of each allocation. + */ +#if 0 +#define ISC_MEM_CHECKOVERRUN +#endif + +/* + * Define ISC_MEM_FILL to fill each block of memory returned to the system + * with the byte string '0xbe'. This helps track down uninitialized pointers + * and the like. On freeing memory, the space is filled with '0xde' for + * the same reasons. + */ +#define ISC_MEM_FILL + +/* + * Define this to turn on memory pool names. + */ +#define ISC_MEMPOOL_NAMES + +/* + * _DEBUGTRACE + * log (to isc_lctx) each allocation and free. + * + * _DEBUGRECORD + * remember each allocation, and match them up on free. Crash if + * a free doesn't match an allocation + */ +extern unsigned int isc_mem_debugging; +#define ISC_MEM_DEBUGTRACE 0x00000001U +#define ISC_MEM_DEBUGRECORD 0x00000002U + +#ifdef ISC_MEM_TRACKLINES +#define _ISC_MEM_FILELINE , __FILE__, __LINE__ +#define _ISC_MEM_FLARG , const char *, int +#else +#define _ISC_MEM_FILELINE +#define _ISC_MEM_FLARG +#endif + +#define isc_mem_get(c, s) isc__mem_get((c), (s) _ISC_MEM_FILELINE) +#define isc_mem_allocate(c, s) isc__mem_allocate((c), (s) _ISC_MEM_FILELINE) +#define isc_mem_strdup(c, p) isc__mem_strdup((c), (p) _ISC_MEM_FILELINE) +#define isc_mempool_get(c) isc__mempool_get((c) _ISC_MEM_FILELINE) #ifdef ISC_MEM_DEBUG -#define isc_mem_get(c, s) isc__mem_getdebug(c, s, __FILE__, __LINE__) -#define isc_mem_put(c, p, s) isc__mem_putdebug(c, p, s, __FILE__, __LINE__) -#define isc_mem_allocate(c, s) isc__mem_allocatedebug(c, s, \ - __FILE__, __LINE__) -#define isc_mem_free(c, p) isc__mem_freedebug(c, p, __FILE__, __LINE__) -#define isc_mem_strdup(c, p) isc__mem_strdupdebug(c, p, \ - __FILE__, __LINE__) -#define isc_mempool_get(c) isc__mempool_getdebug(c, __FILE__, __LINE__) -#define isc_mempool_put(c, p) isc__mempool_putdebug(c, p, \ - __FILE__, __LINE__) +#define isc_mem_put(c, p, s) \ + do { \ + isc__mem_put((c), (p), (s) _ISC_MEM_FILELINE); \ + (p) = NULL; \ + } while (0) +#define isc_mem_free(c, p) \ + do { \ + isc__mem_free((c), (p) _ISC_MEM_FILELINE); \ + (p) = NULL; \ + } while (0) +#define isc_mempool_put(c, p) \ + do { \ + isc__mempool_put((c), (p) _ISC_MEM_FILELINE); \ + (p) = NULL; \ + } while (0) #else -#define isc_mem_get isc__mem_get -#define isc_mem_put isc__mem_put -#define isc_mem_allocate isc__mem_allocate -#define isc_mem_free isc__mem_free -#define isc_mem_strdup isc__mem_strdup -#define isc_mempool_get isc__mempool_get -#define isc_mempool_put isc__mempool_put -#endif /* ISC_MEM_DEBUG */ +#define isc_mem_put(c, p, s) isc__mem_put((c), (p), (s) _ISC_MEM_FILELINE) +#define isc_mem_free(c, p) isc__mem_free((c), (p) _ISC_MEM_FILELINE) +#define isc_mempool_put(c, p) isc__mempool_put((c), (p) _ISC_MEM_FILELINE) +#endif isc_result_t isc_mem_create(size_t, size_t, isc_mem_t **); void isc_mem_attach(isc_mem_t *, isc_mem_t **); @@ -67,25 +121,19 @@ void isc_mem_destroy(isc_mem_t **); isc_result_t isc_mem_ondestroy(isc_mem_t *ctx, isc_task_t *task, isc_event_t **event); -void * isc__mem_get(isc_mem_t *, size_t); -void isc__mem_put(isc_mem_t *, void *, size_t); -void * isc__mem_getdebug(isc_mem_t *, size_t, - const char *, int); -void isc__mem_putdebug(isc_mem_t *, void *, - size_t, const char *, int); +void * isc__mem_get(isc_mem_t *, size_t + _ISC_MEM_FLARG); +void isc__mem_put(isc_mem_t *, void *, + size_t _ISC_MEM_FLARG); isc_result_t isc_mem_preallocate(isc_mem_t *); void isc_mem_stats(isc_mem_t *, FILE *); isc_boolean_t isc_mem_valid(isc_mem_t *, void *); -void * isc__mem_allocate(isc_mem_t *, size_t); -void * isc__mem_allocatedebug(isc_mem_t *, size_t, - const char *, int); -void isc__mem_free(isc_mem_t *, void *); -void isc__mem_freedebug(isc_mem_t *, void *, - const char *, int); -char * isc__mem_strdup(isc_mem_t *, const char *); -char * isc__mem_strdupdebug(isc_mem_t *, - const char *, - const char *, int); +void * isc__mem_allocate(isc_mem_t *, size_t + _ISC_MEM_FLARG); +void isc__mem_free(isc_mem_t *, void * + _ISC_MEM_FLARG); +char * isc__mem_strdup(isc_mem_t *, const char * + _ISC_MEM_FLARG); void isc_mem_setdestroycheck(isc_mem_t *, isc_boolean_t); void isc_mem_setsplit(isc_mem_t *, isc_boolean_t); @@ -99,38 +147,6 @@ isc_result_t isc_mem_createx(size_t, size_t, void *arg, isc_mem_t **); isc_result_t isc_mem_restore(isc_mem_t *); -#ifdef ISC_MEMCLUSTER_LEGACY - -/* - * Legacy. - */ - -#define meminit isc__legacy_meminit -#define mem_default_context isc__legacy_mem_default_context -#ifdef MEMCLUSTER_DEBUG -#define memget(s) isc__legacy_memget_debug(s, __FILE__, __LINE__) -#define memput(p, s) isc__legacy_memput_debug(p, s, \ - __FILE__, __LINE__) -#else -#define memget isc__legacy_memget -#define memput isc__legacy_memput -#endif -#define memvalid isc__legacy_memvalid -#define memstats isc__legacy_memstats - -int meminit(size_t, size_t); -isc_mem_t * mem_default_context(void); -void * isc__legacy_memget(size_t); -void isc__legacy_memput(void *, size_t); -void * isc__legacy_memget_debug(size_t, const char *, - int); -void isc__legacy_memput_debug(void *, size_t, - const char *, int); -int memvalid(void *); -void memstats(FILE *); - -#endif /* ISC_MEMCLUSTER_LEGACY */ - /* * Memory pools */ @@ -139,11 +155,8 @@ void memstats(FILE *); * Internal (but public) functions. Don't call these from application * code. Use isc_mempool_get() and isc_mempool_put() instead. */ -void * isc__mempool_get(isc_mempool_t *); -void isc__mempool_put(isc_mempool_t *, void *); -void * isc__mempool_getdebug(isc_mempool_t *, const char *, int); -void isc__mempool_putdebug(isc_mempool_t *, void *, - const char *, int); +void * isc__mempool_get(isc_mempool_t * _ISC_MEM_FLARG); +void isc__mempool_put(isc_mempool_t *, void * _ISC_MEM_FLARG); isc_result_t isc_mempool_create(isc_mem_t *mctx, size_t size, isc_mempool_t **mpctxp); diff --git a/lib/isc/mem.c b/lib/isc/mem.c index 85fd283142..c220b38e7c 100644 --- a/lib/isc/mem.c +++ b/lib/isc/mem.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: mem.c,v 1.53 2000/06/26 20:27:42 bwelling Exp $ */ +/* $Id: mem.c,v 1.54 2000/07/26 19:06:19 explorer Exp $ */ #include @@ -37,26 +37,7 @@ #define UNLOCK(l) #endif -isc_boolean_t isc_mem_debugging = ISC_FALSE; - -#ifndef ISC_MEM_FILL - /* - * XXXMPA - * We want this on during development to catch: - * 1. some reference after free bugs. - * 2. some failure to initalise bugs. - */ -#define ISC_MEM_FILL 1 -#endif - -#ifndef ISC_MEMPOOL_NAMES -/* - * During development it is nice to be able to see names associated with - * memory pools. - */ -#define ISC_MEMPOOL_NAMES 1 -#endif - +unsigned int isc_mem_debugging = 0; /* * Constants. @@ -67,13 +48,29 @@ isc_boolean_t isc_mem_debugging = ISC_FALSE; #define ALIGNMENT_SIZE 8 #define NUM_BASIC_BLOCKS 64 /* must be > 1 */ #define TABLE_INCREMENT 1024 +#define DEBUGLIST_COUNT 1024 /* * Types. */ +#ifdef ISC_MEM_TRACKLINES +typedef struct debuglink debuglink_t; +struct debuglink { + ISC_LINK(debuglink_t) link; + const void *ptr[DEBUGLIST_COUNT]; + const char *file[DEBUGLIST_COUNT]; + unsigned int line[DEBUGLIST_COUNT]; + unsigned int count; +}; + +#define FLARG_PASS , file, line +#define FLARG , const char *file, int line +#else +#define FLARG_PASS +#define FLARG +#endif typedef struct element element; - struct element { element * next; }; @@ -122,6 +119,9 @@ struct isc_mem { size_t total; size_t inuse; ISC_LIST(isc_mempool_t) pools; +#ifdef ISC_MEM_TRACKLINES + ISC_LIST(debuglink_t) debuglist; +#endif }; #define MEMPOOL_MAGIC 0x4D454d70U /* MEMp. */ @@ -145,7 +145,7 @@ struct isc_mempool { /* Stats only. */ unsigned int gets; /* # of requests to this pool */ /* Debugging only. */ -#if ISC_MEMPOOL_NAMES +#ifdef ISC_MEMPOOL_NAMES char name[16]; /* printed name in stats reports */ #endif }; @@ -154,6 +154,111 @@ struct isc_mempool { * Private Inline-able. */ +#ifndef ISC_MEM_TRACKLINES +#define ADD_TRACE(a, b, c, d, e) +#define DELETE_TRACE(a, b, c, d, e) +#else +#define ADD_TRACE(a, b, c, d, e) add_trace_entry(a, b, c, d, e) +#define DELETE_TRACE(a, b, c, d, e) delete_trace_entry(a, b, c, d, e) + +#define MEM_TRACE ((isc_mem_debugging & ISC_MEM_DEBUGTRACE) != 0) +#define MEM_RECORD ((isc_mem_debugging & ISC_MEM_DEBUGRECORD) != 0) + +/* + * mctx must be locked. + */ +static inline void +add_trace_entry(isc_mem_t *mctx, const void *ptr, unsigned int size + const char *file, int line) +{ + debuglink_t *dl; + unsigned int i; + + if (MEM_TRACE) + fprintf(stderr, "add %p size %u file %s line %u\n", + ptr, size, file, line); + + if (!MEM_RECORD) + return; + + dl = ISC_LIST_HEAD(mctx->debuglist); + while (dl != NULL) { + if (dl->count == DEBUGLIST_COUNT) + goto next; + for (i = 0 ; i < DEBUGLIST_COUNT ; i++) { + if (dl->ptr[i] == NULL) { + dl->ptr[i] = ptr; + dl->file[i] = file; + dl->line[i] = line; + dl->count++; + return; + } + } + next: + dl = ISC_LIST_NEXT(dl, link); + } + + dl = malloc(sizeof(debuglink_t)); + INSIST(dl != NULL); + + ISC_LINK_INIT(dl, link); + for (i = 1 ; i < DEBUGLIST_COUNT ; i++) { + dl->ptr[i] = NULL; + dl->file[i] = NULL; + dl->line[i] = 0; + } + + dl->ptr[0] = ptr; + dl->file[0] = file; + dl->line[0] = line; + dl->count = 1; + + ISC_LIST_PREPEND(mctx->debuglist, dl, link); +} + +static inline void +delete_trace_entry(isc_mem_t *mctx, const void *ptr, unsigned int size, + const char *file, unsigned int line) +{ + debuglink_t *dl; + unsigned int i; + + if (MEM_TRACE) + fprintf(stderr, "del %p size %u file %s line %u\n", + ptr, size, file, line); + + if (!MEM_RECORD) + return; + + dl = ISC_LIST_HEAD(mctx->debuglist); + while (dl != NULL) { + for (i = 0 ; i < DEBUGLIST_COUNT ; i++) { + if (dl->ptr[i] == ptr) { + dl->ptr[i] = NULL; + dl->file[i] = NULL; + dl->line[i] = 0; + + INSIST(dl->count > 0); + dl->count--; + if (dl->count == 0) { + ISC_LIST_UNLINK(mctx->debuglist, + dl, link); + free(dl); + } + return; + } + } + dl = ISC_LIST_NEXT(dl, link); + } + + /* + * If we get here, we didn't find the item on the list. We're + * screwed. + */ + INSIST(dl != NULL); +} +#endif /* ISC_MEM_TRACKLINES */ + static inline size_t quantize(size_t size) { int temp; @@ -412,7 +517,7 @@ mem_getunlocked(isc_mem_t *ctx, size_t size) { done: -#if ISC_MEM_FILL +#ifdef ISC_MEM_FILL if (ret != NULL) memset(ret, 0xbe, new_size); /* Mnemonic for "beef". */ #endif @@ -428,7 +533,7 @@ mem_putunlocked(isc_mem_t *ctx, void *mem, size_t size) { /* * memput() called on something beyond our upper limit. */ -#if ISC_MEM_FILL +#ifdef ISC_MEM_FILL memset(mem, 0xde, size); /* Mnemonic for "dead". */ #endif (ctx->memfree)(ctx->arg, mem); @@ -440,8 +545,8 @@ mem_putunlocked(isc_mem_t *ctx, void *mem, size_t size) { return; } -#if ISC_MEM_FILL -#if ISC_MEM_CHECKOVERRUN +#ifdef ISC_MEM_FILL +#ifdef ISC_MEM_CHECKOVERRUN check_overrun(mem, size, new_size); #endif memset(mem, 0xde, new_size); /* Mnemonic for "dead". */ @@ -549,6 +654,9 @@ isc_mem_createx(size_t init_max_size, size_t target_size, ctx->magic = MEM_MAGIC; isc_ondestroy_init(&ctx->ondestroy); ISC_LIST_INIT(ctx->pools); +#ifdef ISC_MEM_TRACKLINES + ISC_LIST_INIT(ctx->debuglist); +#endif *ctxp = ctx; return (ISC_R_SUCCESS); @@ -571,6 +679,9 @@ destroy(isc_mem_t *ctx) { ctx->magic = 0; INSIST(ISC_LIST_EMPTY(ctx->pools)); +#ifdef ISC_MEM_TRACKLINES + INSIST(ISC_LIST_EMPTY(ctx->debuglist)); +#endif INSIST(ctx->references == 0); if (ctx->checkfree) { @@ -683,20 +794,7 @@ isc_mem_restore(isc_mem_t *ctx) { return (result); } -void * -isc__mem_get(isc_mem_t *ctx, size_t size) { - void *ret; - - REQUIRE(VALID_CONTEXT(ctx)); - - LOCK(&ctx->lock); - ret = mem_getunlocked(ctx, size); - UNLOCK(&ctx->lock); - - return (ret); -} - -#if ISC_MEM_FILL != 0 && ISC_MEM_CHECKOVERRUN != 0 +#if defined(ISC_MEM_FILL) && defined(ISC_MEM_CHECKOVERRUN) static inline void check_overrun(void *mem, size_t size, size_t new_size) { unsigned char *cp; @@ -711,34 +809,29 @@ check_overrun(void *mem, size_t size, size_t new_size) { } #endif -void -isc__mem_put(isc_mem_t *ctx, void *mem, size_t size) { +void * +isc__mem_get(isc_mem_t *ctx, size_t size FLARG) { + void *ptr; + REQUIRE(VALID_CONTEXT(ctx)); LOCK(&ctx->lock); - mem_putunlocked(ctx, mem, size); + ptr = mem_getunlocked(ctx, size); + ADD_TRACE(ctx, ptr, size, file, line); UNLOCK(&ctx->lock); -} - -void * -isc__mem_getdebug(isc_mem_t *ctx, size_t size, const char *file, int line) { - void *ptr; - - ptr = isc__mem_get(ctx, size); - if (isc_mem_debugging) - fprintf(stderr, "%s:%d: mem_get(%p, %lu) -> %p\n", file, line, - ctx, (unsigned long)size, ptr); return (ptr); } void -isc__mem_putdebug(isc_mem_t *ctx, void *ptr, size_t size, const char *file, - int line) +isc__mem_put(isc_mem_t *ctx, void *ptr, size_t size FLARG) { - if (isc_mem_debugging) - fprintf(stderr, "%s:%d: mem_put(%p, %p, %lu)\n", file, line, - ctx, ptr, (unsigned long)size); - isc__mem_put(ctx, ptr, size); + REQUIRE(VALID_CONTEXT(ctx)); + REQUIRE(ptr != NULL); + + LOCK(&ctx->lock); + DELETE_TRACE(ctx, ptr, size, file, line); + mem_putunlocked(ctx, ptr, size); + UNLOCK(&ctx->lock); } isc_result_t @@ -816,6 +909,27 @@ isc_mem_stats(isc_mem_t *ctx, FILE *out) { pool = ISC_LIST_NEXT(pool, link); } +#ifdef ISC_MEM_TRACKLINES + if (isc_mem_debugging > 1) { + debuglink_t *dl; + unsigned int i; + + fprintf(out, "DUMP OF ALL OUTSTANDING MEMORY ALLOCATIONS\n"); + dl = ISC_LIST_HEAD(ctx->debuglist); + if (dl == NULL) + fprintf(out, "\tNone.\n"); + while (dl != NULL) { + for (i = 0 ; i < DEBUGLIST_COUNT ; i++) + if (dl->ptr[i] != NULL) + fprintf(out, + "\tptr %p file %s line %u\n", + dl->ptr[i], dl->file[i], + dl->line[i]); + dl = ISC_LIST_NEXT(dl, link); + } + } +#endif + UNLOCK(&ctx->lock); } @@ -840,12 +954,12 @@ isc_mem_valid(isc_mem_t *ctx, void *ptr) { * size of the object allocated (with some additional overhead). */ -void * -isc__mem_allocate(isc_mem_t *ctx, size_t size) { +static void * +isc__mem_allocateunlocked(isc_mem_t *ctx, size_t size) { size_info *si; size += ALIGNMENT_SIZE; - si = isc__mem_get(ctx, size); + si = mem_getunlocked(ctx, size); if (si == NULL) return (NULL); si->u.size = size; @@ -853,36 +967,34 @@ isc__mem_allocate(isc_mem_t *ctx, size_t size) { } void * -isc__mem_allocatedebug(isc_mem_t *ctx, size_t size, const char *file, - int line) { +isc__mem_allocate(isc_mem_t *ctx, size_t size FLARG) { size_info *si; - si = isc__mem_allocate(ctx, size); - if (si == NULL) - return (NULL); - if (isc_mem_debugging) - fprintf(stderr, "%s:%d: mem_get(%p, %lu) -> %p\n", file, line, - ctx, (unsigned long)si[-1].u.size, si); + REQUIRE(VALID_CONTEXT(ctx)); + + LOCK(&ctx->lock); + si = isc__mem_allocateunlocked(ctx, size); +#ifdef ISC_MEM_TRACKLINES + if (si != NULL) + ADD_TRACE(ctx, si, si[-1].u.size, file, line); +#endif + UNLOCK(&ctx->lock); + return (si); } void -isc__mem_free(isc_mem_t *ctx, void *ptr) { +isc__mem_free(isc_mem_t *ctx, void *ptr FLARG) { size_info *si; - si = &(((size_info *)ptr)[-1]); - isc__mem_put(ctx, si, si->u.size); -} - -void -isc__mem_freedebug(isc_mem_t *ctx, void *ptr, const char *file, int line) { - size_info *si; + REQUIRE(VALID_CONTEXT(ctx)); + REQUIRE(ptr != NULL); si = &(((size_info *)ptr)[-1]); - if (isc_mem_debugging) - fprintf(stderr, "%s:%d: mem_put(%p, %p, %lu)\n", file, line, - ctx, ptr, (unsigned long)si->u.size); - isc__mem_put(ctx, si, si->u.size); + LOCK(&ctx->lock); + DELETE_TRACE(ctx, ptr, si->u.size, file, line); + mem_putunlocked(ctx, si, si->u.size); + UNLOCK(&ctx->lock); } /* @@ -890,33 +1002,23 @@ isc__mem_freedebug(isc_mem_t *ctx, void *ptr, const char *file, int line) { */ char * -isc__mem_strdup(isc_mem_t *mctx, const char *s) { +isc__mem_strdup(isc_mem_t *mctx, const char *s FLARG) { size_t len; char *ns; + REQUIRE(VALID_CONTEXT(mctx)); + REQUIRE(s != NULL); + len = strlen(s); - ns = isc__mem_allocate(mctx, len + 1); - if (ns == NULL) - return (NULL); - strncpy(ns, s, len + 1); + + ns = isc__mem_allocate(mctx, len + 1 FLARG_PASS); + + if (ns != NULL) + strncpy(ns, s, len + 1); return (ns); } -char * -isc__mem_strdupdebug(isc_mem_t *mctx, const char *s, const char *file, - int line) { - char *ptr; - size_info *si; - - ptr = isc__mem_strdup(mctx, s); - si = &(((size_info *)ptr)[-1]); - if (isc_mem_debugging) - fprintf(stderr, "%s:%d: mem_get(%p, %lu) -> %p\n", file, line, - mctx, (unsigned long)si->u.size, ptr); - return (ptr); -} - void isc_mem_setdestroycheck(isc_mem_t *ctx, isc_boolean_t flag) { REQUIRE(VALID_CONTEXT(ctx)); @@ -980,92 +1082,6 @@ isc_mem_inuse(isc_mem_t *ctx) { return (inuse); } -#ifdef ISC_MEMCLUSTER_LEGACY - -/* - * Public Legacy. - */ - -static isc_mem_t *default_context = NULL; - -int -meminit(size_t init_max_size, size_t target_size) { - /* - * Need default_context lock here. - */ - if (default_context != NULL) - return (-1); - return (isc_mem_create(init_max_size, target_size, &default_context)); -} - -isc_mem_t * -mem_default_context(void) { - /* - * Need default_context lock here. - */ - if (default_context == NULL && meminit(0, 0) == -1) - return (NULL); - return (default_context); -} - -void * -isc__legacy_memget(size_t size) { - /* - * Need default_context lock here. - */ - if (default_context == NULL && meminit(0, 0) == -1) - return (NULL); - return (isc__mem_get(default_context, size)); -} - -void -isc__legacy_memput(void *mem, size_t size) { - /* - * Need default_context lock here. - */ - REQUIRE(default_context != NULL); - isc__mem_put(default_context, mem, size); -} - -void * -isc__legacy_memget_debug(size_t size, const char *file, int line) { - void *ptr; - ptr = isc__legacy_memget(size); - if (isc_mem_debugging) - fprintf(stderr, "%s:%d: memget(%lu) -> %p\n", file, line, - (unsigned long)size, ptr); - return (ptr); -} - -void -isc__legacy_memput_debug(void *ptr, size_t size, const char *file, int line) { - if (isc_mem_debugging) - fprintf(stderr, "%s:%d: memput(%p, %lu)\n", file, line, - ptr, (unsigned long)size); - isc__legacy_memput(ptr, size); -} - -int -memvalid(void *ptr) { - /* - * Need default_context lock here. - */ - REQUIRE(default_context != NULL); - return (isc_mem_valid(default_context, ptr)); -} - -void -memstats(FILE *out) { - /* - * Need default_context lock here. - */ - REQUIRE(default_context != NULL); - isc_mem_stats(default_context, out); -} - -#endif /* ISC_MEMCLUSTER_LEGACY */ - - /* * Memory pool stuff */ @@ -1168,7 +1184,7 @@ isc_mempool_create(isc_mem_t *mctx, size_t size, isc_mempool_t **mpctxp) { mpctx->freemax = 1; mpctx->fillcount = 1; mpctx->gets = 0; -#if ISC_MEMPOOL_NAMES +#ifdef ISC_MEMPOOL_NAMES mpctx->name[0] = 0; #endif mpctx->items = NULL; @@ -1186,7 +1202,7 @@ void isc_mempool_setname(isc_mempool_t *mpctx, const char *name) { REQUIRE(name != NULL); -#if ISC_MEMPOOL_NAMES +#ifdef ISC_MEMPOOL_NAMES if (mpctx->lock != NULL) LOCK(mpctx->lock); @@ -1253,7 +1269,7 @@ isc_mempool_associatelock(isc_mempool_t *mpctx, isc_mutex_t *lock) { } void * -isc__mempool_get(isc_mempool_t *mpctx) { +isc__mempool_get(isc_mempool_t *mpctx FLARG) { element *item; isc_mem_t *mctx; unsigned int i; @@ -1317,11 +1333,17 @@ isc__mempool_get(isc_mempool_t *mpctx) { if (mpctx->lock != NULL) UNLOCK(mpctx->lock); + if (item != NULL) { + LOCK(&mctx->lock); + ADD_TRACE(mctx, item, mpctx->size, file, line); + UNLOCK(&mctx->lock); + } + return (item); } void -isc__mempool_put(isc_mempool_t *mpctx, void *mem) { +isc__mempool_put(isc_mempool_t *mpctx, void *mem FLARG) { isc_mem_t *mctx; element *item; @@ -1336,11 +1358,15 @@ isc__mempool_put(isc_mempool_t *mpctx, void *mem) { INSIST(mpctx->allocated > 0); mpctx->allocated--; + DELETE_TRACE(mctx, mem, mpctx->size, file, line); + /* * If our free list is full, return this to the mctx directly. */ if (mpctx->freecount >= mpctx->freemax) { - isc__mem_put(mctx, mem, mpctx->size); + LOCK(&mctx->lock); + mem_putunlocked(mctx, mem, mpctx->size); + UNLOCK(&mctx->lock); if (mpctx->lock != NULL) UNLOCK(mpctx->lock); return; @@ -1358,28 +1384,6 @@ isc__mempool_put(isc_mempool_t *mpctx, void *mem) { UNLOCK(mpctx->lock); } -void * -isc__mempool_getdebug(isc_mempool_t *mpctx, const char *file, int line) { - void *ptr; - - ptr = isc__mempool_get(mpctx); - if (isc_mem_debugging) - fprintf(stderr, "%s:%d: mempool_get(%p) -> %p\n", file, line, - mpctx, ptr); - - return (ptr); -} - -void -isc__mempool_putdebug(isc_mempool_t *mpctx, void *ptr, const char *file, - int line) -{ - if (isc_mem_debugging) - fprintf(stderr, "%s:%d: mempool_put(%p, %p)\n", file, line, - mpctx, ptr); - isc__mempool_put(mpctx, ptr); -} - /* * Quotas */ From 9c3903a58a4baa93df8523196c23abf0b0b2785a Mon Sep 17 00:00:00 2001 From: Michael Graff Date: Wed, 26 Jul 2000 19:07:36 +0000 Subject: [PATCH 214/226] set isc_mem_debugging = 2 --- bin/tests/mempool_test.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/bin/tests/mempool_test.c b/bin/tests/mempool_test.c index de178a5982..3538effea7 100644 --- a/bin/tests/mempool_test.c +++ b/bin/tests/mempool_test.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: mempool_test.c,v 1.7 2000/06/22 21:50:32 tale Exp $ */ +/* $Id: mempool_test.c,v 1.8 2000/07/26 19:07:36 explorer Exp $ */ #include @@ -36,6 +36,8 @@ main(int argc, char *argv[]) { UNUSED(argc); UNUSED(argv); + isc_mem_debugging = 2; + RUNTIME_CHECK(isc_mutex_init(&lock) == ISC_R_SUCCESS); mctx = NULL; @@ -91,7 +93,7 @@ main(int argc, char *argv[]) { */ isc_mempool_setfreemax(mp2, 25); isc_mempool_setfillcount(mp2, 25); - for (j = 0 ; j < 500000 ; j++) { + for (j = 0 ; j < 5000 ; j++) { for (i = 0 ; i < 50 ; i++) { items2[i] = isc_mempool_get(mp2); RUNTIME_CHECK(items2[i] != NULL); From 6967adadcb84848f1c886f4f79172824e68ee153 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 26 Jul 2000 19:13:18 +0000 Subject: [PATCH 215/226] minor clarifications --- bin/dnssec/dnssec-signkey.8 | 9 +++++---- doc/man/dnssec/dnssec-signkey.8 | 9 +++++---- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/bin/dnssec/dnssec-signkey.8 b/bin/dnssec/dnssec-signkey.8 index f7f80dc170..bd180f0f97 100644 --- a/bin/dnssec/dnssec-signkey.8 +++ b/bin/dnssec/dnssec-signkey.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signkey.8,v 1.4 2000/07/26 00:47:16 bwelling Exp $ +.\" $Id: dnssec-signkey.8,v 1.5 2000/07/26 19:13:18 gson Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-SIGNKEY 8 @@ -51,8 +51,8 @@ Each argument will be a key identification string as reported by .Xr dnssec-keygen 8 for the parent zone. -This allows the child's keys to be signed by more than 1 parent zone -key if these exist. +This allows the child's keys to be signed by more than one +parent zone key. .Pp The .Fl h @@ -118,7 +118,8 @@ when it next gets signed with .Xr dnssec-signzone 8 . A copy of the generated .Ar signedkey -file should be kept by the parent zone's DNS administrator. +file should be kept by the parent zone's DNS administrator, since +it will be needed when signing the parent zone. .Sh EXAMPLE The DNS administrator for a DNSSEC-aware .Dv .com diff --git a/doc/man/dnssec/dnssec-signkey.8 b/doc/man/dnssec/dnssec-signkey.8 index f7f80dc170..bd180f0f97 100644 --- a/doc/man/dnssec/dnssec-signkey.8 +++ b/doc/man/dnssec/dnssec-signkey.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signkey.8,v 1.4 2000/07/26 00:47:16 bwelling Exp $ +.\" $Id: dnssec-signkey.8,v 1.5 2000/07/26 19:13:18 gson Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-SIGNKEY 8 @@ -51,8 +51,8 @@ Each argument will be a key identification string as reported by .Xr dnssec-keygen 8 for the parent zone. -This allows the child's keys to be signed by more than 1 parent zone -key if these exist. +This allows the child's keys to be signed by more than one +parent zone key. .Pp The .Fl h @@ -118,7 +118,8 @@ when it next gets signed with .Xr dnssec-signzone 8 . A copy of the generated .Ar signedkey -file should be kept by the parent zone's DNS administrator. +file should be kept by the parent zone's DNS administrator, since +it will be needed when signing the parent zone. .Sh EXAMPLE The DNS administrator for a DNSSEC-aware .Dv .com From 6d016e34bf98a543e66710c2bab1b3fbeae3027c Mon Sep 17 00:00:00 2001 From: Michael Graff Date: Wed, 26 Jul 2000 20:56:39 +0000 Subject: [PATCH 216/226] minor formatting issue -- kill trailing whitespace --- lib/isc/mem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/isc/mem.c b/lib/isc/mem.c index c220b38e7c..801d78c728 100644 --- a/lib/isc/mem.c +++ b/lib/isc/mem.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: mem.c,v 1.54 2000/07/26 19:06:19 explorer Exp $ */ +/* $Id: mem.c,v 1.55 2000/07/26 20:56:39 explorer Exp $ */ #include @@ -272,7 +272,7 @@ quantize(size_t size) { if (size == 0) return (ALIGNMENT_SIZE); temp = size + (ALIGNMENT_SIZE - 1); - return (temp - temp % ALIGNMENT_SIZE); + return (temp - temp % ALIGNMENT_SIZE); } static inline void From 10680f2169aa2c701ededb09435e1f0c4ab51819 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Wed, 26 Jul 2000 20:58:11 +0000 Subject: [PATCH 217/226] The cycle text was even more confusing than it is now. --- bin/dnssec/dnssec-signzone.8 | 47 +++++++++++--------------------- doc/man/dnssec/dnssec-signzone.8 | 47 +++++++++++--------------------- 2 files changed, 32 insertions(+), 62 deletions(-) diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8 index c0081f1b53..4217e00ae1 100644 --- a/bin/dnssec/dnssec-signzone.8 +++ b/bin/dnssec/dnssec-signzone.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signzone.8,v 1.4 2000/07/26 00:47:17 bwelling Exp $ +.\" $Id: dnssec-signzone.8,v 1.5 2000/07/26 20:58:11 bwelling Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-SIGNZONE 8 @@ -141,43 +141,28 @@ When no expiry date is set for the SIG records, defaults to an expire time of 30 days from the start time of the SIG records. .Pp +When a previously signed zone is passed as input to +.Nm dnssec-signzone , +records may be resigned. Whether or not to resign records is configurable +by using the +.Fl c +option, which specifies the cycle period as an offset from the current time +(in seconds). If a SIG record expires after the cycle period, it is retained. +Otherwise, it is considered to be expiring soon, and .Nm dnssec-signzone -can automatically re-sign records if their signatures expire before -the expiry date that applies for the current zone signing activity. -This would apply to a zone that has previously been signed. -The decision to generate a new SIG record is determined by the cycle -time. -If the current SIG record expires after the cycle time, it is left -alone. -If it expires before the cycle time, the SIG record is considered to -be close to expiry. -Therefore -.Nm dnssec-signzone -creates a new SIG record to replace then one that is about to expire. +will remove it and generate a new SIG record to replace it. .Pp -The default cycle time is quarter of the difference between the -signature end and start dates for the current invocation of -.Nm dnssec-signzone . -So if the +The default cycle period is one quarter of the difference between the +specified signature end and start dates. So if the .Fl e and .Fl s options are not specified, .Nm dnssec-signzone -generates signatures that are valid for 30 days from the current -date by default. -The cycle time would be 7.5 days from the current date. -Therefore any SIG records that -were due to expire in that time would be replaced with new ones. -.Pp -The -.Fl c -option can be used to change the cycle time. -.Ar cycle-time -indicates the number of seconds from the current time that should be -used to -set the cycle time and -determine when fresh SIG records should be generated. +generates signatures that are valid for 30 days from the current date +by default, with a cycle period of 7.5 days. Therefore, if any SIG records +are due to expire in less than 7.5 days, they would be replaced +with new ones. .Pp The .Fl p diff --git a/doc/man/dnssec/dnssec-signzone.8 b/doc/man/dnssec/dnssec-signzone.8 index c0081f1b53..4217e00ae1 100644 --- a/doc/man/dnssec/dnssec-signzone.8 +++ b/doc/man/dnssec/dnssec-signzone.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signzone.8,v 1.4 2000/07/26 00:47:17 bwelling Exp $ +.\" $Id: dnssec-signzone.8,v 1.5 2000/07/26 20:58:11 bwelling Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-SIGNZONE 8 @@ -141,43 +141,28 @@ When no expiry date is set for the SIG records, defaults to an expire time of 30 days from the start time of the SIG records. .Pp +When a previously signed zone is passed as input to +.Nm dnssec-signzone , +records may be resigned. Whether or not to resign records is configurable +by using the +.Fl c +option, which specifies the cycle period as an offset from the current time +(in seconds). If a SIG record expires after the cycle period, it is retained. +Otherwise, it is considered to be expiring soon, and .Nm dnssec-signzone -can automatically re-sign records if their signatures expire before -the expiry date that applies for the current zone signing activity. -This would apply to a zone that has previously been signed. -The decision to generate a new SIG record is determined by the cycle -time. -If the current SIG record expires after the cycle time, it is left -alone. -If it expires before the cycle time, the SIG record is considered to -be close to expiry. -Therefore -.Nm dnssec-signzone -creates a new SIG record to replace then one that is about to expire. +will remove it and generate a new SIG record to replace it. .Pp -The default cycle time is quarter of the difference between the -signature end and start dates for the current invocation of -.Nm dnssec-signzone . -So if the +The default cycle period is one quarter of the difference between the +specified signature end and start dates. So if the .Fl e and .Fl s options are not specified, .Nm dnssec-signzone -generates signatures that are valid for 30 days from the current -date by default. -The cycle time would be 7.5 days from the current date. -Therefore any SIG records that -were due to expire in that time would be replaced with new ones. -.Pp -The -.Fl c -option can be used to change the cycle time. -.Ar cycle-time -indicates the number of seconds from the current time that should be -used to -set the cycle time and -determine when fresh SIG records should be generated. +generates signatures that are valid for 30 days from the current date +by default, with a cycle period of 7.5 days. Therefore, if any SIG records +are due to expire in less than 7.5 days, they would be replaced +with new ones. .Pp The .Fl p From ef4010aae70f0fa9a26fb5c4c6053d455cdb86af Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Wed, 26 Jul 2000 21:31:52 +0000 Subject: [PATCH 218/226] cross-reference error strings with their result.h macros --- lib/dns/result.c | 175 +++++++++++++++++++++++++---------------------- 1 file changed, 95 insertions(+), 80 deletions(-) diff --git a/lib/dns/result.c b/lib/dns/result.c index 12e45deec6..26350e46a9 100644 --- a/lib/dns/result.c +++ b/lib/dns/result.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: result.c,v 1.66 2000/07/20 19:32:57 bwelling Exp $ */ +/* $Id: result.c,v 1.67 2000/07/26 21:31:52 tale Exp $ */ #include @@ -26,88 +26,103 @@ #include static const char *text[DNS_R_NRESULTS] = { - "label too long", /* 0 */ - "bad escape", /* 1 */ - "bad bitstring", /* 2 */ - "bitstring too long", /* 3 */ - "empty label", /* 4 */ - "bad dotted quad", /* 5 */ - "invalid NS owner name (wildcard)", /* 6 */ - "unknown class/type", /* 7 */ - "bad label type", /* 8 */ - "bad compression pointer", /* 9 */ - "too many hops", /* 10 */ - "disallowed (by application policy)", /* 11 */ - "extra input text", /* 12 */ - "extra input data", /* 13 */ - "text too long", /* 14 */ - "not at top of zone", /* 15 */ - "syntax error", /* 16 */ - "bad checksum", /* 17 */ - "bad IPv6 address", /* 18 */ - "no owner", /* 19 */ - "no ttl", /* 20 */ - "bad class", /* 21 */ - "name too long", /* 22 */ - "partial match", /* 23 */ - "new origin", /* 24 */ - "unchanged", /* 25 */ - "bad ttl", /* 26 */ - "more data needed/to be rendered", /* 27 */ - "continue", /* 28 */ - "delegation", /* 29 */ - "glue", /* 30 */ - "dname", /* 31 */ - "cname", /* 32 */ - "bad database", /* 33 */ - "zonecut", /* 34 */ - "bad zone", /* 35 */ - "more data", /* 36 */ - "up to date", /* 37 */ - "tsig verify failure", /* 38 */ - "tsig indicates error", /* 39 */ - "SIG failed to verify", /* 40 */ - "SIG has expired", /* 41 */ - "SIG validity period has not begun", /* 42 */ - "key is unauthorized to sign data", /* 43 */ - "invalid time", /* 44 */ - "expected a TSIG", /* 45 */ - "did not expect a TSIG", /* 46 */ - "TKEY is unacceptable", /* 47 */ - "hint", /* 48 */ - "drop", /* 49 */ - "zone not loaded", /* 50 */ - "ncache nxdomain", /* 51 */ - "ncache nxrrset", /* 52 */ - "wait", /* 53 */ - "not verified yet", /* 54 */ - "no identity", /* 55 */ - "no journal", /* 56 */ - "alias", /* 57 */ - "use TCP", /* 58 */ - "no valid SIG", /* 59 */ - "no valid NXT", /* 60 */ - "not insecure" /* 61 */ + "label too long", /* 0 DNS_R_LABELTOOLONG */ + "bad escape", /* 1 DNS_R_BADESCAPE */ + "bad bitstring", /* 2 DNS_R_BADBITSTRING */ + "bitstring too long", /* 3 DNS_R_BITSTRINGTOOLONG */ + "empty label", /* 4 DNS_R_EMPTYLABEL */ + + "bad dotted quad", /* 5 DNS_R_BADDOTTEDQUAD */ + "invalid NS owner name (wildcard)", /* 6 DNS_R_INVALIDNS */ + "unknown class/type", /* 7 DNS_R_UNKNOWN */ + "bad label type", /* 8 DNS_R_BADLABELTYPE */ + "bad compression pointer", /* 9 DNS_R_BADPOINTER */ + + "too many hops", /* 10 DNS_R_TOOMANYHOPS */ + "disallowed (by application policy)", /* 11 DNS_R_DISALLOWED */ + "extra input text", /* 12 DNS_R_EXTRATOKEN */ + "extra input data", /* 13 DNS_R_EXTRADATA */ + "text too long", /* 14 DNS_R_TEXTTOOLONG */ + + "not at top of zone", /* 15 DNS_R_NOTZONETOP */ + "syntax error", /* 16 DNS_R_SYNTAX */ + "bad checksum", /* 17 DNS_R_BADCKSUM */ + "bad IPv6 address", /* 18 DNS_R_BADAAAA */ + "no owner", /* 19 DNS_R_NOOWNER */ + + "no ttl", /* 20 DNS_R_NOTTL */ + "bad class", /* 21 DNS_R_BADCLASS */ + "name too long", /* 22 DNS_R_NAMETOOLONG */ + "partial match", /* 23 DNS_R_PARTIALMATCH */ + "new origin", /* 24 DNS_R_NEWORIGIN */ + + "unchanged", /* 25 DNS_R_UNCHANGED */ + "bad ttl", /* 26 DNS_R_BADTTL */ + "more data needed/to be rendered", /* 27 DNS_R_NOREDATA */ + "continue", /* 28 DNS_R_CONTINUE */ + "delegation", /* 29 DNS_R_DELEGATION */ + + "glue", /* 30 DNS_R_GLUE */ + "dname", /* 31 DNS_R_DNAME */ + "cname", /* 32 DNS_R_CNAME */ + "bad database", /* 33 DNS_R_BADDB */ + "zonecut", /* 34 DNS_R_ZONECUT */ + + "bad zone", /* 35 DNS_R_BADZONE */ + "more data", /* 36 DNS_R_MOREDATA */ + "up to date", /* 37 DNS_R_UPTODATE */ + "tsig verify failure", /* 38 DNS_R_TSIGVERIFYFAILURE */ + "tsig indicates error", /* 39 DNS_R_TSIGERRORSET */ + + "SIG failed to verify", /* 40 DNS_R_SIGINVALID */ + "SIG has expired", /* 41 DNS_R_SIGEXPIRED */ + "SIG validity period has not begun", /* 42 DNS_R_SIGFUTURE */ + "key is unauthorized to sign data", /* 43 DNS_R_KEYUNAUTHORIZED */ + "invalid time", /* 44 DNS_R_INVALIDTIME */ + + "expected a TSIG", /* 45 DNS_R_EXPECTEDTSIG */ + "did not expect a TSIG", /* 46 DNS_R_UNEXPECTEDTSIG */ + "TKEY is unacceptable", /* 47 DNS_R_INVALIDTKEY */ + "hint", /* 48 DNS_R_HINT */ + "drop", /* 49 DNS_R_DROP */ + + "zone not loaded", /* 50 DNS_R_NOTLOADED */ + "ncache nxdomain", /* 51 DNS_R_NCACHENXDOMAIN */ + "ncache nxrrset", /* 52 DNS_R_NCACHENXRRSET */ + "wait", /* 53 DNS_R_WAIT */ + "not verified yet", /* 54 DNS_R_NOTVERIFIEDYET */ + + "no identity", /* 55 DNS_R_NOIDENTITY */ + "no journal", /* 56 DNS_R_NOJOURNAL */ + "alias", /* 57 DNS_R_ALIAS */ + "use TCP", /* 58 DNS_R_USETCP */ + "no valid SIG", /* 59 DNS_R_NOVALIDSIG */ + + "no valid NXT", /* 60 DNS_R_NOVALIDNXT */ + "not insecure" /* 61 DNS_R_NOTINSECURE */ }; static const char *rcode_text[DNS_R_NRCODERESULTS] = { - "NOERROR", /* 0 */ - "FORMERR", /* 1 */ - "SERVFAIL", /* 2 */ - "NXDOMAIN", /* 3 */ - "NOTIMP", /* 4 */ - "REFUSED", /* 5 */ - "YXDOMAIN", /* 6 */ - "YXRRSET", /* 7 */ - "NXRRSET", /* 8 */ - "NOTAUTH", /* 9 */ - "NOTZONE", /* 10 */ - "", /* 11 */ - "", /* 12 */ - "", /* 13 */ - "", /* 14 */ - "", /* 15 */ - "BADVERS", /* 16 */ + "NOERROR", /* 0 DNS_R_NOEROR */ + "FORMERR", /* 1 DNS_R_FORMERR */ + "SERVFAIL", /* 2 DNS_R_SERVFAIL */ + "NXDOMAIN", /* 3 DNS_R_NXDOMAIN */ + "NOTIMP", /* 4 DNS_R_NOTIMP */ + + "REFUSED", /* 5 DNS_R_REFUSED */ + "YXDOMAIN", /* 6 DNS_R_YXDOMAIN */ + "YXRRSET", /* 7 DNS_R_YXRRSET */ + "NXRRSET", /* 8 DNS_R_NXRRSET */ + "NOTAUTH", /* 9 DNS_R_NOTAUTH */ + + "NOTZONE", /* 10 DNS_R_NOTZONE */ + "", /* 11 has no macro */ + "", /* 12 has no macro */ + "", /* 13 has no macro */ + "", /* 14 has no macro */ + + "", /* 15 has no macro */ + "BADVERS", /* 16 DNS_R_BADVERS */ }; #define DNS_RESULT_RESULTSET 2 From 894a2f61c9e3e51463bf21957c003d7c5636bdc5 Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Wed, 26 Jul 2000 21:32:57 +0000 Subject: [PATCH 219/226] minor style issue -- missing periods at ends of sentences/phrasesin comments. --- lib/dns/include/dns/result.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/dns/include/dns/result.h b/lib/dns/include/dns/result.h index 6da4907d92..3dc0e41432 100644 --- a/lib/dns/include/dns/result.h +++ b/lib/dns/include/dns/result.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: result.h,v 1.61 2000/07/13 02:41:20 bwelling Exp $ */ +/* $Id: result.h,v 1.62 2000/07/26 21:32:57 tale Exp $ */ #ifndef DNS_RESULT_H #define DNS_RESULT_H 1 @@ -102,10 +102,10 @@ #define DNS_R_NRESULTS 62 /* Number of results */ /* - * DNS wire format rcodes + * DNS wire format rcodes. * * By making these their own class we can easily convert them into the - * wire-format rcode value simply by masking off the resultclass + * wire-format rcode value simply by masking off the resultclass. */ #define DNS_R_NOERROR (ISC_RESULTCLASS_DNSRCODE + 0) #define DNS_R_FORMERR (ISC_RESULTCLASS_DNSRCODE + 1) From f6f4d7ee0f04474a13f4c28f1d05112325f3c8b0 Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Wed, 26 Jul 2000 21:34:11 +0000 Subject: [PATCH 220/226] separate the ISC_R_NRESULTS macro from those that define result codes, for clarity --- lib/isc/include/isc/result.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/lib/isc/include/isc/result.h b/lib/isc/include/isc/result.h index 0ec1a344b4..3160bb9689 100644 --- a/lib/isc/include/isc/result.h +++ b/lib/isc/include/isc/result.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: result.h,v 1.44 2000/06/22 21:57:59 tale Exp $ */ +/* $Id: result.h,v 1.45 2000/07/26 21:34:11 tale Exp $ */ #ifndef ISC_RESULT_H #define ISC_RESULT_H 1 @@ -70,7 +70,11 @@ #define ISC_R_NOTFILE 44 /* not a file */ #define ISC_R_NOTDIRECTORY 45 /* not a directory */ #define ISC_R_QUEUEFULL 46 /* queue is full */ -#define ISC_R_NRESULTS 47 /* Number of results */ + +/* + * Not an result code: the number of results. + */ +#define ISC_R_NRESULTS 47 ISC_LANG_BEGINDECLS From a1cbe5c5a18929a6b9986a94a6ee3d7fcafe1559 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Wed, 26 Jul 2000 21:36:08 +0000 Subject: [PATCH 221/226] The example omitted the -o option for the wrong reason. --- bin/dnssec/dnssec-signzone.8 | 9 ++++----- doc/man/dnssec/dnssec-signzone.8 | 9 ++++----- 2 files changed, 8 insertions(+), 10 deletions(-) diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8 index 4217e00ae1..5eaca322b0 100644 --- a/bin/dnssec/dnssec-signzone.8 +++ b/bin/dnssec/dnssec-signzone.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signzone.8,v 1.5 2000/07/26 20:58:11 bwelling Exp $ +.\" $Id: dnssec-signzone.8,v 1.6 2000/07/26 21:36:08 bwelling Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-SIGNZONE 8 @@ -219,11 +219,10 @@ zone with the key that was generated in the example given in the man page for .Xr dnssec-keygen 8 . The zone file for this zone is -.Dv example.com -and it can be assumed to contain fully qualified domain names which -means there is no need to use the +.Dv example.com , +which is the same as the origin, so there is no need to use the .Fl o -option to set the domain origin. +option to set the origin. This zone file contains the keyset for .Dv example.com that was created by diff --git a/doc/man/dnssec/dnssec-signzone.8 b/doc/man/dnssec/dnssec-signzone.8 index 4217e00ae1..5eaca322b0 100644 --- a/doc/man/dnssec/dnssec-signzone.8 +++ b/doc/man/dnssec/dnssec-signzone.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signzone.8,v 1.5 2000/07/26 20:58:11 bwelling Exp $ +.\" $Id: dnssec-signzone.8,v 1.6 2000/07/26 21:36:08 bwelling Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-SIGNZONE 8 @@ -219,11 +219,10 @@ zone with the key that was generated in the example given in the man page for .Xr dnssec-keygen 8 . The zone file for this zone is -.Dv example.com -and it can be assumed to contain fully qualified domain names which -means there is no need to use the +.Dv example.com , +which is the same as the origin, so there is no need to use the .Fl o -option to set the domain origin. +option to set the origin. This zone file contains the keyset for .Dv example.com that was created by From 7916c2f2b2ed57cd609621a4695ad312493f18c2 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 26 Jul 2000 21:36:43 +0000 Subject: [PATCH 222/226] clarified --- bin/dnssec/dnssec-signzone.8 | 14 +++++++------- doc/man/dnssec/dnssec-signzone.8 | 14 +++++++------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8 index 5eaca322b0..c7bf4dd866 100644 --- a/bin/dnssec/dnssec-signzone.8 +++ b/bin/dnssec/dnssec-signzone.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signzone.8,v 1.6 2000/07/26 21:36:08 bwelling Exp $ +.\" $Id: dnssec-signzone.8,v 1.7 2000/07/26 21:36:43 gson Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-SIGNZONE 8 @@ -78,20 +78,20 @@ If there is a .Ar signedkey file from the zone's parent, the parent's signatures will be incorporated into the generated signed zone file. -Any delegation points in the signed zone will have their security -status defined - i.e. whether they are DNSSEC-aware or not. +The security status of delegations from the the signed zone +- i.e. whether the child zones are DNSSEC-aware or not - is +set according to the presence or absence of a +.Ar signedkey +file for the child in case. .Pp By default, .Nm dnssec-signzone generates a file called .Ar zonefile.signed containing the signed zone file. -This can be overridden by the +The output file name can be overridden usign the .Fl f option. -Instead of this default file name, the signed zone file will be -written to -.Ar output-file . .\" Don't hyphenate YYYYMMDDHHMMSS .nh YYYYMMDDHHMMSS .Pp diff --git a/doc/man/dnssec/dnssec-signzone.8 b/doc/man/dnssec/dnssec-signzone.8 index 5eaca322b0..c7bf4dd866 100644 --- a/doc/man/dnssec/dnssec-signzone.8 +++ b/doc/man/dnssec/dnssec-signzone.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signzone.8,v 1.6 2000/07/26 21:36:08 bwelling Exp $ +.\" $Id: dnssec-signzone.8,v 1.7 2000/07/26 21:36:43 gson Exp $ .\" .Dd Jun 30, 2000 .Dt DNSSEC-SIGNZONE 8 @@ -78,20 +78,20 @@ If there is a .Ar signedkey file from the zone's parent, the parent's signatures will be incorporated into the generated signed zone file. -Any delegation points in the signed zone will have their security -status defined - i.e. whether they are DNSSEC-aware or not. +The security status of delegations from the the signed zone +- i.e. whether the child zones are DNSSEC-aware or not - is +set according to the presence or absence of a +.Ar signedkey +file for the child in case. .Pp By default, .Nm dnssec-signzone generates a file called .Ar zonefile.signed containing the signed zone file. -This can be overridden by the +The output file name can be overridden usign the .Fl f option. -Instead of this default file name, the signed zone file will be -written to -.Ar output-file . .\" Don't hyphenate YYYYMMDDHHMMSS .nh YYYYMMDDHHMMSS .Pp From 951c247f2923f667c5c97355b31dc564bd540bfe Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Wed, 26 Jul 2000 21:44:34 +0000 Subject: [PATCH 223/226] style lint --- lib/dns/cache.c | 59 +++++++++++++++++++++++++++++++++++-------------- 1 file changed, 42 insertions(+), 17 deletions(-) diff --git a/lib/dns/cache.c b/lib/dns/cache.c index 5d01070af3..3dc4ca1a9e 100644 --- a/lib/dns/cache.c +++ b/lib/dns/cache.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: cache.c,v 1.23 2000/06/07 02:38:30 marka Exp $ */ +/* $Id: cache.c,v 1.24 2000/07/26 21:44:34 tale Exp $ */ #include @@ -500,48 +500,67 @@ incremental_cleaning_action(isc_task_t *task, isc_event_t *event) { } INSIST(node != NULL); - /* Check TTLs, mark expired rdatasets stale. */ + /* + * Check TTLs, mark expired rdatasets stale. + */ result = dns_db_expirenode(cleaner->cache->db, node, now); if (result != ISC_R_SUCCESS) { UNEXPECTED_ERROR(__FILE__, __LINE__, - "cache cleaner: dns_db_expirenode() " + "cache cleaner: dns_db_expirenode() " "failed: %s", dns_result_totext(result)); - /* Continue anyway. */ + /* + * Continue anyway. + */ } - /* This is where the actual freeing takes place. */ + /* + * This is where the actual freeing takes place. + */ dns_db_detachnode(cleaner->cache->db, &node); - /* Step to the next node */ + /* + * Step to the next node. + */ result = dns_dbiterator_next(cleaner->iterator); if (result == ISC_R_NOMORE) { - /* We have successfully cleaned the whole cache. */ + /* + * We have successfully cleaned the whole cache. + */ goto idle; } if (result != ISC_R_SUCCESS) { UNEXPECTED_ERROR(__FILE__, __LINE__, - "cache cleaner: dns_dbiterator_next() " - "failed: %s", dns_result_totext(result)); + "cache cleaner: " + "dns_dbiterator_next() failed: %s", + dns_result_totext(result)); goto idle; } } - /* We have successfully performed a cleaning increment. */ + /* + * We have successfully performed a cleaning increment. + */ result = dns_dbiterator_pause(cleaner->iterator); if (result != ISC_R_SUCCESS && result != ISC_R_NOMORE) { UNEXPECTED_ERROR(__FILE__, __LINE__, "cache cleaner: dns_dbiterator_pause() " "failed: %s", dns_result_totext(result)); - /* Try to continue. */ + /* + * Try to continue. + */ } - /* Still busy, reschedule. */ + /* + * Still busy, reschedule. + */ isc_task_send(task, &event); INSIST(CLEANER_BUSY(cleaner)); return; idle: - /* No longer busy; save the event for later use. */ + /* + * No longer busy; save the event for later use. + */ end_cleaning(cleaner, event); INSIST(CLEANER_IDLE(cleaner)); return; @@ -568,17 +587,23 @@ dns_cache_clean(dns_cache_t *cache, isc_stdtime_t now) { if (result != ISC_R_SUCCESS) break; - /* Check TTLs, mark expired rdatasets stale. */ + /* + * Check TTLs, mark expired rdatasets stale. + */ result = dns_db_expirenode(cache->db, node, now); if (result != ISC_R_SUCCESS) { UNEXPECTED_ERROR(__FILE__, __LINE__, - "cache cleaner: dns_db_expirenode() " + "cache cleaner: dns_db_expirenode() " "failed: %s", dns_result_totext(result)); - /* Continue anyway. */ + /* + * Continue anyway. + */ } - /* This is where the actual freeing takes place. */ + /* + * This is where the actual freeing takes place. + */ dns_db_detachnode(cache->db, &node); result = dns_dbiterator_next(iterator); From 7b04a0e1df1d641a2eac54585839ab5d7ac7de8c Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Wed, 26 Jul 2000 21:56:28 +0000 Subject: [PATCH 224/226] does not need stddef.h, tell emacs to use C mode on the file --- lib/lwres/include/lwres/netdb.h.in | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/lwres/include/lwres/netdb.h.in b/lib/lwres/include/lwres/netdb.h.in index 4952611c4f..0088156d51 100644 --- a/lib/lwres/include/lwres/netdb.h.in +++ b/lib/lwres/include/lwres/netdb.h.in @@ -15,12 +15,11 @@ * SOFTWARE. */ -/* $Id: netdb.h.in,v 1.23 2000/06/23 03:14:04 tale Exp $ */ +/* $Id: netdb.h.in,v 1.24 2000/07/26 21:56:28 tale Exp $ */ #ifndef LWRES_NETDB_H #define LWRES_NETDB_H 1 -#include #include /* Contractual provision. */ #include @@ -453,4 +452,11 @@ struct rpcent *lwres_getrpcent(); #endif /* sun */ #endif /* notyet */ +/* + * Tell Emacs to use C mode on this file. + * Local variables: + * mode: c + * End: + */ + #endif /* LWRES_NETDB_H */ From 976f44baa3028118a4175a21536e68049e1d3766 Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Wed, 26 Jul 2000 22:36:34 +0000 Subject: [PATCH 225/226] needed isc/string.h for memset() prototype --- lib/isc/hmacmd5.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/isc/hmacmd5.c b/lib/isc/hmacmd5.c index f3771c6ed2..6204db7983 100644 --- a/lib/isc/hmacmd5.c +++ b/lib/isc/hmacmd5.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: hmacmd5.c,v 1.1 2000/07/17 17:33:31 bwelling Exp $ */ +/* $Id: hmacmd5.c,v 1.2 2000/07/26 22:36:34 tale Exp $ */ /* * This code implements the HMAC-MD5 keyed hash algorithm @@ -27,6 +27,7 @@ #include #include #include +#include #include #include From 371827c1e0aec7e97ac9bd2b146ff574386e7031 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Wed, 26 Jul 2000 22:41:28 +0000 Subject: [PATCH 226/226] added missing DNSSAFE license file --- lib/dns/sec/dnssafe/LICENSE_RSA | 43 +++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 lib/dns/sec/dnssafe/LICENSE_RSA diff --git a/lib/dns/sec/dnssafe/LICENSE_RSA b/lib/dns/sec/dnssafe/LICENSE_RSA new file mode 100644 index 0000000000..e448039b60 --- /dev/null +++ b/lib/dns/sec/dnssafe/LICENSE_RSA @@ -0,0 +1,43 @@ + DNSSAFE LICENSE TERMS + +This BIND software includes the DNSsafe software from RSA Data +Security, Inc., which is copyrighted software that can only be +distributed under the terms of this license agreement. + +The DNSsafe software cannot be used or distributed separately from the +BIND software. You only have the right to use it or distribute it as +a bundled, integrated product. + +The DNSsafe software can ONLY be used to provide authentication for +resource records in the Domain Name System, as specified in RFC 2065 +and successors. You cannot modify the BIND software to use the +DNSsafe software for other purposes, or to make its cryptographic +functions available to end-users for other uses. + +If you modify the DNSsafe software itself, you cannot modify its +documented API, and you must grant RSA Data Security the right to use, +modify, and distribute your modifications, including the right to use +any patents or other intellectual property that your modifications +depend upon. + +You must not remove, alter, or destroy any of RSA's copyright notices +or license information. When distributing the software to the Federal +Government, it must be licensed to them as "commercial computer +software" protected under 48 CFR 12.212 of the FAR, or 48 CFR +227.7202.1 of the DFARS. + +You must not violate United States export control laws by distributing +the DNSsafe software or information about it, when such distribution +is prohibited by law. + +THE DNSSAFE SOFTWARE IS PROVIDED "AS IS" WITHOUT ANY WARRANTY +WHATSOEVER. RSA HAS NO OBLIGATION TO SUPPORT, CORRECT, UPDATE OR +MAINTAIN THE RSA SOFTWARE. RSA DISCLAIMS ALL WARRANTIES, EXPRESS, +IMPLIED OR STATUTORY, AS TO ANY MATTER WHATSOEVER, INCLUDING ALL +IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR +PURPOSE AND NON-INFRINGEMENT OF THIRD PARTY RIGHTS. + +If you desire to use DNSsafe in ways that these terms do not permit, +please contact RSA Data Security, Inc., 100 Marine Parkway, Redwood +City, California 94065, USA, to discuss alternate licensing +arrangements.
+

3

 +

13

 +

8

 +

@@ -487,25 +493,25 @@ The internal structure of the Public Topology for an A6 global unicast address c

+

FP

 +

TLA ID

 +

RES

 +

@@ -532,7 +538,7 @@ A 3 bit FP (Format Prefix) of 001 indicates this is a global Unicast address. FP

-There is no particular structure for the Site topology section. Organizations can allocate these bits in any way they desire, in the same way as they would subnet an IPv4 class A (8-bit prefix) network.

+There is no particular structure for the Site topology section. Organizations can allocate these bits in any way they desire.

@@ -550,35 +556,34 @@ IPv6 address specifications are likely to contain long strings of zeros, so the

-
+

-Bibliography (and Suggested Reading)

+Appendix D. Bibliography (and Suggested Reading)
-
+

-Request for Comments (RFCs)

+Request for Comments (RFCs)

Specification documents for the Internet protocol suite, including the DNS, are published as part of the Request for Comments (RFCs) series of technical notes. The standards themselves are defined by the Internet Engineering Task Force (IETF) and the Internet Engineering Steering Group (IESG). RFCs can be obtained online via FTP at
- -ftp://www.isi.edu/in-notes/RFCxxx.txt - (where -xxx +ftp://www.isi.edu/in-notes/RFCxxx.txt + (where +xxx is the number of the RFC). RFCs are also available via the Web at -http://www.ietf.org/rfc/ +http://www.ietf.org/rfc/ .

-
+

-Standards

+Standards

diff --git a/doc/arm/Bv9ARM.css b/doc/arm/Bv9ARM.css index 487d04744a..21c7aebe23 100644 --- a/doc/arm/Bv9ARM.css +++ b/doc/arm/Bv9ARM.css @@ -1,22 +1,3 @@ -/* - * Copyright (C) 2000 Internet Software Consortium. - * - * Permission to use, copy, modify, and distribute this software for any - * purpose with or without fee is hereby granted, provided that the above - * copyright notice and this permission notice appear in all copies. - * - * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS - * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES - * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE - * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL - * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR - * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS - * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS - * SOFTWARE. - */ - -/* $Id: Bv9ARM.css,v 1.6 2000/06/29 00:13:47 gson Exp $ */ - A:link { color: blue; text-decoration: underline; diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html index 925153244c..553fc20f81 100644 --- a/doc/arm/Bv9ARM.html +++ b/doc/arm/Bv9ARM.html @@ -16,8 +16,9 @@ - SOFTWARE. --> - + + @@ -31,7 +32,7 @@

BIND 9
Administrator Reference Manual


-June, 2000 +

July, 2000

diff --git a/doc/arm/Bv9ARM.txt b/doc/arm/Bv9ARM.txt index 89ec68a66b..884c776151 100644 --- a/doc/arm/Bv9ARM.txt +++ b/doc/arm/Bv9ARM.txt @@ -1,14 +1,12 @@ -Copyright (C) 2000 Internet Software Consortium. -See COPYRIGHT in the source root or http://www.isc.org/copyright for terms. - -$Id: Bv9ARM.txt,v 1.5 2000/06/29 00:13:49 gson Exp $ - BIND 9 Administrator Reference Manual -June 2000 +July 2000 Copyright (c) 2000 Internet Software Consortium -------------------------------------------------------------------- + + BIND 9 ADMINISTRATOR REFERENCE MANUAL + Table of Contents Section 1 : Introduction @@ -45,6 +43,7 @@ Section 3 : Nameserver Configuration 3.4.1 Tools for Use With the Nameserver Daemon 3.4.1.1 Diagnostic Tools 3.4.1.2 Administrative Tools +3.4.2 Signals Section 4 : Advanced Concepts @@ -144,7 +143,7 @@ Section 6 : BIND 9 Configuration Reference 6.3.5.2 The $INCLUDE Directive 6.3.5.3 The $TTL Directive 6.3.6 BIND Master File Extension: the $GENERATE Directive -6.3.7 Signals 69 +6.3.7 Signals 69 Section 7 : BIND 9 Security Considerations @@ -216,7 +215,7 @@ In this document, Section 1 introduces the basic DNS and BIND concepts. Section 2 describes resource requirements for running BIND in various environments. Information in Section 3 is task-oriented in its presentation and is organized functionally, to aid in the process of installing the -BIND 9 software. The task-oriented section is followed by Section 4 , which +BIND 9 software. The task-oriented section is followed by Section 4, which contains more advanced concepts that the system administrator may need for implementing certain options. Section 5 describes the BIND 9 lightweight resolver. The contents of Section 6 are organized as in a reference manual @@ -262,7 +261,7 @@ nameserver (or "daemon") called named and a resolver library. The BIND server runs in the background, servicing queries on a well known network port. The standard port for the User Datagram Protocol (UDP) and Transmission Control Protocol (TCP), usually port 53, is specified in -/etc/services . The resolver is a set of routines residing in a system +/etc/services. The resolver is a set of routines residing in a system library that provides the interface that programs can use to access the domain name services. @@ -280,7 +279,7 @@ a label. The name of the domain is the concatenation of all the labels of the domains from the root to the current domain. This is represented in written form as a string of labels listed from right to left and separated by dots. A label need only be unique within its domain. The whole name space -is partitioned into areas called zones , each starting at a domain and +is partitioned into areas called zones, each starting at a domain and extending down to the leaf domains or to domains where other zones start. Zones usually represent administrative boundaries. For example, a domain name for a host at the company Example, Inc. would be: @@ -288,16 +287,15 @@ name for a host at the company Example, Inc. would be: ourhost.example.com where com is the top level domain to which ourhost.example.com belongs, -example is a subdomain of com , and ourhost is the name of the host. +example is a subdomain of com, and ourhost is the name of the host. -The specifications for the domain nameserver are defined in the RFC 1034, -RFC 1035 and RFC 974. These documents can be found in -/usr/src/etc/named/doc in 4.4BSD or are available via File Transfer Protocol -(FTP) from -ftp://www.isi.edu/in-notes/ or via the Web at http://www.ietf.org/rfc/ . -(See Appendix C for complete information on finding and retrieving RFCs.) It -is also recommended that you read the related man pages: named and resolver -. +The specifications for the domain nameserver are defined in the RFC +1034, RFC 1035 and RFC 974. These documents can be found in +/usr/src/etc/named/doc in 4.4BSD or are available via File Transfer +Protocol (FTP) from ftp://www.isi.edu/in-notes/ or via the Web at +http://www.ietf.org/rfc/. (See Appendix C for complete information +on finding and retrieving RFCs.) It is also recommended that you read +the related man pages: named and resolver. 1.4.2 Types of Zones @@ -310,15 +308,15 @@ or more NS records in the parent zone, which should be matched by equivalent NS records at the root of the delegated zone. To properly operate a nameserver, it is important to understand the -difference between a zone and a domain . +difference between a zone and a domain. For instance, consider the example.com domain which includes names such as host.aaa.example.com and host.bbb.example.com even though the example.com zone includes only delegations for the aaa.example.com and bbb.example.com zones. A zone can map exactly to a single domain, but could also include only part of a domain, the rest of which could be delegated to other -nameservers. Every name in the DNS tree is a domain , even if it is terminal -, that is, has no subdomains . Every subdomain is a domain and every domain +nameservers. Every name in the DNS tree is a domain, even if it is terminal +, that is, has no subdomains. Every subdomain is a domain and every domain except the root is also a subdomain. The terminology is not intuitive and we suggest that you read RFCs 1033, 1034 and 1035 to gain a complete understanding of this difficult and subtle topic. @@ -326,22 +324,22 @@ understanding of this difficult and subtle topic. Though BIND is a Domain Nameserver, it deals primarily in terms of zones. The master and slave declarations in the named.conf file specify zones, not domains. When you ask some other site if it is willing to be a slave server -for your domain , you are actually asking for slave service for some +for your domain, you are actually asking for slave service for some collection of zones. -Each zone will have one primary master (also called primary ) server which +Each zone will have one primary master (also called primary) server which loads the zone contents from some local file edited by humans or perhaps generated mechanically from some other local file which is edited by humans. There there will be some number of slave (also called secondary) servers, which load the zone contents using the DNS protocol (that is, the secondary servers will contact the primary and fetch the zone data using TCP). This set of servers--the primary and all of its secondaries--should be listed in -the NS records in the parent zone and will constitute a delegation . This +the NS records in the parent zone and will constitute a delegation. This set of servers must also be listed in the zone file itself, usually under the @ name which indicates the top level or root of the current zone. You can list servers in the zone's top-level @ NS records that are not in the parent's NS delegation, but you cannot list servers in the parent's -delegation that are not present in the zone's @ . +delegation that are not present in the zone's @. Any servers listed in the NS records must be configured as authoritative for the zone. A server is authoritative for a zone when it has been configured @@ -363,8 +361,8 @@ the AA bit. A DNS server can be master for some zones and slave for others or can be only a master, or only a slave, or can serve no zones and just answer -queries via its cache . Master servers are often also called primaries and -slave servers are often also called secondaries . Both master/primary and +queries via its cache. Master servers are often also called primaries and +slave servers are often also called secondaries. Both master/primary and slave/secondary servers are authoritative for a zone. All servers keep data in their cache until the data expires, based on a Time @@ -379,7 +377,7 @@ master server obtains data for the zone from a file on disk. 1.4.3.2 Slave Server -A slave server , also called a secondary server , is an authoritative server +A slave server, also called a secondary server, is an authoritative server that uses zone transfers from the primary master server to retrieve the zone data. Optionally, the slave server obtains zone data from a cache on disk. Slave servers provide necessary redundancy. All secondary/slave servers are @@ -387,7 +385,7 @@ named in the NS RRs for the zone. 1.4.3.3 Caching Only Server -Some servers are caching only servers . This means that the server caches +Some servers are caching only servers. This means that the server caches the information that it receives and uses it until the data expires. A caching only server is a server that is not authoritative for any zone. This server services queries and asks other servers, who have the authority, for @@ -398,7 +396,7 @@ the information it needs. Instead of interacting with the nameservers for the root and other domains, a forwarding server always forwards queries it cannot satisfy from its authoritative data or cache to a fixed list of other servers. The forwarded -queries are also known as recursive queries , the same type as a client +queries are also known as recursive queries, the same type as a client would send to a server. There may be one or more servers forwarded to, and they are queried in turn until the list is exhausted or an answer is found. A forwarding server is typically used when you do not wish all the servers @@ -594,8 +592,8 @@ master server, the slave will check to see that its version of the zone is the current version and, if not, initiate a transfer. DNS Notify is fully documented in RFC 1996. See also the description of the -zone option also-notify under Zone Transfers . More information about notify -can be found under Boolean Options . +zone option also-notify under Zone Transfers. More information about notify +can be found under Boolean Options. 3.4 Nameserver Operations @@ -609,7 +607,7 @@ the nameserver daemon. We describe several in this section dig -The domain information groper ( dig ) is a command line tool that can be +The domain information groper ( dig) is a command line tool that can be used to gather information from the Domain Name System servers. Dig has two modes: simple interactive mode for a single query, and batch mode which executes a query for each in a list of several query lines. All query @@ -639,6 +637,9 @@ Usage host [-aCdlrTwv] [-c class] [-N ndots] [-t type] [-W timeout] [-R retries] hostname [server] +For more information and a list of available commands and options, see the +host man page. + nslookup nslookup is a program used to query Internet domain nameservers. nslookup @@ -672,7 +673,7 @@ For more information and a list of available commands and options, see the nslookup man page. Due to its arcane user interface and frequently inconsistent behavior, we do -not recommend the use of nslookup , and it is not installed by default when +not recommend the use of nslookup, and it is not installed by default when installing BIND 9. Use dig instead. 3.4.1.2 Administrative Tools @@ -681,16 +682,106 @@ Administrative tools play an integral part in the management of a server. rndc -The remote name daemon control ( rndc ) program is a program that allows the -system administrator to control the operation of a nameserver. If you run -rndc without any options it will display a usage message. +The remote name daemon control (rndc) program allows the system +administrator to control the operation of a nameserver. If you run +rndc without any options it will display a usage message as follows: -Usage: +Usage: rndc [-c config] [-s server] [-p port] [-y key] command [command ...] -rndc [-p port] [-m] server command [command ...] + command is one of the following for named: + + *status Display ps(1) status of named. + *dumpdb Dump database and cache to /var/tmp/named_dump.db. + reload Reload configuration file and zones. + *stats Dump statistics to /var/tmp/named.stats. + *trace Increment debugging level by one. + *notrace Set debugging level to 0. + *querylog Toggle query logging. + *stop Stop the server. + *restart Restart the server. + + * == not yet implemented + +As noted above, "reload" is the only command available for BIND 9.0.0. +The other commands, and more, are planned to be implemented for future +releases. + +A configuration file is required, since all communication with the +server is authenticated with digital signatures that rely on a shared +secret, and there is no way to provide that secret other than with a +configuration file. The default location for the rndc configuration +file is /etc/rndc.conf, but an alternate location can be specified +with the "-c" option. + +The format of the configuration file is similar to that of named.conf, but +limited to only three statements, the options{}, key{} and server{} +statements. These statements are what associate the secret keys to the +servers with which they are meant to be shared. The order of statements is not +significant. + +The options{} statement has two clauses: default-server and +default-key. default-server takes a host name or address argument and +represents the server that will be contacted if no "-s" option is +provided on the command line. default-key takes the name of the key +as its argument, as defined by a key{} statement. In the future a +default-port clause will be added to specify the port to which rndc +should connect. + +The key{} statement names a key with its string argument. The string is +required by the server to be a valid domain name, though it need not +actually be hierarchical; thus, a string like "rndc_key" is a valid name. +The key{} statement has two clauses: algorithm and secret. While the +configuration parser will accept any string as the argument to algorithm, +currently only the string "hmac-md5" has any meaning. The secret is a +base-64 encoded string, typically generated with either dnssec-keygen or +mmencode. The parser will happily accept an invalid base-64 string, but it +will never work with the server because the server validates the +base-64 of the secret for itself when loading its own configuration file. + +The server{} statement uses the key clause to associate a key{}-defined key +with a server. The argument to the server{} statement is a host name or +address (addresses must be double quoted). The argument to the key clause +is the name of key as defined by the key{} statement. A port clause will +be added to a future release to specify the port to which rndc should +connect on the given server. + +A sample minimal configuration file is as follows: + +key rndc_key { + algorithm "hmac-md5"; + secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K"; +}; + +options { + default-server localhost; + default-key rndc_key; +}; + +This file, if installed as /etc/rndc.conf, would allow the command: + +$ rndc reload + +to connect to 127.0.0.1 port 953 and cause the nameserver to reload, +if a nameserver on the local machine were running with following controls +statements: + +controls { + inet 127.0.0.1 allow { localhost; } keys { rndc_key; }; +}; + +and it had an identical key statement for rndc_key. + + +3.4.2 Signals + +Certain UNIX signals cause the name server to take specific actions, as +described in the following table. These signals can be sent using the kill +command. + + SIGHUP Causes the server to read named.conf and reload the database. + SIGTERM Causes the server to clean up and exit. + SIGINT Causes the server to clean up and exit. -For more information and a list of available commands and options, see the -rndc man page. ------------------------------------------------------------------------ @@ -718,7 +809,7 @@ The zone files of dynamic zones must not be edited by hand. The zone file on disk at any given time may not contain the latest changes performed by dynamic update. The zone file is written to disk only periodically, and changes that have occurred since the zone file was last written to disk are -stored only in the zone's journal ( .jnl ) file. BIND 9 currently does not +stored only in the zone's journal ( .jnl) file. BIND 9 currently does not update the zone file when it exits as BIND 8 does, so editing the zone file manually is unsafe even when the server has been shut down. @@ -727,7 +818,7 @@ manually is unsafe even when the server has been shut down. The incremental zone transfer (IXFR) protocol is a way for slave servers to transfer only changed data, instead of having to transfer the entire zone. The IXFR protocol is documented in RFC 1995. See the list of proposed -standards in Appendix C . +standards in Appendix C. When acting as a master, BIND 9 supports IXFR for those zones where the necessary change history information is available. These include master @@ -774,23 +865,23 @@ space) and the other set will be on bastion hosts, which are "proxy" hosts that can talk to both sides of its network, in the DMZ. The internal servers will be configured to forward all queries, except -queries for site1.internal , site2.internal , site1.example.com , and -site2.example.com , to the servers in the DMZ. These internal servers will -have complete sets of information for site1.example.com , site2.example.com -, site1.internal , and site2.internal . +queries for site1.internal, site2.internal, site1.example.com, and +site2.example.com, to the servers in the DMZ. These internal servers +will have complete sets of information for site1.example.com, +site2.example.com, site1.internal, and site2.internal. -To protect the site1.interna l and site2.internal domains, the internal -nameservers must be configured to disallow all queries to these domains from -any external hosts, including the bastion hosts. +To protect the site1.internal and site2.internal domains, the internal +nameservers must be configured to disallow all queries to these +domains from any external hosts, including the bastion hosts. -The external servers, which are on the bastion hosts, will be configured to -serve the "public" version of the site1 and site2.example.com zones. This -could include things such as the host records for public servers ( -www.example.com and ftp.example.com ), and mail exchange (MX) records ( -a.mx.example.com and b.mx.example.com ). +The external servers, which are on the bastion hosts, will be +configured to serve the "public" version of the site1 and +site2.example.com zones. This could include things such as the host +records for public servers (www.example.com and ftp.example.com), and +mail exchange (MX) records (a.mx.example.com and b.mx.example.com). In addition, the public site1 and site2.example.com zones should have -special MX records that contain wildcard (`*') records pointing to the +special MX records that contain wildcard ('*') records pointing to the bastion hosts. This is needed because external mail servers do not have any other way of looking up how to deliver mail to those internal hosts. With the wildcard records, the mail will be delivered to the bastion host, which @@ -814,7 +905,7 @@ In order for all this to work properly, internal clients will need to be configured to query only the internal nameservers for DNS queries. This could also be enforced via selective filtering on the network. -If everything has been set properly, Example, Inc. 's internal clients will +If everything has been set properly, Example, Inc.'s internal clients will now be able to: * Look up any hostnames in the site1 and site2.example.com zones. @@ -829,7 +920,7 @@ Hosts on the Internet will be able to: Here is an example configuration for the setup we just described above. Note that this is only configuration information; for information on how to -configure your zone files, see the Sample Configurations . +configure your zone files, see the Sample Configurations. Internal DNS server config: @@ -890,9 +981,9 @@ bastion-ips-go-here; }; options { ... ... - allow-transfer { none; }; // sample allow-transfer (no one) - allow-query { internals; externals; }; // restrict query access - allow-recursion { internals; externals; }; // restrict recursion + allow-transfer { none; }; // sample allow-transfer (no one) + allow-query { internals; externals; }; // restrict query access + allow-recursion { internals; externals; }; // restrict recursion ... ... }; @@ -931,16 +1022,16 @@ BIND primarily supports TSIG for server to server communication. This includes zone transfer, notify, and recursive query messages. Resolvers based on newer versions of BIND 8 have limited support for TSIG. -TSIG might be most useful for dynamic update. A primary server for a dynamic -zone should use access control to control updates, but IP-based access -control is insufficient. Key-based access control is far superior. See RFC -2845 in the Proposed Standards section of the Appendix. The nsupdate program -that is shipped with BIND 8 supports TSIG via the " -k " command line -option. +TSIG might be most useful for dynamic update. A primary server for a +dynamic zone should use access control to control updates, but +IP-based access control is insufficient. Key-based access control is +far superior. See RFC 2845 in the Proposed Standards section of the +Appendix. The nsupdate program supports TSIG via the " -k " and "-y" +command line options. 4.4.1 Generate Shared Keys for Each Pair of Hosts -A shared secret is generated to be shared between host1 and host2 . An +A shared secret is generated to be shared between host1 and host2. An arbitrary key name is chosen: "host1-host2.". The key name must be the same on both hosts. @@ -953,7 +1044,7 @@ will be digested with MD5 to produce a 128 bit key. dnssec-keygen -a hmac-md5 -b 128 -n HOST host1-host2. -The key is in the file Khost1-host2.+157+00000.private . Nothing directly +The key is in the file Khost1-host2.+157+00000.private. Nothing directly uses this file, but the base-64 encoded string following " Key :" can be extracted from the file and used as a shared secret: @@ -989,7 +1080,7 @@ key host1-host2. { The algorithm, hmac-md5, is the only one supported by BIND. The secret is the one generated above. Since this is a secret, it is recommended that either named.conf be non-world readable, or the key directive be added to a -non-world readable file that is included by named.conf . +non-world readable file that is included by named.conf. At this point, the key is recognized. This means that if the server receives a message signed by this key, it can verify the signature. If the signature @@ -997,9 +1088,9 @@ succeeds, the response is signed by the same key. 4.4.4 Instructing the Server to Use the Key -Since keys are shared between two hosts only, the server must be told when -keys are to be used. The following is added to the named.conf file for host1 -, if the IP address of host2 is 10.1.2.3: +Since keys are shared between two hosts only, the server must be told +when keys are to be used. The following is added to the named.conf +file for host1, if the IP address of host2 is 10.1.2.3: server 10.1.2.3 { keys { host1-host2. ;}; @@ -1012,8 +1103,8 @@ If host1 sends a message that is a response to that address, the message will be signed with the specified key. host1 will expect any responses to signed messages to be signed with the same key. -A similar statement must be present in host2 's configuration file (with -host1 's address) for host2 to sign non-response messages to host1 . +A similar statement must be present in host2's configuration file (with +host1's address) for host2 to sign non-response messages to host1. 4.4.5 TSIG Key Based Access Control @@ -1029,7 +1120,7 @@ This allows dynamic updates to succeed only if the request was signed by a key named " host1-host2. ". The more powerful update-policy statement is described Dynamic Update -Policies . +Policies. 4.4.6 Errors @@ -1085,7 +1176,7 @@ BIND 9 does not ship with any tools that generate SIG(0) signed messages. 4.7 DNSSEC Cryptographic authentication of DNS information is possible through the DNS -Security ( DNSSEC ) extensions, defined in RFC 2535. This section describes +Security ( DNSSEC) extensions, defined in RFC 2535. This section describes the creation and use of DNSSEC signed zones. In order to set up a DNSSEC secure zone, there are a series of steps which @@ -1109,7 +1200,7 @@ The dnssec-keygen program is used to generate keys. A secure zone must contain one or more zone keys. The zone keys will sign all other records in the zone, as well as the zone keys of any secure delegated zones. Zone keys must have the same name as the zone, a name type -of ZONE , and must be usable for authentication. It is recommended that zone +of ZONE, and must be usable for authentication. It is recommended that zone keys be mandatory to implement a cryptographic algorithm; currently the only key mandatory to implement an algorithm is DSA. @@ -1120,7 +1211,7 @@ dnssec-keygen -a DSA -b 768 -n ZONE child.example. Two output files will be produced: Kchild.example.+003+12345.key and Kchild.example.+003+12345.private (where 12345 is an example of a key -identifier). The key file names contain the key name ( child.example. ), +identifier). The key file names contain the key name ( child.example.), algorithm (3 is DSA, 1 is RSA, etc.), and the key identifier (12345 in this case). The private key (in the .private file) is used to generate signatures, and the public key (in the .key file) is used for signature @@ -1145,17 +1236,17 @@ be included and the TTL of the set must be specified, and the desired signature validity period of the parent's signature may also be specified. The list of keys to be inserted into the key set may also included non-zone -keys present at the apex. dnssec-makekeyset may also be used at non-apex -names. +keys present at the top of the zone. dnssec-makekeyset may also be used at other +names in the zone. The following command generates a key set containing the above key and another key similarly generated, with a TTL of 3600 and a signature validity period of 10 days starting from now. -dnssec-makekeyset -t 3600 -s now -e now+864000 Kchild.example.+003+12345 +dnssec-makekeyset -t 3600 -e +864000 Kchild.example.+003+12345 Kchild.example.+003+23456 -One output file is produced: child.example.keyset . This file should be +One output file is produced: child.example.keyset. This file should be transmitted to the parent to be signed. It includes the keys, as well as signatures over the key set generated by the zone keys themselves, which are used to prove ownership of the private keys and encode the desired validity @@ -1166,7 +1257,7 @@ period. The dnssec-signkey program is used to sign one child's keyset. If the child.example zone has any delegations which are secure, for example, -grand.child.example , the child.example administrator should receive keyset +grand.child.example, the child.example administrator should receive keyset files for each secure subzone. These keys must be signed by this zone's zone keys. @@ -1175,7 +1266,7 @@ The following command signs the child's key set with the zone keys: dnssec-signkey grand.child.example.keyset Kchild.example.+003+12345 Kchild.example.+003+23456 -One output file is produced: grand.child.example.signedkey . This file +One output file is produced: grand.child.example.signedkey. This file should be both transmitted back to the child and retained. It includes all keys (the child's keys) from the keyset file and signatures generated by this zone's zone keys. @@ -1191,12 +1282,12 @@ well as incorporate the zone key signature from the parent and indicate the security status at all delegation points. The following command signs the zone, assuming it is in a file called -zone.child.example . By default, all zone keys which have an available +zone.child.example. By default, all zone keys which have an available private key are used to generate signatures. dnssec-signzone -o child.example zone.child.example -One output file is produced: zone.child.example.signed . This file should be +One output file is produced: zone.child.example.signed. This file should be referenced by named.conf as the input file for the zone. 4.7.5 Configuring Servers @@ -1270,12 +1361,12 @@ host 1h IN A6 64 0:0:0:0:42::1 company.example2.net. ISP1 will use: $ORIGIN example1.net. -company 1h IN A6 0 3ffe:8050:201:1860:: +company 1h IN A6 0 3ffe:8050:201:1860:: ISP2 will use: $ORIGIN example2.net. -company 1h IN A6 0 1234:5678:90ab:fffa:: +company 1h IN A6 0 1234:5678:90ab:fffa:: When host.example.com is looked up, the resolver (in the resolver daemon or caching name server) will find two partial A6 records, and will use the @@ -1305,50 +1396,64 @@ supported for backwards compatiblity with existing IPv6 applications. When looking up an address in nibble format, the address components are simply reversed, just as in IPv4, and ip6.int. is appended to the resulting name. For example, the following would provide reverse name lookup for a -host with address 3ffe:8050:201:1860:42::1 . +host with address 3ffe:8050:201:1860:42::1. $ORIGIN 0.6.8.1.1.0.2.0.0.5.0.8.e.f.f.3.ip6.int. -1.0.0.0.0.0.0.0.0.0.0.0.2.4.0.0 4h IN PTR host.example.com. +1.0.0.0.0.0.0.0.0.0.0.0.2.4.0.0 4h IN PTR host.example.com. 4.8.4 Address to Name Lookups Using Bitstring Format Bitstring labels can start and end on any bit boundary, rather than on a multiple of 4 bits as in the nibble format. They also use ip6.arpa rather -than ip6.int . +than ip6.int. To replicate the previous example using bitstrings: $ORIGIN \[x3ffe805002011860/64].ip6.arpa. -\[x0042000000000001/64] 4h IN PTR host.example.com. +\[x0042000000000001/64] 4h IN PTR host.example.com. 4.8.5 Using DNAME for Delegation of IPv6 Reverse Addresses -Delegation of reverse addresses is done through the new DNAME RR. In the -example above, where \[x2/3].ip6.int. needs to delegate \[xFFF0] to an -organization ( example2.com ), the domain administrator would insert a line -similar to the following in the \[x2/3].ip6.int. zone: +In IPV6, the same host may have many addresses from many network +providers. Since the trailing portion of the address usually +remains constant, DNAME can help reduce the number of zone files used +for reverse mapping that need to be maintained. -$ORIGIN \[x2/3].ip6.int. -\[xFFF0/13] 1h IN DNAME ip6.example2.com. +For example, consider a host which has two providers (example.net and +example2.net) and therefore two IPv6 addresses. Since the host chooses +its own 64 bit host address portion, the provider address is the only +part that changes: -example2.com would then place into the ip6 zone: +$ORIGIN example.com. +host A6 64 ::1234:5678:1212:5675 cust1.example.net. + A6 64 ::1234:5678:1212:5675 subnet5.example2.net. -$ORIGIN ip6.example.com. -\[x80500201/32] 1h IN DNAME ip6.example.com. +$ORIGIN example.net. +cust1 A6 48 0:0:0:dddd:: ipv6net.example.net. +ipv6net A6 0 aa:bb:cccc:: -Finally, example.com needs to include in the ip6.example.com zone: +$ORIGIN example2.net. +subnet5 A6 48 0:0:0:1:: ipv6net2.example2.net. +ipv6net2 A6 0 6666:5555:4:: -$ORIGIN ip6.example.com. -\[x00090A0020FFFE812B32/80] 1h IN PTR host.example.com. -We suggest that the top of your administrative control ( example.com , in -this case) provide all the bits required for reverse and forward resolution -to allow name resolution even if the network is disconnected from the -Internet. This will also allow operation with DNSSEC if you set up a false -trusted server for "." containing only delegations for your forward and -reverse zones directly to the top of your administrative control. This -should be signed with a key trusted by all of your clients, equivalent to -the real key for ".". +This sets up forward lookups. To handle the reverse lookups, the +provider example.net would have: + +$ORIGIN \[x00aa00bbcccc/48].ip6.arpa. +\[xdddd/16] DNAME ipv6-rev.example.com. + +and example2.net would have: + +$ORIGIN \[x666655550004/48].ip6.arpa. +\[x0001/16] DNAME ipv6-rev.example.com. + +example.com needs only one zone file to handle both of these reverse +mappings: + +$ORIGIN ipv6-rev.example.com. +\[x1234567812125675/64] PTR host.example.com. + ------------------------------------------------------------------------ @@ -1373,7 +1478,7 @@ simpler than the full DNS protocol. 5.2 Running a Resolver Daemon To use the lightweight resolver interface, the system must run the resolver -daemon lwresd . +daemon lwresd. Applications using the lightweight resolver library will make UDP requests to the IPv4 loopback address (127.0.0.1) on port 921. The daemon will try to @@ -1381,7 +1486,7 @@ find the answer to the questions "what are the addresses for host foo.example.com ?" and "what are the names for IPv4 address 204.152.184.79?" The daemon currently only looks in the DNS, but in the future it may use -other sources such as /etc/hosts , NIS, etc. +other sources such as /etc/hosts, NIS, etc. The lwresd daemon is essentially a stripped-down, caching-only name server that answers requests using the lightweight resolver protocol rather than @@ -1402,7 +1507,7 @@ implemented using the new features found in BIND 9. BIND 4 configuration files can be converted to the new format using the shell script -contrib/named-bootconf/named-bootconf.sh . +contrib/named-bootconf/named-bootconf.sh. 6.1 Configuration File Elements @@ -1414,62 +1519,67 @@ documentation: acl_name The name of an address_match_list as defined by the acl statement. - address_match_list A list of one or more ip_addr , ip_prefix , key_id , or - acl_name elements, as described in Address Match Lists - . + address_match_list A list of one or more ip_addr, ip_prefix, key_id, or + acl_name elements, as described in Address Match Lists. + domain_name A quoted string which will be used as a DNS name, for example " my.test.domain ". dotted_decimal One or more integers valued 0 through 255 separated - only by dots (`.'), such as 123 , 45.67 or 89.123.45.67 - . + only by dots ('.'), such as 123, 45.67 or 89.123.45.67. + ip4_addr An IPv4 address with exactly four elements in dotted_decimal notation. ip6_addr - An IPv6 address, such as fe80::200:f8ff:fe01:9742 . + An IPv6 address, such as fe80::200:f8ff:fe01:9742. - ip_addr - An ip4_addr or ip6_addr . + ip_addr An ip4_addr or ip6_addr. - An IP port number . number is limited to 0 through - ip_port 65535, with values below 1024 typically restricted to - root-owned processes. In some cases an asterisk (`*') + ip_port An IP port number. number is limited to 0 through + 65535, with values below 1024 typically restricted to + root-owned processes. In some cases an asterisk ('*') character can be used as a placeholder to select a random high-numbered port. - An IP network specified as an ip_addr , followed by a - ip_prefix slash (`/') and then the number of bits in the netmask. + + An IP network specified as an ip_addr, followed by a + ip_prefix slash ('/') and then the number of bits in the netmask. For example, 127/8 is the network 127.0.0.0 with netmask 255.0.0.0 and 1.2.3.0/28 is network 1.2.3.0 - with netmask 255.255.255.240 . - key_name A domain_name representing the name of a shared key, to + with netmask 255.255.255.240. + + key_id A domain_name representing the name of a shared key, to be used for transaction security. - A non-negative integer with an entire range limited by - number the range of a C language signed integer (2,147,483,647 + + key_list A list of one or more key_ids, separated by semicolons + and ending with a semicolon. + + number A non-negative integer with an entire range limited by + the range of a C language signed integer (2,147,483,647 on a machine with 32 bit integers). Its acceptable value might further be limited by the context in which it is used. - path_name A quoted string which will be used as a pathname, such - as " zones/master/my.test.domain " . - A number, the word unlimited , or the word default . + path_name A quoted string which will be used as a pathname, such + as " zones/master/my.test.domain ". + + size_spec A number, the word unlimited, or the word default. The maximum value of size_spec is that of unsigned long integers on the machine. An unlimited size_spec requests unlimited use, or the maximum available amount. A default size_spec uses the limit that was in force when the server was started. - - size_spec A number can optionally be followed by a scaling + A number can optionally be followed by a scaling factor: K or k for kilobytes, M or m for megabytes, and G or g for gigabytes, which scale by 1024, 1024*1024, and 1024*1024*1024 respectively. - Integer storage overflow is currently silently ignored during conversion of scaled values, resulting in values less than intended, possibly even negative. Using unlimited is the best way to safely set a really large number. - yes_or_no Either yes or no . The words true and false are also - accepted, as are the numbers 1 and 0 . + + yes_or_no Either yes or no. The words true and false are also + accepted, as are the numbers 1 and 0. 6.1.1 Address Match Lists @@ -1495,7 +1605,7 @@ be any of the following: statement * a nested address match list enclosed in braces -Elements can be negated with a leading exclamation mark (`!') and the match +Elements can be negated with a leading exclamation mark ('!') and the match list names "any," "none," "localhost" and "localnets" are predefined. More information on those names can be found in the description of the acl statement. @@ -1512,7 +1622,7 @@ listen-on ports, or as a topology, and whether the element was negated. When used as an access control list, a non-negated match allows access and a negated match denies access. If there is no match, access is denied. The -clauses allow-query , allow-transfer , allow-update and blackhole all use +clauses allow-query, allow-transfer, allow-update and blackhole all use address match lists this. Similarly, the listen-on option will cause the server to not accept queries on any of the machine's addresses which do not match the list. @@ -1583,7 +1693,7 @@ For example: # is a new comment, even though it is logically # part of the previous comment. -WARNING: you cannot use the semicolon (`;') character to start a comment +WARNING: you cannot use the semicolon (';') character to start a comment such as you would in a zone file. The semicolon indicates the end of a configuration statement. @@ -1596,11 +1706,11 @@ substatements, which are also terminated with a semicolon. The following statements are supported: - - acl defines a named IP address matching list, for access control and other uses. + controls declares control channels to be used by the rndc utility. + include includes a file. key specifies key information for use in authentication and @@ -1611,9 +1721,13 @@ The following statements are supported: options controls global server configuration options and sets defaults for other statements. + server sets certain configuration options on a per-server basis. + trusted-keys defines trusted DNSSEC keys. + view defines a view. + zone defines a zone. The logging and options statements may only occur once per configuration. @@ -1635,8 +1749,6 @@ can be used elsewhere; no forward references are allowed. The following ACLs are built-in: - - any Matches all hosts. none Matches no hosts. localhost Matches the IP addresses of all interfaces on the system. @@ -1648,36 +1760,41 @@ The following ACLs are built-in: controls { [ inet (ip_addr|*) port ip_port allow { address_match_list } ; - [ inet...;[...]]] - [ unix string permission number owner number group number ; - [ unix...;[..]]] + keys { key_list }; + [ inet...; ] }; 6.2.4 controls Statement Definition and Usage The controls statement declares control channels to be used by system administrators to affect the operation of the local nameserver. These -control channels are used by the ndc utility to send commands to and +control channels are used by the rndc utility to send commands to and retrieve non-DNS results from a nameserver. -A UNIX control channel is a "first in first out" (FIFO) named pipe in the -file system, and access to it is controlled by normal file system -permissions. It is created by named with the specified file mode bits (see -the chmod(1) manual page), user and group owner. Note that, unlike chmod , -the mode bits specified for permission will normally have a leading 0 so the -number is interpreted as octal. Also note that the user and group ownership -specified as owner and group must be given as numbers, not names. It is -recommended that the permissions be restricted to administrative personnel -only to prevent random users on the system from having the ability to manage -the local nameserver. - An inet control channel is a TCP/IP socket accessible to the Internet, -created at the specified ip_port on the specified ip_addr . It is -recommended that 127.0.0.1 be the only ip_addr used, and this only if you -trust all non-privileged users on the local host to manage your nameserver. +created at the specified ip_port on the specified ip_addr. If no port +is specified, port 953 is used by default. "*" cannot be used for +ip_port. -The controls statement is not yet implemented in BIND 9. The server always -listens for control connections on IP address 127.0.0.1, port 953. +The ability to issue commands over the control channel is restricted +by the allow and keys clauses. Connections to the control channel are +permitted based on the address permissions in address_match_list. +key_id members of the address_match_list are ignored, and instead are +interpreted independently based the key_list. Each key_id in the +key_list is allowed to be used to authenticate commands and responses +given over the control channel by digitally signing each message +between the server and a command client (see rndc in section 3.4.1.2). +All commands to the control channel must be signed by one of its +specified keys to be honored. + +For the initial release of BIND 9.0.0, only one command is possible +over the command channel, the command to reload the server. We will +expand command set in future releases. + +The UNIX control channel type of BIND 8 is not supported in BIND +9.0.0, and is not expected to be added in future releases. If it is +present in the controls statement from a BIND 8 configuration file, a +non-fatal warning will be logged. 6.2.5 include Statement Grammar @@ -1700,9 +1817,9 @@ secret string; 6.2.8 key Statement Definition and Usage -The key statement defines a shared secret key for use with TSIG. See TSIG . +The key statement defines a shared secret key for use with TSIG. See TSIG. -The key_id , also known as the key name, is a domain name uniquely +The key_id, also known as the key name, is a domain name uniquely identifying the key. It can be used in a "server" statement to cause requests sent to that server to be signed with this key, or in address match lists to verify that incoming requests have been signed with a key matching @@ -1710,7 +1827,7 @@ this name, algorithm, and secret. The algorithm_id is a string that specifies a security/authentication algorithm. The only algorithm currently supported with TSIG authentication -is hmac-md5 . The secret_string is the secret to be used by the algorithm, +is hmac-md5. The secret_string is the secret to be used by the algorithm, and is treated as a base-64 encoded string. 6.2.9 logging Statement Grammar @@ -1763,7 +1880,7 @@ as you want. Every channel definition must include a clause that says whether messages selected for the channel go to a file, to a particular syslog facility, or are discarded. It can optionally also limit the message severity level that -will be accepted by the channel (the default is info ), and whether to +will be accepted by the channel (the default is info), and whether to include a named -generated time stamp, the category name and/or severity level (the default is not to include any). @@ -1783,8 +1900,8 @@ trigger a reopen. The default behavior is not to limit the size of the file. If you use the version log file option, then named will retain that many backup versions of the file by renaming them when opening. For example, if you choose to keep 3 old versions of the file lamers.log then just before it -is opened lamers.log.1 is renamed to lamers.log.2 , lamers.log.0 is renamed -to lamers.log.1 , and lamers.log is renamed to lamers.log.0 . No rolled +is opened lamers.log.1 is renamed to lamers.log.2, lamers.log.0 is renamed +to lamers.log.1, and lamers.log is renamed to lamers.log.0. No rolled versions are kept by default; any existing log file is simply appended. The unlimited keyword is synonymous with 99 in current BIND releases. @@ -1802,13 +1919,13 @@ described in the syslog.conf man page. If you have a system which uses a very old version of syslog that only uses two arguments to the openlog() function, then this clause is silently ignored. -The severity clause works like syslog 's "priorities," except that they can -also be used if you are writing straight to a file rather than using syslog -. Messages which are not at least of the severity level given will not be -selected for the channel; messages of higher severity levels will be -accepted. +The severity clause works like syslog's "priorities," except that they +can also be used if you are writing straight to a file rather than +using syslog. Messages which are not at least of the severity level +given will not be selected for the channel; messages of higher +severity levels will be accepted. -If you are using syslog , then the syslog.conf priorities will also +If you are using syslog, then the syslog.conf priorities will also determine what eventually passes through. For example, defining a channel facility and severity as daemon and debug but only logging daemon.warning via syslog.conf will cause messages of severity info and notice to be @@ -1817,14 +1934,15 @@ warning or higher, then syslogd would print all messages it received from the channel. The server can supply extensive debugging information when it is in -debugging mode. If the server's global debug level is greater than zero, -then debugging mode will be active. The global debug level is set either by -starting the named server with the " -d " flag followed by a positive -integer, or by running rndc trace ( the latter method is not yet implemented -). The global debug level can be set to zero, and debugging mode turned off, -by running ndc notrace . All debugging messages in the server have a debug -level, and higher debug levels give more detailed output. Channels that -specify a specific debug severity, for example: +debugging mode. If the server's global debug level is greater than +zero, then debugging mode will be active. The global debug level is +set either by starting the named server with the " -d " flag followed +by a positive integer, or by running rndc trace (the latter method is +not yet implemented). The global debug level can be set to zero, and +debugging mode turned off, by running ndc notrace. All debugging +messages in the server have a debug level, and higher debug levels +give more detailed output. Channels that specify a specific debug +severity, for example: channel "specific_debug_level" { file "foo"; @@ -1843,12 +1961,12 @@ then the category of the message will be logged as well. Finally, if print-severity is on, then the severity level of the message will be logged. The print- options may be used in any combination, and will always be printed in the following order: time, category, severity. Here is an example -where all three print- options are on: +where all three print-options are on: 28-Feb-2000 15:05:32.863 general: notice: running -There are four predefined channels that are used for named 's default -logging as follows. How they are used is described in the category Phrase . +There are four predefined channels that are used for named's default +logging as follows. How they are used is described in the category Phrase. channel "default_syslog" { syslog daemon; // end to syslog's daemon @@ -1881,16 +1999,16 @@ logging as follows. How they are used is described in the category Phrase . }; The default_debug channel normally writes to a file named.run in the -server's working directory. For security reasons, when the " -u " command -line option is used, the named.run file is created only after named has -changed to the new UID, and any debug output generated while named is -starting up and still running as root is discarded. If you need to capture -this output, you must run the server with the " -g " option and redirect -standard error to a file. +server's working directory. For security reasons, when the "-u" +command line option is used, the named.run file is created only after +named has changed to the new UID, and any debug output generated while +named is starting up and still running as root is discarded. If you +need to capture this output, you must run the server with the "-g" +option and redirect standard error to a file. -Once a channel is defined, it cannot be redefined. Thus you cannot alter the -built-in channels directly, but you can modify the default logging by -pointing categories at channels you have defined. +Once a channel is defined, it cannot be redefined. Thus you cannot +alter the built-in channels directly, but you can modify the default +logging by pointing categories at channels you have defined. 6.2.10.2 The category Phrase @@ -1921,7 +2039,7 @@ category "xfer-out" { "null"; }; category "notify" { "null"; }; Following are the available categories and brief descriptions of the types -of log information they contain . More categories may be added in future +of log information they contain. More categories may be added in future BIND releases. default The default category defines the logging options for those @@ -1932,16 +2050,24 @@ BIND releases. database Messages relating to the databases used internally by the name server to store zone and cache data. + security Approval and denial of requests. + config Configuration file parsing and processing. resolver DNS resolution, such as the recursive lookups performed on behalf of clients by a caching name server. + xfer-in Zone transfers the server is receiving. + xfer-out Zone transfers the server is sending. + notify The NOTIFY protocol. + client Processing of client requests. + network Network operations. + update Dynamic updates. 6.2.11 options Statement Grammar @@ -1995,10 +2121,19 @@ options { [ transfer-source ip4_addr; ] [ transfer-source-v6 ip6_addr; ] [ also-notify { ip_addr; [ ip_addr; ... ] }; ] - [ max-ixfr-log-size number; ] [ coresize size_spec ; ] [ datasize size_spec ; ] [ files size_spec ; ] [ stacksize size_spec ; ] [ cleaning-interval number; ] [ heartbeat-interval number; ] [ interface-interval number; ] [ statistics-interval number; ] + [ max-ixfr-log-size number; ] + [ coresize size_spec ; ] + [ datasize size_spec ; ] + [ files size_spec ; ] + [ stacksize size_spec ; ] + [ cleaning-interval number; ] + [ heartbeat-interval number; ] + [ interface-interval number; ] + [ statistics-interval number; ] [ topology { address_match_list }; ] [ sortlist { address_match_list }; ] - [ rrset-order { order_spec ; [ order_spec ; ... ] ] }; [ lame-ttl number; ] [ max-ncache-ttl number; ] + [ rrset-order { order_spec ; [ order_spec ; ... ] ] }; + [ lame-ttl number; ] [ max-ncache-ttl number; ] [ max-cache-ttl number; ] [ sig-validity-interval number ; ] [ min-roots number; ] @@ -2014,63 +2149,73 @@ occurrence is found, the first occurrence determines the actual options used, and a warning will be generated. If there is no options statement, an options block with each option set to its default will be used. - The version the server should report via a query of - version name version.bind in class chaos . The default is the + version The version the server should report via a query of + name version.bind in class chaos. The default is the real version number of this server. - The working directory of the server. Any non-absolute + + directory The working directory of the server. Any non-absolute pathnames in the configuration file will be taken as relative to this directory. The default location for - directory most server output files (e.g. named.run ) is this + most server output files (e.g. named.run) is this directory. If a directory is not specified, the working - directory defaults to ` . ', the directory from which + directory defaults to '.', the directory from which the server was started. The directory specified should be an absolute path. - This option is obsolete. It was used in BIND 8 to - named-xfer specify the pathname to the named-xfer program. In + + named-xfer This option is obsolete. It was used in BIND 8 to + specify the pathname to the named-xfer program. In BIND 9, no separate named-xfer program is needed; its functionality is built into the name server. - The domain appended to the names of all shared keys - generated with TKEY . When a client requests a TKEY + + tkey-domain The domain appended to the names of all shared keys + generated with TKEY. When a client requests a TKEY exchange, it may or may not specify the desired name - tkey-domain for the key. If present, the name of the shared key + for the key. If present, the name of the shared key will be " client specified part " + " tkey-domain ". Otherwise, the name of the shared key will be " random hex digits " + " tkey-domain ". In most cases, the domainname should be the server's domain name. - The Diffie-Hellman key used by the server to generate + + tkey-dhkey The Diffie-Hellman key used by the server to generate shared keys with clients using the Diffie-Hellman mode - tkey-dhkey of TKEY . The server must be able to load the public + of TKEY. The server must be able to load the public and private keys from files in the working directory. In most cases, the keyname should be the server's host name. - The pathname of the file the server dumps the database - dump-file to when it receives SIGINT signal ( ndc dumpdb ). If - not specified, the default is named_dump.db . Not yet + + dump-file The pathname of the file the server dumps the database + to when it receives SIGINT signal (ndc dumpdb). If + not specified, the default is named_dump.db. Not yet implemented in BIND 9. - The pathname of the file the server writes memory usage - memstatistics-file statistics to on exit. If not specified, the default is - named.memstats . Not yet implemented in BIND 9. - The pathname of the file the server writes its process + + memstatistics-file The pathname of the file the server writes memory usage + statistics to on exit. If not specified, the default is + named.memstats. Not yet implemented in BIND 9. + + pid-file The pathname of the file the server writes its process ID in. If not specified, the default is operating - pid-file system dependent, but is usually - /var/run/named.pid or /etc/named.pid . The pid-file is + system dependent, but is usually + /var/run/named.pid or /etc/named.pid. The pid-file is used by programs that want to send signals to the running nameserver. - The pathname of the file the server appends statistics - statistics-file to. If not specified, the default is named.stats . Not - yet implemented in BIND 9 . + + statistics-file The pathname of the file the server appends statistics + to. If not specified, the default is named.stats. Not + yet implemented in BIND 9. 6.2.12.1 Boolean Options - If yes , then the AA bit is always set on NXDOMAIN + auth-nxdomain If yes, then the AA bit is always set on NXDOMAIN responses, even if the server is not actually - auth-nxdomain authoritative. The default is no ; this is a change + authoritative. The default is no ; this is a change from BIND 8. If you are using very old DNS software, - you may need to set it to yes . - This option was used in BIND 8 to enable checking for - deallocate-on-exit memory leaks on exit. BIND 9 ignores the option and + you may need to set it to yes. + + deallocate-on-exit This option was used in BIND 8 to enable checking for + memory leaks on exit. BIND 9 ignores the option and always performs the checks. - If yes , then the server treats all zones as if they + + dialup If yes, then the server treats all zones as if they are doing zone transfers across a dial on demand dialup link, which can be brought up by traffic originating from this server. This has different effects according @@ -2078,80 +2223,87 @@ options block with each option set to its default will be used. that it all happens in a short interval, once every heartbeat-interval and hopefully during the one call. It also suppresses some of the normal zone maintenance - traffic. The default is no . - + traffic. The default is no. The dialup option may also be specified in the zone statement, in which case it overrides the options - dialup dialup statement. - + dialup statement. If the zone is a master then the server will send out a NOTIFY request to all the slaves. This will trigger the zone serial number check in the slave (providing it supports NOTIFY) allowing the slave to verify the zone while the connection is active. - If the zone is a slave or stub then the server will suppress the regular "zone up to date" queries and only perform them when the heartbeat-interval expires. Not yet implemented in BIND 9. - In BIND 8, this option was used to enable simulating - fake-iquery the obsolete DNS query type IQUERY. BIND 9 never does + + fake-iquery In BIND 8, this option was used to enable simulating + the obsolete DNS query type IQUERY. BIND 9 never does IQUERY simulation. - (Information present outside of the authoritative nodes + + fetch-glue (Information present outside of the authoritative nodes in the zone is called glue information). If yes (the default), the server will fetch glue resource records it doesn't have when constructing the additional data - fetch-glue section of a response. fetch-glue no can be used in + section of a response. fetch-glue no can be used in conjunction with recursion no to prevent the server's cache from growing or becoming corrupted (at the cost of requiring more work from the client). Not yet implemented in BIND 9. - This option was incorrectly implemented in BIND 8, and - has-old-clients is ignored by BIND 9. To achieve the intended effect of - has-old-clients yes , specify the two separate options + + has-old-clients This option was incorrectly implemented in BIND 8, and + is ignored by BIND 9. To achieve the intended effect of + has-old-clients yes, specify the two separate options auth-nxdomain yes and rfc2308-type1 no instead. - If yes , then statistics are kept for every host that - host-statistics the nameserver interacts with. The default is no . + + host-statistics If yes, then statistics are kept for every host that + the nameserver interacts with. The default is no. Note: turning on host-statistics can consume huge amounts of memory. Not yet implemented in BIND 9. - This option is obsolete . It was used in BIND 8 to + + maintain-ixfr-base This option is obsolete. It was used in BIND 8 to determine whether a transaction log was kept for - maintain-ixfr-base Incremental Zone Transfer. BIND 9 maintains a + Incremental Zone Transfer. BIND 9 maintains a transaction log whenever possible. If you need to disable outgoing incremental zone transfers, use - provide-ixfr no . - This option was used in BIND 8 to allow a domain name + provide-ixfr no. + + multiple-cnames This option was used in BIND 8 to allow a domain name to allow multiple CNAME records in violation of the DNS standards. BIND 9 currently does not check for multiple - multiple-cnames CNAMEs in zone data loaded from master files, but such + CNAMEs in zone data loaded from master files, but such checks may be introduced in a later release. BIND 9 always strictly enforces the CNAME rules in dynamic updates. - If yes (the default), DNS NOTIFY messages are sent when + + notify If yes (the default), DNS NOTIFY messages are sent when a zone the server is authoritative for changes. See - Notify , for more information. The notify option may - notify also be specified in the zone statement, in which case + Notify, for more information. The notify option may + also be specified in the zone statement, in which case it overrides the options notify statement. It would only be necessary to turn off this option if it caused - slaves to crash . - If yes , and a DNS query requests recursion, then the - server will attempt to do all the work required to - recursion answer the query. If recursion is not on, the server - will return a referral to the client if it doesn't know - the answer. The default is yes . See also fetch-glue - above. - Setting this to yes will cause the server to send NS - rfc2308-type1 records along with the SOA record for negative answers. - The default is no . Not yet implemented in BIND 9 . + slaves to crash. - use-id-pool This option is obsolete . BIND 9 always allocates query + recursion If yes, and a DNS query requests recursion, then the + server will attempt to do all the work required to + answer the query. If recursion is not on, the server + will return a referral to the client if it doesn't know + the answer. The default is yes. See also fetch-glue + above. + + rfc2308-type1 Setting this to yes will cause the server to send NS + records along with the SOA record for negative answers. + The default is no. Not yet implemented in BIND 9. + + use-id-pool This option is obsolete. BIND 9 always allocates query IDs from a pool. - This option was used in BIND 8 to make the server treat - " \r " characters the same way as " " or " \t - treat-cr-as-space ", to facilitate loading of zone files on a UNIX system + + treat-cr-as-space This option was used in BIND 8 to make the server treat + "\r" characters the same way as " " or "\t", + to facilitate loading of zone files on a UNIX system that were generated on an NT or DOS machine. In BIND 9, - both UNIX " \n " and NT/DOS " \r\n " newlines are + both UNIX "\n" and NT/DOS "\r\n" newlines are always accepted, and the option is ignored. 6.2.12.2 Forwarding @@ -2164,10 +2316,9 @@ only on those queries for which the server is not authoritative and does not have the answer in its cache. - - This option is only meaningful if the forwarders list is not - empty. A value of first , the default, causes the server to - forward query the forwarders first, and if that doesn't answer the + forward This option is only meaningful if the forwarders list is not + empty. A value of first, the default, causes the server to + query the forwarders first, and if that doesn't answer the question the server will then look for the answer itself. If only is specified, the server will only query the forwarders. @@ -2188,8 +2339,6 @@ with the RFCs defining valid hostnames. Three checking methods are available: - - ignore No checking is done. warn Names are checked against their expected client contexts. Invalid @@ -2222,32 +2371,33 @@ Access to the server can be restricted based on the IP address of the requesting system. See Address Match Lists for details on how to specify IP address lists. - - - Specifies which hosts are allowed to ask ordinary + allow-query Specifies which hosts are allowed to ask ordinary questions. allow-query may also be specified in the zone - allow-query statement, in which case it overrides the options + statement, in which case it overrides the options allow-query statement. If not specified, the default is to allow queries from all hosts. - Specifies which hosts are allowed to make recursive - allow-recursion queries through this server. If not specified, the default + + allow-recursion Specifies which hosts are allowed to make recursive + queries through this server. If not specified, the default is to allow recursive queries from all hosts. - Specifies which hosts are allowed to receive zone + + allow-transfer Specifies which hosts are allowed to receive zone transfers from the server. allow-transfer may also be - allow-transfer specified in the zone statement, in which case it + specified in the zone statement, in which case it overrides the options allow-transfer statement. If not specified, the default is to allow transfers from all hosts. - Specifies a list of addresses that the server will not - blackhole accept queries from or use to resolve a query. Queries + + blackhole Specifies a list of addresses that the server will not + accept queries from or use to resolve a query. Queries from these addresses will not be responded to. The default - is none . Not yet implemented in BIND 9. + is none. Not yet implemented in BIND 9. 6.2.12.5 Interfaces The interfaces and ports that the server will answer queries from may be specified using the listen-on option. listen-on takes an optional port, and -an address_match_list . The server will listen on all interfaces allowed by +an address_match_list. The server will listen on all interfaces allowed by the address match list. If a port is not specified, port 53 will be used. Multiple listen-on statements are allowed. For example, @@ -2286,7 +2436,7 @@ on the IPv6 wildcard address. If the server doesn't know the answer to a question, it will query other nameservers. query-source specifies the address and port used for such queries. For queries sent over IPv6, there is a separate query-source-v6 -option. If address is * or is omitted, a wildcard IP address ( INADDR_ANY ) +option. If address is * or is omitted, a wildcard IP address (INADDR_ANY) will be used. If port is * or is omitted, a random unprivileged port will be used. The defaults are @@ -2303,32 +2453,36 @@ the amount of load that transfers place on the system. The following options apply to zone transfers. - - Defines a global list of IP addresses that are also + + also-notify Defines a global list of IP addresses that are also sent NOTIFY messages whenever a fresh copy of the zone is loaded. This helps to ensure that copies of the zones will quickly converge on stealth servers. - also-notify If an also-notify list is given in a zone statement, + If an also-notify list is given in a zone statement, it will override the options also-notify statement. - When a zone notify statement is set to no , the IP + When a zone notify statement is set to no, the IP addresses in the global also-notify list will not be sent NOTIFY messages for that zone. The default is the empty list (no global notification list). - Inbound zone transfers running longer than this many - max-transfer-time-in minutes will be terminated. The default is 120 - minutes (2 hours). - Inbound zone transfers making no progress in this - max-transfer-idle-in many minutes will be terminated. The default is 60 - minutes (1 hour). - Outbound zone transfers running longer than this - max-transfer-time-out many minutes will be terminated. The default is 120 - minutes (2 hours). - Outbound zone transfers making no progress in this - many minutes will be terminated. The default is 60 - max-transfer-idle-out minutes - (1 hour). - Slave servers will periodically query master servers + + max-transfer-time-in Inbound zone transfers running longer than this many + minutes will be terminated. The default is 120 + minutes (2 hours). + + max-transfer-idle-in Inbound zone transfers making no progress in this + many minutes will be terminated. The default is 60 + minutes (1 hour). + + max-transfer-time-out Outbound zone transfers running longer than this + many minutes will be terminated. The default is 120 + minutes (2 hours). + + max-transfer-idle-out Outbound zone transfers making no progress in this + many minutes will be terminated. The default is 60 + minutes (1 hour). + + serial-queries Slave servers will periodically query master servers to find out if zone serial numbers have changed. Each such query uses a minute amount of the slave server's network bandwidth, but more importantly @@ -2337,7 +2491,7 @@ apply to zone transfers. respond. The serial-queries option sets the maximum number of concurrent serial-number queries allowed to be outstanding at any given time. The default is - serial-queries 4. Note: If a server loads a large (tens or hundreds + 4. Note: If a server loads a large (tens or hundreds of thousands) number of slave zones, then this limit should be raised to the high hundreds or low thousands, otherwise the slave server may never @@ -2348,39 +2502,44 @@ apply to zone transfers. resources. As with all tunable limits, this one should be changed gently and monitored for its effects. Not yet implemented in BIND 9. - The server supports two zone transfer methods. + + transfer-format The server supports two zone transfer methods. one-answer uses one DNS message per resource record transferred. many-answers packs as many resource records as possible into a message. many-answers is - transfer-format more efficient, but is only known to be understood + more efficient, but is only known to be understood by BIND 9, BIND 8.x and patched versions of - BIND 4.9.5. The default is many-answers . + BIND 4.9.5. The default is many-answers. transfer-format may be overridden on a per-server basis by using the server statement. - The maximum number of inbound zone transfers that - can be running concurrently. The default value is 10 - transfers-in . Increasing transfers-in may speed up the + + transfers-in The maximum number of inbound zone transfers that + can be running concurrently. The default value is 10. + Increasing transfers-in may speed up the convergence of slave zones, but it also may increase the load on the local system. - The maximum number of outbound zone transfers that - transfers-out can be running concurrently. Zone transfer requests + + transfers-out The maximum number of outbound zone transfers that + can be running concurrently. Zone transfer requests in excess of the limit will be refused. The default - value is 10 . - The maximum number of inbound zone transfers that + value is 10. + + transfers-per-ns The maximum number of inbound zone transfers that can be concurrently transferring from a given remote - nameserver. The default value is 2 . Increasing - transfers-per-ns transfers-per-ns may speed up the convergence of + nameserver. The default value is 2. Increasing + transfers-per-ns may speed up the convergence of slave zones, but it also may increase the load on the remote nameserver. transfers-per-ns may be overridden on a per-server basis by using the transfers phrase of the server statement. - transfer-source determines which local address will + + transfer-source transfer-source determines which local address will be bound to IPv4 TCP connections used to fetch zones transferred inbound by the server. If not set, it defaults to a system controlled value which will usually be the address of the interface "closest to" the remote end. This address must appear in the - transfer-source remote end's allow-transfer option for the zone + remote end's allow-transfer option for the zone being transferred, if one is specified. This statement sets the transfer-source for all zones, but can be overridden on a per-zone basis by @@ -2388,7 +2547,7 @@ apply to zone transfers. transfer-source statement within the zone block in the configuration file. - transfer-source-v6 The same as transfer-source , except zone transfers + transfer-source-v6 The same as transfer-source, except zone transfers are performed using IPv6. 6.2.12.8 Resource Limits @@ -2406,34 +2565,38 @@ description of size_spec in Configuration File Elements for more details. - coresize The maximum size of a core dump. The default is default - . Not yet implemented in BIND 9. + coresize The maximum size of a core dump. The default is default. + Not yet implemented in BIND 9. datasize The maximum amount of data memory the server may use. - The default is default . Not yet implemented in BIND 9. + The default is default. Not yet implemented in BIND 9. + The maximum number of files the server may have open - concurrently. The default is unlimited . Note: on some + concurrently. The default is unlimited. Note: on some operating systems the server cannot set an unlimited value and cannot determine the maximum number of open files files the kernel can support. On such systems, choosing unlimited will cause the server to use the larger of the rlim_max for RLIMIT_NOFILE and the value returned by - sysconf(_SC_OPEN_MAX) . If the actual kernel limit is + sysconf(_SC_OPEN_MAX). If the actual kernel limit is larger than this value, use limit files to specify the limit explicitly. Not yet implemented in BIND 9. - The max-ixfr-log-size will be used in a future release - max-ixfr-log-size of the server to limit the size of the transaction log + + max-ixfr-log-size The max-ixfr-log-size will be used in a future release + of the server to limit the size of the transaction log kept for Incremental Zone Transfer. Not yet implemented in BIND 9. - The maximum number of simultaneous recursive lookups the - recursive-clients server will perform on behalf of clients. The default is - 100 . + + recursive-clients The maximum number of simultaneous recursive lookups the + server will perform on behalf of clients. The default is + 100. stacksize The maximum amount of stack memory the server may use. - The default is default . Not yet implemented in BIND 9. - The maximum number of simultaneous client TCP - tcp-clients connections that the server will accept. The default is - 100 . + The default is default. Not yet implemented in BIND 9. + + tcp-clients The maximum number of simultaneous client TCP + connections that the server will accept. The default is + 100. Resource limits are not yet implemented in BIND 9. @@ -2441,27 +2604,30 @@ Resource limits are not yet implemented in BIND 9. - The server will remove expired resource records from - cleaning-interval the cache every cleaning-interval minutes. The default - is 60 minutes. If set to 0 , no periodic cleaning will + cleaning-interval The server will remove expired resource records from + the cache every cleaning-interval minutes. The default + is 60 minutes. If set to 0, no periodic cleaning will occur. - The server will perform zone maintenance tasks for all + + heartbeat-interval The server will perform zone maintenance tasks for all zones marked dialup yes whenever this interval - heartbeat-interval expires. The default is 60 minutes. Reasonable values - are up to 1 day (1440 minutes). If set to 0 , no zone + expires. The default is 60 minutes. Reasonable values + are up to 1 day (1440 minutes). If set to 0, no zone maintenance for these zones will occur. Not yet implemented in BIND 9. - The server will scan the network interface list every + + interface-interval The server will scan the network interface list every interface-interval minutes. The default is 60 minutes. - If set to 0 , interface scanning will only occur when - interface-interval the configuration file is loaded. After the scan, + If set to 0, interface scanning will only occur when + the configuration file is loaded. After the scan, listeners will be started on any new interfaces (provided they are allowed by the listen-on configuration). Listeners on interfaces that have gone away will be cleaned up. - Nameserver statistics will be logged every - statistics-interval statistics-interval minutes. The default is 60 . If - set to 0 , no statistics will be logged. Not yet + + statistics-interval Nameserver statistics will be logged every + statistics-interval minutes. The default is 60. If + set to 0, no statistics will be logged. Not yet implemented in BIND 9. 6.2.12.10 Topology @@ -2498,11 +2664,11 @@ The topology option is not yet implemented in BIND 9. Resource Records (RRs) are the data associated with the names in a domain name space. The data is maintained in the form of sets of RRs. The order of RRs in a set is, by default, not significant. Therefore, to control the -sorting of records in a set of resource records, or RRset , you must use the +sorting of records in a set of resource records, or RRset, you must use the sortlist statement. RRs are explained more fully in See Types of Resource Records and When to -Use Them . Specifications for RRs are documented in RFC 1035. +Use Them. Specifications for RRs are documented in RFC 1035. When returning multiple RRs the nameserver will normally return them in Round Robin order, that is, after each request the first RR is put at the @@ -2515,10 +2681,10 @@ configuring the nameservers, not all the clients. The sortlist statement (see below) takes an address_match_list and interprets it even more specifically than the topology statement does (see -Topology ). Each top level statement in the sortlist must itself be an +Topology). Each top level statement in the sortlist must itself be an explicit address_match_list with one or two elements. The first element (which may be an IP address, an IP prefix, an ACL name or a nested -address_match_list ) of each top level list is checked against the source +address_match_list) of each top level list is checked against the source address of the query until a match is found. Once the source address of the query has been matched, if the top level @@ -2590,16 +2756,16 @@ An order_spec is defined as follows: [ class class_name ][ type type_name ][ name "domain_name"] order ordering -If no class is specified, the default is ANY . If no type is specified, the -default is ANY . If no name is specified, the default is " * ". +If no class is specified, the default is ANY. If no type is specified, the +default is ANY. If no name is specified, the default is "*". The legal values for ordering are: - - fixed Records are returned in the order they are defined in the zone file. + random Records are returned in some random order. + cyclic Records are returned in a round-robin order. For example: @@ -2609,9 +2775,9 @@ For example: order cyclic; }; -will cause any responses for type A records in class IN that have " -host.example.com " as a suffix, to always be returned in random order. All -other records are returned in cyclic order. +will cause any responses for type A records in class IN that have +"host.example.com" as a suffix, to always be returned in random +order. All other records are returned in cyclic order. If multiple rrset-order statements appear, they are not combined--the last one applies. @@ -2628,30 +2794,33 @@ The rrset-order statement is not yet implemented in BIND 9. 6.2.12.13 Tuning - - Sets the number of seconds to cache a lame server + lame-ttl Sets the number of seconds to cache a lame server indication. 0 disables caching. (This is NOT - lame-ttl recommended.) Default is 600 (10 minutes). Maximum + recommended.) Default is 600 (10 minutes). Maximum value is 1800 (30 minutes). Not yet implemented in BIND 9. - To reduce network traffic and increase performance + + max-ncache-ttl To reduce network traffic and increase performance the server stores negative answers. max-ncache-ttl is used to set a maximum retention time for these - max-ncache-ttl answers in the server in seconds. The default + answers in the server in seconds. The default max-ncache-ttl is 10800 seconds (3 hours). max-ncache-ttl cannot exceed 7 days and will be silently truncated to 7 days if set to a greater value. - max-cache-ttl sets the maximum time for which the - max-cache-ttl server will cache ordinary (positive) answers. The + + max-cache-ttl max-cache-ttl sets the maximum time for which the + server will cache ordinary (positive) answers. The default is one week (7 days). - The minimum number of root servers that is required - min-roots for a request for the root servers to be accepted. - Default is 2 . Not yet implemented in BIND 9. - Specifies the number of days into the future when + + min-roots The minimum number of root servers that is required + for a request for the root servers to be accepted. + Default is 2. Not yet implemented in BIND 9. + + sig-validity-interval Specifies the number of days into the future when DNSSEC signatures automatically generated as a - result of dynamic updates (see Dynamic Update ) will - sig-validity-interval expire. The default is 30 days. The signature + result of dynamic updates (see Dynamic Update) will + expire. The default is 30 days. The signature inception time is unconditionally set to one hour before the current time to allow for a limited amount of clock skew. @@ -2660,8 +2829,8 @@ The rrset-order statement is not yet implemented in BIND 9. use-ixfr is deprecated in BIND 9. If you need to disable IXFR to a particular server or servers see the information on the provide-ixfr option -in server Statement Definition and Usage . See also the description of IXFR -in the section Incremental Zone Transfers (IXFR) . +in server Statement Definition and Usage. See also the description of IXFR +in the section Incremental Zone Transfers (IXFR). 6.2.13 server Statement Grammar @@ -2681,13 +2850,13 @@ The server statement defines the characteristics to be associated with a remote nameserver. If you discover that a remote server is giving out bad data, marking it as -bogus will prevent further queries to it. The default value of bogus is no . +bogus will prevent further queries to it. The default value of bogus is no. The bogus clause is not yet implemented in BIND 9. The provide-ixfr clause determines whether the local server, acting as master, will respond with an incremental zone transfer when the given remote -server, a slave, requests it. If set to yes , incremental transfer will be -provided whenever possible. If set to no , all transfers to the remote +server, a slave, requests it. If set to yes, incremental transfer will be +provided whenever possible. If set to no, all transfers to the remote server will be nonincremental. If not set, the value of the provide-ixfr option in the global options block is used as a default. @@ -2704,7 +2873,7 @@ possible to disable the use of IXFR even when both master and slave claim to support it, for example if one of the servers is buggy and crashes or corrupts data when IXFR is used. -The server supports two zone transfer methods. The first, one-answer , uses +The server supports two zone transfer methods. The first, one-answer, uses one DNS message per resource record transferred. many-answers packs as many resource records as possible into a message. many-answers is more efficient, but is only known to be understood by BIND 9, BIND 8.x, and patched versions @@ -2770,7 +2939,7 @@ client query will be resolved in the context of the first view whose match-clients list matches the client's IP address. Zones defined within a view statement will be only be accessible to clients -that match the view . By defining a zone of the same name in multiple views, +that match the view. By defining a zone of the same name in multiple views, different zone data can be given to different clients, for example, "internal" and "external" clients in a split DNS setup. @@ -2789,7 +2958,7 @@ statements specified on the top level of the configuration file are considered to be part of this default view. If any explicit view statements are present, all zone statements must occur inside view statements. -A zone statement of type hint for the root zone (` . ') does not strictly +A zone statement of type hint for the root zone ('.') does not strictly define a zone. Therefore, it should not be included in a view statement. Here is an example of a typical split DNS setup implemented using view @@ -2857,14 +3026,15 @@ zone zone name [class] [{ master The server has a master copy of the data for the zone and will be able to provide authoritative answers for it. - A slave zone is a replica of a master zone. The masters list + + slave A slave zone is a replica of a master zone. The masters list specifies one or more IP addresses that the slave contacts to update its copy of the zone. If a port is specified, the slave then checks to see if the zone is current and zone transfers will be done to the port given. If a file is specified, then the replica will be written to this file whenever the zone is changed, and reloaded from this file on a server restart. Use of a file is - slave recommended, since it often speeds server start-up and eliminates + recommended, since it often speeds server start-up and eliminates a needless waste of bandwidth. Note that for large numbers (in the tens or hundreds of thousands) of zones per server, it is best to use a two level naming scheme for zone file names. For example, a @@ -2873,7 +3043,8 @@ zone zone name [class] [{ ex/example.com where ex/ is just the first two letters of the zone name. (Most operating systems behave very slowly if you put 100K files into a single directory.) - A stub zone is similar to a slave zone, except that it replicates + +stub A stub zone is similar to a slave zone, except that it replicates only the NS records of a master zone instead of the entire zone. Stub zones are not a standard part of the DNS; they are a peculiarity of BIND 4 and BIND 8 that relies heavily on the @@ -2881,7 +3052,6 @@ zone zone name [class] [{ BIND 9 attempts to emulate the BIND 4/8 stub zone feature for backwards compatibility, but we do not recommend its use in new configurations. - stub In BIND 4/8, zone transfers of a parent zone included the NS records from stub children of that zone. This meant that, in some cases, users could get away with configuring child stubs only in @@ -2890,21 +3060,23 @@ zone zone name [class] [{ master serving a parent zone has child stub zones configured, all the slave servers for the parent zone also need to have the same child stub zones configured.. - A "forward zone" is a way to configure forwarding on a per-domain + + forward A "forward zone" is a way to configure forwarding on a per-domain basis. A zone statement of type forward can contain a forward and/or forwarders statement, which will apply to queries within the domain given by the zone name. If no forwarders statement is present or an empty list for forwarders is given, then no - forward forwarding will be done for the domain, cancelling the effects of + forwarding will be done for the domain, cancelling the effects of any forwarders in the options statement. Thus if you want to use this type of zone to change the behavior of the global forward option (that is, "forward first to", then "forward only", or vice versa, but want to use the same servers as set globally) you need to respecify the global forwarders. Domain-specific forwarding is not yet implemented in BIND 9. - The initial set of root nameservers is specified using a "hint + + hint The initial set of root nameservers is specified using a "hint zone". When the server starts up, it uses the root hints to find a - hint root nameserver and get the most recent list of root nameservers. + root nameserver and get the most recent list of root nameservers. If no hint zone is specified for class IN, the server users a compiled-in default set of root servers hints. Classes other than IN have no built-in defaults hints. @@ -2912,7 +3084,7 @@ zone zone name [class] [{ 6.2.20.2 Class The zone's name may optionally be followed by a class. If a class is not -specified, class IN (for Internet ), is assumed. This is correct for the +specified, class IN (for Internet), is assumed. This is correct for the vast majority of cases. The hesiod class is named for an information service from MIT's Project @@ -2926,82 +3098,92 @@ mid-1970s. Zone data for it can be specified with the CHAOS class. 6.2.20.3 Zone Options allow-query See the description of allow-query under Access - Control . + Control. allow-transfer See the description of allow-transfer under Access - Control . - Specifies which hosts are allowed to submit - allow-update Dynamic DNS updates for master zones. The default - is to deny updates from all hosts. + Control. + + allow-update Specifies which hosts are allowed to submit Dynamic DNS + updates for master zones. The default is to deny updates + from all hosts. update-policy Specifies a "Simple Secure Update" policy. See - description in Dynamic Update Policies . - Specifies which hosts are allowed to submit + description in Dynamic Update Policies. + + allow-update-forwarding Specifies which hosts are allowed to submit Dynamic DNS updates to slave zones to be forwarded - allow-update-forwarding to the master. The default is to deny update + to the master. The default is to deny update forwarding from all hosts. Update forwarding is not yet implemented. - Only meaningful if notify is active for this zone. - The set of machines that will receive a DNS NOTIFY - message for this zone is made up of all the listed - also-notify nameservers (other than the primary master) for - the zone plus any IP addresses specified with - also-notify . - also-notify is not meaningful for stub zones. The - default is the empty list . - check-names See Name Checking . + also-notify Only meaningful if notify is active for this zone. The + set of machines that will receive a DNS + NOTIFY message for this zone is made up of + all the listed nameservers (other than the + primary master) for the zone plus any IP + addresses specified with also-notify. + also-notify is not meaningful for stub + zones. The default is the empty list. + + check-names See Name Checking. Not yet implemented in BIND 9. - See the description of dialup under Boolean - dialup Options . + + dialup See the description of dialup under Boolean + Options. Not yet implemented in BIND 9. - Only meaningful if the zone has a forwarders list. + + forward Only meaningful if the zone has a forwarders list. The only value causes the lookup to fail after - forward trying the forwarders and getting no answer, while + trying the forwarders and getting no answer, while first would allow a normal lookup to be tried. Not yet implemented in BIND 9. - Used to override the list of global forwarders. If - it is not specified in a zone of type forward , no - forwarders forwarding is done for the zone; the global - options are not used. + forwarders Used to override the list of global forwarders. If + it is not specified in a zone of type forward, no + forwarding is done for the zone; the global + options are not used. Not yet implemented in BIND 9. - Was used in BIND 8 to specify the name of the + + ixfr-base Was used in BIND 8 to specify the name of the transaction log (journal) file for dynamic update - ixfr-base and IXFR. BIND 9 ignores the option and constructs - the name of the journal file by appending ". jnl " + and IXFR. BIND 9 ignores the option and constructs + the name of the journal file by appending ".jnl" to the name of the zone file. max-transfer-time-in See the description of - max-transfer-time-in under Zone Transfers . + max-transfer-time-in under Zone Transfers. max-transfer-idle-in See the description of - max-transfer-idle-in under Zone Transfers . + max-transfer-idle-in under Zone Transfers. max-transfer-time-out See the description of - max-transfer-time-out under Zone Transfers . + max-transfer-time-out under Zone Transfers. max-transfer-idle-out See the description of - max-transfer-idle-out under Zone Transfers . + max-transfer-idle-out under Zone Transfers. notify See the description of notify under Boolean - Options . - In BIND 8, this option was intended for specifying + Options. + + pubkey In BIND 8, this option was intended for specifying a public zone key for verification of signatures - pubkey in DNSSEC signed zones when they are loaded from + in DNSSEC signed zones when they are loaded from disk. BIND 9 does not verify signatures on loading and ignores the option. sig-validity-interval See the description of sig-validity-interval in - Tuning . - Determines which local address will be bound to - the IPv4 TCP connection used to fetch this zone. - If not set, it defaults to a system controlled - transfer-source value which will usually be the address of the - interface "closest to" the remote end. This - address must appear in the remote end's - allow-transfer option for this zone if one is - specified. + Tuning. + + transfer-source Determines which local address will be bound + to the IPv4 TCP connection used to fetch this + zone. If not set, it defaults to a system + controlled value which will + usually be the address of the interface + "closest to" the remote end. If the remote + end user is an allow-transfer option for + this zone, the address, supplied by the + transfer-source option, needs to be specified + in that allow-transfer option. transfer-source-v6 Similar to transfer-source, but for zone transfers performed using IPv6. @@ -3040,7 +3222,7 @@ identity field, the name matches the name field, and the type is specified in the type field. The identity field specifies a name or a wildcard name. The nametype field -has 4 values: name , subdomain , wildcard , and self . +has 4 values: name, subdomain, wildcard, and self. name Matches when the updated name is the same as the name in the name field. @@ -3096,37 +3278,53 @@ The following are types of valid RRs (some of these listed, although not obsolete, are experimental (x) or historical (h) and no longer in general use): - A a host address. - A6 an IPv6 address. - AAAA Obsolete format of IPv6 address + A a host address. + + A6 an IPv6 address. + + AAAA Obsolete format of IPv6 address + AFSDB(x) location of AFS database servers. Experimental. - CNAMEidentifies the canonical name of an alias. - DNAMEfor delegation of reverse addresses. Replaces the domain name - specified with another name to be looked up. Described in RFC 2672. - HINFOidentifies the CPU and OS used by a host. - ISDN (x) representation of ISDN addresses. Experimental. - KEY stores a public key associated with a DNS name. - LOC (x) for storing GPS info. See RFC 1876. Experimental. - MX identifies a mail exchange for the domain. See RFC 974 for details. - NS the authoritative nameserver for the domain. - used in DNSSEC to securely indicate that RRs with an owner name in a - NXT certain name interval do not exist in a zone and indicate what RR - types are present for an existing name. See RFC 2535 for details. - PTR a pointer to another part of the domain name space. - RP (x) information on persons responsible for the domain. Experimental. + CNAME identifies the canonical name of an alias. - RT (x) route-through binding for hosts that do not have their own direct - wide area network addresses. Experimental. + DNAME for delegation of reverse addresses. Replaces the domain name + specified with another name to be looked up. Described in RFC 2672. - SIG ("signature") contains data authenticated in the secure DNS. See RFC - 2535 for details. - SOA identifies the start of a zone of authority. - SRV information about well known network services (replaces WKS). + HINFO identifies the CPU and OS used by a host. - WKS (h) information about which well known network services, such as - SMTP, that a domain supports. Historical, replaced by newer RR SRV. - X25 (x) representation of X.25 network addresses. Experimental. + ISDN (x) representation of ISDN addresses. Experimental. + + KEY stores a public key associated with a DNS name. + + LOC (x) for storing GPS info. See RFC 1876. Experimental. + + MX identifies a mail exchange for the domain. See RFC 974 for details. + + NS the authoritative nameserver for the domain. + used in DNSSEC to securely indicate that RRs with an owner name in a + + NXT certain name interval do not exist in a zone and indicate what RR + types are present for an existing name. See RFC 2535 for details. + + PTR a pointer to another part of the domain name space. + + RP (x) information on persons responsible for the domain. Experimental. + + RT (x) route-through binding for hosts that do not have their own direct + wide area network addresses. Experimental. + + SIG ("signature") contains data authenticated in the secure DNS. See RFC + 2535 for details. + + SOA identifies the start of a zone of authority. + + SRV information about well known network services (replaces WKS). + + WKS (h) information about which well known network services, such as + SMTP, that a domain supports. Historical, replaced by newer RR SRV. + + X25 (x) representation of X.25 network addresses. Experimental. The following classes of resource records are currently valid in the DNS: @@ -3137,21 +3335,26 @@ The following classes of resource records are currently valid in the DNS: RDATA is the type-dependent or class-dependent data that describes the resource: - A for the IN class, a 32 bit IP address. + A for the IN class, a 32 bit IP address. - A6 maps a domain name to an IPv6 address, with a provision for - indirection for leading "prefix" bits. - CNAMEa domain name. - provides alternate naming to an entire subtree of the domain name - DNAMEspace, rather than to a single node. It causes some suffix of a - queried name to be substituted with a name from the DNAME record's - RDATA. + A6 maps a domain name to an IPv6 address, with a provision for + indirection for leading "prefix" bits. - MX a 16 bit preference value (lower is better) followed by a host name - willing to act as a mail exchange for the owner domain. - NS a fully qualified domain name. - PTR a fully qualified domain name. - SOA several fields. + CNAME a domain name. + provides alternate naming to an entire subtree of the domain name + + DNAME space, rather than to a single node. It causes some suffix of a + queried name to be substituted with a name from the DNAME record's + RDATA. + + MX a 16 bit preference value (lower is better) followed by a host name + willing to act as a mail exchange for the owner domain. + + NS a fully qualified domain name. + + PTR a fully qualified domain name. + + SOA several fields. The owner name is often implicit, rather than forming an integral part of the RR. For example, many nameservers internally form tree or hash @@ -3218,7 +3421,7 @@ Similarly we might see: XX.LCS.MIT.EDU. IN A 10.0.0.44 CH A MIT.EDU. 2420 -This example shows two addresses for XX.LCS.MIT.EDU , each of a different +This example shows two addresses for XX.LCS.MIT.EDU, each of a different class. 6.3.2 Discussion of MX Records @@ -3264,21 +3467,20 @@ describes how long a RR can be cached before it should be discarded. The following three types of TTL are currently used in a zone file. + SOA The last field in the SOA is the negative caching TTL. This + controls how long other servers will cache no-such-domain + (NXDOMAIN) responses from you. - The last field in the SOA is the negative caching TTL. This - controls how long other servers will cache no-such-domain - SOA (NXDOMAIN) responses from you. + The maximum time for negative caching is 3 hours (3h). - The maximum time for negative caching is 3 hours (3h). + $TTL The $TTL directive at the top of the zone file (before the SOA) + gives a default TTL for every RR without a specific TTL set. - $TTL The $TTL directive at the top of the zone file (before the SOA) - gives a default TTL for every RR without a specific TTL set. - - RR TTLsEach RR can have a TTL as the second field in the RR, which will - control how long other servers can cache the it. + RR TTLs Each RR can have a TTL as the second field in the RR, which will + control how long other servers can cache the it. All of these TTLs default to units of seconds, though units can be -explicitly specified, for example, 1h30m . +explicitly specified, for example, 1h30m. 6.3.4 Inverse Mapping in IPv4 @@ -3309,16 +3511,16 @@ The Master File Format was initially defined in RFC 1035 and has subsequently been extended. While the Master File Format itself is class independent all records in a Master File must be of the same class. -Master File Directives include $ORIGIN , $INCLUDE , and $TTL. +Master File Directives include $ORIGIN, $INCLUDE, and $TTL. 6.3.5.1 The $ORIGIN Directive Syntax: $ORIGIN < domain-name > [ < comment > ] $ORIGIN sets the domain name that will be appended to any unqualified -records. When a zone is first read in there is an implicit $ORIGIN < -zone-name > . The current $ORIGIN is appended to the domain specified in the -$ORIGIN argument if it is not absolute. +records. When a zone is first read in there is an implicit $ORIGIN +. The current $ORIGIN is appended to the domain specified +in the $ORIGIN argument if it is not absolute. $ORIGIN example.com WWW CNAME MAIN-SERVER @@ -3375,32 +3577,23 @@ is equivalent to - This can be one of two forms: start-stop or start-stop/step. If the - range first form is used then step is set to 1. All of start, stop and + range This can be one of two forms: start-stop or start-stop/step. If the + first form is used then step is set to 1. All of start, stop and step must be positive. - lhs describes the owner name of the resource records to be created. + + lhs lhs describes the owner name of the resource records to be created. Any single $ symbols within the lhs side are replaced by the - lhs iterator value. To get a $ in the output use a double $ , e.g. $$ . + iterator value. To get a $ in the output use a double $, e.g. $$. If the lhs is not absolute, the current $ORIGIN is appended to the name. + type At present the only supported types are PTR, CNAME and NS. + rhs rhs is a domain name. It is processed similarly to lhs. The $GENERATE directive is a BIND extension and not part of the standard zone file format. It is not yet implemented in BIND 9. -6.3.7 Signals - -Certain UNIX signals cause the name server to take specific actions, as -described in the following table. These signals can be sent using the kill -command. - - - - SIGHUP Causes the server to read named.conf and reload the database. - SIGTERM Causes the server to clean up and exit. - SIGINT Causes the server to clean up and exit. - SIGQUIT Causes the server to clean up and exit. ------------------------------------------------------------------------ @@ -3409,8 +3602,8 @@ command. 7.1 Access Control Lists Access Control Lists (ACLs), are address match lists that you can set up and -nickname for future use in allow-query , allow-recursion , blackhole , -allow-transfer , etc. +nickname for future use in allow-query, allow-recursion, blackhole, +allow-transfer, etc. Using ACLs allows you to have finer control over who can access your nameserver, without cluttering up your config files with huge lists of IP @@ -3458,25 +3651,25 @@ ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos 7.2 chroot and setuid (for UNIX servers) On UNIX servers, it is possible to run BIND in a chrooted environment ( -chroot() ) by specifying the " -t " option. This can help improve system +chroot() ) by specifying the "-t" option. This can help improve system security by placing BIND in a "sandbox," which will limit the damage done if a server is compromised. Another useful feature in the UNIX version of BIND is the ability to run the -daemon as a nonprivileged user ( -u user ). We suggest running as a +daemon as a nonprivileged user (-u user). We suggest running as a nonprivileged user when using the chroot feature. Here is an example command line to load BIND in a chroot() sandbox, -/var/named , and to run named setuid to user 202: +/var/named, and to run named setuid to user 202: /usr/local/bin/named -u 202 -t /var/named 7.2.1 The chroot Environment In order for a chroot() environment to work properly in a particular -directory (for example, /var/named ), you will need to set up an environment +directory (for example, /var/named), you will need to set up an environment that includes everything BIND needs to run. From BIND's point of view, -/var/named is the root of the filesystem. You will need /dev/null , and any +/var/named is the root of the filesystem. You will need /dev/null, and any library directories and files that BIND needs to run on your system. Please consult your operating system's instructions if you need help figuring out which library files you need to copy over to the chroot() sandbox. @@ -3629,8 +3822,8 @@ IPv6 addresses (A6) IPv6 addresses are 128-bit identifiers for interfaces and sets of interfaces which were introduced in the DNS to facilitate scalable Internet routing. -There are three types of addresses: Unicast , an identifier for a single -interface; Anycast , an identifier for a set of interfaces; and Multicast , +There are three types of addresses: Unicast, an identifier for a single +interface; Anycast, an identifier for a set of interfaces; and Multicast, an identifier for a set of interfaces. Here we describe the global Unicast address scheme. For more information, see RFC 2374. @@ -3640,26 +3833,24 @@ The aggregatable global Unicast address format is as follows: 3 13 8 24 16 64 bits FP TLA ID RES NLA ID SLA ID Interface ID - <------ Public Topology - ------> + <-- Public Topology --> <-Site Topology-> - <------ Interface Identifier - ------> + <- Interface Identifier -> Where - FP = Format Prefix (001) - TLA ID = Top-Level Aggregation Identifier - RES = Reserved for future use - NLA ID = Next-Level Aggregation Identifier - SLA ID = Site-Level Aggregation Identifier - INTERFACE ID= Interface Identifier + FP = Format Prefix (001) + TLA ID = Top-Level Aggregation Identifier + RES = Reserved for future use + NLA ID = Next-Level Aggregation Identifier + SLA ID = Site-Level Aggregation Identifier + INTERFACE ID = Interface Identifier The Public Topology is provided by the upstream provider or ISP, and (roughly) corresponds to the IPv4 network section of the address range. The Site Topology is where you can subnet this space, much the same as -subnetting an IPv4 class A or B network into class Cs. The Interface +subnetting an IPv4 /16 network into /24 subnets. The Interface Identifier is the address of an individual interface on a given network. (With IPv6, addresses belong to interfaces rather than machines.) @@ -3672,8 +3863,8 @@ address consists of: - 3 13 8 24 - FPTLA ID RES NLA ID + 3 13 8 24 + FP TLA ID RES NLA ID A 3 bit FP (Format Prefix) of 001 indicates this is a global Unicast address. FP lengths for other types of addresses may vary. @@ -3689,8 +3880,7 @@ client can then split up the network further by filling in more NLA bits, and hand out IPv6 prefixes to their clients, and so forth. There is no particular structure for the Site topology section. -Organizations can allocate these bits in any way they desire, in the same -way as they would subnet an IPv4 class A (8-bit prefix) network. +Organizations can allocate these bits in any way they desire. The Interface Identifier must be unique on that network. On ethernet networks, one way to ensure this is to set the address to the first three @@ -3703,7 +3893,7 @@ colon, and leading zeros of a block may be omitted, for example: IPv6 address specifications are likely to contain long strings of zeros, so the architects have included a shorthand for specifying them. The double -colon (`::') indicates the longest possible string of zeros that can fit, +colon ('::') indicates the longest possible string of zeros that can fit, and can be used only once in an address. Bibliography (and Suggested Reading) @@ -3716,13 +3906,13 @@ notes. The standards themselves are defined by the Internet Engineering Task Force (IETF) and the Internet Engineering Steering Group (IESG). RFCs can be obtained online via FTP at ftp://www.isi.edu/in-notes/RFCxxx.txt (where xxx is the number of the RFC). -RFCs are also available via the Web at http://www.ietf.org/rfc/ . +RFCs are also available via the Web at http://www.ietf.org/rfc/. Standards -RFC974. Partridge, C. Mail Routing and the Domain System . January 1986. +RFC974. Partridge, C. Mail Routing and the Domain System. January 1986. -RFC1034. Mockapetris, P.V. Domain Names - Concepts and Facilities . P.V. +RFC1034. Mockapetris, P.V. Domain Names - Concepts and Facilities. P.V. November 1987. RFC1035. Mockapetris, P. V. Domain Names - Implementation and Specification @@ -3730,33 +3920,33 @@ RFC1035. Mockapetris, P. V. Domain Names - Implementation and Specification Proposed Standards -RFC2181. Elz, R., R. Bush. Clarifications to the DNS Specification . July +RFC2181. Elz, R., R. Bush. Clarifications to the DNS Specification. July 1997. -RFC2308. Andrews, M. Negative Caching of DNS Queries . March 1998. +RFC2308. Andrews, M. Negative Caching of DNS Queries. March 1998. -RFC1995. Ohta, M. Incremental Zone Transfer in DNS . August 1996. +RFC1995. Ohta, M. Incremental Zone Transfer in DNS. August 1996. -RFC1996. Vixie, P. A Mechanism for Prompt Notification of Zone Changes . +RFC1996. Vixie, P. A Mechanism for Prompt Notification of Zone Changes. August 1996. RFC2136. Vixie, P., S. Thomson, Y. Rekhter, J. Bound. Dynamic Updates in the -Domain Name System . April 1997. +Domain Name System. April 1997. RFC2845. Vixie, P., O. Gudmundsson, D. Eastlake 3rd, B. Wellington. Secret -Key Transaction Authentication for DNS (TSIG) . May 2000. +Key Transaction Authentication for DNS (TSIG). May 2000. Proposed Standards Still Under Development Note: the following list of RFCs are undergoing major revision by the IETF. -RFC1886. Thomson, S., C. Huitema. DNS Extensions to support IP version 6 . +RFC1886. Thomson, S., C. Huitema. DNS Extensions to support IP version 6. S. December 1995. RFC2065. Eastlake, 3rd, D., C. Kaufman. Domain Name System Security -Extensions . January 1997. +Extensions. January 1997. -RFC2137. Eastlake, 3rd, D. Secure Domain Name System Dynamic Update . April +RFC2137. Eastlake, 3rd, D. Secure Domain Name System Dynamic Update. April 1997. Other Important RFCs About DNS Implementation @@ -3765,55 +3955,55 @@ RFC1535. Gavron, E. A Security Problem and Proposed Correction With Widely Deployed DNS Software. October 1993. RFC1536. Kumar, A., J. Postel, C. Neuman, P. Danzig, S. Miller. Common DNS -Implementation Errors and Suggested Fixes . October 1993. +Implementation Errors and Suggested Fixes. October 1993. -RFC1982. Elz, R., R. Bush. Serial Number Arithmetic . August 1996. +RFC1982. Elz, R., R. Bush. Serial Number Arithmetic. August 1996. Resource Record Types RFC1183. Everhart, C.F., L. A. Mamakos, R. Ullmann, P. Mockapetris. New DNS -RR Definitions . October 1990. +RR Definitions. October 1990. -RFC1706. Manning, B., R. Colella. DNS NSAP Resource Records . October 1994. +RFC1706. Manning, B., R. Colella. DNS NSAP Resource Records. October 1994. RFC2168. Daniel, R., M. Mealling. Resolution of Uniform Resource Identifiers using the Domain Name System. June 1997. RFC1876. Davis, C., P. Vixie, T. Goodwin, I. Dickinson. A Means for -Expressing Location Information in the Domain Name System . January 1996. +Expressing Location Information in the Domain Name System. January 1996. RFC2052. Gulbrandsen, A., P. Vixie. A DNS RR for Specifying the Location of Services. October 1996. RFC2163. Allocchio, A. U sing the Internet DNS to Distribute MIXER -Conformant Global Address Mapping . January 1998. +Conformant Global Address Mapping. January 1998. -RFC2230. Atkinson, R. Key Exchange Delegation Record for the DNS . October +RFC2230. Atkinson, R. Key Exchange Delegation Record for the DNS. October 1997. DNS and the Internet -RFC1101. Mockapetris, P. V. DNS Encoding of Network Names and Other Types . +RFC1101. Mockapetris, P. V. DNS Encoding of Network Names and Other Types. April 1989. RFC1123. Braden, R. Requirements for Internet Hosts - Application and -Support . October 1989. +Support. October 1989. -RFC1591. Postel, J. D omain Name System Structure and Delegation . March +RFC1591. Postel, J. D omain Name System Structure and Delegation. March 1994. RFC2317. Eidnes, H., G. de Groot, P. Vixie. Classless IN-ADDR.ARPA -Delegation . March 1998. +Delegation. March 1998. DNS Operations -RFC1537. Beertema, P. Common DNS Data File Configuration Errors . October +RFC1537. Beertema, P. Common DNS Data File Configuration Errors. October 1993. -RFC1912. Barr, D. Common DNS Operational and Configuration Errors . February +RFC1912. Barr, D. Common DNS Operational and Configuration Errors. February 1996. -RFC1912. Barr, D. Common DNS Operational and Configuration Errors . February +RFC1912. Barr, D. Common DNS Operational and Configuration Errors. February 1996. RFC2010. Manning, B., P. Vixie. Operational Criteria for Root Name Servers. @@ -3828,25 +4018,25 @@ Note: the following list of RFCs, although DNS-related, are not concerned with implementing software. RFC1464. Rosenbaum, R. Using the Domain Name System To Store Arbitrary -String Attributes . May 1993. +String Attributes. May 1993. -RFC1713. Romao, A. Tools for DNS Debugging . November 1994. +RFC1713. Romao, A. Tools for DNS Debugging. November 1994. -RFC1794. Brisco, T. DNS Support for Load Balancing . April 1995. +RFC1794. Brisco, T. DNS Support for Load Balancing. April 1995. -RFC2240. Vaughan, O. A Legal Basis for Domain Name Allocation . +RFC2240. Vaughan, O. A Legal Basis for Domain Name Allocation. November1997. RFC2345. Klensin, J., T. Wolf, G. Oglesby. Domain Names and Company Name -Retrieval . May 1998. +Retrieval. May 1998. -RFC2352. Vaughan, O. A Convention For Using Legal Names as Domain Names . +RFC2352. Vaughan, O. A Convention For Using Legal Names as Domain Names. May 1998. Obsolete and Unimplemented Experimental RRs RFC1712. Farrell, C., M. Schulze, S. Pleitner, D. Baldoni. DNS Encoding of -Geographical Location . November 1994. +Geographical Location. November 1994. Internet Drafts @@ -3860,7 +4050,7 @@ authors. Other BIND Documents -Albitz, Paul and Cricket Liu. 1998. DNS and BIND . Sebastopol, CA: O'Reilly +Albitz, Paul and Cricket Liu. 1998. DNS and BIND. Sebastopol, CA: O'Reilly and Associates. ------------------------------------------------------------------------ From 9df4200a67abf7a9907e95d2e01c7313328ad272 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Wed, 12 Jul 2000 17:59:08 +0000 Subject: [PATCH 051/226] Check the return value of kill. This means that the test can now detect the case when a program no longer exists (due to a crash) or when a program responds badly to a SIGTERM and doesn't clean up the pid file. --- bin/tests/system/notify/tests.sh | 30 +++++++++++++++++++++++++----- bin/tests/system/stop.sh | 30 +++++++++++++++++++++++++----- 2 files changed, 50 insertions(+), 10 deletions(-) diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh index 0737b9936a..ce5a545241 100644 --- a/bin/tests/system/notify/tests.sh +++ b/bin/tests/system/notify/tests.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: tests.sh,v 1.22 2000/07/07 18:25:13 bwelling Exp $ +# $Id: tests.sh,v 1.23 2000/07/12 17:59:07 bwelling Exp $ # # Perform tests @@ -52,14 +52,24 @@ grep ";" dig.out.ns3 $PERL ../digcomp.pl dig.out.ns2 dig.out.ns3 || status=1 -kill -TERM `cat ns3/named.pid` +kill -TERM `cat ns3/named.pid` > /dev/null 2>&1 +if [ $? != 0 ]; then + echo "I:ns3 died before a SIGTERM was sent" + status=1 + rm -f ns3/named.pid +fi rm -f ns2/example.db cp ns2/example3.db ns2/example.db sleep 6 if [ -f ns3/named.pid ]; then echo "I:ns3 didn't die when sent a SIGTERM" - kill -KILL `cat ns3/named.pid` + kill -KILL `cat ns3/named.pid` > /dev/null 2>&1 + if [ $? != 0 ]; then + echo "I:ns3 died before a SIGKILL was sent" + status=1 + rm -f ns3/named.pid + fi status=1 fi @@ -78,12 +88,22 @@ grep ";" dig.out.ns3 $PERL ../digcomp.pl dig.out.ns2 dig.out.ns3 || status=1 rm -f ns2/example.db -kill -TERM `cat ns2/named.pid` +kill -TERM `cat ns2/named.pid` > /dev/null 2>&1 +if [ $? != 0 ]; then + echo "I:ns2 died before a SIGTERM was sent" + status=1 + rm -f ns2/named.pid +fi sleep 6 if [ -f ns2/named.pid ]; then echo "I:ns2 didn't die when sent a SIGTERM" - kill -KILL `cat ns2/named.pid` + kill -KILL `cat ns2/named.pid` > /dev/null 2>&1 + if [ $? != 0 ]; then + echo "I:ns2 died before a SIGKILL was sent" + status=1 + rm -f ns2/named.pid + fi status=1 fi diff --git a/bin/tests/system/stop.sh b/bin/tests/system/stop.sh index 665299330f..b172a40e54 100644 --- a/bin/tests/system/stop.sh +++ b/bin/tests/system/stop.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: stop.sh,v 1.12 2000/07/09 15:55:01 tale Exp $ +# $Id: stop.sh,v 1.13 2000/07/12 17:59:08 bwelling Exp $ # # Stop name servers. @@ -31,7 +31,12 @@ for d in ns* do pidfile="$d/named.pid" if [ -f $pidfile ]; then - kill -TERM `cat $pidfile` + kill -TERM `cat $pidfile` > /dev/null 2>&1 + if [ $? != 0 ]; then + echo "I:$d died before a SIGTERM was sent" + status=`expr $status + 1` + rm -f $pidfile + fi fi done @@ -39,7 +44,12 @@ for d in lwresd* do pidfile="$d/lwresd.pid" if [ -f $pidfile ]; then - kill -TERM `cat $pidfile` + kill -TERM `cat $pidfile` > /dev/null 2>&1 + if [ $? != 0 ]; then + echo "I:$d died before a SIGTERM was sent" + status=`expr $status + 1` + rm -f $pidfile + fi fi done @@ -51,7 +61,12 @@ do if [ -f $pidfile ]; then echo "I:$d didn't die when sent a SIGTERM" status=`expr $status + 1` - kill -KILL `cat $pidfile` + kill -KILL `cat $pidfile` > /dev/null 2>&1 + if [ $? != 0 ]; then + echo "I:$d died before a SIGKILL was sent" + status=`expr $status + 1` + rm -f $pidfile + fi rm -f $pidfile fi done @@ -62,7 +77,12 @@ do if [ -f $pidfile ]; then echo "I:$d didn't die when sent a SIGTERM" status=`expr $status + 1` - kill -KILL `cat $pidfile` + kill -KILL `cat $pidfile` > /dev/null 2>&1 + if [ $? != 0 ]; then + echo "I:$d died before a SIGKILL was sent" + status=`expr $status + 1` + rm -f $pidfile + fi rm -f $pidfile fi done From df5918b068fecf7ce1a4003a340c2110bd3cbd19 Mon Sep 17 00:00:00 2001 From: Jim Reid Date: Wed, 12 Jul 2000 18:29:33 +0000 Subject: [PATCH 052/226] incorporated Brian's review comments and corrections --- bin/nsupdate/nsupdate.8 | 55 +++++++++++++++++++++++++++++++++-------- doc/man/bin/nsupdate.8 | 55 +++++++++++++++++++++++++++++++++-------- 2 files changed, 90 insertions(+), 20 deletions(-) diff --git a/bin/nsupdate/nsupdate.8 b/bin/nsupdate/nsupdate.8 index 75b1205c2a..2de9cbcf08 100644 --- a/bin/nsupdate/nsupdate.8 +++ b/bin/nsupdate/nsupdate.8 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: nsupdate.8,v 1.1 2000/07/12 17:17:03 jim Exp $ +.\" $Id: nsupdate.8,v 1.2 2000/07/12 18:29:33 jim Exp $ .\" .Dd Jun 30, 2000 .Dt NSUPDATE 8 @@ -72,15 +72,18 @@ HMAC-MD5, which is defined in RFC 2104. Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. -Suitable +For instance suitable .Dv key{} and .Dv server{} -statements will be added to +statements would be added to .Pa /etc/named.conf -so that the appropriate secret key and algorithm can be associated -with the IP address of the +so that the name server can associate the appropriate secret key +and algorithm with the IP address of the client application that will be using TSIG authentication. +.Nm nsupdate +does not read +.Pa /etc/named.conf . .Pp .Nm nsupdate uses the @@ -104,7 +107,8 @@ is used, a signature is generated from is the name of the key, and .Ar secret -is a string comprising the shared secret. +is a string comprising the shared secret, typically written in base-64 +encoding. Use of the .Fl y option is discouraged because the shared secret is supplied as a command @@ -126,12 +130,14 @@ This may be preferable when a batch of update requests are made. .Nm nsupdate reads commands from its standard input. Each command is supplied on exactly one line of input. -Commands can be update instructions or prerequisite checks on the +Some commands are for administrative purposes. +The others are either update instructions or prerequisite checks on the contents of the zone. These checks set conditions that some name or set of resource records (RRset) either exists or is absent from the zone. These conditions must be met if the entire update request is to succeed. Updates will be rejected if the tests for the prerequisite conditions fail. +.Pp Every update request consists of zero or more prerequisites and one or more updates. This allows a suitably authenticated update request to proceed if some @@ -142,6 +148,34 @@ DNS update request to the name server. The command formats and their meaning are as follows: .Bl -ohang indent .It Xo +.Ic server Va servername Op port +.Xc +.sp 1 +Sends all dynamic update requests to the name server +.Va servername . +When no server statement is provided, +.Nm nsupdate +will send updates to the master server of the correct zone. +The MNAME field of that zone's SOA record will identify the master +server for that zone. +.Va port +is the port number on +.Va servername +where the dynamic update requests get sent. +If no port number is specified, the default DNS port number of 53 is +used. +.It Xo +.Ic zone Va zonename +.Xc +.sp 1 +Specifies that all updates are to be made to the zone +.Va zonename . +.Nm nsupdate +will determine the correct zone to update based on the rest of the input +data if no +.Va zone +statement is provided. +.It Xo .Ic prereq nxdomain Va domain-name .Xc .sp 1 @@ -258,6 +292,7 @@ long-standing rule in RFC1034 that a name must not exist as any other record type if it exists as a CNAME. (The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have SIG, KEY and NXT records.) +.Pp .Sh NAME SERVER PROCESSING .Pp When a successful update request is made, the BIND9 name server @@ -271,13 +306,13 @@ XXXJR WHEN DOES IT DO THAT??? It then sends a NOTIFY message to the zone's slave servers to inform them that the zone's contents have changed. .Sh FILES -.Bl -tag -width Kname.+157.+{random}.private -compact +.Bl -tag -width K{name}.+157.+{random}.private -compact .It Pa /etc/named.conf name server configuration file -.It Pa Kname.+157.+{random}.key +.It Pa K{name}.+157.+{random}.key base-64 encoding of HMAC-MD5 key created by .Xr dnssec-keygen 8 . -.It Pa Kname.+157.+{random}.private +.It Pa K{name}.+157.+{random}.private base-64 encoding of HMAC-MD5 key created by .Xr dnssec-keygen 8 . .El diff --git a/doc/man/bin/nsupdate.8 b/doc/man/bin/nsupdate.8 index 75b1205c2a..2de9cbcf08 100644 --- a/doc/man/bin/nsupdate.8 +++ b/doc/man/bin/nsupdate.8 @@ -13,7 +13,7 @@ .\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS .\" SOFTWARE. .\" -.\" $Id: nsupdate.8,v 1.1 2000/07/12 17:17:03 jim Exp $ +.\" $Id: nsupdate.8,v 1.2 2000/07/12 18:29:33 jim Exp $ .\" .Dd Jun 30, 2000 .Dt NSUPDATE 8 @@ -72,15 +72,18 @@ HMAC-MD5, which is defined in RFC 2104. Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. -Suitable +For instance suitable .Dv key{} and .Dv server{} -statements will be added to +statements would be added to .Pa /etc/named.conf -so that the appropriate secret key and algorithm can be associated -with the IP address of the +so that the name server can associate the appropriate secret key +and algorithm with the IP address of the client application that will be using TSIG authentication. +.Nm nsupdate +does not read +.Pa /etc/named.conf . .Pp .Nm nsupdate uses the @@ -104,7 +107,8 @@ is used, a signature is generated from is the name of the key, and .Ar secret -is a string comprising the shared secret. +is a string comprising the shared secret, typically written in base-64 +encoding. Use of the .Fl y option is discouraged because the shared secret is supplied as a command @@ -126,12 +130,14 @@ This may be preferable when a batch of update requests are made. .Nm nsupdate reads commands from its standard input. Each command is supplied on exactly one line of input. -Commands can be update instructions or prerequisite checks on the +Some commands are for administrative purposes. +The others are either update instructions or prerequisite checks on the contents of the zone. These checks set conditions that some name or set of resource records (RRset) either exists or is absent from the zone. These conditions must be met if the entire update request is to succeed. Updates will be rejected if the tests for the prerequisite conditions fail. +.Pp Every update request consists of zero or more prerequisites and one or more updates. This allows a suitably authenticated update request to proceed if some @@ -142,6 +148,34 @@ DNS update request to the name server. The command formats and their meaning are as follows: .Bl -ohang indent .It Xo +.Ic server Va servername Op port +.Xc +.sp 1 +Sends all dynamic update requests to the name server +.Va servername . +When no server statement is provided, +.Nm nsupdate +will send updates to the master server of the correct zone. +The MNAME field of that zone's SOA record will identify the master +server for that zone. +.Va port +is the port number on +.Va servername +where the dynamic update requests get sent. +If no port number is specified, the default DNS port number of 53 is +used. +.It Xo +.Ic zone Va zonename +.Xc +.sp 1 +Specifies that all updates are to be made to the zone +.Va zonename . +.Nm nsupdate +will determine the correct zone to update based on the rest of the input +data if no +.Va zone +statement is provided. +.It Xo .Ic prereq nxdomain Va domain-name .Xc .sp 1 @@ -258,6 +292,7 @@ long-standing rule in RFC1034 that a name must not exist as any other record type if it exists as a CNAME. (The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have SIG, KEY and NXT records.) +.Pp .Sh NAME SERVER PROCESSING .Pp When a successful update request is made, the BIND9 name server @@ -271,13 +306,13 @@ XXXJR WHEN DOES IT DO THAT??? It then sends a NOTIFY message to the zone's slave servers to inform them that the zone's contents have changed. .Sh FILES -.Bl -tag -width Kname.+157.+{random}.private -compact +.Bl -tag -width K{name}.+157.+{random}.private -compact .It Pa /etc/named.conf name server configuration file -.It Pa Kname.+157.+{random}.key +.It Pa K{name}.+157.+{random}.key base-64 encoding of HMAC-MD5 key created by .Xr dnssec-keygen 8 . -.It Pa Kname.+157.+{random}.private +.It Pa K{name}.+157.+{random}.private base-64 encoding of HMAC-MD5 key created by .Xr dnssec-keygen 8 . .El From 8d790f3e952bca3e3617f47023c9314a1766b1e5 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Wed, 12 Jul 2000 19:03:08 +0000 Subject: [PATCH 053/226] When lwresd is shutting down, don't explicitly send shutdown events to the clientmgr tasks, since the task manager already sends them. --- bin/named/lwresd.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/bin/named/lwresd.c b/bin/named/lwresd.c index 8ab64de382..9d9702695d 100644 --- a/bin/named/lwresd.c +++ b/bin/named/lwresd.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: lwresd.c,v 1.10 2000/06/28 00:06:24 bwelling Exp $ */ +/* $Id: lwresd.c,v 1.11 2000/07/12 19:03:08 bwelling Exp $ */ /* * Main program for the Lightweight Resolver Daemon. @@ -89,15 +89,11 @@ mem_free(void *arg, void *mem, size_t size) { static void shutdown_lwresd(isc_task_t *task, isc_event_t *event) { ns_lwresd_t *lwresd = event->ev_arg; - unsigned int i; UNUSED(task); dns_dispatchmgr_destroy(&lwresd->dispmgr); - for (i = 0; i < lwresd->ntasks; i++) - isc_task_shutdown(lwresd->cmgr[i].task); - /* * Wait for everything to die off by waiting for the sockets * to be detached. From 3dae6c46753c6e2608b15c84b77991add3e0bac3 Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Wed, 12 Jul 2000 19:39:49 +0000 Subject: [PATCH 054/226] minor cleanups from review --- bin/named/lwresd.8 | 41 ++++++++++++++++++++--------------------- doc/man/bin/lwresd.8 | 41 ++++++++++++++++++++--------------------- 2 files changed, 40 insertions(+), 42 deletions(-) diff --git a/bin/named/lwresd.8 b/bin/named/lwresd.8 index 643f62e63b..c361880eaf 100644 --- a/bin/named/lwresd.8 +++ b/bin/named/lwresd.8 @@ -14,12 +14,12 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: lwresd.8,v 1.2 2000/06/28 02:51:45 jim Exp $ +.\" $Id: lwresd.8,v 1.3 2000/07/12 19:39:49 tale Exp $ .\" .Dd Jun 30, 2000 .Dt LWRESD 8 .Os BIND9 9 -.ds vT BIND9 Programmer's Manual +.ds vT BIND 9 Programmer's Manual .Sh NAME .Nm lwresd .Nd lightweight resolver daemon @@ -36,7 +36,7 @@ .Op Fl u Ar user-id .Sh DESCRIPTION .Nm lwresd -is the daemon for processes that use the BIND9 lightweight resolver +is the daemon for processes that use the BIND 9 lightweight resolver library. The daemon is actually a DNS name server, .Nm named , @@ -60,12 +60,7 @@ requests and responses. .Pp Incoming lightweight resolver requests are decoded by .Nm lwresd -which resolves them using the DNS protocol. -.Nm lwresd -either forwards the DNS queries to the name servers listed in -.Pa /etc/resolv.conf -or else resolves the request for itself by querying its built-in list -of root name servers. +which then resolves them using the DNS protocol. When the DNS lookup completes, .Nm lwresd encodes the answers from the name servers in the lightweight @@ -88,7 +83,7 @@ is present, uses its built-in list of root name servers. In this mode of operation, .Nm lwresd -analagous to a caching-only name server, albeit one that does not +analogous to a caching-only name server, albeit one that does not receive conventional DNS queries. .Pp The lightweight resolver simplifies the task of looking up hostnames @@ -102,7 +97,7 @@ having to make many DNS queries to resolve the hostname or IP address. Without the lightweight resolver, clients would be expected to deal with the complexities of processing the DNS resource records used for IPv6 addresses, dealing -with DNAME records and possibly DNSSEC. +with DNAME records and deciphering DNSSEC. Instead of directly handling those complications, clients can make .Nm lwresd do the work for them. @@ -131,7 +126,7 @@ also runs the lightweight resolver daemon in the foreground, but logs to .Dv stderr . .It Fl i -write the daemon's process id (PID) to +write the daemon's process id to .Ar pid-file instead of the default pathname. .It Fl n @@ -158,22 +153,26 @@ instead of the default port number, 921. .It Fl s write memory usage statistics to .Dv stdout -on exit. This option is only of interest -to BIND9 developers and may be removed or changed in a future release. +on exit. +This option is only of interest to BIND 9 developers and may be +removed or changed in a future release. .It Fl t tells .Nm lwresd to chroot() to .Ar directory -immediately after reading its config file. +immediately after reading its configuration file. .It Fl u run .Nm lwresd -as UID -.Ar user-id . -The lightweight resolver daemon will change its UID after it has -carried out any privileged operations, such as writing the PID file -or creating a socket that uses its default UDP port number. +as +.Ar user-id , +which is a user name or numeric id that must be present in the +password file. +The lightweight resolver daemon will change its user-id after it has +carried out any privileged operations, such as writing the process-id +file or binding a socket to a privileged port (typically any port +less than 1024). .El .Sh FILES .Bl -tag -width /var/run/lwresd.pid -compact @@ -185,7 +184,7 @@ default process-id file .Sh SEE ALSO .Xr named 8 , .Xr lwres 3 . -.Sh BUGS +.Sh NOTES .Nm lwresd is a daemon for lightweight resolvers, not a lightweight daemon for resolvers. diff --git a/doc/man/bin/lwresd.8 b/doc/man/bin/lwresd.8 index 643f62e63b..c361880eaf 100644 --- a/doc/man/bin/lwresd.8 +++ b/doc/man/bin/lwresd.8 @@ -14,12 +14,12 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: lwresd.8,v 1.2 2000/06/28 02:51:45 jim Exp $ +.\" $Id: lwresd.8,v 1.3 2000/07/12 19:39:49 tale Exp $ .\" .Dd Jun 30, 2000 .Dt LWRESD 8 .Os BIND9 9 -.ds vT BIND9 Programmer's Manual +.ds vT BIND 9 Programmer's Manual .Sh NAME .Nm lwresd .Nd lightweight resolver daemon @@ -36,7 +36,7 @@ .Op Fl u Ar user-id .Sh DESCRIPTION .Nm lwresd -is the daemon for processes that use the BIND9 lightweight resolver +is the daemon for processes that use the BIND 9 lightweight resolver library. The daemon is actually a DNS name server, .Nm named , @@ -60,12 +60,7 @@ requests and responses. .Pp Incoming lightweight resolver requests are decoded by .Nm lwresd -which resolves them using the DNS protocol. -.Nm lwresd -either forwards the DNS queries to the name servers listed in -.Pa /etc/resolv.conf -or else resolves the request for itself by querying its built-in list -of root name servers. +which then resolves them using the DNS protocol. When the DNS lookup completes, .Nm lwresd encodes the answers from the name servers in the lightweight @@ -88,7 +83,7 @@ is present, uses its built-in list of root name servers. In this mode of operation, .Nm lwresd -analagous to a caching-only name server, albeit one that does not +analogous to a caching-only name server, albeit one that does not receive conventional DNS queries. .Pp The lightweight resolver simplifies the task of looking up hostnames @@ -102,7 +97,7 @@ having to make many DNS queries to resolve the hostname or IP address. Without the lightweight resolver, clients would be expected to deal with the complexities of processing the DNS resource records used for IPv6 addresses, dealing -with DNAME records and possibly DNSSEC. +with DNAME records and deciphering DNSSEC. Instead of directly handling those complications, clients can make .Nm lwresd do the work for them. @@ -131,7 +126,7 @@ also runs the lightweight resolver daemon in the foreground, but logs to .Dv stderr . .It Fl i -write the daemon's process id (PID) to +write the daemon's process id to .Ar pid-file instead of the default pathname. .It Fl n @@ -158,22 +153,26 @@ instead of the default port number, 921. .It Fl s write memory usage statistics to .Dv stdout -on exit. This option is only of interest -to BIND9 developers and may be removed or changed in a future release. +on exit. +This option is only of interest to BIND 9 developers and may be +removed or changed in a future release. .It Fl t tells .Nm lwresd to chroot() to .Ar directory -immediately after reading its config file. +immediately after reading its configuration file. .It Fl u run .Nm lwresd -as UID -.Ar user-id . -The lightweight resolver daemon will change its UID after it has -carried out any privileged operations, such as writing the PID file -or creating a socket that uses its default UDP port number. +as +.Ar user-id , +which is a user name or numeric id that must be present in the +password file. +The lightweight resolver daemon will change its user-id after it has +carried out any privileged operations, such as writing the process-id +file or binding a socket to a privileged port (typically any port +less than 1024). .El .Sh FILES .Bl -tag -width /var/run/lwresd.pid -compact @@ -185,7 +184,7 @@ default process-id file .Sh SEE ALSO .Xr named 8 , .Xr lwres 3 . -.Sh BUGS +.Sh NOTES .Nm lwresd is a daemon for lightweight resolvers, not a lightweight daemon for resolvers. From ecb2897c71b2268b2f828c6b563aea06320c8ee2 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Wed, 12 Jul 2000 23:56:06 +0000 Subject: [PATCH 055/226] Insist that when a fetch returns a successful event, the rdataset is associated. A test failed about a week ago because this was not true, and because it died in the event handler, diagnosing the problem was impossible. --- lib/dns/resolver.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 94a0ed6e7b..38db487176 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: resolver.c,v 1.144 2000/07/07 19:43:14 tale Exp $ */ +/* $Id: resolver.c,v 1.145 2000/07/12 23:56:06 bwelling Exp $ */ #include @@ -504,6 +504,8 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) { event->ev_sender = fctx; if (!HAVE_ANSWER(fctx)) event->result = result; + if (result == ISC_R_SUCCESS) + INSIST(dns_rdataset_isassociated(event->rdataset)); isc_task_sendanddetach(&task, (isc_event_t **)&event); } ISC_LIST_INIT(fctx->events); From 30576c592b538cab293cf6e1f6265d376cd5a12c Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Thu, 13 Jul 2000 00:19:02 +0000 Subject: [PATCH 056/226] 330. [func] New function isc_log_wouldlog(). --- CHANGES | 2 ++ lib/isc/include/isc/log.h | 13 ++++++++++- lib/isc/log.c | 45 ++++++++++++++++++++++----------------- 3 files changed, 40 insertions(+), 20 deletions(-) diff --git a/CHANGES b/CHANGES index 0772b30444..c2421bde6c 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,5 @@ + 330. [func] New function isc_log_wouldlog(). + 329. [func] omapi_auth_register() now takes a size_t argument for the length of a key's secret data. Previously OMAPI only stored secrets up to the first NUL byte. diff --git a/lib/isc/include/isc/log.h b/lib/isc/include/isc/log.h index 091c763371..f80f735d59 100644 --- a/lib/isc/include/isc/log.h +++ b/lib/isc/include/isc/log.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: log.h,v 1.25 2000/06/19 21:45:03 explorer Exp $ */ +/* $Id: log.h,v 1.26 2000/07/13 00:18:53 gson Exp $ */ #ifndef ISC_LOG_H #define ISC_LOG_H 1 @@ -627,6 +627,17 @@ isc_log_getdebuglevel(isc_log_t *lctx); * The current logging debugging level is returned. */ +isc_boolean_t +isc_log_wouldlog(isc_log_t *lctx, int level); +/* + * Determine whether logging something to 'lctx' at 'level' would + * actually cause something to be logged somewhere. + * + * If ISC_FALSE is returned, it is guaranteed that nothing would + * be logged, allowing the caller to omit unnecessary + * isc_log_write() calls and possible message preformatting. + */ + void isc_log_setduplicateinterval(isc_logconfig_t *lcfg, unsigned int interval); /* diff --git a/lib/isc/log.c b/lib/isc/log.c index 93df1fe816..e3c5d308bc 100644 --- a/lib/isc/log.c +++ b/lib/isc/log.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: log.c,v 1.38 2000/06/23 17:52:20 tale Exp $ */ +/* $Id: log.c,v 1.39 2000/07/13 00:18:51 gson Exp $ */ /* Principal Authors: DCL */ @@ -1197,6 +1197,30 @@ isc_log_open(isc_logchannel_t *channel) { return (ISC_R_SUCCESS); } +isc_boolean_t +isc_log_wouldlog(isc_log_t *lctx, int level) { + /* + * Try to avoid locking the mutex for messages which can't + * possibly be logged to any channels -- primarily debugging + * messages that the debug level is not high enough to print. + * + * If the level is (mathematically) less than or equal to the + * highest_level, or if there is a dynamic channel and the level is + * less than or equal to the debug level, the main loop must be + * entered to see if the message should really be output. + * + * NOTE: this is UNLOCKED access to the logconfig. However, + * the worst thing that can happen is that a bad decision is made + * about returning without logging, and that's not a big concern, + * because that's a risk anyway if the logconfig is being + * dynamically changed. + */ + + return (ISC_TF(level <= lctx->logconfig->highest_level || + (lctx->logconfig->dynamic && + level <= lctx->debug_level))); +} + static void isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category, isc_logmodule_t *module, int level, isc_boolean_t write_once, @@ -1232,24 +1256,7 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category, REQUIRE(category->id < lctx->category_count); REQUIRE(module->id < lctx->module_count); - /* - * Try to avoid locking the mutex for messages which can't - * possibly be logged to any channels -- primarily debugging - * messages that the debug level is not high enough to print. - * - * If the level is (mathematically) less than or equal to the - * highest_level, or if there is a dynamic channel and the level is - * less than or equal to the debug level, the main loop must be - * entered to see if the message should really be output. - * - * NOTE: this is UNLOCKED access to the logconfig. However, - * the worst thing that can happen is that a bad decision is made - * about returning without logging, and that's not a big concern, - * because that's a risk anyway if the logconfig is being - * dynamically changed. - */ - if (! (level <= lctx->logconfig->highest_level || - (lctx->logconfig->dynamic && level <= lctx->debug_level))) + if (! isc_log_wouldlog(lctx, level)) return; time_string[0] = '\0'; From 720319de674728f25ca6a1b42f087b1fcb453516 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Thu, 13 Jul 2000 00:21:27 +0000 Subject: [PATCH 057/226] Call isc_log_wouldlog in ns_client_log --- bin/named/client.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/bin/named/client.c b/bin/named/client.c index ad5fa8140e..b7ef7d018f 100644 --- a/bin/named/client.c +++ b/bin/named/client.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: client.c,v 1.98 2000/06/22 23:48:07 marka Exp $ */ +/* $Id: client.c,v 1.99 2000/07/13 00:21:27 bwelling Exp $ */ #include @@ -268,7 +268,7 @@ set_timeout(ns_client_t *client, unsigned int seconds) { if (result != ISC_R_SUCCESS) { ns_client_log(client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_CLIENT, ISC_LOG_ERROR, - "setting timouet: %s", + "setting timeout: %s", isc_result_totext(result)); /* Continue anyway. */ } @@ -1659,6 +1659,9 @@ ns_client_log(ns_client_t *client, isc_logcategory_t *category, { va_list ap; + if (isc_log_wouldlog(ns_g_lctx, level) == ISC_FALSE) + return; + va_start(ap, fmt); ns_client_logv(client, category, module, level, fmt, ap); va_end(ap); From 211ac47e07f46ed6aafc0e9f60bc7fce640964cd Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Thu, 13 Jul 2000 00:25:38 +0000 Subject: [PATCH 058/226] use isc_log_wouldlog() to avoid unnecessary formatting work when the debug level does not warrant logging --- lib/isc/unix/socket.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c index a1327a4a87..f468552736 100644 --- a/lib/isc/unix/socket.c +++ b/lib/isc/unix/socket.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: socket.c,v 1.147 2000/07/10 19:40:06 explorer Exp $ */ +/* $Id: socket.c,v 1.148 2000/07/13 00:25:38 gson Exp $ */ #include @@ -245,6 +245,9 @@ socket_log(isc_socket_t *sock, isc_sockaddr_t *address, char peerbuf[256]; va_list ap; + if (! isc_log_wouldlog(isc_lctx, level)) + return; + va_start(ap, fmt); vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap); va_end(ap); From 945c32833bd1a2caf18e8d830461d87c0e5b3a04 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Thu, 13 Jul 2000 00:27:17 +0000 Subject: [PATCH 059/226] Call isc_log_wouldlog() in a few places. --- lib/dns/xfrin.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c index 0f435c9335..278b5d506d 100644 --- a/lib/dns/xfrin.c +++ b/lib/dns/xfrin.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: xfrin.c,v 1.82 2000/07/05 20:28:34 gson Exp $ */ +/* $Id: xfrin.c,v 1.83 2000/07/13 00:27:17 bwelling Exp $ */ #include @@ -1215,6 +1215,9 @@ xfrin_log1(int level, dns_name_t *zonename, isc_sockaddr_t *masteraddr, { va_list ap; + if (isc_log_wouldlog(dns_lctx, level) == ISC_FALSE) + return; + va_start(ap, fmt); xfrin_logv(level, zonename, masteraddr, fmt, ap); va_end(ap); @@ -1229,6 +1232,9 @@ xfrin_log(dns_xfrin_ctx_t *xfr, unsigned int level, const char *fmt, ...) { va_list ap; + if (isc_log_wouldlog(dns_lctx, level) == ISC_FALSE) + return; + va_start(ap, fmt); xfrin_logv(level, &xfr->name, &xfr->masteraddr, fmt, ap); va_end(ap); From 2e1236ad1eb37716c43827df1b8585ce58592e2c Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Thu, 13 Jul 2000 00:30:58 +0000 Subject: [PATCH 060/226] Call isc_log_wouldlog() --- lib/dns/zone.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/dns/zone.c b/lib/dns/zone.c index b68971cd9c..2b4f375340 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: zone.c,v 1.156 2000/07/11 22:44:33 gson Exp $ */ +/* $Id: zone.c,v 1.157 2000/07/13 00:30:58 bwelling Exp $ */ #include @@ -3360,6 +3360,9 @@ zone_log(dns_zone_t *zone, const char *me, int level, const char *fmt, ...) { int len; isc_result_t result = ISC_R_FAILURE; + if (isc_log_wouldlog(dns_lctx, level) == ISC_FALSE) + return; + isc_buffer_init(&buffer, namebuf, sizeof(namebuf)); if (dns_name_dynamic(&zone->origin)) From d2895dd9bba25beaa167cb1fe9282855bc002768 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Thu, 13 Jul 2000 00:32:20 +0000 Subject: [PATCH 061/226] Major changes to how dighost handles lists and shutdown conditions. Probably not safe to pull up to release branch, since, though it works, it needs serious testing and more changes are still pending. In particular, I INSIST lots of things I didn't used to INSIST, which may be set off under certain conditions. --- bin/dig/dighost.c | 497 ++++++++++++++++++++++++---------------------- 1 file changed, 258 insertions(+), 239 deletions(-) diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index df7561240e..50b1e6523d 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.77 2000/07/12 00:42:54 mws Exp $ */ +/* $Id: dighost.c,v 1.78 2000/07/13 00:32:20 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -88,6 +88,7 @@ isc_sockaddr_t bind_any; char *rootspace[BUFSIZE]; isc_buffer_t rootbuf; int sendcount = 0; +int recvcount = 0; int sockcount = 0; int ndots = -1; int tries = 3; @@ -107,7 +108,7 @@ extern isc_boolean_t isc_mem_debugging; isc_boolean_t debugging = ISC_FALSE; char *progname = NULL; -static isc_boolean_t +static void cancel_lookup(dig_lookup_t *lookup); static int @@ -237,8 +238,7 @@ requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { debug("requeue_lookup()"); - if (free_now) - return(ISC_R_SUCCESS); + INSIST(!free_now); lookup_counter++; if (lookup_counter > LOOKUP_LIMIT) @@ -615,19 +615,114 @@ add_question(dns_message_t *message, dns_name_t *name, } /* - * Return ISC_TRUE if we're in the process of shutting down on the - * return. + * We're done iff all the counts are zero and the lookup list is empty */ +static void +check_if_done(void) { + debug("check_if_done()"); + if ((sockcount == 0) && (recvcount == 0) && (sendcount == 0) + && ISC_LIST_EMPTY(lookup_list)) { + debug("shutting down"); + dighost_shutdown(); + } +} + +/* + * Clear out a query when we're done with it. WARNING: This routine + * WILL invalidate the query pointer. + */ +static void +clear_query(dig_query_t *query) { + dig_lookup_t *lookup; + + REQUIRE(query != NULL); + + lookup = query->lookup; + ISC_LIST_UNLINK(lookup->q, query, link); + if (ISC_LINK_LINKED(&query->recvbuf, link)) + ISC_LIST_DEQUEUE(query->recvlist, &query->recvbuf, + link); + if (ISC_LINK_LINKED(&query->lengthbuf, link)) + ISC_LIST_DEQUEUE(query->lengthlist, &query->lengthbuf, + link); + isc_buffer_invalidate(&query->recvbuf); + isc_buffer_invalidate(&query->lengthbuf); + isc_mem_free(mctx, query); +} + static isc_boolean_t -check_next_lookup(dig_lookup_t *lookup) { +try_clear_lookup(dig_lookup_t *lookup) { + dig_server_t *s; + void *ptr; + + REQUIRE(lookup != NULL); + + if (ISC_LIST_HEAD(lookup->q) != NULL) + return (ISC_FALSE); + /* + * At this point, we know there are no queries on the lookup, + * so can make it go away also. + */ + if (lookup->use_my_server_list) { + s = ISC_LIST_HEAD(lookup->my_server_list); + while (s != NULL) { + debug("freeing server %p belonging to %p", + s, lookup); + ptr = s; + s = ISC_LIST_NEXT(s, link); + ISC_LIST_DEQUEUE(lookup->my_server_list, + (dig_server_t *)ptr, link); + isc_mem_free(mctx, ptr); + } + } + if (lookup->sendmsg != NULL) + dns_message_destroy(&lookup->sendmsg); + if (lookup->querysig != NULL) { + debug("freeing buffer %p", lookup->querysig); + isc_buffer_free(&lookup->querysig); + } + if (lookup->timer != NULL) + isc_timer_detach(&lookup->timer); + + ptr = lookup; + lookup = ISC_LIST_NEXT(lookup, link); + ISC_LIST_DEQUEUE(lookup_list, (dig_lookup_t *)ptr, link); + isc_mem_free(mctx, ptr); + return (ISC_TRUE); +} + + +/* + * If we can, start the next lookup in the queue running. + * This assumes that the lookup on the head of the queue hasn't been + * started yet. + */ +static void +begin_next_lookup(void) { dig_lookup_t *next; + + next = ISC_LIST_HEAD(lookup_list); + if (next != NULL) { + setup_lookup(next); + do_lookup(next); + } else { + check_if_done(); + } +} + +/* + * WARNING: The following routine may invalidate the lookup pointer. + * Never depend on being able to reference lookup or query pointers on the + * current lookup after calling this. + */ +static void +check_next_lookup(dig_lookup_t *lookup) { dig_query_t *query; isc_boolean_t still_working=ISC_FALSE; - if (free_now) - return (ISC_TRUE); + INSIST(!free_now); - debug("check_next_lookup(%p)", lookup); + debug("is_lookup_done(%p)", lookup); for (query = ISC_LIST_HEAD(lookup->q); query != NULL; query = ISC_LIST_NEXT(query, link)) { @@ -637,54 +732,11 @@ check_next_lookup(dig_lookup_t *lookup) { } } if (still_working) - return (ISC_FALSE); - - debug("have %d retries left for %s", - lookup->retries-1, lookup->textname); - debug("lookup %s pending", lookup->pending ? "is" : "is not"); - - next = ISC_LIST_NEXT(lookup, link); - - if (lookup->tcp_mode) { - if (next == NULL) { - debug("shutting down", stderr); - dighost_shutdown(); - return (ISC_TRUE); - } - if (next->sendmsg == NULL) { - debug("setting up for TCP"); - setup_lookup(next); - do_lookup(next); - } - } else { - if (!lookup->pending) { - if (next == NULL) { - debug("shutting down", stderr); - dighost_shutdown(); - return (ISC_TRUE); - } - if (next->sendmsg == NULL) { - debug("setting up for UDP"); - setup_lookup(next); - do_lookup(next); - } - } else { - if (lookup->retries > 1) { - debug("retrying"); - lookup->retries --; - if (lookup->timer != NULL) - isc_timer_detach(&lookup->timer); - send_udp(lookup); - } else { - debug("cancelling"); - return(cancel_lookup(lookup)); - } - } - } - return (ISC_FALSE); + return; + if (try_clear_lookup(lookup)) + begin_next_lookup(); } - static void followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) { @@ -699,9 +751,9 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, isc_boolean_t success = ISC_FALSE; int len; + INSIST(!free_now); + debug("followup_lookup()"); - if (free_now) - return; result = dns_message_firstname(msg,section); if (result != ISC_R_SUCCESS) { debug("firstname returned %s", @@ -810,9 +862,9 @@ next_origin(dns_message_t *msg, dig_query_t *query) { UNUSED(msg); + INSIST(!free_now); + debug("next_origin()"); - if (free_now) - return; debug("following up %s", query->lookup->textname); if (query->lookup->origin == NULL) { @@ -903,12 +955,10 @@ setup_lookup(dig_lookup_t *lookup) { char store[MXNAME]; REQUIRE(lookup != NULL); - + INSIST(!free_now); + debug("setup_lookup(%p)",lookup); - if (free_now) - return; - debug("setting up for looking up %s @%p->%p", lookup->textname, lookup, lookup->link.next); @@ -1142,12 +1192,12 @@ send_done(isc_task_t *task, isc_event_t *event) { isc_event_free(&event); debug("send_done()"); + sendcount--; + debug("sendcount=%d",sendcount); + INSIST(sendcount >= 0); } -/* - * Return ISC_TRUE if we're in the process of shutting down - */ -static isc_boolean_t +void cancel_lookup(dig_lookup_t *lookup) { dig_query_t *query = NULL; @@ -1163,12 +1213,13 @@ cancel_lookup(dig_lookup_t *lookup) { ISC_SOCKCANCEL_ALL); isc_socket_detach(&query->sock); sockcount--; - debug("socket = %d", sockcount); + debug("sockcount=%d", sockcount); + INSIST(sockcount >= 0); + check_if_done(); } } lookup->pending = ISC_FALSE; lookup->retries = 0; - return(check_next_lookup(lookup)); } static void @@ -1214,8 +1265,8 @@ for (query = ISC_LIST_HEAD(lookup->q); result = isc_socket_recvv(query->sock, &query->recvlist, 1, global_task, recv_done, query); check_result(result, "isc_socket_recvv"); - sendcount++; - debug("sent count number %d", sendcount); + recvcount++; + debug("recvcount=%d", recvcount); ISC_LIST_ENQUEUE(query->sendlist, &lookup->sendbuf, link); debug("sending a request"); result = isc_time_now(&query->time_sent); @@ -1225,6 +1276,7 @@ for (query = ISC_LIST_HEAD(lookup->q); global_task, send_done, query, &query->sockaddr, NULL); check_result(result, "isc_socket_sendtov"); + sendcount++; } } @@ -1253,27 +1305,26 @@ connect_timeout(isc_task_t *task, isc_event_t *event) { q != NULL; q = ISC_LIST_NEXT(q, link)) { if (q->working) { - if (!free_now) { - isc_buffer_clear(b); - result = isc_sockaddr_totext(&q->sockaddr, b); - check_result(result, "isc_sockaddr_totext"); - isc_buffer_usedregion(b, &r); - if ((q->lookup->retries > 1) && - (!q->lookup->tcp_mode)) - printf(";; Connection to server %.*s " - "for %s timed out. " - "Retrying %d.\n", - (int)r.length, r.base, - q->lookup->textname, - q->lookup->retries-1); - else { - printf(";; Connection to " - "server %.*s " - "for %s timed out. " - "Giving up.\n", - (int)r.length, r.base, - q->lookup->textname); - } + INSIST(!free_now); + isc_buffer_clear(b); + result = isc_sockaddr_totext(&q->sockaddr, b); + check_result(result, "isc_sockaddr_totext"); + isc_buffer_usedregion(b, &r); + if ((q->lookup->retries > 1) && + (!q->lookup->tcp_mode)) + printf(";; Connection to server %.*s " + "for %s timed out. " + "Retrying %d.\n", + (int)r.length, r.base, + q->lookup->textname, + q->lookup->retries-1); + else { + printf(";; Connection to " + "server %.*s " + "for %s timed out. " + "Giving up.\n", + (int)r.length, r.base, + q->lookup->textname); } isc_socket_cancel(q->sock, task, ISC_SOCKCANCEL_ALL); @@ -1295,16 +1346,12 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) { isc_uint16_t length; REQUIRE(event->ev_type == ISC_SOCKEVENT_RECVDONE); + INSIST(!free_now); UNUSED(task); debug("tcp_length_done()"); - if (free_now) { - isc_event_free(&event); - return; - } - sevent = (isc_socketevent_t *)event; query = event->ev_arg; @@ -1326,9 +1373,10 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) { isc_result_totext(sevent->result)); isc_buffer_free(&b); query->working = ISC_FALSE; - sockcount--; - debug("socket = %d",sockcount); isc_socket_detach(&query->sock); + sockcount--; + debug("sockcount=%d",sockcount); + INSIST(sockcount >= 0); isc_event_free(&event); check_next_lookup(query->lookup); return; @@ -1354,7 +1402,9 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) { result = isc_socket_recvv(query->sock, &query->recvlist, length, task, recv_done, query); check_result(result, "isc_socket_recvv"); - debug("resubmitted recv request with length %d", length); + recvcount++; + debug("resubmitted recv request with length %d, recvcount=%d", + length, recvcount); isc_event_free(&event); } @@ -1362,16 +1412,16 @@ static void launch_next_query(dig_query_t *query, isc_boolean_t include_question) { isc_result_t result; - debug("launch_next_query()"); + INSIST(!free_now); - if (free_now) - return; + debug("launch_next_query()"); if (!query->lookup->pending) { debug("ignoring launch_next_query because !pending"); - sockcount--; - debug("socket = %d", sockcount); isc_socket_detach(&query->sock); + sockcount--; + debug("sockcount=%d", sockcount); + INSIST(sockcount >= 0); query->working = ISC_FALSE; query->waiting_connect = ISC_FALSE; check_next_lookup(query->lookup); @@ -1391,14 +1441,17 @@ launch_next_query(dig_query_t *query, isc_boolean_t include_question) { result = isc_socket_recvv(query->sock, &query->lengthlist, 0, global_task, tcp_length_done, query); check_result(result, "isc_socket_recvv"); - sendcount++; + recvcount++; + debug("recvcount=%d",recvcount); if (!query->first_soa_rcvd) { debug("sending a request"); result = isc_time_now(&query->time_sent); check_result(result, "isc_time_now"); result = isc_socket_sendv(query->sock, &query->sendlist, global_task, send_done, query); - check_result(result, "isc_socket_recvv"); + check_result(result, "isc_socket_sendv"); + sendcount++; + debug("sendcount=%d", sendcount); } query->waiting_connect = ISC_FALSE; check_next_lookup(query->lookup); @@ -1416,14 +1469,10 @@ connect_done(isc_task_t *task, isc_event_t *event) { UNUSED(task); REQUIRE(event->ev_type == ISC_SOCKEVENT_CONNECT); + INSIST(!free_now); debug("connect_done()"); - if (free_now) { - isc_event_free(&event); - return; - } - sevent = (isc_socketevent_t *)event; query = sevent->ev_arg; @@ -1644,38 +1693,30 @@ recv_done(isc_task_t *task, isc_event_t *event) { isc_buffer_t ab; char abspace[MXNAME]; isc_region_t r; - dig_lookup_t *n; + dig_lookup_t *n, *l; isc_boolean_t docancel = ISC_FALSE; - isc_boolean_t result_bool; unsigned int local_timeout; UNUSED(task); + INSIST(!free_now); debug("recv_done()"); - if (free_now) { - isc_event_free(&event); - return; - } + recvcount--; + debug("recvcount=%d", recvcount); + INSIST(recvcount >= 0); query = event->ev_arg; debug("lookup=%p, query=%p", query->lookup, query); - if (free_now) { - debug("bailing out, since freeing now"); - isc_event_free(&event); - return; - } + l = query->lookup; - sendcount--; - debug("in recv_done, counter down to %d", sendcount); REQUIRE(event->ev_type == ISC_SOCKEVENT_RECVDONE); sevent = (isc_socketevent_t *)event; - if ((query->lookup->tcp_mode) && - (query->lookup->timer != NULL)) - isc_timer_touch(query->lookup->timer); - if (!query->lookup->pending && !query->lookup->ns_search_only) { + if ((l->tcp_mode) && (l->timer != NULL)) + isc_timer_touch(l->timer); + if (!l->pending && !l->ns_search_only) { debug("no longer pending. Got %s", isc_result_totext(sevent->result)); @@ -1683,10 +1724,8 @@ recv_done(isc_task_t *task, isc_event_t *event) { query->waiting_connect = ISC_FALSE; isc_event_free(&event); - /* - * In this case, we don't actually use result_bool - */ - result_bool = cancel_lookup(query->lookup); + clear_query(query); + check_next_lookup(l); return; } @@ -1698,24 +1737,24 @@ recv_done(isc_task_t *task, isc_event_t *event) { check_result(result, "dns_message_create"); if (key != NULL) { - debug("querysig 1 is %p", query->lookup->querysig); - if (query->lookup->querysig == NULL) { + debug("querysig 1 is %p", l->querysig); + if (l->querysig == NULL) { debug("getting initial querysig"); result = dns_message_getquerytsig( - query->lookup->sendmsg, - mctx, &query->lookup->querysig); + l->sendmsg, + mctx, &l->querysig); check_result(result, "dns_message_getquerytsig"); } result = dns_message_setquerytsig(msg, - query->lookup->querysig); + l->querysig); check_result(result, "dns_message_setquerytsig"); result = dns_message_settsigkey(msg, key); check_result(result, "dns_message_settsigkey"); - msg->tsigctx = query->lookup->tsigctx; - if (query->lookup->msgcounter != 0) + msg->tsigctx = l->tsigctx; + if (l->msgcounter != 0) msg->tcp_continuation = 1; - query->lookup->msgcounter++; + l->msgcounter++; } debug("before parse starts"); result = dns_message_parse(msg, b, ISC_TRUE); @@ -1724,18 +1763,20 @@ recv_done(isc_task_t *task, isc_event_t *event) { hex_dump(b); query->working = ISC_FALSE; query->waiting_connect = ISC_FALSE; - if (!query->lookup->tcp_mode) { + if (!l->tcp_mode) { printf(";; Retrying in TCP mode.\n"); - n = requeue_lookup(query->lookup, ISC_TRUE); + n = requeue_lookup(l, ISC_TRUE); n->tcp_mode = ISC_TRUE; } dns_message_destroy(&msg); isc_event_free(&event); - result_bool = cancel_lookup(query->lookup); + clear_query(query); + cancel_lookup(l); + check_next_lookup(l); return; } if (key != NULL) { - debug("querysig 2 is %p", query->lookup->querysig); + debug("querysig 2 is %p", l->querysig); debug("before verify"); result = dns_tsig_verify(&query->recvbuf, msg, NULL, keyring); @@ -1745,29 +1786,29 @@ recv_done(isc_task_t *task, isc_event_t *event) { dns_result_totext(result)); validated = ISC_FALSE; } - query->lookup->tsigctx = msg->tsigctx; - if (query->lookup->querysig != NULL) { + l->tsigctx = msg->tsigctx; + if (l->querysig != NULL) { debug("freeing querysig buffer %p", - query->lookup->querysig); - isc_buffer_free(&query->lookup->querysig); + l->querysig); + isc_buffer_free(&l->querysig); } result = dns_message_getquerytsig(msg, mctx, - &query->lookup->querysig); + &l->querysig); check_result(result,"dns_message_getquerytsig"); - debug("querysig 3 is %p", query->lookup->querysig); + debug("querysig 3 is %p", l->querysig); } debug("after parse"); - if (query->lookup->xfr_q == NULL) { - query->lookup->xfr_q = query; + if (l->xfr_q == NULL) { + l->xfr_q = query; /* * Once we are in the XFR message, increase * the timeout to much longer, so brief network * outages won't cause the XFR to abort */ if ((timeout != INT_MAX) && - (query->lookup->timer != NULL)) { + (l->timer != NULL)) { if (timeout == 0) { - if (query->lookup->tcp_mode) + if (l->tcp_mode) local_timeout = TCP_TIMEOUT; else local_timeout = UDP_TIMEOUT; @@ -1779,62 +1820,62 @@ recv_done(isc_task_t *task, isc_event_t *event) { } debug("have local timeout of %d", local_timeout); - isc_interval_set(&query->lookup->interval, + isc_interval_set(&l->interval, local_timeout, 0); - result = isc_timer_reset(query->lookup->timer, + result = isc_timer_reset(l->timer, isc_timertype_once, NULL, - &query->lookup->interval, + &l->interval, ISC_FALSE); check_result(result, "isc_timer_reset"); } } - if (query->lookup->xfr_q == query) { - if ((query->lookup->trace)|| - (query->lookup->ns_search_only)) { + if (l->xfr_q == query) { + if ((l->trace)|| + (l->ns_search_only)) { debug("in TRACE code"); if (show_details || (((dns_message_firstname(msg, DNS_SECTION_ANSWER) == ISC_R_SUCCESS)) && - !query->lookup->trace_root)) { + !l->trace_root)) { printmessage(query, msg, ISC_TRUE); } if ((msg->rcode != 0) && - (query->lookup->origin != NULL)) { + (l->origin != NULL)) { next_origin(msg, query); } else { result = dns_message_firstname (msg,DNS_SECTION_ANSWER); if ((result != ISC_R_SUCCESS) || - query->lookup->trace_root) + l->trace_root) followup_lookup(msg, query, DNS_SECTION_AUTHORITY); } } else if ((msg->rcode != 0) && - (query->lookup->origin != NULL)) { + (l->origin != NULL)) { next_origin(msg, query); if (show_details) { printmessage(query, msg, ISC_TRUE); } } else { if (query->first_soa_rcvd && - query->lookup->doing_xfr) + l->doing_xfr) printmessage(query, msg, ISC_FALSE); else printmessage(query, msg, ISC_TRUE); } } else if ((dns_message_firstname(msg, DNS_SECTION_ANSWER) == ISC_R_SUCCESS) && - query->lookup->ns_search_only && - !query->lookup->trace_root ) { + l->ns_search_only && + !l->trace_root ) { printmessage(query, msg, ISC_TRUE); } - if (query->lookup->pending) + if (l->pending) debug("still pending."); - if (query->lookup->doing_xfr) { - if (query != query->lookup->xfr_q) { + if (l->doing_xfr) { + if (query != l->xfr_q) { dns_message_destroy(&msg); isc_event_free (&event); query->working = ISC_FALSE; @@ -1844,7 +1885,8 @@ recv_done(isc_task_t *task, isc_event_t *event) { docancel = check_for_more_data(query, msg, sevent); if (docancel) { dns_message_destroy(&msg); - result_bool = cancel_lookup(query->lookup); + clear_query(query); + cancel_lookup(l); } if (msg != NULL) dns_message_destroy(&msg); @@ -1852,7 +1894,7 @@ recv_done(isc_task_t *task, isc_event_t *event) { } else { if ((msg->rcode == 0) || - (query->lookup->origin == NULL)) { + (l->origin == NULL)) { isc_buffer_init(&ab, abspace, MXNAME); result = isc_sockaddr_totext(&sevent->address, &ab); @@ -1869,17 +1911,16 @@ recv_done(isc_task_t *task, isc_event_t *event) { } query->working = ISC_FALSE; query->lookup->pending = ISC_FALSE; - result_bool = ISC_FALSE; if (!query->lookup->ns_search_only || query->lookup->trace_root) { dns_message_destroy(&msg); - result_bool = cancel_lookup(query->lookup); + cancel_lookup(l); } if (msg != NULL) dns_message_destroy(&msg); isc_event_free(&event); - if ((!free_now) && (!result_bool)) - check_next_lookup(query->lookup); + clear_query(query); + check_next_lookup(l); } return; } @@ -1892,7 +1933,8 @@ recv_done(isc_task_t *task, isc_event_t *event) { query->working = ISC_FALSE; query->waiting_connect = ISC_FALSE; isc_event_free(&event); - check_next_lookup(query->lookup); + clear_query(query); + check_next_lookup(l); return; } fatal("recv_done got result %s", @@ -1972,13 +2014,13 @@ do_lookup_tcp(dig_lookup_t *lookup) { query->waiting_connect = ISC_TRUE; get_address(query->servname, port, &query->sockaddr); - sockcount++; - debug("socket = %d",sockcount); ENSURE(query->sock == NULL); result = isc_socket_create(socketmgr, isc_sockaddr_pf(&query->sockaddr), isc_sockettype_tcp, &query->sock) ; check_result(result, "isc_socket_create"); + sockcount++; + debug("sockcount=%d",sockcount); if (specified_source) result = isc_socket_bind(query->sock, &bind_address); else { @@ -2011,12 +2053,12 @@ do_lookup_udp(dig_lookup_t *lookup) { query->waiting_connect = ISC_FALSE; get_address(query->servname, port, &query->sockaddr); - sockcount++; - debug("socket = %d", sockcount); result = isc_socket_create(socketmgr, isc_sockaddr_pf(&query->sockaddr), isc_sockettype_udp, &query->sock); check_result(result, "isc_socket_create"); + sockcount++; + debug("sockcount=%d", sockcount); if (specified_source) result = isc_socket_bind(query->sock, &bind_address); else { @@ -2048,10 +2090,9 @@ void start_lookup(void) { dig_lookup_t *lookup; - debug("start_lookup()"); + INSIST(!free_now); - if (free_now) - return; + debug("start_lookup()"); lookup = ISC_LIST_HEAD(lookup_list); if (lookup != NULL) { @@ -2067,20 +2108,16 @@ onrun_callback(isc_task_t *task, isc_event_t *event) { start_lookup(); } -void -free_lists(void) { - void *ptr; +#if 0 +/* + * This will be used in the SIGINT handler, and perhaps other places. + */ +static void +cancel_all(void) { dig_lookup_t *l; dig_query_t *q; - dig_server_t *s; - dig_searchlist_t *o; - debug("free_lists()"); - - if (free_now) - return; - - free_now = ISC_TRUE; + debug ("cancel_all()"); l = ISC_LIST_HEAD(lookup_list); while (l != NULL) { @@ -2095,12 +2132,35 @@ free_lists(void) { ISC_SOCKCANCEL_ALL); isc_socket_detach(&q->sock); sockcount--; - debug("socket = %d",sockcount); + debug("sockcount=%d",sockcount); + INSIST(sockcount >= 0); + check_if_done(); } q = ISC_LIST_NEXT(q, link); } l = ISC_LIST_NEXT(l, link); } + check_if_done(); +} +#endif + +void +free_lists(void) { + void *ptr; + dig_server_t *s; + dig_searchlist_t *o; + + debug("free_lists()"); + + REQUIRE(sockcount == 0); + REQUIRE(recvcount == 0); + REQUIRE(sendcount == 0); + + INSIST(ISC_LIST_HEAD(lookup_list) == NULL); + INSIST(!free_now); + + free_now = ISC_TRUE; + s = ISC_LIST_HEAD(server_list); while (s != NULL) { debug("freeing global server %p", s); @@ -2136,47 +2196,6 @@ free_lists(void) { if (namebuf != NULL) isc_buffer_free(&namebuf); - l = ISC_LIST_HEAD(lookup_list); - while (l != NULL) { - q = ISC_LIST_HEAD(l->q); - while (q != NULL) { - debug("freeing query %p, belonging to %p", - q, l); - if (ISC_LINK_LINKED(&q->recvbuf, link)) - ISC_LIST_DEQUEUE(q->recvlist, &q->recvbuf, - link); - if (ISC_LINK_LINKED(&q->lengthbuf, link)) - ISC_LIST_DEQUEUE(q->lengthlist, &q->lengthbuf, - link); - isc_buffer_invalidate(&q->recvbuf); - isc_buffer_invalidate(&q->lengthbuf); - ptr = q; - q = ISC_LIST_NEXT(q, link); - isc_mem_free(mctx, ptr); - } - if (l->use_my_server_list) { - s = ISC_LIST_HEAD(l->my_server_list); - while (s != NULL) { - debug("freeing server %p belonging to %p", - s, l); - ptr = s; - s = ISC_LIST_NEXT(s, link); - isc_mem_free(mctx, ptr); - - } - } - if (l->sendmsg != NULL) - dns_message_destroy(&l->sendmsg); - if (l->querysig != NULL) { - debug("freeing buffer %p", l->querysig); - isc_buffer_free(&l->querysig); - } - - ptr = l; - l = ISC_LIST_NEXT(l, link); - isc_mem_free(mctx, ptr); - } - if (keyring != NULL) { debug("freeing keyring %p", keyring); dns_tsigkeyring_destroy(&keyring); From febc974d0fc0066282e91d38f895004a27cd40d7 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Thu, 13 Jul 2000 01:13:53 +0000 Subject: [PATCH 062/226] Use isc_log_wouldlog() to avoid calling strerror() whenever possible. --- lib/isc/unix/socket.c | 39 +++++++++++++++++++++++++-------------- 1 file changed, 25 insertions(+), 14 deletions(-) diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c index f468552736..7c8900350d 100644 --- a/lib/isc/unix/socket.c +++ b/lib/isc/unix/socket.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: socket.c,v 1.148 2000/07/13 00:25:38 gson Exp $ */ +/* $Id: socket.c,v 1.149 2000/07/13 01:13:53 bwelling Exp $ */ #include @@ -76,11 +76,17 @@ * DLVL(50) -- Event tracing, including receiving/sending completion events. * DLVL(20) -- Socket creation/destruction. */ -#define TRACE DLVL(90) -#define CORRECTNESS DLVL(70) -#define IOEVENT DLVL(60) -#define EVENT DLVL(50) -#define CREATION DLVL(20) +#define TRACE_LEVEL 90 +#define CORRECTNESS_LEVEL 70 +#define IOEVENT_LEVEL 60 +#define EVENT_LEVEL 50 +#define CREATION_LEVEL 20 + +#define TRACE DLVL(TRACE_LEVEL) +#define CORRECTNESS DLVL(CORRECTNESS_LEVEL) +#define IOEVENT DLVL(IOEVENT_LEVEL) +#define EVENT DLVL(EVENT_LEVEL) +#define CREATION DLVL(CREATION_LEVEL) typedef isc_event_t intev_t; @@ -744,9 +750,10 @@ doio_recv(isc_socket_t *sock, isc_socketevent_t *dev) { if (SOFT_ERROR(errno)) return (DOIO_SOFT); - socket_log(sock, NULL, IOEVENT, - "doio_recv: recvmsg(%d) %d bytes, err %d/%s", - sock->fd, cc, errno, strerror(errno)); + if (isc_log_wouldlog(isc_lctx, IOEVENT_LEVEL)) + socket_log(sock, NULL, IOEVENT, + "doio_recv: recvmsg(%d) %d bytes, err %d/%s", + sock->fd, cc, errno, strerror(errno)); #define SOFT_OR_HARD(_system, _isc) \ if (errno == _system) { \ @@ -1521,8 +1528,10 @@ internal_accept(isc_task_t *me, isc_event_t *ev) { * If some other error, ignore it as well and hope * for the best, but log it. */ - socket_log(sock, NULL, TRACE, - "accept() returned %d/%s", errno, strerror(errno)); + if (isc_log_wouldlog(isc_lctx, TRACE_LEVEL)) + socket_log(sock, NULL, TRACE, + "accept() returned %d/%s", errno, + strerror(errno)); fd = -1; @@ -1802,9 +1811,11 @@ watcher(void *uap) { UNLOCK(&manager->lock); cc = select(maxfd, &readfds, &writefds, NULL, NULL); - manager_log(manager, IOEVENT, - "select(%d, ...) == %d, errno %d/%s", - maxfd, cc, errno, strerror(errno)); + if (isc_log_wouldlog(isc_lctx, IOEVENT_LEVEL)) + manager_log(manager, IOEVENT, + "select(%d, ...) == %d, " + "errno %d/%s", + maxfd, cc, errno, strerror(errno)); if (cc < 0) { if (!SOFT_ERROR(errno)) FATAL_ERROR(__FILE__, __LINE__, From 9317787889b6d2437b2f8e77583b49246f7511fe Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Thu, 13 Jul 2000 01:16:22 +0000 Subject: [PATCH 063/226] use isc_log_wouldlog() --- lib/dns/dispatch.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c index 0c6c2de5d8..3b2ef22338 100644 --- a/lib/dns/dispatch.c +++ b/lib/dns/dispatch.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dispatch.c,v 1.58 2000/07/04 01:48:10 tale Exp $ */ +/* $Id: dispatch.c,v 1.59 2000/07/13 01:16:22 gson Exp $ */ #include @@ -189,6 +189,9 @@ dispatch_log(dns_dispatch_t *disp, int level, const char *fmt, ...) { char msgbuf[2048]; va_list ap; + if (! isc_log_wouldlog(dns_lctx, level)) + return; + va_start(ap, fmt); vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap); va_end(ap); From 738310d8cf560c8e246c81d5ecccf4c96e567a58 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Thu, 13 Jul 2000 01:22:38 +0000 Subject: [PATCH 064/226] It's probably a bad idea to pre-allocate 64K buffers for each lookup as soon as you read in the batch file. Don't. --- bin/dig/dig.c | 8 ++++---- bin/dig/dighost.c | 15 +++++++++++++-- bin/dig/host.c | 4 ++-- bin/dig/include/dig/dig.h | 6 +++--- bin/dig/nslookup.c | 4 ++-- 5 files changed, 24 insertions(+), 13 deletions(-) diff --git a/bin/dig/dig.c b/bin/dig/dig.c index 1d8943fde5..de80861cfe 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.c,v 1.61 2000/07/12 17:44:03 mws Exp $ */ +/* $Id: dig.c,v 1.62 2000/07/13 01:22:33 mws Exp $ */ #include #include @@ -1047,7 +1047,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { strcpy(lookup->rttext, "ptr"); strcpy(lookup->rctext, "in"); lookup->namespace[0] = 0; - lookup->sendspace[0] = 0; + lookup->sendspace = NULL; lookup->sendmsg = NULL; lookup->name = NULL; lookup->oname = NULL; @@ -1112,7 +1112,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { lookup->rttext[0] = 0; lookup->rctext[0] = 0; lookup->namespace[0] = 0; - lookup->sendspace[0] = 0; + lookup->sendspace = NULL; lookup->sendmsg = NULL; lookup->name = NULL; lookup->oname = NULL; @@ -1189,7 +1189,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { lookup->pending = ISC_FALSE; lookup->rctext[0] = 0; lookup->namespace[0] = 0; - lookup->sendspace[0] = 0; + lookup->sendspace = NULL; lookup->sendmsg = NULL; lookup->name = NULL; lookup->oname = NULL; diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index 50b1e6523d..60c5ed006a 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.78 2000/07/13 00:32:20 mws Exp $ */ +/* $Id: dighost.c,v 1.79 2000/07/13 01:22:34 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -252,7 +252,7 @@ requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { strncpy(looknew->rttext, lookold-> rttext, 32); strncpy(looknew->rctext, lookold-> rctext, 32); looknew->namespace[0] = 0; - looknew->sendspace[0] = 0; + looknew->sendspace = NULL; looknew->sendmsg = NULL; looknew->name = NULL; looknew->oname = NULL; @@ -645,6 +645,8 @@ clear_query(dig_query_t *query) { if (ISC_LINK_LINKED(&query->lengthbuf, link)) ISC_LIST_DEQUEUE(query->lengthlist, &query->lengthbuf, link); + INSIST(query->recvspace != NULL); + isc_mem_put(mctx, query->recvspace, COMMSIZE); isc_buffer_invalidate(&query->recvbuf); isc_buffer_invalidate(&query->lengthbuf); isc_mem_free(mctx, query); @@ -683,6 +685,8 @@ try_clear_lookup(dig_lookup_t *lookup) { } if (lookup->timer != NULL) isc_timer_detach(&lookup->timer); + INSIST(lookup->sendspace != NULL); + isc_mem_put(mctx, lookup->sendspace, COMMSIZE); ptr = lookup; lookup = ISC_LIST_NEXT(lookup, link); @@ -1129,6 +1133,10 @@ setup_lookup(dig_lookup_t *lookup) { lookup->querysig = NULL; } + lookup->sendspace = isc_mem_get(mctx, COMMSIZE); + if (lookup->sendspace == NULL) + fatal("memory allocation failure"); + debug("starting to render the message"); isc_buffer_init(&lookup->sendbuf, lookup->sendspace, COMMSIZE); result = dns_message_renderbegin(lookup->sendmsg, &lookup->sendbuf); @@ -1172,6 +1180,9 @@ setup_lookup(dig_lookup_t *lookup) { ISC_LIST_INIT(query->recvlist); ISC_LIST_INIT(query->lengthlist); query->sock = NULL; + query->recvspace = isc_mem_get(mctx, COMMSIZE); + if (query->recvspace == NULL) + fatal("memory allocation failure"); isc_buffer_init(&query->recvbuf, query->recvspace, COMMSIZE); isc_buffer_init(&query->lengthbuf, query->lengthspace, 2); diff --git a/bin/dig/host.c b/bin/dig/host.c index ca67b84600..d73a1f5069 100644 --- a/bin/dig/host.c +++ b/bin/dig/host.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: host.c,v 1.37 2000/07/10 18:02:29 bwelling Exp $ */ +/* $Id: host.c,v 1.38 2000/07/13 01:22:35 mws Exp $ */ #include #include @@ -661,7 +661,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { strncpy(lookup->rttext, querytype, 32); strncpy(lookup->rctext, queryclass, 32); lookup->namespace[0] = 0; - lookup->sendspace[0] = 0; + lookup->sendspace = NULL; lookup->sendmsg = NULL; lookup->name = NULL; lookup->oname = NULL; diff --git a/bin/dig/include/dig/dig.h b/bin/dig/include/dig/dig.h index 66d2c3f431..120f7c3201 100644 --- a/bin/dig/include/dig/dig.h +++ b/bin/dig/include/dig/dig.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.h,v 1.30 2000/07/10 18:02:31 bwelling Exp $ */ +/* $Id: dig.h,v 1.31 2000/07/13 01:22:38 mws Exp $ */ #ifndef DIG_H #define DIG_H @@ -99,7 +99,7 @@ struct dig_lookup { isc_buffer_t namebuf; isc_buffer_t onamebuf; isc_buffer_t sendbuf; - char sendspace[COMMSIZE]; + char *sendspace; dns_name_t *name; isc_timer_t *timer; isc_interval_t interval; @@ -139,7 +139,7 @@ struct dig_query { isc_buffer_t recvbuf, lengthbuf, slbuf; - char recvspace[COMMSIZE], + char *recvspace, lengthspace[4], slspace[4]; isc_socket_t *sock; diff --git a/bin/dig/nslookup.c b/bin/dig/nslookup.c index 6de37deabf..5f032a4923 100644 --- a/bin/dig/nslookup.c +++ b/bin/dig/nslookup.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: nslookup.c,v 1.23 2000/07/05 23:28:30 mws Exp $ */ +/* $Id: nslookup.c,v 1.24 2000/07/13 01:22:36 mws Exp $ */ #include @@ -651,7 +651,7 @@ addlookup(char *opt) { strncpy (lookup->rttext, deftype, MXNAME); strncpy (lookup->rctext, defclass, MXNAME); lookup->namespace[0]=0; - lookup->sendspace[0]=0; + lookup->sendspace = NULL; lookup->sendmsg=NULL; lookup->name=NULL; lookup->oname=NULL; From 2935e25e99a4b93126a9aebcc94cd52c7aa8ca67 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Thu, 13 Jul 2000 01:22:56 +0000 Subject: [PATCH 065/226] Removed debugging code that is no longer useful. --- lib/isc/unix/socket.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c index 7c8900350d..f666db91d3 100644 --- a/lib/isc/unix/socket.c +++ b/lib/isc/unix/socket.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: socket.c,v 1.149 2000/07/13 01:13:53 bwelling Exp $ */ +/* $Id: socket.c,v 1.150 2000/07/13 01:22:56 bwelling Exp $ */ #include @@ -1811,11 +1811,6 @@ watcher(void *uap) { UNLOCK(&manager->lock); cc = select(maxfd, &readfds, &writefds, NULL, NULL); - if (isc_log_wouldlog(isc_lctx, IOEVENT_LEVEL)) - manager_log(manager, IOEVENT, - "select(%d, ...) == %d, " - "errno %d/%s", - maxfd, cc, errno, strerror(errno)); if (cc < 0) { if (!SOFT_ERROR(errno)) FATAL_ERROR(__FILE__, __LINE__, From 0072e42780cda66e72303bb6449a9ad8bbbc8fe4 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Thu, 13 Jul 2000 01:38:40 +0000 Subject: [PATCH 066/226] use isc_log_wouldlog() in manager_log() --- lib/isc/unix/socket.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c index f666db91d3..ce57288544 100644 --- a/lib/isc/unix/socket.c +++ b/lib/isc/unix/socket.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: socket.c,v 1.150 2000/07/13 01:22:56 bwelling Exp $ */ +/* $Id: socket.c,v 1.151 2000/07/13 01:38:40 gson Exp $ */ #include @@ -234,6 +234,9 @@ manager_log(isc_socketmgr_t *sockmgr, char msgbuf[2048]; va_list ap; + if (! isc_log_wouldlog(isc_lctx, level)) + return; + va_start(ap, fmt); vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap); va_end(ap); From 77365675e9db53de6ef728c98fc696ce86e88e63 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Thu, 13 Jul 2000 01:49:44 +0000 Subject: [PATCH 067/226] Use mempools instead of free lists for the comm buffers. --- bin/dig/dighost.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index 60c5ed006a..944a638ccf 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.79 2000/07/13 01:22:34 mws Exp $ */ +/* $Id: dighost.c,v 1.80 2000/07/13 01:49:44 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -103,7 +103,7 @@ isc_buffer_t *namebuf = NULL; dns_tsigkey_t *key = NULL; isc_boolean_t validated = ISC_TRUE; isc_entropy_t *entp = NULL; - +isc_mempool_t *commctx = NULL; extern isc_boolean_t isc_mem_debugging; isc_boolean_t debugging = ISC_FALSE; char *progname = NULL; @@ -142,7 +142,6 @@ hex_dump(isc_buffer_t *b) { printf("\n"); } - void fatal(const char *format, ...) { va_list args; @@ -566,6 +565,16 @@ setup_libs(void) { result = dst_lib_init(mctx, entp, 0); check_result(result, "dst_lib_init"); is_dst_up = ISC_TRUE; + + result = isc_mempool_create(mctx, COMMSIZE, &commctx); + check_result(result, "isc_mempool_create"); + isc_mempool_setname(commctx, "COMMPOOL"); + /* + * 6 and 2 set as reasonable parameters for 3 or 4 nameserver + * systems. + */ + isc_mempool_setfreemax(commctx, 6); + isc_mempool_setfillcount(commctx, 2); } static void @@ -646,7 +655,7 @@ clear_query(dig_query_t *query) { ISC_LIST_DEQUEUE(query->lengthlist, &query->lengthbuf, link); INSIST(query->recvspace != NULL); - isc_mem_put(mctx, query->recvspace, COMMSIZE); + isc_mempool_put(commctx, query->recvspace); isc_buffer_invalidate(&query->recvbuf); isc_buffer_invalidate(&query->lengthbuf); isc_mem_free(mctx, query); @@ -686,7 +695,7 @@ try_clear_lookup(dig_lookup_t *lookup) { if (lookup->timer != NULL) isc_timer_detach(&lookup->timer); INSIST(lookup->sendspace != NULL); - isc_mem_put(mctx, lookup->sendspace, COMMSIZE); + isc_mempool_put(commctx, lookup->sendspace); ptr = lookup; lookup = ISC_LIST_NEXT(lookup, link); @@ -1133,7 +1142,7 @@ setup_lookup(dig_lookup_t *lookup) { lookup->querysig = NULL; } - lookup->sendspace = isc_mem_get(mctx, COMMSIZE); + lookup->sendspace = isc_mempool_get(commctx); if (lookup->sendspace == NULL) fatal("memory allocation failure"); @@ -1180,7 +1189,7 @@ setup_lookup(dig_lookup_t *lookup) { ISC_LIST_INIT(query->recvlist); ISC_LIST_INIT(query->lengthlist); query->sock = NULL; - query->recvspace = isc_mem_get(mctx, COMMSIZE); + query->recvspace = isc_mempool_get(commctx); if (query->recvspace == NULL) fatal("memory allocation failure"); @@ -2187,6 +2196,10 @@ free_lists(void) { o = ISC_LIST_NEXT(o, link); isc_mem_free(mctx, ptr); } + if (commctx != NULL) { + debug("freeing commctx"); + isc_mempool_destroy(&commctx); + } if (socketmgr != NULL) { debug("freeing socketmgr"); isc_socketmgr_destroy(&socketmgr); From 58cdafb232d9226b8110301536f97a55b541bf5c Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Thu, 13 Jul 2000 02:14:17 +0000 Subject: [PATCH 068/226] Style changes, nothing functional --- bin/dig/dighost.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index 944a638ccf..477af1ea8a 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.80 2000/07/13 01:49:44 mws Exp $ */ +/* $Id: dighost.c,v 1.81 2000/07/13 02:14:17 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -146,7 +146,7 @@ void fatal(const char *format, ...) { va_list args; - fprintf (stderr, "%s: ", progname); + fprintf(stderr, "%s: ", progname); va_start(args, format); vfprintf(stderr, format, args); va_end(args); @@ -495,7 +495,7 @@ setup_system(void) { dns_rootname, ISC_FALSE, namebuf); if (result != ISC_R_SUCCESS) { - printf (";; Couldn't create key %s: %s\n", + printf(";; Couldn't create key %s: %s\n", keynametext, dns_result_totext(result)); goto SYSSETUP_FAIL; } @@ -773,7 +773,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, isc_result_totext(result)); if ((section == DNS_SECTION_ANSWER) && (query->lookup->trace || query->lookup->ns_search_only)) - followup_lookup (msg, query, DNS_SECTION_AUTHORITY); + followup_lookup(msg, query, DNS_SECTION_AUTHORITY); return; } @@ -860,7 +860,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, loopresult = dns_rdataset_next(rdataset); } } - result = dns_message_nextname (msg, section); + result = dns_message_nextname(msg, section); if (result != ISC_R_SUCCESS) break; } @@ -2137,7 +2137,7 @@ cancel_all(void) { dig_lookup_t *l; dig_query_t *q; - debug ("cancel_all()"); + debug("cancel_all()"); l = ISC_LIST_HEAD(lookup_list); while (l != NULL) { From 4532e9e7c666375dd329b067b0805ef77f72df08 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Thu, 13 Jul 2000 02:28:18 +0000 Subject: [PATCH 069/226] in isc_log_wouldlog(), deal with the possibility of lctx being NULL --- lib/isc/log.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/isc/log.c b/lib/isc/log.c index e3c5d308bc..e9f7260371 100644 --- a/lib/isc/log.c +++ b/lib/isc/log.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: log.c,v 1.39 2000/07/13 00:18:51 gson Exp $ */ +/* $Id: log.c,v 1.40 2000/07/13 02:28:18 gson Exp $ */ /* Principal Authors: DCL */ @@ -1216,6 +1216,9 @@ isc_log_wouldlog(isc_log_t *lctx, int level) { * dynamically changed. */ + if (lctx == NULL) + return (ISC_FALSE); + return (ISC_TF(level <= lctx->logconfig->highest_level || (lctx->logconfig->dynamic && level <= lctx->debug_level))); From 618e871c2eb80021673bedf083496ccd1bf65cd0 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Thu, 13 Jul 2000 02:41:20 +0000 Subject: [PATCH 070/226] Add DNS_R_NAMETOOLONG --- lib/dns/include/dns/result.h | 4 ++-- lib/dns/result.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/dns/include/dns/result.h b/lib/dns/include/dns/result.h index 91452f90e4..6da4907d92 100644 --- a/lib/dns/include/dns/result.h +++ b/lib/dns/include/dns/result.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: result.h,v 1.60 2000/07/04 03:59:53 marka Exp $ */ +/* $Id: result.h,v 1.61 2000/07/13 02:41:20 bwelling Exp $ */ #ifndef DNS_RESULT_H #define DNS_RESULT_H 1 @@ -58,7 +58,7 @@ #define DNS_R_NOOWNER (ISC_RESULTCLASS_DNS + 19) #define DNS_R_NOTTL (ISC_RESULTCLASS_DNS + 20) #define DNS_R_BADCLASS (ISC_RESULTCLASS_DNS + 21) -/* 22 is unused */ +#define DNS_R_NAMETOOLONG (ISC_RESULTCLASS_DNS + 22) #define DNS_R_PARTIALMATCH (ISC_RESULTCLASS_DNS + 23) #define DNS_R_NEWORIGIN (ISC_RESULTCLASS_DNS + 24) #define DNS_R_UNCHANGED (ISC_RESULTCLASS_DNS + 25) diff --git a/lib/dns/result.c b/lib/dns/result.c index 6a9d9d6fc1..b1ed52d2bf 100644 --- a/lib/dns/result.c +++ b/lib/dns/result.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: result.c,v 1.64 2000/07/04 03:59:51 marka Exp $ */ +/* $Id: result.c,v 1.65 2000/07/13 02:41:19 bwelling Exp $ */ #include @@ -48,7 +48,7 @@ static const char *text[DNS_R_NRESULTS] = { "no owner", /* 19 */ "no ttl", /* 20 */ "bad class", /* 21 */ - "UNUSED22", /* 22 */ + "name too long", /* 22 */ "partial match", /* 23 */ "new origin", /* 24 */ "unchanged", /* 25 */ From 425028583845247a2e09532a88e58165e82924f4 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Thu, 13 Jul 2000 18:10:18 +0000 Subject: [PATCH 071/226] Return DNS_R_NAMETOOLONG in a few places where less useful errors were returned before. --- lib/dns/include/dns/name.h | 3 ++- lib/dns/name.c | 8 ++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/lib/dns/include/dns/name.h b/lib/dns/include/dns/name.h index 11ba00c568..1ce797c996 100644 --- a/lib/dns/include/dns/name.h +++ b/lib/dns/include/dns/name.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: name.h,v 1.73 2000/06/22 21:55:49 tale Exp $ */ +/* $Id: name.h,v 1.74 2000/07/13 18:10:16 bwelling Exp $ */ #ifndef DNS_NAME_H #define DNS_NAME_H 1 @@ -931,6 +931,7 @@ dns_name_concatenate(dns_name_t *prefix, dns_name_t *suffix, * Returns: * ISC_R_SUCCESS * ISC_R_NOSPACE + * DNS_R_NAMETOOLONG */ isc_result_t diff --git a/lib/dns/name.c b/lib/dns/name.c index 67690c9f61..00593ff2b7 100644 --- a/lib/dns/name.c +++ b/lib/dns/name.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: name.c,v 1.93 2000/06/22 21:54:32 tale Exp $ */ +/* $Id: name.c,v 1.94 2000/07/13 18:10:18 bwelling Exp $ */ #include @@ -2345,7 +2345,7 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source, * The name did not fit even though we had a buffer * big enough to fit a maximum-length name. */ - return (DNS_R_FORMERR); + return (DNS_R_NAMETOOLONG); else /* * The name might fit if only the caller could give us a @@ -2513,6 +2513,10 @@ dns_name_concatenate(dns_name_t *prefix, dns_name_t *suffix, dns_name_t *name, length += suffix->length; labels += suffix->labels; } + if (length > 255) { + MAKE_EMPTY(name); + return (DNS_R_NAMETOOLONG); + } if (length > nrem) { MAKE_EMPTY(name); return (ISC_R_NOSPACE); From c5ec9b45bbf7175cf3c9b36293555c93bb703d93 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Thu, 13 Jul 2000 18:52:58 +0000 Subject: [PATCH 072/226] Lots of duplicate code removed +tcp mode bug fixed --- bin/dig/dig.c | 545 ++++++++++---------------------------- bin/dig/dighost.c | 106 ++++++-- bin/dig/include/dig/dig.h | 8 +- 3 files changed, 225 insertions(+), 434 deletions(-) diff --git a/bin/dig/dig.c b/bin/dig/dig.c index de80861cfe..e1d96eab00 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.c,v 1.62 2000/07/13 01:22:33 mws Exp $ */ +/* $Id: dig.c,v 1.63 2000/07/13 18:52:55 mws Exp $ */ #include #include @@ -556,13 +556,13 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { isc_boolean_t have_host = ISC_FALSE; dig_server_t *srv = NULL; dig_lookup_t *lookup = NULL; + static dig_lookup_t *default_lookup = NULL; char *batchname = NULL; char batchline[MXNAME]; char address[MXNAME]; FILE *fp = NULL; int bargc; char *bargv[16]; - char bargv0[sizeof("dig")]; int i, n; int adrs[4]; int rc; @@ -575,8 +575,16 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { * otherwise make it apply to the latest host. This is * a bit different than the previous versions, but should * form a consistent user interface. + * + * First, create a "default lookup" which won't actually be used + * anywhere, except for cloning into new lookups */ + if (!is_batchfile) + default_lookup = make_empty_lookup(); + + lookup = default_lookup; + rc = argc; rv = argv; for (rc--, rv++; rc > 0; rc--, rv++) { @@ -589,42 +597,26 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { if (srv == NULL) fatal("Memory allocation failure"); strncpy(srv->servername, &rv[0][1], MXNAME-1); - if (is_batchfile && have_host) { - if (!lookup->use_my_server_list) { - ISC_LIST_INIT(lookup-> - my_server_list); - lookup->use_my_server_list = - ISC_TRUE; - } - ISC_LIST_APPEND(lookup->my_server_list, - srv, link); - } else { - ISC_LIST_APPEND(server_list, srv, link); + if (!lookup->use_my_server_list) { + ISC_LIST_INIT(lookup-> + my_server_list); + lookup->use_my_server_list = + ISC_TRUE; } + ISC_LIST_APPEND(lookup->my_server_list, + srv, link); } else if ((strcmp(rv[0], "+vc") == 0) && (!is_batchfile)) { - if (have_host) - lookup->tcp_mode = ISC_TRUE; - else - tcpmode = ISC_TRUE; + lookup->tcp_mode = ISC_TRUE; } else if ((strcmp(rv[0], "+novc") == 0) && (!is_batchfile)) { - if (have_host) - lookup->tcp_mode = ISC_FALSE; - else - tcpmode = ISC_FALSE; + lookup->tcp_mode = ISC_FALSE; } else if ((strcmp(rv[0], "+tcp") == 0) && (!is_batchfile)) { - if (have_host) - lookup->tcp_mode = ISC_TRUE; - else - tcpmode = ISC_TRUE; + lookup->tcp_mode = ISC_TRUE; } else if ((strcmp(rv[0], "+notcp") == 0) && (!is_batchfile)) { - if (have_host) - lookup->tcp_mode = ISC_FALSE; - else - tcpmode = ISC_FALSE; + lookup->tcp_mode = ISC_FALSE; } else if (strncmp(rv[0], "+domain=", 8) == 0) { /* Global option always */ strncpy(fixeddomain, &rv[0][8], MXNAME); @@ -634,15 +626,9 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { } else if (strncmp(rv[0], "+nosea", 6) == 0) { usesearch = ISC_FALSE; } else if (strncmp(rv[0], "+defn", 5) == 0) { - if (have_host) - lookup->defname = ISC_TRUE; - else - defname = ISC_TRUE; + lookup->defname = ISC_TRUE; } else if (strncmp(rv[0], "+nodefn", 7) == 0) { - if (have_host) - lookup->defname = ISC_FALSE; - else - defname = ISC_FALSE; + lookup->defname = ISC_FALSE; } else if (strncmp(rv[0], "+time=", 6) == 0) { /* Global option always */ timeout = atoi(&rv[0][6]); @@ -656,150 +642,71 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { timeout = 1; debug("timeout set to %d", timeout); } else if (strncmp(rv[0], "+tries=", 7) == 0) { - if (have_host) { - lookup->retries = atoi(&rv[0][7]); - if (lookup->retries <= 0) - lookup->retries = 1; - } else { - tries = atoi(&rv[0][7]); - if (tries <= 0) - tries = 1; - } + lookup->retries = atoi(&rv[0][7]); + if (lookup->retries <= 0) + lookup->retries = 1; } else if (strncmp(rv[0], "+buf=", 5) == 0) { - if (have_host) { - lookup->udpsize = atoi(&rv[0][5]); - if (lookup->udpsize <= 0) - lookup->udpsize = 0; - if (lookup->udpsize > COMMSIZE) - lookup->udpsize = COMMSIZE; - } else { - bufsize = atoi(&rv[0][5]); - if (bufsize <= 0) - bufsize = 0; - if (bufsize > COMMSIZE) - bufsize = COMMSIZE; - } + lookup->udpsize = atoi(&rv[0][5]); + if (lookup->udpsize <= 0) + lookup->udpsize = 0; + if (lookup->udpsize > COMMSIZE) + lookup->udpsize = COMMSIZE; } else if (strncmp(rv[0], "+bufsize=", 9) == 0) { - if (have_host) { - lookup->udpsize = atoi(&rv[0][9]); - if (lookup->udpsize <= 0) - lookup->udpsize = 0; - if (lookup->udpsize > COMMSIZE) - lookup->udpsize = COMMSIZE; - } else { - bufsize = atoi(&rv[0][9]); - if (bufsize <= 0) - bufsize = 0; - if (bufsize > COMMSIZE) - bufsize = COMMSIZE; - } + lookup->udpsize = atoi(&rv[0][9]); + if (lookup->udpsize <= 0) + lookup->udpsize = 0; + if (lookup->udpsize > COMMSIZE) + lookup->udpsize = COMMSIZE; } else if (strncmp(rv[0], "+ndots=", 7) == 0) { /* Global option always */ ndots = atoi(&rv[0][7]); if (ndots < 0) ndots = 0; } else if (strncmp(rv[0], "+rec", 4) == 0) { - if (have_host) - lookup->recurse = ISC_TRUE; - else - recurse = ISC_TRUE; + lookup->recurse = ISC_TRUE; } else if (strncmp(rv[0], "+norec", 6) == 0) { - if (have_host) - lookup->recurse = ISC_FALSE; - else - recurse = ISC_FALSE; + lookup->recurse = ISC_FALSE; } else if (strncmp(rv[0], "+aa", 3) == 0) { - if (have_host) - lookup->aaonly = ISC_TRUE; - else - aaonly = ISC_TRUE; + lookup->aaonly = ISC_TRUE; } else if (strncmp(rv[0], "+noaa", 5) == 0) { - if (have_host) - lookup->aaonly = ISC_FALSE; - else - aaonly = ISC_FALSE; + lookup->aaonly = ISC_FALSE; } else if (strncmp(rv[0], "+adf", 4) == 0) { - if (have_host) - lookup->adflag = ISC_TRUE; - else - adflag = ISC_TRUE; + lookup->adflag = ISC_TRUE; } else if (strncmp(rv[0], "+noadf", 6) == 0) { - if (have_host) - lookup->adflag = ISC_FALSE; - else - adflag = ISC_FALSE; + lookup->adflag = ISC_FALSE; } else if (strncmp(rv[0], "+cd", 3) == 0) { - if (have_host) - lookup->cdflag = ISC_TRUE; - else - cdflag = ISC_TRUE; + lookup->cdflag = ISC_TRUE; } else if (strncmp(rv[0], "+nocd", 5) == 0) { - if (have_host) - lookup->cdflag = ISC_FALSE; - else - cdflag = ISC_FALSE; + lookup->cdflag = ISC_FALSE; } else if (strncmp(rv[0], "+ns", 3) == 0) { - if (have_host) { - lookup->ns_search_only = ISC_TRUE; - lookup->trace_root = ISC_TRUE; - lookup->recurse = ISC_FALSE; - lookup->identify = ISC_TRUE; - lookup->stats = ISC_FALSE; - if (!forcecomment) - lookup->comments = ISC_FALSE; - lookup->section_additional = ISC_FALSE; - lookup->section_authority = ISC_FALSE; - lookup->section_question = ISC_FALSE; - } else { - ns_search_only = ISC_TRUE; - recurse = ISC_FALSE; - identify = ISC_TRUE; - stats = ISC_FALSE; - if (!forcecomment) - comments = ISC_FALSE; - section_additional = ISC_FALSE; - section_authority = ISC_FALSE; - section_question = ISC_FALSE; - } + lookup->ns_search_only = ISC_TRUE; + lookup->trace_root = ISC_TRUE; + lookup->recurse = ISC_FALSE; + lookup->identify = ISC_TRUE; + lookup->stats = ISC_FALSE; + if (!forcecomment) + lookup->comments = ISC_FALSE; + lookup->section_additional = ISC_FALSE; + lookup->section_authority = ISC_FALSE; + lookup->section_question = ISC_FALSE; } else if (strncmp(rv[0], "+nons", 6) == 0) { - if (have_host) - lookup->ns_search_only = ISC_FALSE; - else - ns_search_only = ISC_FALSE; + lookup->ns_search_only = ISC_FALSE; } else if (strncmp(rv[0], "+tr", 3) == 0) { - if (have_host) { - lookup->trace = ISC_TRUE; - lookup->trace_root = ISC_TRUE; - lookup->recurse = ISC_FALSE; - lookup->identify = ISC_TRUE; - if (!forcecomment) { - lookup->comments = ISC_FALSE; - lookup->stats = ISC_FALSE; - } - lookup->section_additional = ISC_FALSE; - lookup->section_authority = ISC_TRUE; - lookup->section_question = ISC_FALSE; - show_details = ISC_TRUE; - } else { - trace = ISC_TRUE; - recurse = ISC_FALSE; - identify = ISC_TRUE; - if (!forcecomment) { - comments = ISC_FALSE; - stats = ISC_FALSE; - } - section_additional = ISC_FALSE; - section_authority = ISC_TRUE; - section_question = ISC_FALSE; - show_details = ISC_TRUE; + lookup->trace = ISC_TRUE; + lookup->trace_root = ISC_TRUE; + lookup->recurse = ISC_FALSE; + lookup->identify = ISC_TRUE; + if (!forcecomment) { + lookup->comments = ISC_FALSE; + lookup->stats = ISC_FALSE; } + lookup->section_additional = ISC_FALSE; + lookup->section_authority = ISC_TRUE; + lookup->section_question = ISC_FALSE; + show_details = ISC_TRUE; } else if (strncmp(rv[0], "+notr", 6) == 0) { - if (have_host) { - lookup->trace = ISC_FALSE; - lookup->trace_root = ISC_FALSE; - } - else - trace = ISC_FALSE; + lookup->trace = ISC_FALSE; + lookup->trace_root = ISC_FALSE; } else if (strncmp(rv[0], "+det", 4) == 0) { show_details = ISC_TRUE; } else if (strncmp(rv[0], "+nodet", 6) == 0) { @@ -811,156 +718,81 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { } else if (strncmp(rv[0], "+sho", 4) == 0) { short_form = ISC_TRUE; printcmd = ISC_FALSE; - if (have_host) { - lookup->section_additional = ISC_FALSE; - lookup->section_authority = ISC_FALSE; - lookup->section_question = ISC_FALSE; - if (!forcecomment) { - lookup->comments = ISC_FALSE; - lookup->stats = ISC_FALSE; - } - } else { - section_additional = ISC_FALSE; - section_authority = ISC_FALSE; - section_question = ISC_FALSE; - if (!forcecomment) { - comments = ISC_FALSE; - stats = ISC_FALSE; - } + lookup->section_additional = ISC_FALSE; + lookup->section_authority = ISC_FALSE; + lookup->section_question = ISC_FALSE; + if (!forcecomment) { + lookup->comments = ISC_FALSE; + lookup->stats = ISC_FALSE; } } else if (strncmp(rv[0], "+nosho", 6) == 0) { short_form = ISC_FALSE; } else if (strncmp(rv[0], "+id", 3) == 0) { - if (have_host) - lookup->identify = ISC_TRUE; - else - identify = ISC_TRUE; + lookup->identify = ISC_TRUE; } else if (strncmp(rv[0], "+noid", 5) == 0) { - if (have_host) - lookup->identify = ISC_FALSE; - else - identify = ISC_FALSE; + lookup->identify = ISC_FALSE; } else if (strncmp(rv[0], "+com", 4) == 0) { - if (have_host) - lookup->comments = ISC_TRUE; - else - comments = ISC_TRUE; + lookup->comments = ISC_TRUE; forcecomment = ISC_TRUE; } else if (strncmp(rv[0], "+nocom", 6) == 0) { - if (have_host) { - lookup->comments = ISC_FALSE; - lookup->stats = ISC_FALSE; - } else { - comments = ISC_FALSE; - stats = ISC_FALSE; - } + lookup->comments = ISC_FALSE; + lookup->stats = ISC_FALSE; forcecomment = ISC_FALSE; } else if (strncmp(rv[0], "+sta", 4) == 0) { - if (have_host) - lookup->stats = ISC_TRUE; - else - stats = ISC_TRUE; + lookup->stats = ISC_TRUE; } else if (strncmp(rv[0], "+nosta", 6) == 0) { - if (have_host) - lookup->stats = ISC_FALSE; - else - stats = ISC_FALSE; + lookup->stats = ISC_FALSE; } else if (strncmp(rv[0], "+qr", 3) == 0) { qr = ISC_TRUE; } else if (strncmp(rv[0], "+noqr", 5) == 0) { qr = ISC_FALSE; } else if (strncmp(rv[0], "+que", 4) == 0) { - if (have_host) - lookup->section_question = ISC_TRUE; - else - section_question = ISC_TRUE; + lookup->section_question = ISC_TRUE; } else if (strncmp(rv[0], "+noque", 6) == 0) { - if (have_host) - lookup->section_question = ISC_FALSE; - else - section_question = ISC_FALSE; + lookup->section_question = ISC_FALSE; } else if (strncmp(rv[0], "+ans", 4) == 0) { - if (have_host) - lookup->section_answer = ISC_TRUE; - else - section_answer = ISC_TRUE; + lookup->section_answer = ISC_TRUE; } else if (strncmp(rv[0], "+noans", 6) == 0) { - if (have_host) - lookup->section_answer = ISC_FALSE; - else - section_answer = ISC_FALSE; + lookup->section_answer = ISC_FALSE; } else if (strncmp(rv[0], "+add", 4) == 0) { - if (have_host) - lookup->section_additional = ISC_TRUE; - else - section_additional = ISC_TRUE; + lookup->section_additional = ISC_TRUE; } else if (strncmp(rv[0], "+noadd", 6) == 0) { - if (have_host) - lookup->section_additional = ISC_FALSE; - else - section_additional = ISC_FALSE; + lookup->section_additional = ISC_FALSE; } else if (strncmp(rv[0], "+aut", 4) == 0) { - if (have_host) - lookup->section_authority = ISC_TRUE; - else - section_authority = ISC_TRUE; + lookup->section_authority = ISC_TRUE; } else if (strncmp(rv[0], "+noaut", 6) == 0) { - if (have_host) lookup->section_authority = ISC_FALSE; - else - section_authority = ISC_FALSE; } else if (strncmp(rv[0], "+all", 4) == 0) { - if (have_host) { - lookup->section_question = ISC_TRUE; - lookup->section_authority = ISC_TRUE; - lookup->section_answer = ISC_TRUE; - lookup->section_additional = ISC_TRUE; - lookup->comments = ISC_TRUE; - } else { - section_question = ISC_TRUE; - section_authority = ISC_TRUE; - section_answer = ISC_TRUE; - section_additional = ISC_TRUE; - comments = ISC_TRUE; - } + lookup->section_question = ISC_TRUE; + lookup->section_authority = ISC_TRUE; + lookup->section_answer = ISC_TRUE; + lookup->section_additional = ISC_TRUE; + lookup->comments = ISC_TRUE; } else if (strncmp(rv[0], "+noall", 6) == 0) { - if (have_host) { - lookup->section_question = ISC_FALSE; - lookup->section_authority = ISC_FALSE; - lookup->section_answer = ISC_FALSE; - lookup->section_additional = ISC_FALSE; - lookup->comments = ISC_FALSE; - } else { - section_question = ISC_FALSE; - section_authority = ISC_FALSE; - section_answer = ISC_FALSE; - section_additional = ISC_FALSE; - comments = ISC_FALSE; - } - + lookup->section_question = ISC_FALSE; + lookup->section_authority = ISC_FALSE; + lookup->section_answer = ISC_FALSE; + lookup->section_additional = ISC_FALSE; + lookup->comments = ISC_FALSE; } else if (strncmp(rv[0], "-c", 2) == 0) { - if (have_host) { - if (rv[0][2] != 0) { - strncpy(lookup->rctext, &rv[0][2], - MXRD); - } else { - strncpy(lookup->rctext, rv[1], - MXRD); - rv++; - rc--; - } + if (rv[0][2] != 0) { + strncpy(lookup->rctext, &rv[0][2], + MXRD); + } else { + strncpy(lookup->rctext, rv[1], + MXRD); + rv++; + rc--; } } else if (strncmp(rv[0], "-t", 2) == 0) { - if (have_host) { - if (rv[0][2] != 0) { - strncpy(lookup->rttext, &rv[0][2], - MXRD); - } else { - strncpy(lookup->rttext, rv[1], - MXRD); - rv++; - rc--; - } + if (rv[0][2] != 0) { + strncpy(lookup->rttext, &rv[0][2], + MXRD); + } else { + strncpy(lookup->rttext, rv[1], + MXRD); + rv++; + rc--; } } else if (strncmp(rv[0], "-f", 2) == 0) { if (rv[0][2] != 0) { @@ -1031,12 +863,9 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { &adrs[2], &adrs[3]); if (n == 0) show_usage(); - lookup = isc_mem_allocate(mctx, - sizeof(struct dig_lookup)); - if (lookup == NULL) - fatal("Memory allocation failure"); - lookup->pending = ISC_FALSE; - lookup->textname[0] = 0; + + lookup = clone_lookup(default_lookup, ISC_TRUE); + for (i = n - 1; i >= 0; i--) { snprintf(batchline, MXNAME/8, "%d.", adrs[i]); @@ -1044,50 +873,25 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { } strncat(lookup->textname, "in-addr.arpa.", MXNAME); debug("looking up %s", lookup->textname); + lookup->trace_root = ISC_TF(lookup->trace || + lookup->ns_search_only); strcpy(lookup->rttext, "ptr"); strcpy(lookup->rctext, "in"); - lookup->namespace[0] = 0; - lookup->sendspace = NULL; - lookup->sendmsg = NULL; - lookup->name = NULL; - lookup->oname = NULL; - lookup->timer = NULL; - lookup->xfr_q = NULL; - lookup->origin = NULL; - lookup->querysig = NULL; - lookup->use_my_server_list = ISC_FALSE; - lookup->trace = trace; - lookup->trace_root = ISC_TF(trace || ns_search_only); - lookup->ns_search_only = ns_search_only; - lookup->doing_xfr = ISC_FALSE; - lookup->ixfr_serial = 0; - lookup->defname = ISC_FALSE; - lookup->identify = identify; - lookup->recurse = recurse; - lookup->aaonly = aaonly; - lookup->adflag = adflag; - lookup->cdflag = cdflag; - lookup->retries = tries; - lookup->udpsize = bufsize; - lookup->nsfound = 0; - lookup->comments = comments; - lookup->tcp_mode = tcpmode; - lookup->stats = stats; - lookup->section_question = section_question; - lookup->section_answer = section_answer; - lookup->section_authority = section_authority; - lookup->section_additional = section_additional; lookup->new_search = ISC_TRUE; - ISC_LIST_INIT(lookup->q); - lookup->origin = NULL; - ISC_LIST_INIT(lookup->my_server_list); + ISC_LIST_APPEND(lookup_list, lookup, link); have_host = ISC_TRUE; rv++; rc--; } else { + /* + * If we decide to allow query type and class + * to be specified (without -t and -c options) + * before a host is given, all that needs to + * happen is the have_host test here get removed. + * Nothing should break by doing this. + */ if (have_host) { - ENSURE(lookup != NULL); if (strncmp(rv[0], "ixfr=", 5) == 0) { strcpy(lookup->rttext, "ixfr"); lookup->ixfr_serial = @@ -1103,49 +907,12 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { continue; } } - lookup = isc_mem_allocate(mctx, - sizeof(struct dig_lookup)); - if (lookup == NULL) - fatal("Memory allocation failure"); - lookup->pending = ISC_FALSE; + lookup=clone_lookup(default_lookup, ISC_TRUE); strncpy(lookup->textname, rv[0], MXNAME-1); - lookup->rttext[0] = 0; - lookup->rctext[0] = 0; - lookup->namespace[0] = 0; - lookup->sendspace = NULL; - lookup->sendmsg = NULL; - lookup->name = NULL; - lookup->oname = NULL; - lookup->timer = NULL; - lookup->xfr_q = NULL; - lookup->origin = NULL; - lookup->querysig = NULL; - lookup->use_my_server_list = ISC_FALSE; - lookup->doing_xfr = ISC_FALSE; - lookup->ixfr_serial = 0; - lookup->defname = ISC_FALSE; - lookup->trace_root = ISC_TF(trace || ns_search_only); - lookup->trace = trace; - lookup->ns_search_only = ns_search_only; - lookup->identify = identify; - lookup->recurse = recurse; - lookup->aaonly = aaonly; - lookup->adflag = adflag; - lookup->cdflag = cdflag; - lookup->retries = tries; - lookup->udpsize = bufsize; - lookup->nsfound = 0; - lookup->comments = comments; - lookup->tcp_mode = tcpmode; - lookup->stats = stats; - lookup->section_question = section_question; - lookup->section_answer = section_answer; - lookup->section_authority = section_authority; - lookup->section_additional = section_additional; + lookup->trace_root = ISC_TF(lookup->trace || + lookup->ns_search_only); lookup->new_search = ISC_TRUE; - ISC_LIST_INIT(lookup->q); ISC_LIST_APPEND(lookup_list, lookup, link); - lookup->origin = NULL; ISC_LIST_INIT(lookup->my_server_list); have_host = ISC_TRUE; debug("looking up %s", lookup->textname); @@ -1168,63 +935,19 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { bargv[bargc] = strtok(NULL, " \t\r\n"); } - /* - * This silliness (instead of ``bargv[0] = "dig";'') - * dances around the const string issue. If in - * the future the 2nd argument to strncpy() is made - * longer than three characters, don't forget to resize - * bargv0 to accommodate it. - */ - strncpy(bargv0, "dig", sizeof(bargv0)); - bargv[0] = bargv0; + bargv[0] = argv[0]; reorder_args(bargc, (char **)bargv); parse_args(ISC_TRUE, bargc, (char **)bargv); } } if (lookup_list.head == NULL) { - lookup = isc_mem_allocate(mctx, sizeof(struct dig_lookup)); - if (lookup == NULL) - fatal("Memory allocation failure"); - lookup->pending = ISC_FALSE; - lookup->rctext[0] = 0; - lookup->namespace[0] = 0; - lookup->sendspace = NULL; - lookup->sendmsg = NULL; - lookup->name = NULL; - lookup->oname = NULL; - lookup->timer = NULL; - lookup->xfr_q = NULL; - lookup->origin = NULL; - lookup->querysig = NULL; - lookup->use_my_server_list = ISC_FALSE; - lookup->doing_xfr = ISC_FALSE; - lookup->ixfr_serial = 0; - lookup->defname = ISC_FALSE; - lookup->trace_root = ISC_TF(trace || ns_search_only); - lookup->trace = trace; - lookup->ns_search_only = ns_search_only; - lookup->identify = identify; - lookup->recurse = recurse; - lookup->aaonly = aaonly; - lookup->adflag = adflag; - lookup->cdflag = cdflag; - lookup->retries = tries; - lookup->udpsize = bufsize; - lookup->nsfound = 0; - lookup->comments = comments; - lookup->tcp_mode = tcpmode; - lookup->stats = stats; - lookup->section_question = section_question; - lookup->section_answer = section_answer; - lookup->section_authority = section_authority; - lookup->section_additional = section_additional; + lookup=clone_lookup(default_lookup, ISC_TRUE); + lookup->trace_root = ISC_TF(lookup->trace || + lookup->ns_search_only); lookup->new_search = ISC_TRUE; - ISC_LIST_INIT(lookup->q); - ISC_LIST_INIT(lookup->my_server_list); strcpy(lookup->textname, "."); strcpy(lookup->rttext, "NS"); - lookup->rctext[0] = 0; ISC_LIST_APPEND(lookup_list, lookup, link); } if (!is_batchfile) diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index 477af1ea8a..1e78ee43de 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.81 2000/07/13 02:14:17 mws Exp $ */ +/* $Id: dighost.c,v 1.82 2000/07/13 18:52:57 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -231,32 +231,71 @@ istype(char *text) { } dig_lookup_t * -requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { +make_empty_lookup(void) { dig_lookup_t *looknew; - dig_server_t *s, *srv; - debug("requeue_lookup()"); + debug("make_lookup()"); INSIST(!free_now); - lookup_counter++; - if (lookup_counter > LOOKUP_LIMIT) - fatal("Too many lookups"); looknew = isc_mem_allocate(mctx, sizeof(struct dig_lookup)); if (looknew == NULL) fatal("Memory allocation failure in %s:%d", __FILE__, __LINE__); - looknew->pending = ISC_FALSE; - strncpy(looknew->textname, lookold-> textname, MXNAME); - strncpy(looknew->rttext, lookold-> rttext, 32); - strncpy(looknew->rctext, lookold-> rctext, 32); - looknew->namespace[0] = 0; + looknew->pending = ISC_TRUE; + looknew->textname[0]=0; + looknew->rttext[0]=0; + looknew->rctext[0]=0; looknew->sendspace = NULL; looknew->sendmsg = NULL; looknew->name = NULL; looknew->oname = NULL; looknew->timer = NULL; looknew->xfr_q = NULL; + looknew->doing_xfr = ISC_FALSE; + looknew->ixfr_serial = ISC_FALSE; + looknew->defname = ISC_FALSE; + looknew->trace = ISC_FALSE; + looknew->trace_root = ISC_FALSE; + looknew->identify = ISC_FALSE; + looknew->udpsize = 0; + looknew->recurse = ISC_TRUE; + looknew->aaonly = ISC_FALSE; + looknew->adflag = ISC_FALSE; + looknew->cdflag = ISC_FALSE; + looknew->ns_search_only = ISC_FALSE; + looknew->origin = NULL; + looknew->querysig = NULL; + looknew->retries = tries; + looknew->nsfound = 0; + looknew->tcp_mode = ISC_FALSE; + looknew->comments = ISC_TRUE; + looknew->stats = ISC_TRUE; + looknew->section_question = ISC_TRUE; + looknew->section_answer = ISC_TRUE; + looknew->section_authority = ISC_TRUE; + looknew->section_additional = ISC_TRUE; + looknew->new_search = ISC_FALSE; + ISC_LIST_INIT(looknew->my_server_list); + ISC_LIST_INIT(looknew->q); + looknew->use_my_server_list = ISC_FALSE; + return (looknew); +} + +dig_lookup_t * +clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { + dig_lookup_t *looknew; + dig_server_t *s, *srv; + + debug("clone_lookup()"); + + INSIST(!free_now); + + looknew = make_empty_lookup(); + INSIST(looknew != NULL); + strncpy(looknew->textname, lookold-> textname, MXNAME); + strncpy(looknew->rttext, lookold-> rttext, 32); + strncpy(looknew->rctext, lookold-> rctext, 32); looknew->doing_xfr = lookold->doing_xfr; looknew->ixfr_serial = lookold->ixfr_serial; looknew->defname = lookold->defname; @@ -269,10 +308,6 @@ requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { looknew->adflag = lookold->adflag; looknew->cdflag = lookold->cdflag; looknew->ns_search_only = lookold->ns_search_only; - looknew->origin = NULL; - looknew->querysig = NULL; - looknew->retries = tries; - looknew->nsfound = 0; looknew->tcp_mode = lookold->tcp_mode; looknew->comments = lookold->comments; looknew->stats = lookold->stats; @@ -280,11 +315,7 @@ requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { looknew->section_answer = lookold->section_answer; looknew->section_authority = lookold->section_authority; looknew->section_additional = lookold->section_additional; - looknew->new_search = ISC_FALSE; - ISC_LIST_INIT(looknew->my_server_list); - ISC_LIST_INIT(looknew->q); - looknew->use_my_server_list = ISC_FALSE; if (servers) { looknew->use_my_server_list = lookold->use_my_server_list; if (looknew->use_my_server_list) { @@ -303,6 +334,22 @@ requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { } } } + return (looknew); +} + +dig_lookup_t * +requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { + dig_lookup_t *looknew; + + debug("requeue_lookup()"); + + lookup_counter++; + if (lookup_counter > LOOKUP_LIMIT) + fatal("Too many lookups"); + + looknew = clone_lookup(lookold, servers); + INSIST(looknew != NULL); + debug("before insertion, init@%p " "-> %p, new@%p -> %p", lookold, lookold->link.next, looknew, looknew->link.next); @@ -629,6 +676,9 @@ add_question(dns_message_t *message, dns_name_t *name, static void check_if_done(void) { debug("check_if_done()"); + debug("sockcount=%d, recvcount=%d, sendcount=%d, list %s", + sockcount, recvcount, sendcount, + ISC_LIST_EMPTY(lookup_list)?"empty":"full"); if ((sockcount == 0) && (recvcount == 0) && (sendcount == 0) && ISC_LIST_EMPTY(lookup_list)) { debug("shutting down"); @@ -646,6 +696,8 @@ clear_query(dig_query_t *query) { REQUIRE(query != NULL); + debug("clear_query(%p)",query); + lookup = query->lookup; ISC_LIST_UNLINK(lookup->q, query, link); if (ISC_LINK_LINKED(&query->recvbuf, link)) @@ -668,8 +720,12 @@ try_clear_lookup(dig_lookup_t *lookup) { REQUIRE(lookup != NULL); - if (ISC_LIST_HEAD(lookup->q) != NULL) + debug("try_clear_lookup(%p)", lookup); + + if (ISC_LIST_HEAD(lookup->q) != NULL) { + debug("can't clear; query still pending."); return (ISC_FALSE); + } /* * At this point, we know there are no queries on the lookup, * so can make it go away also. @@ -1363,6 +1419,7 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) { isc_region_t r; isc_result_t result; dig_query_t *query=NULL; + dig_lookup_t *l; isc_uint16_t length; REQUIRE(event->ev_type == ISC_SOCKEVENT_RECVDONE); @@ -1376,10 +1433,15 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) { query = event->ev_arg; + recvcount--; + INSIST(recvcount >= 0); + if (sevent->result == ISC_R_CANCELED) { query->working = ISC_FALSE; isc_event_free(&event); - check_next_lookup(query->lookup); + l = query->lookup; + clear_query(query); + check_next_lookup(l); return; } if (sevent->result != ISC_R_SUCCESS) { diff --git a/bin/dig/include/dig/dig.h b/bin/dig/include/dig/dig.h index 120f7c3201..bd2a52e866 100644 --- a/bin/dig/include/dig/dig.h +++ b/bin/dig/include/dig/dig.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.h,v 1.31 2000/07/13 01:22:38 mws Exp $ */ +/* $Id: dig.h,v 1.32 2000/07/13 18:52:58 mws Exp $ */ #ifndef DIG_H #define DIG_H @@ -209,6 +209,12 @@ free_lists(void); dig_lookup_t * requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers); +dig_lookup_t * +make_empty_lookup(void); + +dig_lookup_t * +clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers); + /* * Routines needed in dig.c and host.c. From 8f56f93547c0be53351ba2bf096e5c82de4dae25 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Thu, 13 Jul 2000 21:01:00 +0000 Subject: [PATCH 073/226] Clean up duplicate code in host.c Fix a socket cleanup problem which, in some isolated cases, prevented correct shutdown. Remove +aa option completely. --- bin/dig/dig.c | 8 +------- bin/dig/dighost.c | 25 ++++++++++++------------- bin/dig/host.c | 31 ++----------------------------- 3 files changed, 15 insertions(+), 49 deletions(-) diff --git a/bin/dig/dig.c b/bin/dig/dig.c index e1d96eab00..52288028a5 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.c,v 1.63 2000/07/13 18:52:55 mws Exp $ */ +/* $Id: dig.c,v 1.64 2000/07/13 21:00:58 mws Exp $ */ #include #include @@ -86,7 +86,6 @@ isc_boolean_t section_additional = ISC_TRUE, recurse = ISC_TRUE, defname = ISC_TRUE, - aaonly = ISC_FALSE, tcpmode = ISC_FALSE, adflag = ISC_FALSE, cdflag = ISC_FALSE; @@ -159,7 +158,6 @@ show_usage(void) { " +[no]search (Set whether to use searchlist)\n" " +[no]defname (Set whether to use default domain)\n" " +[no]recursive (Recursive mode)\n" -" +[no]aaonly (Set AA flag in query)\n" " +[no]adflag (Set AD flag in query)\n" " +[no]cdflag (Set CD flag in query)\n" " +[no]details (Show details of all requests)\n" @@ -666,10 +664,6 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { lookup->recurse = ISC_TRUE; } else if (strncmp(rv[0], "+norec", 6) == 0) { lookup->recurse = ISC_FALSE; - } else if (strncmp(rv[0], "+aa", 3) == 0) { - lookup->aaonly = ISC_TRUE; - } else if (strncmp(rv[0], "+noaa", 5) == 0) { - lookup->aaonly = ISC_FALSE; } else if (strncmp(rv[0], "+adf", 4) == 0) { lookup->adflag = ISC_TRUE; } else if (strncmp(rv[0], "+noadf", 6) == 0) { diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index 1e78ee43de..eb78de81e0 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.82 2000/07/13 18:52:57 mws Exp $ */ +/* $Id: dighost.c,v 1.83 2000/07/13 21:00:59 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -260,7 +260,6 @@ make_empty_lookup(void) { looknew->identify = ISC_FALSE; looknew->udpsize = 0; looknew->recurse = ISC_TRUE; - looknew->aaonly = ISC_FALSE; looknew->adflag = ISC_FALSE; looknew->cdflag = ISC_FALSE; looknew->ns_search_only = ISC_FALSE; @@ -304,7 +303,6 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { looknew->identify = lookold->identify; looknew->udpsize = lookold->udpsize; looknew->recurse = lookold->recurse; - looknew->aaonly = lookold->aaonly; looknew->adflag = lookold->adflag; looknew->cdflag = lookold->cdflag; looknew->ns_search_only = lookold->ns_search_only; @@ -707,6 +705,9 @@ clear_query(dig_query_t *query) { ISC_LIST_DEQUEUE(query->lengthlist, &query->lengthbuf, link); INSIST(query->recvspace != NULL); + isc_socket_detach(&query->sock); + sockcount--; + debug("sockcount=%d", sockcount); isc_mempool_put(commctx, query->recvspace); isc_buffer_invalidate(&query->recvbuf); isc_buffer_invalidate(&query->lengthbuf); @@ -1139,11 +1140,6 @@ setup_lookup(dig_lookup_t *lookup) { lookup->sendmsg->flags |= DNS_MESSAGEFLAG_RD; } - if (lookup->aaonly) { - debug("AA query"); - lookup->sendmsg->flags |= DNS_MESSAGEFLAG_AA; - } - if (lookup->adflag) { debug("AD query"); lookup->sendmsg->flags |= DNS_MESSAGEFLAG_AD; @@ -1287,9 +1283,6 @@ cancel_lookup(dig_lookup_t *lookup) { if (query->sock != NULL) { isc_socket_cancel(query->sock, global_task, ISC_SOCKCANCEL_ALL); - isc_socket_detach(&query->sock); - sockcount--; - debug("sockcount=%d", sockcount); INSIST(sockcount >= 0); check_if_done(); } @@ -1406,7 +1399,7 @@ connect_timeout(isc_task_t *task, isc_event_t *event) { ISC_SOCKCANCEL_ALL); } } - ENSURE(lookup->timer != NULL); + INSIST(lookup->timer != NULL); isc_timer_detach(&lookup->timer); isc_buffer_free(&b); debug("done with connect_timeout()"); @@ -1545,6 +1538,7 @@ connect_done(isc_task_t *task, isc_event_t *event) { isc_result_t result; isc_socketevent_t *sevent = NULL; dig_query_t *query = NULL; + dig_lookup_t *l; isc_buffer_t *b = NULL; isc_region_t r; @@ -1572,13 +1566,18 @@ connect_done(isc_task_t *task, isc_event_t *event) { printf(";; Connection to server %.*s for %s failed: %s.\n", (int)r.length, r.base, query->lookup->textname, isc_result_totext(sevent->result)); + isc_socket_detach(&query->sock); + sockcount--; + INSIST(sockcount >= 0); if (exitcode < 9) exitcode = 9; isc_buffer_free(&b); query->working = ISC_FALSE; query->waiting_connect = ISC_FALSE; isc_event_free(&event); - check_next_lookup(query->lookup); + l = query->lookup; + clear_query(query); + check_next_lookup(l); return; } launch_next_query(query, ISC_TRUE); diff --git a/bin/dig/host.c b/bin/dig/host.c index d73a1f5069..27b1205445 100644 --- a/bin/dig/host.c +++ b/bin/dig/host.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: host.c,v 1.38 2000/07/13 01:22:35 mws Exp $ */ +/* $Id: host.c,v 1.39 2000/07/13 21:01:00 mws Exp $ */ #include #include @@ -627,9 +627,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { ISC_LIST_APPEND(server_list, srv, link); } - lookup = isc_mem_allocate(mctx, sizeof(struct dig_lookup)); - if (lookup == NULL) - fatal("Memory allocation failure."); + lookup = make_empty_lookup(); lookup->pending = ISC_FALSE; /* * XXXMWS Add IPv6 translation here, probably using inet_pton @@ -660,36 +658,11 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { strcpy(queryclass, "in"); strncpy(lookup->rttext, querytype, 32); strncpy(lookup->rctext, queryclass, 32); - lookup->namespace[0] = 0; - lookup->sendspace = NULL; - lookup->sendmsg = NULL; - lookup->name = NULL; - lookup->oname = NULL; - lookup->timer = NULL; - lookup->xfr_q = NULL; - lookup->origin = NULL; - lookup->querysig = NULL; - lookup->doing_xfr = ISC_FALSE; - lookup->ixfr_serial = 0; - lookup->defname = ISC_FALSE; - lookup->identify = ISC_FALSE; - lookup->recurse = recursion; lookup->ns_search_only = showallsoa; - lookup->use_my_server_list = ISC_FALSE; - lookup->retries = tries; - lookup->udpsize = 0; - lookup->nsfound = 0; - lookup->trace = ISC_FALSE; lookup->trace_root = showallsoa; lookup->tcp_mode = tcpmode; lookup->new_search = ISC_TRUE; - lookup->aaonly = ISC_FALSE; - lookup->adflag = ISC_FALSE; - lookup->cdflag = ISC_FALSE; - ISC_LIST_INIT(lookup->q); ISC_LIST_APPEND(lookup_list, lookup, link); - lookup->origin = NULL; - ISC_LIST_INIT(lookup->my_server_list); } int From a31dbaa03fcb3cd5a182dab542b26bb3c4888aee Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Thu, 13 Jul 2000 21:12:21 +0000 Subject: [PATCH 074/226] Replace +aa option, per AG. --- bin/dig/dig.c | 7 ++++++- bin/dig/dighost.c | 9 ++++++++- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/bin/dig/dig.c b/bin/dig/dig.c index 52288028a5..6ed208ab5e 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.c,v 1.64 2000/07/13 21:00:58 mws Exp $ */ +/* $Id: dig.c,v 1.65 2000/07/13 21:12:20 mws Exp $ */ #include #include @@ -158,6 +158,7 @@ show_usage(void) { " +[no]search (Set whether to use searchlist)\n" " +[no]defname (Set whether to use default domain)\n" " +[no]recursive (Recursive mode)\n" +" +[no]aaonly (Set AA flag in query)\n" " +[no]adflag (Set AD flag in query)\n" " +[no]cdflag (Set CD flag in query)\n" " +[no]details (Show details of all requests)\n" @@ -664,6 +665,10 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { lookup->recurse = ISC_TRUE; } else if (strncmp(rv[0], "+norec", 6) == 0) { lookup->recurse = ISC_FALSE; + } else if (strncmp(rv[0], "+aa", 3) == 0) { + lookup->aaonly = ISC_TRUE; + } else if (strncmp(rv[0], "+noaa", 5) == 0) { + lookup->aaonly = ISC_FALSE; } else if (strncmp(rv[0], "+adf", 4) == 0) { lookup->adflag = ISC_TRUE; } else if (strncmp(rv[0], "+noadf", 6) == 0) { diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index eb78de81e0..39a11b30e0 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.83 2000/07/13 21:00:59 mws Exp $ */ +/* $Id: dighost.c,v 1.84 2000/07/13 21:12:21 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -260,6 +260,7 @@ make_empty_lookup(void) { looknew->identify = ISC_FALSE; looknew->udpsize = 0; looknew->recurse = ISC_TRUE; + looknew->aaonly = ISC_FALSE; looknew->adflag = ISC_FALSE; looknew->cdflag = ISC_FALSE; looknew->ns_search_only = ISC_FALSE; @@ -303,6 +304,7 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { looknew->identify = lookold->identify; looknew->udpsize = lookold->udpsize; looknew->recurse = lookold->recurse; + looknew->aaonly = lookold->aaonly; looknew->adflag = lookold->adflag; looknew->cdflag = lookold->cdflag; looknew->ns_search_only = lookold->ns_search_only; @@ -1140,6 +1142,11 @@ setup_lookup(dig_lookup_t *lookup) { lookup->sendmsg->flags |= DNS_MESSAGEFLAG_RD; } + if (lookup->aaonly) { + debug("AA query"); + lookup->sendmsg->flags |= DNS_MESSAGEFLAG_AA; + } + if (lookup->adflag) { debug("AD query"); lookup->sendmsg->flags |= DNS_MESSAGEFLAG_AD; From 0840ae769a95796a0a57da2dea8fb73086ce21d8 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Thu, 13 Jul 2000 22:53:51 +0000 Subject: [PATCH 075/226] When doing multi-stage lookups (like +trace and +nss), don't wait for all of the servers being queried to return results if we only need one of them. --- bin/dig/dighost.c | 77 ++++++++++++++++++++++++++++++--------- bin/dig/include/dig/dig.h | 4 +- 2 files changed, 61 insertions(+), 20 deletions(-) diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index 39a11b30e0..9367242ff2 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.84 2000/07/13 21:12:21 mws Exp $ */ +/* $Id: dighost.c,v 1.85 2000/07/13 22:53:49 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -707,9 +707,11 @@ clear_query(dig_query_t *query) { ISC_LIST_DEQUEUE(query->lengthlist, &query->lengthbuf, link); INSIST(query->recvspace != NULL); - isc_socket_detach(&query->sock); - sockcount--; - debug("sockcount=%d", sockcount); + if (query->sock != NULL) { + isc_socket_detach(&query->sock); + sockcount--; + debug("sockcount=%d", sockcount); + } isc_mempool_put(commctx, query->recvspace); isc_buffer_invalidate(&query->recvbuf); isc_buffer_invalidate(&query->lengthbuf); @@ -719,6 +721,7 @@ clear_query(dig_query_t *query) { static isc_boolean_t try_clear_lookup(dig_lookup_t *lookup) { dig_server_t *s; + dig_query_t *q; void *ptr; REQUIRE(lookup != NULL); @@ -726,8 +729,15 @@ try_clear_lookup(dig_lookup_t *lookup) { debug("try_clear_lookup(%p)", lookup); if (ISC_LIST_HEAD(lookup->q) != NULL) { - debug("can't clear; query still pending."); + if (debugging) { + q = ISC_LIST_HEAD(lookup->q); + while (q != NULL) { + debug ("query to %s still pending", + q->servname); + q = ISC_LIST_NEXT(q, link); + } return (ISC_FALSE); + } } /* * At this point, we know there are no queries on the lookup, @@ -773,6 +783,7 @@ static void begin_next_lookup(void) { dig_lookup_t *next; + debug("begin_next_lookup()"); next = ISC_LIST_HEAD(lookup_list); if (next != NULL) { setup_lookup(next); @@ -794,7 +805,7 @@ check_next_lookup(dig_lookup_t *lookup) { INSIST(!free_now); - debug("is_lookup_done(%p)", lookup); + debug("check_next_lookup(%p)", lookup); for (query = ISC_LIST_HEAD(lookup->q); query != NULL; query = ISC_LIST_NEXT(query, link)) { @@ -851,7 +862,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, rdata.type); if ((rdata.type == dns_rdatatype_ns) && (!query->lookup->trace_root || - (query->lookup->nsfound < ROOTNS))) + (query->lookup->nsfound < MXSERV))) { query->lookup->nsfound++; result = isc_buffer_allocate(mctx, &b, @@ -874,6 +885,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, if (!success) { success = ISC_TRUE; lookup_counter++; + cancel_lookup(query->lookup); lookup = requeue_lookup (query->lookup, ISC_FALSE); @@ -901,7 +913,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, my_server_list); } srv = isc_mem_allocate(mctx, - sizeof(struct dig_server)); + sizeof(struct dig_server)); if (srv == NULL) fatal("Memory allocation " "failure in %s:%d", @@ -909,7 +921,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, strncpy(srv->servername, (char *)r.base, len); srv->servername[len] = 0; - debug("adding server %s", + debug("adding1 server %s", srv->servername); ISC_LIST_APPEND (lookup->my_server_list, @@ -946,6 +958,7 @@ next_origin(dns_message_t *msg, dig_query_t *query) { debug("made it to the root with nowhere to go"); return; } + cancel_lookup(query->lookup); lookup = requeue_lookup(query->lookup, ISC_TRUE); lookup->defname = ISC_FALSE; lookup->origin = ISC_LIST_NEXT(query->lookup->origin, link); @@ -1266,14 +1279,34 @@ setup_lookup(dig_lookup_t *lookup) { static void send_done(isc_task_t *task, isc_event_t *event) { + isc_socketevent_t *sevent = NULL; + dig_query_t *query; + dig_lookup_t *l; + + REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE); + UNUSED(task); + sevent = (isc_socketevent_t *)event; + query = event->ev_arg; + isc_event_free(&event); debug("send_done()"); sendcount--; debug("sendcount=%d",sendcount); INSIST(sendcount >= 0); + + if (sevent->result == ISC_R_CANCELED) { + debug("in send cancel handler"); + query->working = ISC_FALSE; + query->waiting_connect = ISC_FALSE; + l = query->lookup; + clear_query(query); + check_next_lookup(l); + return; + } + } void @@ -1290,7 +1323,6 @@ cancel_lookup(dig_lookup_t *lookup) { if (query->sock != NULL) { isc_socket_cancel(query->sock, global_task, ISC_SOCKCANCEL_ALL); - INSIST(sockcount >= 0); check_if_done(); } } @@ -1388,18 +1420,20 @@ connect_timeout(isc_task_t *task, isc_event_t *event) { isc_buffer_usedregion(b, &r); if ((q->lookup->retries > 1) && (!q->lookup->tcp_mode)) - printf(";; Connection to server %.*s " + printf(";; Connection to %.*s(%s) " "for %s timed out. " "Retrying %d.\n", (int)r.length, r.base, + q->servname, q->lookup->textname, q->lookup->retries-1); else { printf(";; Connection to " - "server %.*s " + "%.*s(%s) " "for %s timed out. " "Giving up.\n", (int)r.length, r.base, + q->servname, q->lookup->textname); } isc_socket_cancel(q->sock, task, @@ -1493,6 +1527,7 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) { static void launch_next_query(dig_query_t *query, isc_boolean_t include_question) { isc_result_t result; + dig_lookup_t *l; INSIST(!free_now); @@ -1506,7 +1541,9 @@ launch_next_query(dig_query_t *query, isc_boolean_t include_question) { INSIST(sockcount >= 0); query->working = ISC_FALSE; query->waiting_connect = ISC_FALSE; - check_next_lookup(query->lookup); + l = query->lookup; + clear_query(query); + check_next_lookup(l); return; } @@ -1564,20 +1601,24 @@ connect_done(isc_task_t *task, isc_event_t *event) { query->waiting_connect = ISC_FALSE; if (sevent->result != ISC_R_SUCCESS) { - debug("buffer allocate connect_timeout"); + debug("unsuccessful connection: %s", + isc_result_totext(sevent->result)); result = isc_buffer_allocate(mctx, &b, 256); check_result(result, "isc_buffer_allocate"); result = isc_sockaddr_totext(&query->sockaddr, b); check_result(result, "isc_sockaddr_totext"); isc_buffer_usedregion(b, &r); - printf(";; Connection to server %.*s for %s failed: %s.\n", - (int)r.length, r.base, query->lookup->textname, - isc_result_totext(sevent->result)); + if (sevent->result != ISC_R_CANCELED) + printf(";; Connection to %.*s(%s) for %s failed: " + "%s.\n", (int)r.length, r.base, + query->servname, query->lookup->textname, + isc_result_totext(sevent->result)); isc_socket_detach(&query->sock); sockcount--; INSIST(sockcount >= 0); if (exitcode < 9) exitcode = 9; + debug("sockcount=%d",sockcount); isc_buffer_free(&b); query->working = ISC_FALSE; query->waiting_connect = ISC_FALSE; @@ -2017,7 +2058,7 @@ recv_done(isc_task_t *task, isc_event_t *event) { * the cancel_lookup() routine clears the pending flag. */ if (sevent->result == ISC_R_CANCELED) { - debug("in cancel handler"); + debug("in recv cancel handler"); query->working = ISC_FALSE; query->waiting_connect = ISC_FALSE; isc_event_free(&event); diff --git a/bin/dig/include/dig/dig.h b/bin/dig/include/dig/dig.h index bd2a52e866..1defb0f4a7 100644 --- a/bin/dig/include/dig/dig.h +++ b/bin/dig/include/dig/dig.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.h,v 1.32 2000/07/13 18:52:58 mws Exp $ */ +/* $Id: dig.h,v 1.33 2000/07/13 22:53:51 mws Exp $ */ #ifndef DIG_H #define DIG_H @@ -32,7 +32,7 @@ #include #include -#define MXSERV 4 +#define MXSERV 6 #define MXNAME 1005 #define MXRD 32 #define BUFSIZE 512 From 6bc1a645619a14707da68b130dafe41721fd2f25 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Thu, 13 Jul 2000 23:52:04 +0000 Subject: [PATCH 076/226] If a positive validation fails and it looks like the reason is that there are no material DNSSEC signatures, try an insecurity proof. --- lib/dns/validator.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/lib/dns/validator.c b/lib/dns/validator.c index ec626e8104..a45a68cee4 100644 --- a/lib/dns/validator.c +++ b/lib/dns/validator.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: validator.c,v 1.64 2000/07/07 00:44:01 bwelling Exp $ */ +/* $Id: validator.c,v 1.65 2000/07/13 23:52:04 bwelling Exp $ */ #include @@ -72,6 +72,7 @@ struct dns_validator { #define VALATTR_SHUTDOWN 0x01 #define VALATTR_FOUNDNONEXISTENCE 0x02 +#define VALATTR_TRIEDVERIFY 0x04 #define SHUTDOWN(v) (((v)->attributes & VALATTR_SHUTDOWN) != 0) static void @@ -922,6 +923,7 @@ validate(dns_validator_t *val, isc_boolean_t resume) { } do { + val->attributes |= VALATTR_TRIEDVERIFY; result = dns_dnssec_verify(event->name, event->rdataset, val->key, ISC_FALSE, @@ -1278,6 +1280,13 @@ validator_start(isc_task_t *task, isc_event_t *event) { "attempting positive response validation"); result = validate(val, ISC_FALSE); + if (result == DNS_R_NOVALIDSIG && + (val->attributes & VALATTR_TRIEDVERIFY) == 0) + { + validator_log(val, ISC_LOG_DEBUG(3), + "falling back to insecurity proof"); + result = proveunsecure(val, ISC_FALSE); + } } else if (val->event->rdataset != NULL) { /* * This is either an unsecure subdomain or a response from From 5b4397d387b89d696b5eb90c328a385e07d4a380 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Fri, 14 Jul 2000 00:03:54 +0000 Subject: [PATCH 077/226] Updated to reflect current status of insecurity proofs on insecure and privately secured zones. --- doc/misc/dnssec | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/doc/misc/dnssec b/doc/misc/dnssec index 9d88f30ad1..8f33c98f68 100644 --- a/doc/misc/dnssec +++ b/doc/misc/dnssec @@ -49,8 +49,10 @@ successfully even if it does not contain the NXT records to prove the nonexistence of a matching wildcard. Proof of insecure status for insecure zones delegated from secure -zones has been partially implemented but should not yet be expected to -work in all cases. +zones works when the zones are completely insecure. Privately +secured zones delegated from secure zones will not work in all cases, +such as when the privately secured zone is served by the same server +as an ancestor (but not parent) zone. Handling of the CD bit in queries is not yet fully implemented; validation is currently attempted for all recursive queries, even if @@ -65,4 +67,4 @@ an update occurs. Advanced access control is possible using the "update-policy" statement in the zone definition. -$Id: dnssec,v 1.5 2000/06/27 21:45:52 bwelling Exp $ +$Id: dnssec,v 1.6 2000/07/14 00:03:54 bwelling Exp $ From 55da37e18f378ddb78ba29b7c7f10c74bf3e4432 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Fri, 14 Jul 2000 00:33:09 +0000 Subject: [PATCH 078/226] removed dead code --- lib/dns/resolver.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 38db487176..5d2721ab2f 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: resolver.c,v 1.145 2000/07/12 23:56:06 bwelling Exp $ */ +/* $Id: resolver.c,v 1.146 2000/07/14 00:33:09 gson Exp $ */ #include @@ -2429,9 +2429,6 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) { &need_validation); if (result != ISC_R_SUCCESS) return (result); - if (need_validation) { - - } adbp = NULL; aname = NULL; From 10f4e9668a61da4e2cf422bb5d57e62ffa31f583 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Fri, 14 Jul 2000 00:37:27 +0000 Subject: [PATCH 079/226] the INSIST condition of 1.145 was too strong, weakened it; dded another INSIST to help track down the INSIST(!external) crash --- lib/dns/resolver.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 5d2721ab2f..d5681da77a 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: resolver.c,v 1.146 2000/07/14 00:33:09 gson Exp $ */ +/* $Id: resolver.c,v 1.147 2000/07/14 00:37:27 gson Exp $ */ #include @@ -504,8 +504,12 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) { event->ev_sender = fctx; if (!HAVE_ANSWER(fctx)) event->result = result; - if (result == ISC_R_SUCCESS) - INSIST(dns_rdataset_isassociated(event->rdataset)); + + INSIST(result != ISC_R_SUCCESS || + dns_rdataset_isassociated(event->rdataset) || + fctx->type == dns_rdatatype_any || + fctx->type == dns_rdatatype_sig); + isc_task_sendanddetach(&task, (isc_event_t **)&event); } ISC_LIST_INIT(fctx->events); @@ -2025,6 +2029,9 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type, goto cleanup_name; dns_rdataset_clone(nameservers, &fctx->nameservers); } + + INSIST(dns_name_issubdomain(&fctx->name, &fctx->domain)); + fctx->type = type; fctx->options = options; /* From 8d51d9e67e1e5dcf10203c4147ece519c7daa57d Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Fri, 14 Jul 2000 02:26:22 +0000 Subject: [PATCH 080/226] 331. [bug] Only log "recursion denied" if RD is set. (RT #178) --- CHANGES | 2 ++ bin/named/client.c | 6 ++++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/CHANGES b/CHANGES index c2421bde6c..a706c5880a 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,5 @@ + 331. [bug] Only log "recursion denied" if RD is set. (RT #178) + 330. [func] New function isc_log_wouldlog(). 329. [func] omapi_auth_register() now takes a size_t argument for diff --git a/bin/named/client.c b/bin/named/client.c index b7ef7d018f..9f565a20a4 100644 --- a/bin/named/client.c +++ b/bin/named/client.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: client.c,v 1.99 2000/07/13 00:21:27 bwelling Exp $ */ +/* $Id: client.c,v 1.100 2000/07/14 02:26:22 marka Exp $ */ #include @@ -816,6 +816,7 @@ client_request(isc_task_t *task, isc_event_t *event) { dns_view_t *view; dns_rdataset_t *opt; isc_boolean_t ra; /* Recursion available. */ + isc_boolean_t rd; /* Recursion desired. */ REQUIRE(event != NULL); client = event->ev_arg; @@ -1041,12 +1042,13 @@ client_request(isc_task_t *task, isc_event_t *event) { * responses to ordinary queries. */ ra = ISC_FALSE; + rd = ISC_TF((client->message->flags & DNS_MESSAGEFLAG_RD) != 0); if (client->view->resolver != NULL && client->view->recursion == ISC_TRUE && /* XXX this will log too much too early */ ns_client_checkacl(client, "recursion", client->view->recursionacl, - ISC_TRUE, ISC_TRUE) == ISC_R_SUCCESS) + ISC_TRUE, rd) == ISC_R_SUCCESS) ra = ISC_TRUE; if (ra == ISC_TRUE) From 1867b6276e222cc3ea98ff3a4d0b8bc7f23f36ab Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Fri, 14 Jul 2000 14:57:24 +0000 Subject: [PATCH 081/226] char secret[], for decoding the base64 string, should not have been const --- bin/named/omapiconf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/named/omapiconf.c b/bin/named/omapiconf.c index 0f4e0e18a1..f7a673f508 100644 --- a/bin/named/omapiconf.c +++ b/bin/named/omapiconf.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: omapiconf.c,v 1.7 2000/07/12 15:33:41 tale Exp $ */ +/* $Id: omapiconf.c,v 1.8 2000/07/14 14:57:24 tale Exp $ */ /* * Principal Author: DCL @@ -199,7 +199,7 @@ register_keys(dns_c_ctrl_t *control, dns_c_kdeflist_t *keydeflist, { dns_c_kid_t *keyid; dns_c_kdef_t *keydef; - const char secret[1024]; + char secret[1024]; isc_buffer_t b; isc_result_t result; From e715e011788a529446b8013239c33599542ece32 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Fri, 14 Jul 2000 16:35:30 +0000 Subject: [PATCH 082/226] More code duplication removal and general cleanup Slight change in +nssearch output formatting --- bin/dig/dig.c | 39 +++-------- bin/dig/dighost.c | 136 ++++++++++++++++++-------------------- bin/dig/host.c | 8 +-- bin/dig/include/dig/dig.h | 12 +++- bin/dig/nslookup.c | 19 +++--- 5 files changed, 90 insertions(+), 124 deletions(-) diff --git a/bin/dig/dig.c b/bin/dig/dig.c index 6ed208ab5e..ecd80de2b7 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.c,v 1.65 2000/07/13 21:12:20 mws Exp $ */ +/* $Id: dig.c,v 1.66 2000/07/14 16:35:25 mws Exp $ */ #include #include @@ -34,7 +34,7 @@ #include extern ISC_LIST(dig_lookup_t) lookup_list; -extern ISC_LIST(dig_server_t) server_list; +extern dig_serverlist_t server_list; extern ISC_LIST(dig_searchlist_t) search_list; #define ADD_STRING(b, s) { \ @@ -73,22 +73,7 @@ extern isc_boolean_t isc_mem_debugging; isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE; isc_uint16_t bufsize = 0; -isc_boolean_t - identify = ISC_FALSE, - trace = ISC_FALSE, - ns_search_only = ISC_FALSE, - forcecomment = ISC_FALSE, - stats = ISC_TRUE, - comments = ISC_TRUE, - section_question = ISC_TRUE, - section_answer = ISC_TRUE, - section_authority = ISC_TRUE, - section_additional = ISC_TRUE, - recurse = ISC_TRUE, - defname = ISC_TRUE, - tcpmode = ISC_FALSE, - adflag = ISC_FALSE, - cdflag = ISC_FALSE; +isc_boolean_t forcecomment = ISC_FALSE; static const char *opcodetext[] = { "QUERY", @@ -201,7 +186,8 @@ received(int bytes, int frmsize, char *frm, dig_query_t *query) { if (query->lookup->stats) { diff = isc_time_microdiff(&now, &query->time_sent); printf(";; Query time: %ld msec\n", (long int)diff/1000); - printf(";; SERVER: %.*s\n", frmsize, frm); + printf(";; SERVER: %.*s(%s)\n", frmsize, frm, + query->servname); time(&tnow); printf(";; WHEN: %s", ctime(&tnow)); printf(";; MSG SIZE rcvd: %d\n", bytes); @@ -591,17 +577,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { if (strncmp(rv[0], "%", 1) == 0) break; if (strncmp(rv[0], "@", 1) == 0) { - srv = isc_mem_allocate(mctx, - sizeof(struct dig_server)); - if (srv == NULL) - fatal("Memory allocation failure"); - strncpy(srv->servername, &rv[0][1], MXNAME-1); - if (!lookup->use_my_server_list) { - ISC_LIST_INIT(lookup-> - my_server_list); - lookup->use_my_server_list = - ISC_TRUE; - } + srv = make_server(&rv[0][1]); ISC_LIST_APPEND(lookup->my_server_list, srv, link); } else if ((strcmp(rv[0], "+vc") == 0) @@ -688,6 +664,8 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { lookup->section_additional = ISC_FALSE; lookup->section_authority = ISC_FALSE; lookup->section_question = ISC_FALSE; + strcpy(lookup->rttext, "soa"); + short_form = ISC_TRUE; } else if (strncmp(rv[0], "+nons", 6) == 0) { lookup->ns_search_only = ISC_FALSE; } else if (strncmp(rv[0], "+tr", 3) == 0) { @@ -912,7 +890,6 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { lookup->ns_search_only); lookup->new_search = ISC_TRUE; ISC_LIST_APPEND(lookup_list, lookup, link); - ISC_LIST_INIT(lookup->my_server_list); have_host = ISC_TRUE; debug("looking up %s", lookup->textname); } diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index 9367242ff2..535b6268a2 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.85 2000/07/13 22:53:49 mws Exp $ */ +/* $Id: dighost.c,v 1.86 2000/07/14 16:35:26 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -64,7 +64,7 @@ extern int h_errno; #include ISC_LIST(dig_lookup_t) lookup_list; -ISC_LIST(dig_server_t) server_list; +dig_serverlist_t server_list; ISC_LIST(dig_searchlist_t) search_list; isc_boolean_t @@ -230,6 +230,36 @@ istype(char *text) { return (ISC_FALSE); } +dig_server_t * +make_server(const char *servname) { + dig_server_t *srv; + + REQUIRE(servname != NULL); + + debug("make_server(%s)",servname); + srv = isc_mem_allocate(mctx, sizeof(struct dig_server)); + if (srv == NULL) + fatal("Memory allocation failure in %s:%d", + __FILE__, __LINE__); + strncpy(srv->servername, servname, MXNAME); + return (srv); +} + +void +clone_server_list(dig_serverlist_t src, + dig_serverlist_t *dest) +{ + dig_server_t *srv, *newsrv; + + debug("clone_server_list()"); + srv = ISC_LIST_HEAD(src); + while (srv != NULL) { + newsrv = make_server(srv->servername); + ISC_LIST_ENQUEUE(*dest, newsrv, link); + srv = ISC_LIST_NEXT(srv, link); + } +} + dig_lookup_t * make_empty_lookup(void) { dig_lookup_t *looknew; @@ -276,16 +306,18 @@ make_empty_lookup(void) { looknew->section_authority = ISC_TRUE; looknew->section_additional = ISC_TRUE; looknew->new_search = ISC_FALSE; - ISC_LIST_INIT(looknew->my_server_list); ISC_LIST_INIT(looknew->q); - looknew->use_my_server_list = ISC_FALSE; + ISC_LIST_INIT(looknew->my_server_list); return (looknew); } +/* + * Caution: If you don't clone the servers, you MUST clone the server + * list seperately from somewhere else, or construct it by hand. + */ dig_lookup_t * clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { dig_lookup_t *looknew; - dig_server_t *s, *srv; debug("clone_lookup()"); @@ -316,24 +348,9 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { looknew->section_authority = lookold->section_authority; looknew->section_additional = lookold->section_additional; - if (servers) { - looknew->use_my_server_list = lookold->use_my_server_list; - if (looknew->use_my_server_list) { - s = ISC_LIST_HEAD(lookold->my_server_list); - while (s != NULL) { - srv = isc_mem_allocate(mctx, - sizeof(struct dig_server)); - if (srv == NULL) - fatal("Memory allocation failure " - "in %s:%d", __FILE__, __LINE__); - strncpy(srv->servername, s->servername, - MXNAME); - ISC_LIST_ENQUEUE(looknew->my_server_list, srv, - link); - s = ISC_LIST_NEXT(s, link); - } - } - } + if (servers) + clone_server_list(lookold->my_server_list, + &looknew->my_server_list); return (looknew); } @@ -401,22 +418,10 @@ setup_system(void) { debug("got a nameserver line"); ptr = strtok(NULL, " \t\r\n"); if (ptr != NULL) { - srv = isc_mem_allocate(mctx, - sizeof(struct dig_server)); - if (srv == NULL) - fatal("Memory " - "allocation " - "failure in " - "%s:%d", - __FILE__, - __LINE__); - strncpy((char *)srv-> - servername, - ptr, - MXNAME - 1); - ISC_LIST_APPEND - (server_list, - srv, link); + srv = make_server(ptr); + ISC_LIST_APPEND + (server_list, + srv, link); } } else if (strcasecmp(ptr, "options") == 0) { ptr = strtok(NULL, " \t\r\n"); @@ -485,10 +490,7 @@ setup_system(void) { ndots = 1; if (server_list.head == NULL) { - srv = isc_mem_allocate(mctx, sizeof(dig_server_t)); - if (srv == NULL) - fatal("Memory allocation failure"); - strcpy(srv->servername, "127.0.0.1"); + srv = make_server("127.0.0.1"); ISC_LIST_APPEND(server_list, srv, link); } @@ -743,17 +745,15 @@ try_clear_lookup(dig_lookup_t *lookup) { * At this point, we know there are no queries on the lookup, * so can make it go away also. */ - if (lookup->use_my_server_list) { - s = ISC_LIST_HEAD(lookup->my_server_list); - while (s != NULL) { - debug("freeing server %p belonging to %p", - s, lookup); - ptr = s; - s = ISC_LIST_NEXT(s, link); - ISC_LIST_DEQUEUE(lookup->my_server_list, - (dig_server_t *)ptr, link); - isc_mem_free(mctx, ptr); - } + s = ISC_LIST_HEAD(lookup->my_server_list); + while (s != NULL) { + debug("freeing server %p belonging to %p", + s, lookup); + ptr = s; + s = ISC_LIST_NEXT(s, link); + ISC_LIST_DEQUEUE(lookup->my_server_list, + (dig_server_t *)ptr, link); + isc_mem_free(mctx, ptr); } if (lookup->sendmsg != NULL) dns_message_destroy(&lookup->sendmsg); @@ -891,8 +891,6 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, ISC_FALSE); lookup->doing_xfr = ISC_FALSE; lookup->defname = ISC_FALSE; - lookup->use_my_server_list = - ISC_TRUE; if (section == DNS_SECTION_ANSWER) { lookup->trace = @@ -909,19 +907,10 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, lookup->ns_search_only; } lookup->trace_root = ISC_FALSE; - ISC_LIST_INIT(lookup-> - my_server_list); } - srv = isc_mem_allocate(mctx, - sizeof(struct dig_server)); - if (srv == NULL) - fatal("Memory allocation " - "failure in %s:%d", - __FILE__, __LINE__); - strncpy(srv->servername, - (char *)r.base, len); - srv->servername[len] = 0; - debug("adding1 server %s", + r.base[len]=0; + srv = make_server(r.base); + debug("adding server %s", srv->servername); ISC_LIST_APPEND (lookup->my_server_list, @@ -1057,6 +1046,10 @@ setup_lookup(dig_lookup_t *lookup) { lookup_counter = 0; } + if (ISC_LIST_EMPTY(lookup->my_server_list)) { + debug("cloning server list"); + clone_server_list(server_list, &lookup->my_server_list); + } result = dns_message_gettempname(lookup->sendmsg, &lookup->name); check_result(result, "dns_message_gettempname"); dns_name_init(lookup->name, NULL); @@ -1237,10 +1230,7 @@ setup_lookup(dig_lookup_t *lookup) { lookup->pending = ISC_FALSE; - if (lookup->use_my_server_list) - serv = ISC_LIST_HEAD(lookup->my_server_list); - else - serv = ISC_LIST_HEAD(server_list); + serv = ISC_LIST_HEAD(lookup->my_server_list); for (; serv != NULL; serv = ISC_LIST_NEXT(serv, link)) { query = isc_mem_allocate(mctx, sizeof(dig_query_t)); @@ -1360,7 +1350,7 @@ send_udp(dig_lookup_t *lookup) { &lookup->timer); check_result(result, "isc_timer_create"); } -for (query = ISC_LIST_HEAD(lookup->q); + for (query = ISC_LIST_HEAD(lookup->q); query != NULL; query = ISC_LIST_NEXT(query, link)) { debug("working on lookup %p, query %p", diff --git a/bin/dig/host.c b/bin/dig/host.c index 27b1205445..27a2d99b02 100644 --- a/bin/dig/host.c +++ b/bin/dig/host.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: host.c,v 1.39 2000/07/13 21:01:00 mws Exp $ */ +/* $Id: host.c,v 1.40 2000/07/14 16:35:27 mws Exp $ */ #include #include @@ -618,11 +618,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { } strncpy(hostname, argv[isc_commandline_index], MXNAME); if (argc > isc_commandline_index + 1) { - srv = isc_mem_allocate(mctx, sizeof(struct dig_server)); - if (srv == NULL) - fatal("Memory allocation failure."); - strncpy(srv->servername, - argv[isc_commandline_index+1], MXNAME-1); + srv = make_server(argv[isc_commandline_index+1]); debug("server is %s", srv->servername); ISC_LIST_APPEND(server_list, srv, link); } diff --git a/bin/dig/include/dig/dig.h b/bin/dig/include/dig/dig.h index 1defb0f4a7..289e2a26aa 100644 --- a/bin/dig/include/dig/dig.h +++ b/bin/dig/include/dig/dig.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.h,v 1.33 2000/07/13 22:53:51 mws Exp $ */ +/* $Id: dig.h,v 1.34 2000/07/14 16:35:30 mws Exp $ */ #ifndef DIG_H #define DIG_H @@ -66,6 +66,7 @@ ISC_LANG_BEGINDECLS typedef struct dig_lookup dig_lookup_t; typedef struct dig_query dig_query_t; typedef struct dig_server dig_server_t; +typedef ISC_LIST(dig_server_t) dig_serverlist_t; typedef struct dig_searchlist dig_searchlist_t; struct dig_lookup { @@ -74,7 +75,6 @@ struct dig_lookup { waiting_connect, doing_xfr, ns_search_only, - use_my_server_list, identify, recurse, aaonly, @@ -107,7 +107,7 @@ struct dig_lookup { dns_name_t *oname; ISC_LINK(dig_lookup_t) link; ISC_LIST(dig_query_t) q; - ISC_LIST(dig_server_t) my_server_list; + dig_serverlist_t my_server_list; dig_searchlist_t *origin; dig_query_t *xfr_q; int retries; @@ -215,6 +215,12 @@ make_empty_lookup(void); dig_lookup_t * clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers); +dig_server_t * +make_server(const char *servname); + +void +clone_server_list(dig_serverlist_t src, + dig_serverlist_t *dest); /* * Routines needed in dig.c and host.c. diff --git a/bin/dig/nslookup.c b/bin/dig/nslookup.c index 5f032a4923..003af850b1 100644 --- a/bin/dig/nslookup.c +++ b/bin/dig/nslookup.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: nslookup.c,v 1.24 2000/07/13 01:22:36 mws Exp $ */ +/* $Id: nslookup.c,v 1.25 2000/07/14 16:35:29 mws Exp $ */ #include @@ -659,7 +659,6 @@ addlookup(char *opt) { lookup->xfr_q = NULL; lookup->origin = NULL; lookup->querysig = NULL; - lookup->use_my_server_list = ISC_FALSE; lookup->doing_xfr = ISC_FALSE; lookup->ixfr_serial = 0; lookup->defname = ISC_FALSE; @@ -802,15 +801,13 @@ flush_lookup_list(void) { ISC_LIST_DEQUEUE(l->q, qp, link); isc_mem_free(mctx, qp); } - if (l->use_my_server_list) { - s = ISC_LIST_HEAD(l->my_server_list); - while (s != NULL) { - sp = s; - s = ISC_LIST_NEXT(s, link); - ISC_LIST_DEQUEUE(l->my_server_list, sp, link); - isc_mem_free(mctx, sp); - - } + s = ISC_LIST_HEAD(l->my_server_list); + while (s != NULL) { + sp = s; + s = ISC_LIST_NEXT(s, link); + ISC_LIST_DEQUEUE(l->my_server_list, sp, link); + isc_mem_free(mctx, sp); + } if (l->sendmsg != NULL) dns_message_destroy(&l->sendmsg); From da892e97332b7f5080c6a56c012bc77752c290ab Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Fri, 14 Jul 2000 16:59:32 +0000 Subject: [PATCH 083/226] Typo in comment - isc_time_microdiff returns microseconds, not milliseconds. --- lib/isc/unix/include/isc/time.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/isc/unix/include/isc/time.h b/lib/isc/unix/include/isc/time.h index 0d2e3dbb77..a43e2217e8 100644 --- a/lib/isc/unix/include/isc/time.h +++ b/lib/isc/unix/include/isc/time.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: time.h,v 1.21 2000/06/30 22:40:30 tale Exp $ */ +/* $Id: time.h,v 1.22 2000/07/14 16:59:32 bwelling Exp $ */ #ifndef ISC_TIME_H #define ISC_TIME_H 1 @@ -218,7 +218,7 @@ isc_time_subtract(isc_time_t *t, isc_interval_t *i, isc_time_t *result); isc_uint64_t isc_time_microdiff(isc_time_t *t1, isc_time_t *t2); /* - * Find the difference in milliseconds between time t1 and time t2. + * Find the difference in microseconds between time t1 and time t2. * t2 is the subtrahend of t1; ie, difference = t1 - t2. * * Requires: From 074ae7bf0993ced96b32e3e85553a401f3f3eca9 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Fri, 14 Jul 2000 17:11:07 +0000 Subject: [PATCH 084/226] RT #169: note that logging categories have changed from BIND 8 --- doc/misc/migration | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/doc/misc/migration b/doc/misc/migration index ab20894abb..5706a767ce 100644 --- a/doc/misc/migration +++ b/doc/misc/migration @@ -25,6 +25,22 @@ warning message. A message is also logged about each option whose default has changed unless the option is set explicitly in named.conf. +1.2. Logging + +The set of logging categories in BIND 9 is different from that +in BIND 8. If you have customized your logging on a per-category +basis, you need to modify your logging statement to use the +new categories. + +Another difference is that the "logging" statement only takes effect +after the entire named.conf file has been read. This means that when +the server starts up, any messages about errors in the configuration +file are always logged to the default destination (syslog) when the +server first starts up, regardless of the contents of the "logging" +statement. In BIND 8, the new logging configuration took effect +immediately after the "logging" statement was read. + + 2. Zone File Compatibility 2.1. Strict RFC1035 Interpretation of TTLs in Zone Files @@ -79,4 +95,4 @@ completely. We have contacted the manufacturer of the name server in case and are trying to resolve the issue with them. -$Id: migration,v 1.2 2000/07/12 05:06:33 gson Exp $ +$Id: migration,v 1.3 2000/07/14 17:11:07 gson Exp $ From 16836f6ab6dec7f75ebccbaf7098b62484fa2624 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Fri, 14 Jul 2000 17:13:49 +0000 Subject: [PATCH 085/226] 9.0.0b5 was built from the release branch, not the mainline --- CHANGES | 2 -- 1 file changed, 2 deletions(-) diff --git a/CHANGES b/CHANGES index a706c5880a..316dea74df 100644 --- a/CHANGES +++ b/CHANGES @@ -141,8 +141,6 @@ keep a copy of the user and group databases in the chroot'ed environment. Suggested by Hakan Olsson. - --- 9.0.0b5 released --- - 298. [bug] A mutex deadlock occurred during shutdown of the interface manager under certain conditions. Digital Unix systems were the most affected. From 8cd54a7461ad183f9e839d96cedb7b7ad03fb244 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Fri, 14 Jul 2000 17:57:27 +0000 Subject: [PATCH 086/226] Lots of changes to the shutdown code. Get rid of the annoying "just exit" method of shutting down. Known bug: SIGINT while doing batch mode causes assertion. --- bin/dig/dig.c | 36 ++++++------- bin/dig/dighost.c | 106 +++++++++++++++++++++++++++++--------- bin/dig/host.c | 19 ++----- bin/dig/include/dig/dig.h | 8 ++- 4 files changed, 111 insertions(+), 58 deletions(-) diff --git a/bin/dig/dig.c b/bin/dig/dig.c index ecd80de2b7..52036f92a3 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.c,v 1.66 2000/07/14 16:35:25 mws Exp $ */ +/* $Id: dig.c,v 1.67 2000/07/14 17:57:23 mws Exp $ */ #include #include @@ -66,6 +66,7 @@ extern dns_tsigkey_t *key; extern isc_boolean_t validated; extern isc_taskmgr_t *taskmgr; extern isc_task_t *global_task; +extern isc_boolean_t free_now; extern isc_boolean_t debugging; extern isc_boolean_t isc_mem_debugging; @@ -539,7 +540,7 @@ reorder_args(int argc, char *argv[]) { static void parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { isc_boolean_t have_host = ISC_FALSE; - dig_server_t *srv = NULL; + dig_server_t *srv = NULL, *s, *s2; dig_lookup_t *lookup = NULL; static dig_lookup_t *default_lookup = NULL; char *batchname = NULL; @@ -926,8 +927,20 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { strcpy(lookup->rttext, "NS"); ISC_LIST_APPEND(lookup_list, lookup, link); } - if (!is_batchfile) + if (!is_batchfile) { printgreeting(argc, argv); + s = ISC_LIST_HEAD(default_lookup->my_server_list); + while (s != NULL) { + debug("freeing server %p belonging to %p", + s, default_lookup); + s2 = s; + s = ISC_LIST_NEXT(s, link); + ISC_LIST_DEQUEUE(default_lookup->my_server_list, + (dig_server_t *)s2, link); + isc_mem_free(mctx, s2); + } + isc_mem_free(mctx, default_lookup); + } } int @@ -946,22 +959,9 @@ main(int argc, char **argv) { result = isc_app_onrun(mctx, global_task, onrun_callback, NULL); check_result(result, "isc_app_onrun"); isc_app_run(); - /* - * XXXMWS This code should really NOT be bypassed. However, - * until the proper code can be added to handle SIGTERM/INT - * correctly, just exit out "hard" and deal as best we can. - */ -#if 0 - if (taskmgr != NULL) { - debug("Freeing taskmgr"); - isc_taskmgr_destroy(&taskmgr); - } - if (isc_mem_debugging) - isc_mem_stats(mctx, stderr); - if (mctx != NULL) - isc_mem_destroy(&mctx); + cancel_all(); + destroy_libs(); isc_app_finish(); -#endif return (exitcode); } diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index 535b6268a2..9331cf8ac6 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.86 2000/07/14 16:35:26 mws Exp $ */ +/* $Id: dighost.c,v 1.87 2000/07/14 17:57:25 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -71,6 +71,7 @@ isc_boolean_t have_ipv6 = ISC_FALSE, specified_source = ISC_FALSE, free_now = ISC_FALSE, + cancel_now = ISC_FALSE, show_details = ISC_FALSE, usesearch = ISC_FALSE, qr = ISC_FALSE, @@ -107,6 +108,21 @@ isc_mempool_t *commctx = NULL; extern isc_boolean_t isc_mem_debugging; isc_boolean_t debugging = ISC_FALSE; char *progname = NULL; +isc_mutex_t lookup_lock; + +/* + * Apply and clear locks at the event level in global task. + */ +#define LOCK_LOOKUP {\ + debug("lock_lookup %s:%d", __FILE__, __LINE__);\ + check_result(isc_mutex_lock((&lookup_lock)), "isc_mutex_lock");\ + debug("success");\ +} +#define UNLOCK_LOOKUP {\ + debug("unlock_lookup %s:%d", __FILE__, __LINE__);\ + check_result(isc_mutex_unlock((&lookup_lock)),\ + "isc_mutex_unlock");\ +} static void cancel_lookup(dig_lookup_t *lookup); @@ -624,6 +640,9 @@ setup_libs(void) { */ isc_mempool_setfreemax(commctx, 6); isc_mempool_setfillcount(commctx, 2); + + result = isc_mutex_init(&lookup_lock); + check_result(result, "isc_mutex_init"); } static void @@ -701,6 +720,7 @@ clear_query(dig_query_t *query) { debug("clear_query(%p)",query); lookup = query->lookup; + ISC_LIST_UNLINK(lookup->q, query, link); if (ISC_LINK_LINKED(&query->recvbuf, link)) ISC_LIST_DEQUEUE(query->recvlist, &query->recvbuf, @@ -784,6 +804,8 @@ begin_next_lookup(void) { dig_lookup_t *next; debug("begin_next_lookup()"); + if (cancel_now) + return; next = ISC_LIST_HEAD(lookup_list); if (next != NULL) { setup_lookup(next); @@ -838,6 +860,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, debug("followup_lookup()"); result = dns_message_firstname(msg,section); + if (result != ISC_R_SUCCESS) { debug("firstname returned %s", isc_result_totext(result)); @@ -1277,6 +1300,7 @@ send_done(isc_task_t *task, isc_event_t *event) { UNUSED(task); + LOCK_LOOKUP; sevent = (isc_socketevent_t *)event; query = event->ev_arg; @@ -1294,9 +1318,8 @@ send_done(isc_task_t *task, isc_event_t *event) { l = query->lookup; clear_query(query); check_next_lookup(l); - return; } - + UNLOCK_LOOKUP; } void @@ -1392,8 +1415,9 @@ connect_timeout(isc_task_t *task, isc_event_t *event) { REQUIRE(event->ev_type == ISC_TIMEREVENT_IDLE); debug("connect_timeout()"); - lookup = event->ev_arg; + LOCK_LOOKUP; + lookup = event->ev_arg; isc_event_free(&event); debug("buffer allocate connect_timeout"); @@ -1434,6 +1458,7 @@ connect_timeout(isc_task_t *task, isc_event_t *event) { isc_timer_detach(&lookup->timer); isc_buffer_free(&b); debug("done with connect_timeout()"); + UNLOCK_LOOKUP; } static void @@ -1453,8 +1478,8 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) { debug("tcp_length_done()"); + LOCK_LOOKUP; sevent = (isc_socketevent_t *)event; - query = event->ev_arg; recvcount--; @@ -1512,6 +1537,7 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) { debug("resubmitted recv request with length %d, recvcount=%d", length, recvcount); isc_event_free(&event); + UNLOCK_LOOKUP; } static void @@ -1583,10 +1609,11 @@ connect_done(isc_task_t *task, isc_event_t *event) { debug("connect_done()"); + LOCK_LOOKUP; sevent = (isc_socketevent_t *)event; query = sevent->ev_arg; - REQUIRE(query->waiting_connect); + INSIST(query->waiting_connect); query->waiting_connect = ISC_FALSE; @@ -1616,10 +1643,12 @@ connect_done(isc_task_t *task, isc_event_t *event) { l = query->lookup; clear_query(query); check_next_lookup(l); + UNLOCK_LOOKUP; return; } launch_next_query(query, ISC_TRUE); isc_event_free(&event); + UNLOCK_LOOKUP; } @@ -1821,6 +1850,7 @@ recv_done(isc_task_t *task, isc_event_t *event) { debug("recv_done()"); + LOCK_LOOKUP; recvcount--; debug("recvcount=%d", recvcount); INSIST(recvcount >= 0); @@ -1835,7 +1865,8 @@ recv_done(isc_task_t *task, isc_event_t *event) { if ((l->tcp_mode) && (l->timer != NULL)) isc_timer_touch(l->timer); - if (!l->pending && !l->ns_search_only) { + if ((!l->pending && !l->ns_search_only) + || cancel_now) { debug("no longer pending. Got %s", isc_result_totext(sevent->result)); @@ -1845,6 +1876,7 @@ recv_done(isc_task_t *task, isc_event_t *event) { isc_event_free(&event); clear_query(query); check_next_lookup(l); + UNLOCK_LOOKUP; return; } @@ -1892,6 +1924,7 @@ recv_done(isc_task_t *task, isc_event_t *event) { clear_query(query); cancel_lookup(l); check_next_lookup(l); + UNLOCK_LOOKUP; return; } if (key != NULL) { @@ -1999,6 +2032,7 @@ recv_done(isc_task_t *task, isc_event_t *event) { isc_event_free (&event); query->working = ISC_FALSE; query->waiting_connect = ISC_FALSE; + UNLOCK_LOOKUP; return; } docancel = check_for_more_data(query, msg, sevent); @@ -2041,6 +2075,7 @@ recv_done(isc_task_t *task, isc_event_t *event) { clear_query(query); check_next_lookup(l); } + UNLOCK_LOOKUP; return; } /* @@ -2054,6 +2089,7 @@ recv_done(isc_task_t *task, isc_event_t *event) { isc_event_free(&event); clear_query(query); check_next_lookup(l); + UNLOCK_LOOKUP; return; } fatal("recv_done got result %s", @@ -2224,20 +2260,27 @@ void onrun_callback(isc_task_t *task, isc_event_t *event) { UNUSED(task); isc_event_free(&event); + LOCK_LOOKUP; start_lookup(); + UNLOCK_LOOKUP; } -#if 0 /* * This will be used in the SIGINT handler, and perhaps other places. */ -static void +void cancel_all(void) { dig_lookup_t *l; dig_query_t *q; debug("cancel_all()"); - + + LOCK_LOOKUP; + if (free_now) { + UNLOCK_LOOKUP; + return; + } + cancel_now = ISC_TRUE; l = ISC_LIST_HEAD(lookup_list); while (l != NULL) { if (l->timer != NULL) @@ -2249,22 +2292,16 @@ cancel_all(void) { if (q->sock != NULL) { isc_socket_cancel(q->sock, NULL, ISC_SOCKCANCEL_ALL); - isc_socket_detach(&q->sock); - sockcount--; - debug("sockcount=%d",sockcount); - INSIST(sockcount >= 0); - check_if_done(); } q = ISC_LIST_NEXT(q, link); } l = ISC_LIST_NEXT(l, link); } - check_if_done(); + UNLOCK_LOOKUP; } -#endif -void -free_lists(void) { +static void +xfree_lists(void) { void *ptr; dig_server_t *s; dig_searchlist_t *o; @@ -2307,10 +2344,6 @@ free_lists(void) { debug("freeing timermgr"); isc_timermgr_destroy(&timermgr); } - if (global_task != NULL) { - debug("freeing task"); - isc_task_detach(&global_task); - } if (key != NULL) { debug("freeing key %p", key); dns_tsigkey_setdeleted(key); @@ -2333,3 +2366,30 @@ free_lists(void) { isc_entropy_detach(&entp); } } + +void +destroy_libs(void) { + debug("destroy_libs()"); + if (global_task != NULL) { + debug("freeing task"); + isc_task_detach(&global_task); + } + if (taskmgr != NULL) { + debug("Freeing taskmgr"); + isc_taskmgr_destroy(&taskmgr); + } + LOCK_LOOKUP; + xfree_lists(); + isc_mutex_destroy(&lookup_lock); + if (isc_mem_debugging) + isc_mem_stats(mctx, stderr); + if (mctx != NULL) + isc_mem_destroy(&mctx); +} + +/* + * Dummy function, soon to go away + */ +void +free_lists(void) { +} diff --git a/bin/dig/host.c b/bin/dig/host.c index 27a2d99b02..0364fcfe3e 100644 --- a/bin/dig/host.c +++ b/bin/dig/host.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: host.c,v 1.40 2000/07/14 16:35:27 mws Exp $ */ +/* $Id: host.c,v 1.41 2000/07/14 17:57:26 mws Exp $ */ #include #include @@ -677,22 +677,9 @@ main(int argc, char **argv) { result = isc_app_onrun(mctx, global_task, onrun_callback, NULL); check_result(result, "isc_app_onrun"); isc_app_run(); - /* - * XXXMWS This code should really NOT be bypassed. However, - * until the proper code can be added to handle SIGTERM/INT - * correctly, just exit out "hard" and deal as best we can. - */ -#if 0 - if (taskmgr != NULL) { - debug("freeing taskmgr"); - isc_taskmgr_destroy(&taskmgr); - } - if (isc_mem_debugging) - isc_mem_stats(mctx, stderr); + cancel_all(); + destroy_libs(); isc_app_finish(); - if (mctx != NULL) - isc_mem_destroy(&mctx); -#endif return (0); } diff --git a/bin/dig/include/dig/dig.h b/bin/dig/include/dig/dig.h index 289e2a26aa..d3d37c0598 100644 --- a/bin/dig/include/dig/dig.h +++ b/bin/dig/include/dig/dig.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.h,v 1.34 2000/07/14 16:35:30 mws Exp $ */ +/* $Id: dig.h,v 1.35 2000/07/14 17:57:27 mws Exp $ */ #ifndef DIG_H #define DIG_H @@ -222,6 +222,12 @@ void clone_server_list(dig_serverlist_t src, dig_serverlist_t *dest); +void +cancel_all(void); + +void +destroy_libs(void); + /* * Routines needed in dig.c and host.c. */ From da527e4ff6a013364826637963e7ac372e024f33 Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Fri, 14 Jul 2000 19:12:54 +0000 Subject: [PATCH 087/226] 332. [func] New function dns_name_reset(). --- CHANGES | 2 ++ lib/dns/include/dns/name.h | 39 +++++++++++++++++++++++++++++++++++++- lib/dns/name.c | 14 ++++++++++++-- 3 files changed, 52 insertions(+), 3 deletions(-) diff --git a/CHANGES b/CHANGES index 316dea74df..39cd65195d 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,5 @@ + 332. [func] New function dns_name_reset(). + 331. [bug] Only log "recursion denied" if RD is set. (RT #178) 330. [func] New function isc_log_wouldlog(). diff --git a/lib/dns/include/dns/name.h b/lib/dns/include/dns/name.h index 1ce797c996..05a1f3dd87 100644 --- a/lib/dns/include/dns/name.h +++ b/lib/dns/include/dns/name.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: name.h,v 1.74 2000/07/13 18:10:16 bwelling Exp $ */ +/* $Id: name.h,v 1.75 2000/07/14 19:12:51 tale Exp $ */ #ifndef DNS_NAME_H #define DNS_NAME_H 1 @@ -236,6 +236,32 @@ dns_name_init(dns_name_t *name, unsigned char *offsets); * Ensures: * 'name' is a valid name. * dns_name_countlabels(name) == 0 + * dns_name_isabsolute(name) == ISC_FALSE + */ + +void +dns_name_reset(dns_name_t *name); +/* + * Reinitialize 'name'. + * + * Notes: + * This function distinguishes itself from dns_name_init() in two + * key ways: + * + * + If any buffer is associated with 'name' (via dns_name_setbuffer() + * or by being part of a dns_fixedname_t) the link to the buffer + * is retained but the buffer itself is cleared. + * + * + Of the attributes associated with 'name', all are retained except + * DNS_NAMEATTR_ABSOLUTE. + * + * Requires: + * 'name' is a valid name. + * + * Ensures: + * 'name' is a valid name. + * dns_name_countlabels(name) == 0 + * dns_name_isabsolute(name) == ISC_FALSE */ void @@ -1182,6 +1208,7 @@ ISC_LANG_ENDDECLS #ifdef DNS_NAME_USEINLINE #define dns_name_init(n, o) DNS_NAME_INIT(n, o) +#define dns_name_reset(n) DNS_NAME_RESET(n) #define dns_name_countlabels(n) DNS_NAME_COUNTLABELS(n) #define dns_name_isabsolute(n) DNS_NAME_ISABSOLUTE(n) @@ -1198,6 +1225,16 @@ do { \ ISC_LIST_INIT((n)->list); \ } while (0) +#define DNS_NAME_RESET(n) \ +do { \ + (n)->ndata = NULL; \ + (n)->length = 0; \ + (n)->labels = 0; \ + (n)->attributes &= ~DNS_NAMEATTR_ABSOLUTE; \ + if ((n)->buffer != NULL) \ + isc_buffer_clear((n)->buffer); \ +} while (0) + #define DNS_NAME_SETBUFFER(n, b) \ (n)->buffer = (b) diff --git a/lib/dns/name.c b/lib/dns/name.c index 00593ff2b7..2f47192f16 100644 --- a/lib/dns/name.c +++ b/lib/dns/name.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: name.c,v 1.94 2000/07/13 18:10:18 bwelling Exp $ */ +/* $Id: name.c,v 1.95 2000/07/14 19:12:53 tale Exp $ */ #include @@ -320,6 +320,16 @@ dns_name_init(dns_name_t *name, unsigned char *offsets) { ISC_LIST_INIT(name->list); } +void +dns_name_reset(dns_name_t *name) { + REQUIRE(VALID_NAME(name)); + REQUIRE(BINDABLE(name)); + + MAKE_EMPTY(name); + if (name->buffer != NULL) + isc_buffer_clear(name->buffer); +} + void dns_name_invalidate(dns_name_t *name) { /* @@ -2476,7 +2486,7 @@ dns_name_concatenate(dns_name_t *prefix, dns_name_t *suffix, dns_name_t *name, REQUIRE(BINDABLE(name)); /* - * IMPORTANT NOTE + * XXX IMPORTANT NOTE * * If the most-signficant label in prefix is a bitstring, * and the least-signficant label in suffix is a bitstring, From 891a1bead8d02d29eb7b4993d7c0975047b0963d Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Fri, 14 Jul 2000 19:17:39 +0000 Subject: [PATCH 088/226] Use new function dns_name_reset() to make a name have no data, instead of dns_name_concatenate(NULL, NULL, name, NULL). Define DNS_NAME_USELINE to get macroized name functions. Removed older FAST_COUNTLABELS and FAST_ISABSOLUTE to use standard name interface, which are covered by DNS_NAME_USEINLINE. --- lib/dns/rbt.c | 50 ++++++++++++++++++++++---------------------------- 1 file changed, 22 insertions(+), 28 deletions(-) diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c index f065abe926..9665df316e 100644 --- a/lib/dns/rbt.c +++ b/lib/dns/rbt.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: rbt.c,v 1.84 2000/07/06 23:54:43 tale Exp $ */ +/* $Id: rbt.c,v 1.85 2000/07/14 19:17:39 tale Exp $ */ /* Principal Authors: DCL */ @@ -25,9 +25,15 @@ #include #include +/* + * This define is so dns/name.h (included by dns/fixedname.h) uses more + * efficient macro calls instead of functions for a few operations. + */ +#define DNS_NAME_USEINLINE 1 + +#include #include #include -#include #define RBT_MAGIC 0x5242542BU /* RBT+. */ #define VALID_RBT(rbt) ISC_MAGIC_VALID(rbt, RBT_MAGIC) @@ -125,12 +131,6 @@ do { \ (name)->attributes |= DNS_NAMEATTR_READONLY; \ } while (0) -#define FAST_ISABSOLUTE(name) \ - (((name)->attributes & DNS_NAMEATTR_ABSOLUTE) ? ISC_TRUE : ISC_FALSE) - -#define FAST_COUNTLABELS(name) \ - ((name)->labels) - #ifdef DEBUG #define inline /* @@ -285,17 +285,11 @@ chain_name(dns_rbtnodechain_t *chain, dns_name_t *name, isc_boolean_t include_chain_end) { dns_name_t nodename; - isc_result_t result; + isc_result_t result = ISC_R_SUCCESS; unsigned int i; dns_name_init(&nodename, NULL); - - /* - * XXX DCL Is this too devilish, initializing name like this? - */ - result = dns_name_concatenate(NULL, NULL, name, NULL); - if (result != ISC_R_SUCCESS) - return result; + dns_name_reset(name); for (i = 0; i < chain->level_count; i++) { NODENAME(chain->levels[i], &nodename); @@ -359,7 +353,7 @@ dns_rbt_addnode(dns_rbt_t *rbt, dns_name_t *name, dns_rbtnode_t **nodep) { int order; REQUIRE(VALID_RBT(rbt)); - REQUIRE(FAST_ISABSOLUTE(name)); + REQUIRE(dns_name_isabsolute(name)); REQUIRE(nodep != NULL && *nodep == NULL); /* @@ -574,8 +568,8 @@ dns_rbt_addnode(dns_rbt_t *rbt, dns_name_t *name, dns_rbtnode_t **nodep) { dns_label_t label; dns_name_getlabel(prefix, - FAST_COUNTLABELS(¤t_name) - - common_labels, + dns_name_countlabels(¤t_name) + - common_labels, &label); INSIST(dns_label_type(&label) == @@ -587,8 +581,8 @@ dns_rbt_addnode(dns_rbt_t *rbt, dns_name_t *name, dns_rbtnode_t **nodep) { label.length); dns_name_getlabel(add_name, - FAST_COUNTLABELS(add_name) - - common_labels, + dns_name_countlabels(add_name) + - common_labels, &label); INSIST(dns_label_type(&label) == dns_labeltype_bitstring); @@ -625,7 +619,7 @@ dns_rbt_addnode(dns_rbt_t *rbt, dns_name_t *name, dns_rbtnode_t **nodep) { ATTRS(current) &= ~DNS_NAMEATTR_ABSOLUTE; if (common_labels == - FAST_COUNTLABELS(add_name) && + dns_name_countlabels(add_name) && common_bits == add_bits) { /* * The name has been added by pushing @@ -692,7 +686,7 @@ dns_rbt_addname(dns_rbt_t *rbt, dns_name_t *name, void *data) { dns_rbtnode_t *node; REQUIRE(VALID_RBT(rbt)); - REQUIRE(FAST_ISABSOLUTE(name)); + REQUIRE(dns_name_isabsolute(name)); node = NULL; @@ -732,7 +726,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname, int order; REQUIRE(VALID_RBT(rbt)); - REQUIRE(FAST_ISABSOLUTE(name)); + REQUIRE(dns_name_isabsolute(name)); REQUIRE(node != NULL && *node == NULL); REQUIRE((options & (DNS_RBTFIND_NOEXACT | DNS_RBTFIND_NOPREDECESSOR)) != (DNS_RBTFIND_NOEXACT | DNS_RBTFIND_NOPREDECESSOR)); @@ -1116,7 +1110,7 @@ dns_rbt_deletename(dns_rbt_t *rbt, dns_name_t *name, isc_boolean_t recurse) { isc_result_t result; REQUIRE(VALID_RBT(rbt)); - REQUIRE(FAST_ISABSOLUTE(name)); + REQUIRE(dns_name_isabsolute(name)); /* * First, find the node. @@ -1247,7 +1241,7 @@ create_node(isc_mem_t *mctx, dns_name_t *name, dns_rbtnode_t **nodep) { REQUIRE(name->offsets != NULL); dns_name_toregion(name, ®ion); - labels = FAST_COUNTLABELS(name); + labels = dns_name_countlabels(name); ENSURE(labels > 0); /* @@ -1972,8 +1966,8 @@ dns_rbtnodechain_current(dns_rbtnodechain_t *chain, dns_name_t *name, /* * Eliminate the root name, except when name is ".". */ - if (FAST_COUNTLABELS(name) > 1) { - INSIST(FAST_ISABSOLUTE(name)); + if (dns_name_countlabels(name) > 1) { + INSIST(dns_name_isabsolute(name)); /* * XXX EVIL. But what _should_ I do? From 925a734426ac10c224d5e4e6f90a108a8418a424 Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Fri, 14 Jul 2000 20:14:36 +0000 Subject: [PATCH 089/226] Handle SIGINT properly during batch mode. --- bin/dig/dighost.c | 74 +++++++++++++++++++++++++---------------------- 1 file changed, 39 insertions(+), 35 deletions(-) diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index 9331cf8ac6..dbfdf0eadc 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.87 2000/07/14 17:57:25 mws Exp $ */ +/* $Id: dighost.c,v 1.88 2000/07/14 20:14:36 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -109,6 +109,7 @@ extern isc_boolean_t isc_mem_debugging; isc_boolean_t debugging = ISC_FALSE; char *progname = NULL; isc_mutex_t lookup_lock; +dig_lookup_t *current_lookup = NULL; /* * Apply and clear locks at the event level in global task. @@ -765,6 +766,7 @@ try_clear_lookup(dig_lookup_t *lookup) { * At this point, we know there are no queries on the lookup, * so can make it go away also. */ + debug("cleared"); s = ISC_LIST_HEAD(lookup->my_server_list); while (s != NULL) { debug("freeing server %p belonging to %p", @@ -783,13 +785,10 @@ try_clear_lookup(dig_lookup_t *lookup) { } if (lookup->timer != NULL) isc_timer_detach(&lookup->timer); - INSIST(lookup->sendspace != NULL); - isc_mempool_put(commctx, lookup->sendspace); + if (lookup->sendspace != NULL) + isc_mempool_put(commctx, lookup->sendspace); - ptr = lookup; - lookup = ISC_LIST_NEXT(lookup, link); - ISC_LIST_DEQUEUE(lookup_list, (dig_lookup_t *)ptr, link); - isc_mem_free(mctx, ptr); + isc_mem_free(mctx, lookup); return (ISC_TRUE); } @@ -799,15 +798,27 @@ try_clear_lookup(dig_lookup_t *lookup) { * This assumes that the lookup on the head of the queue hasn't been * started yet. */ -static void -begin_next_lookup(void) { +void +start_lookup(void) { dig_lookup_t *next; - debug("begin_next_lookup()"); + debug("start_lookup()"); if (cancel_now) return; + + /* + * If there's a current lookup running, we really shouldn't get + * here. + */ + INSIST(current_lookup == NULL); + next = ISC_LIST_HEAD(lookup_list); + current_lookup = next; + /* + * Put the current lookup somewhere so cancel_all can find it + */ if (next != NULL) { + ISC_LIST_DEQUEUE(lookup_list, next, link); setup_lookup(next); do_lookup(next); } else { @@ -838,8 +849,10 @@ check_next_lookup(dig_lookup_t *lookup) { } if (still_working) return; - if (try_clear_lookup(lookup)) - begin_next_lookup(); + if (try_clear_lookup(lookup)) { + current_lookup = NULL; + start_lookup(); + } } static void @@ -2241,21 +2254,6 @@ do_lookup(dig_lookup_t *lookup) { do_lookup_udp(lookup); } -void -start_lookup(void) { - dig_lookup_t *lookup; - - INSIST(!free_now); - - debug("start_lookup()"); - - lookup = ISC_LIST_HEAD(lookup_list); - if (lookup != NULL) { - setup_lookup(lookup); - do_lookup(lookup); - } -} - void onrun_callback(isc_task_t *task, isc_event_t *event) { UNUSED(task); @@ -2270,7 +2268,7 @@ onrun_callback(isc_task_t *task, isc_event_t *event) { */ void cancel_all(void) { - dig_lookup_t *l; + dig_lookup_t *l, *n; dig_query_t *q; debug("cancel_all()"); @@ -2281,21 +2279,26 @@ cancel_all(void) { return; } cancel_now = ISC_TRUE; - l = ISC_LIST_HEAD(lookup_list); - while (l != NULL) { - if (l->timer != NULL) - isc_timer_detach(&l->timer); - q = ISC_LIST_HEAD(l->q); + if (current_lookup != NULL) { + if (current_lookup->timer != NULL) + isc_timer_detach(¤t_lookup->timer); + q = ISC_LIST_HEAD(current_lookup->q); while (q != NULL) { debug("cancelling query %p, belonging to %p", - q, l); + q, current_lookup); if (q->sock != NULL) { isc_socket_cancel(q->sock, NULL, ISC_SOCKCANCEL_ALL); } q = ISC_LIST_NEXT(q, link); } - l = ISC_LIST_NEXT(l, link); + } + l = ISC_LIST_HEAD(lookup_list); + while (l != NULL) { + n = ISC_LIST_NEXT(l, link); + ISC_LIST_DEQUEUE(lookup_list, l, link); + try_clear_lookup(l); + l = n; } UNLOCK_LOOKUP; } @@ -2313,6 +2316,7 @@ xfree_lists(void) { REQUIRE(sendcount == 0); INSIST(ISC_LIST_HEAD(lookup_list) == NULL); + INSIST(current_lookup == NULL); INSIST(!free_now); free_now = ISC_TRUE; From db9455558290798935da24c3ccbc22752c017d31 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Fri, 14 Jul 2000 20:21:26 +0000 Subject: [PATCH 090/226] updated drafts --- ...txt => draft-ietf-dnsext-edns0dot5-01.txt} | 140 ++-- .../draft-ietf-dnsext-zone-status-01.txt | 640 ------------------ .../draft-ietf-dnsext-zone-status-02.txt | 464 +++++++++++++ 3 files changed, 562 insertions(+), 682 deletions(-) rename doc/draft/{draft-ietf-dnsext-edns0dot5-00.txt => draft-ietf-dnsext-edns0dot5-01.txt} (66%) delete mode 100644 doc/draft/draft-ietf-dnsext-zone-status-01.txt create mode 100644 doc/draft/draft-ietf-dnsext-zone-status-02.txt diff --git a/doc/draft/draft-ietf-dnsext-edns0dot5-00.txt b/doc/draft/draft-ietf-dnsext-edns0dot5-01.txt similarity index 66% rename from doc/draft/draft-ietf-dnsext-edns0dot5-00.txt rename to doc/draft/draft-ietf-dnsext-edns0dot5-01.txt index 4e5307a139..cd9e98a1ad 100644 --- a/doc/draft/draft-ietf-dnsext-edns0dot5-00.txt +++ b/doc/draft/draft-ietf-dnsext-edns0dot5-01.txt @@ -5,10 +5,10 @@ Network Working Group R. Austein -draft-ietf-dnsext-edns0dot5-00.txt InterNetShare.com, Inc. +draft-ietf-dnsext-edns0dot5-01.txt InterNetShare.com, Inc. H. Alvestrand EDB MaXware AS - February 2000 + July 2000 A Proposed Enhancement to the EDNS0 Version Mechanism @@ -55,9 +55,9 @@ Motivation and Scope -Austein & Alvestrand Expires 28 August 2000 [Page 1] +Austein & Alvestrand Expires 15 January 2001 [Page 1] -draft-ietf-dnsext-edns0dot5-00.txt February 2000 +draft-ietf-dnsext-edns0dot5-01.txt July 2000 This note proposes to replace the monolithic version numbering @@ -85,9 +85,10 @@ Model of the TTL field of the OPT RR, and a variable-length list of FEATURES, stored in the variable part of the OPT RR. - All FEATUREs are extensions of the DNS. We reserve FEATURE numbers 1 - to 100 for describing features of the original RFC 1034/1035 DNS - specification that we might eventually chose to deprecate. + All FEATUREs are extensions of the DNS. We reserve the range of + FEATURE numbers from 1 to 100 for describing features of the original + RFC 1034/1035 DNS specification that we might eventually choose to + deprecate. Any query/response pair can be described as using a set of DNS FEATUREs. Such features might for instance be: @@ -105,18 +106,18 @@ Model - SIG record parsing and checking; FEATURE numbers are handed out by IANA on a first-come-first-served - basis. Any revised specification of a format or function should have - its own FEATURE number; in the IETF process, any significantly - changed Internet-Draft should have a new FEATURE number assigned for + basis within their appropriate ranges. Any revised specification of + a format or function should have its own FEATURE number; in the IETF -Austein & Alvestrand Expires 28 August 2000 [Page 2] +Austein & Alvestrand Expires 15 January 2001 [Page 2] -draft-ietf-dnsext-edns0dot5-00.txt February 2000 +draft-ietf-dnsext-edns0dot5-01.txt July 2000 - experimentation. + process, any significantly changed Internet-Draft should have a new + FEATURE number assigned for experimentation. An assigned VERSION number names a set of FEATUREs. VERSION numbers are assigned by the IETF through a standards action. @@ -148,35 +149,46 @@ Mechanism Usage - When composing a query message, the client includes an OPT record - indicating the set of FEATUREs that: + In most respects, the FEATURE mechanism is used symmetrically by + clients and servers; exceptions to this rule are stated after the + general explanation. - - Allows the client to express this query; + When composing a DNS message, a client or server includes an OPT + record indicating a set of FEATUREs that: - - Allows the server to express all responses that the client is - prepared to accept for this query. + - MUST include all FEATUREs that the client or server believes are + relevant to this message; + + - MAY include all FEATURES that the client or server is prepared to + receive. This set is expressed as a VERSION and any additional FEATURES required. - The server will include an OPT pseudo-RR that indicates: - - - The highest VERSION numbers supported by the responder (for - information only -- the client takes no action based on this); - - -Austein & Alvestrand Expires 28 August 2000 [Page 3] +Austein & Alvestrand Expires 15 January 2001 [Page 3] -draft-ietf-dnsext-edns0dot5-00.txt February 2000 +draft-ietf-dnsext-edns0dot5-01.txt July 2000 - - The set of FEATUREs not encompassed by the VERSION that are - necessary to express the response. + In general, we expect that a client or server will include an OPT + pseudo-RR that indicates: - No FEATURE may be included or used that is not within the set of - FEATUREs that the query originator indicated. + - The highest VERSION number that the entity generating the message + supports; and + + - A small (possibly empty) set of additional FEATUREs not encompassed + by the VERSION that the entity deems necessary or desirable. + + The above symmetry notwithstanding, we impose one important + constraint on the server: while a server is allowed to indicate + whatever FEATUREs it believes are relevant or useful, a server MUST + NOT make use of any FEATURE in a response that is not within the set + of FEATUREs indicated by the client that generated the corresponding + request. That is, a response may say "I support FEATURE FOO" + regardless of what the client supports, but the rest of the response + must not use FEATURE FOO unless the client also supports it. As a special case, if a client explicitly queries for the OPT RR of the root zone, the server returns an OPT record including all @@ -190,8 +202,8 @@ Life Cycle - VERSION X is defined and deployed. - A new FEATURE is defined and experimentally implemented. All - clients and servers part of the experiment use FEATURE to indicate - support. + clients and servers taking part in the experiment use FEATURE to + indicate support. - Community consensus is reached that this FEATURE is genuinely useful. @@ -209,24 +221,29 @@ Risks all, since by any realistic estimate it takes years (decades?) to upgrade all the DNS implementations already in the field. + + +Austein & Alvestrand Expires 15 January 2001 [Page 4] + +draft-ietf-dnsext-edns0dot5-01.txt July 2000 + + A flexible extension mechanism of this type increases the risk that some implementors might chose to deploy features designed to hinder interoperability (so-called "labeled noninteroperability"). Security Considerations - We do not believe that this protocol enhancement adds any new + We do not believe that this protocol enhancement adds any major new security risks, but we do believe that it would be helpful in getting complicated DNS extensions such as [DNSSEC] deployed more quickly. - - - - -Austein & Alvestrand Expires 28 August 2000 [Page 4] - -draft-ietf-dnsext-edns0dot5-00.txt February 2000 - + As with any enhancement to or complication of the DNS protocol, this + enhancement offers attackers yet another way to increase the load on + a name server. Root, TLD and other "major" name servers should view + excessively complicated FEATURE sets with suspicion, and should not + allow themselves to be tricked into performing more work than is + really necessary. IANA Considerations @@ -234,6 +251,12 @@ IANA Considerations IANA will need to create a new registry of feature numbers. +Acknowledgments + + The authors would like to thank the following people for their help + in improving this document: Randy Bush, Patrik Faltstrom, Olafur + Gudmundsson, Bob Halley, and XXX. + References [DNSSEC] Eastlake, D., "Domain Name System Security Extensions", RFC @@ -251,6 +274,16 @@ References [BINARY-LABELS] Crawford, M., "Binary Labels in the Domain Name System", RFC 2673 August 1999. + + + + + +Austein & Alvestrand Expires 15 January 2001 [Page 5] + +draft-ietf-dnsext-edns0dot5-01.txt July 2000 + + Author's addresses: Rob Austein @@ -279,4 +312,27 @@ Author's addresses: -Austein & Alvestrand Expires 28 August 2000 [Page 5] + + + + + + + + + + + + + + + + + + + + + + + +Austein & Alvestrand Expires 15 January 2001 [Page 6] diff --git a/doc/draft/draft-ietf-dnsext-zone-status-01.txt b/doc/draft/draft-ietf-dnsext-zone-status-01.txt deleted file mode 100644 index af7c85bbe3..0000000000 --- a/doc/draft/draft-ietf-dnsext-zone-status-01.txt +++ /dev/null @@ -1,640 +0,0 @@ -DNSEXT WG Edward Lewis -INTERNET DRAFT NAI Labs -Category:I-D April 13, 2000 - - DNS Security Extension Clarification on Zone Status - - -Status of this Memo - -This document is an Internet-Draft and is in full conformance with all -provisions of Section 10 of RFC2026. - -Internet-Drafts are working documents of the Internet Engineering Task -Force (IETF), its areas, and its working groups. Note that other -groups may also distribute working documents as Internet-Drafts. - -Internet-Drafts are draft documents valid for a maximum of six months -and may be updated, replaced, or obsoleted by other documents at any -time. It is inappropriate to use Internet-Drafts as reference -material or to cite them other than as "work in progress." - -The list of current Internet-Drafts can be accessed at -http://www.ietf.org/ietf/1id-abstracts.txt - -The list of Internet-Draft Shadow Directories can be accessed at -http://www.ietf.org/shadow.html. - -Comments should be sent to the authors or the DNSIND WG mailing list -namedroppers@internic.net. - -This draft expires on October 13, 2000. - -Copyright Notice - -Copyright (C) The Internet Society (1999, 2000). All rights reserved. - -Abstract - -The definition of a secured zone is presented, updating RFC 2535. The -new definition has consequences that alter the interpretation of the -NXT record, obsolete NULL keys, and the designation of "experimentally -secure." - -1 Introduction - -Whether a DNS zone is "secured" or not is a question asked in at least -four contexts. A zone administrator asks the question when -configuring a zone to use DNSSEC. A dynamic update server asks the -question when an update request arrives, which may require DNSSEC -processing. A delegating zone asks the question of a child zone when -the parent enters data indicating the status the child. A resolver -asks the question upon receipt of data belonging to the zone. - -A zone administrator needs to be able to determine what steps are -needed to make the zone as secure as it can be. Realizing that due to -the distributed nature of DNS and its administration, any single zone - -Expires October 13, 2000 [Page 1] - DNS Security Extension Clarification on Zone Status April 13, 2000 - -is at the mercy of other zones when it comes to the appearance of -security. This document will define what makes a zone qualify as -secure (absent interaction with other zones). - -A name server performing dynamic updates needs to know whether a zone -being updated is to have signatures added to the updated data, NXT -records applied, and other required processing. In this case, it is -conceivable that the name server is configured with the knowledge, but -being able to determine the status of a zone by examining the data is -a desirable alternative to configuration parameters. - -A delegating zone is required to indicate whether a child zone is -secured. The reason for this requirement lies in the way in which a -resolver makes its own determination about a zone (next paragraph). To -shorten a long story, a parent needs to know whether a child should be -considered secured. This is a two part question, what does a parent -consider a secure child to be, and how does a parent know if the child -conforms? - -A resolver needs to know if a zone is secured when the resolver is -processing data from the zone. Ultimately, a resolver needs to know -whether or not to expect a usable signature covering the data. How -this determination is done is out of the scope of this document, -except that, in some cases, the resolver will need to contact the -parent of the zone to see if the parent states that the child is -secured. - -This document updates several sections of RFC 2535. The definition of -a secured zone is an update to section 3.4 of the RFC. The document -updates section 2.3.4, by specifying a replacement for the NULL zone -keys. Section 3.4 is updated to eliminate the definition of -experimental keys and illustrate a way to still achieve the -functionality they were designed to provide. Section 3.1.3 is updated -by the specifying the value of the protocol octet in a zone key. - -2 Status of a Zone - -In this section, rules governing a zone's DNSSEC status are presented. -There are three levels of security defined: full, private, and -unsecured. A zone is fully secure when it complies with the strictest -set of DNSSEC processing rules. A zone is privately secured when it -is configured in such a way that only resolvers that are appropriately -configured see the zone as secured. All other zones are unsecured. - -Note: there currently is no document completely defining DNSSEC -verification rules. For the purposes of this document, the strictest -rules are assumed to state that the verification chain of zone keys -parallels the delegation tree up to the root zone. This is not -intended to disallow alternate verification paths, just to establish a -baseline definition. - -To avoid repetition in the rules below, the following terms are -defined. - - -Expires October 13, 2000 [Page 2] - DNS Security Extension Clarification on Zone Status April 13, 2000 - -2.a. Zone signing KEY RR - A KEY RR whose flag field has the value 01 -for name type (indicating a zone key) and either value 00 or value 01 -for key type (indicating a key permitted to authenticate data). (See -RFC 2535, section 3.1.2). The KEY RR also has a protocol octet value -of DNSSEC (3) or All (255). - -The definition updates RFC 2535's definition of a zone key. The -requirement that the protocol field be either DNSSEC or All is a new -requirement. - -2.b On-tree Validation - The authorization model in which only the -parent zone can is recognized to supply a DNSSEC-meaningful signature -that is used by a resolver to build a chain of trust from the child's -keys to a recognized root of security. The term "on-tree" refers to -following up the DNS domain hierarchy to reach a trusted key, -presumably the root key if no other key is available. The term -"validation" refers to the digital signature by the parent to prove -the integrity, authentication and authorization of the child' key to -sign the child's zone data. - -2.c Off-tree Validation - Any authorization model that permits domain -names other than the parent's to provide a signature over a child's -zone keys that will enable a resolver to trust the keys. - -2.1 Fully Secured - -A fully secured zone, in a nutshell, is a zone that uses only -mandatory to implement algorithms (RFC 2535, section 3.2) and relies -on a key certification chain that parallels the delegation tree -(on-tree validation). Fully secured zones are defined by the -following rules. - -2.1.a. The zone's apex MUST have a KEY RR set. There MUST be at least -one zone signing KEY RR (2.a) of a mandatory to implement algorithm in -the set. - -2.1.b. The zone's apex KEY RR set MUST be signed by a private key -belonging to the parent zone. The private key's public companion MUST -be a zone signing KEY RR (2.a) of a mandatory to implement algorithm -and owned by the parent's apex. - -If a zone cannot get a conforming signature from the parent zone, the -child zone cannot be considered fully secured. The only exception to -this is the root zone, for which there is no parent zone. - -2.1.c. NXT records MUST be deployed throughout the zone. (Updates RFC -2535, section 2.3.2.) Note: there is some operational discomfort with -the current NXT record. This requirement is open to modification when -two things happen. First, an alternate mechanism to the NXT is -defined and second, a means by which a zone can indicate that it is -using an alternate method. - -2.1.d. Each RR set that qualifies for zone membership MUST be signed -by a key that is in the apex's KEY RR set and is a zone signing KEY RR - -Expires October 13, 2000 [Page 3] - DNS Security Extension Clarification on Zone Status April 13, 2000 - -(2.a) of a mandatory to implement algorithm. (Updates 2535, section -2.3.1.) - -Mentioned earlier, the root zone is a special case. Defining what -constitutes a secure root zone is difficult, as the discussion on -securing the root zone has not come to a consensus in an open forum. -However, the security of the root zone will be determined by the -preconfiguration of a trusted key in resolvers. Who generates and -distributes the trusted key is an open issue. - -2.2 Privately Secured - -Note that the term "privately" is open to debate... - -A privately secured zone is a zone that complies with rules like those -for a fully secured zone with the following exceptions. The signing -keys may be of an algorithm that is not mandatory to implement and/or -the verification of the zone keys in use may rely on a verification -chain that is not parallel to the delegation tree (off-tree -validation). - -2.2.a. The zone's apex MUST have a KEY RR set. There MUST be at least -one zone signing KEY RR (2.a) in the set. - -2.2.b. The zone's apex KEY RR set MUST be signed by a private key and -one of the following two subclauses MUST hold true. - -2.2.b.1 The private key's public companion MUST be preconfigured in -all the resolvers of interest. - -2.2.b.2 The private key's public component MUST be a zone signing KEY -RR (2.a) authorized to provide validation of the zone's apex KEY RR -set, as recognized by resolvers of interest. - -The previous sentence is trying to convey the notion of using a -trusted third party to provide validation of keys. If the domain name -owning the validating key is not the parent zone, the domain name must -represent someone the resolver trusts to provide validation. - -2.2.c. NXT records MUST be deployed throughout the zone. (Updates RFC -2535, section 2.3.2.) Note: see the discussion following 2.1.c. - -2.2.d. Each RR set that qualifies for zone membership MUST be signed -by a key that is in the apex's KEY RR set and is a zone signing KEY RR -(2.a).. (Updates 2535, section 2.3.1.) - -2.3 Unsecured - -All other zones qualify as unsecured. This includes zones that are -designed to be experimentally secure, as defined in a later section on -that topic. - - - - -Expires October 13, 2000 [Page 4] - DNS Security Extension Clarification on Zone Status April 13, 2000 - -2.4 Wrap up - -The designation of fully secured, privately secured, and unsecured are -merely labels to apply to zones, based on their contents. Resolvers, -when determining whether a signature is expected or not, will only see -a zone as secured or unsecured. - -Resolvers that follow the most restrictive DNSSEC verification rules -will only see fully secured zones as secured, and all others as -unsecured, including zones which are privately secured. Resolvers -that are not as restrictive, such as those that implement algorithms -in addition to the mandatory to implement algorithms, will see some -privately secured zones as secured. - -The intent of the labels "fully" and "privately" is to identify the -specific attributes of a zone. The words are chosen to assist in the -writing of a document recommending the actions a zone administrator -take in making use of the DNS security extensions. The words are -explicitly not intended to convey a state of compliance with DNS -security standards. - -3 Parental Notification - -For a resolver to come to a definitive answer concerning a zone's -security status there is a requirement that the parent of a zone -signify whether the child zone is signed or not. The justification of -this requirement requires a discussion of the resolver's activity, -which is described in RFC 2535. - -In RFC 2535, a parent is required to hold a NULL key for an unsigned -child (a bone of contention here is how this works in light of -multiple algorithms). The parent has the option to hold the keys of -the child if the child is signed. The parent may also hold nothing -cryptographic if the child is signed. This, of course, assumes the -parent is a signed zone. - -RFC 2535 does permit the following case, a child zone that uses DNSSEC -capable software yet chooses to remain unsecured could hold a signed -NULL key delivered from the parent. This is considered to be a rare -condition, a zone administrator that goes to the trouble to get the -keys from the parent and have it signed will likely just sign the -whole zone, or leave the NULL key to the parent. - -There is a strong case for discouraging a parent from holding keys of -a signed child, or an unsigned child for that matter. These include -concrete concerns about performance and more abstract concerns about -the liability of the parent. - -DNS [RFC 1034 and 1035] requires a parent to hold NS records for a -child zone, this signifies the delegation. RFC 2535 requires a -secured parent to also have signed NXT records for the child, and -possibly a signed KEY RR set (required for some NULL key situations). - -By redefining the security status of a zone to be per zone and not per - -Expires October 13, 2000 [Page 5] - DNS Security Extension Clarification on Zone Status April 13, 2000 - -algorithm, there is an opportunity to completely remove the need for a -KEY RR set in the parent. Because the question of whether the zone is -secure or not is a yes-or-no question, the notification needs just one -bit to be expressed. - -Keep in mind that the following sections speak to the contents of a -zone, not a name server. In the case of a name server speaking -authoritatively for both the parent and child, or if a server caches -the information for the other half of the delegation, then a server -will have more types of data at a delegation point than a parent is -supposed to hold. (E.g., if a parent zone's name server caches the -SOA for the child, the SOA is not in the parent zone, but is in the -server's cache.) - -3.1 Child Has Keys Bit - -This section is written assuming the current definition of NXT holds. -There is some controversy surrounding the NXT record, which may result -in a complete replacement of it for proof of non-existence. The -current NXT definition provides an extension bit in the types present -bit map, whose use is remains incompletely defined. The following -text largely ignores these uncertainties, and should be rewritten to -accommodate these uncertainties in revisions. - -In the parent's half of the delegation point, there will be an NXT -record, called an "upper" NXT. According to the rules for a -delegation point, only the NS, NXT, and SIG bits will be turned on in -the types present field, assuming we drop the KEY set altogether. - -The KEY bit in the parent's NXT types present bit map is hereby -redefined to have the following meaning. (Note that this applies to -just delegation points.) - -If the bit corresponding to the KEY RR set in an upper NXT is set, the -parent has generated and issued a currently valid SIG (KEY) RR -validating the child's apex KEY RR set. Note that this does not -require the child to include either a zone signing KEY RR (2.a) or a -NULL zone KEY RR. This does assume that only on-tree validation (2.b) -is in use. - -The temporal validity of the bit's setting may be enforced in the SIG -(NXT) RR validity period, timely editing of the master file, dynamic -updates, or whatever another mechanism. - -If a child submits a key set to the parent for validation that does -not include a zone signing KEY RR (2.a), then the child will remain -unsecured although the upper NXT KEY RR bit will be set to 1 by the -parent. A resolver seeing this will know to look for a child key set, -and see that there is no zone signing KEY RR (2.a) and know to treat -the child as unsecured. - -If a NULL zone KEY RR is seen, the resolver ignores it. If a NULL key -is the only zone key, then the resolver will deduce the child is -unsecured as in the previous paragraph. If there is both a NULL and - -Expires October 13, 2000 [Page 6] - DNS Security Extension Clarification on Zone Status April 13, 2000 - -one or more zone signing KEY RR (2.a), then the zone is considered -signed in the algorithm(s) identified in the signing capable key(s). - -If the bit is 0 then the child has not submitted a KEY RR set for -validation, hence is to be considered unsigned. - -Note that for a fully secured zone (section 2.1), the bit is on (1). -For all unsecured zones (section 2.3) the bit is either off (0) or on -(1) with a NULL KEY and no zone signing KEY RR at the apex. For -privately secured zones (section 2.2), the setting of the bit is -determined by whether the parent signs the child's keys or not. -Hence, for privately secured zones, the parent may have no -responsibility. A child wishing to have the parent set the bit must -contact the parent. - -3.2 Rules Governing the Bit - -In this section, the words of the previous are turned into definitive -MUST and SHOULDs. Note that this section does not refer to the bit in -the NXT. This is in anticipation of a change in the way NXT indicates -types present (e.g., if bit 0 of the field is defined) or a successor -to the NXT is defined. - -3.2.a. At a delegation point, a secured parent zone MUST have a -mechanism in place to indicate which RR sets are present. The -mechanism MUST indicate that the NS, SIG, and the type(s) -corresponding to the mechanism itself are present (of course, with -these types actually being present). With the exception of the KEY RR -type, all other types MUST be indicated as not present, and, in -accordance with delegation rules, actually be absent from the zone. -If, in the future, other data is permitted to be present at a -delegation point, this requirement MUST be amended. - -Assuming the NXT record, the above requirement reads as follows. At a -delegation point, a parent zone must have a secured NXT record. This -NXT record must indicate that the NS, SIG, and NXT types are present. -With the exception of KEY, all other types must be indicated as not -present. The lower casing of the word "must" is intentional, -conveying that this is an explanation of the rule above. - -3.2.b. The KEY set MUST be indicated as present during the time when -the parent has issued a signature for the child's KEY set. Conversely, -during periods of time in which the parent knows it has not generated -a signature for the KEY RR set, the KEY set MUST be indicated to be -absent. - -If the parent has issued signatures with discontinuous validity spans, -then the presence of the KEY set will flip from present to not present -and back as time progresses. - -3.2.c. When signing a child's KEY RR set, a parent SHOULD carefully -consider the algorithm of the key used to generate the signature. The -parent SHOULD make clear to child zones what steps are to be taken to - - -Expires October 13, 2000 [Page 7] - DNS Security Extension Clarification on Zone Status April 13, 2000 - -get the parent to indicate that the child is signed. This document -will go no further in specifying operational considerations. - -(Let's say the parent signs the child's key set with an algorithm the -child can't process. The child could elect not to advertise this -signature, as it cannot verify that the signature covers the real key -set. If this happens, is the parent justified in claiming that the -child is secured?) - -3.2.d. The parent MUST have the capability to allow the child, through -some trusted, probably non-DNS mechanism, to request that the -indication of the KEY set to be turned off. This allows a child to -revert to an unsigned state. - -3.2.e. The parent SHOULD NOT allow the child to request that the KEY -set be indicated as present in the absence of a key signing request. - -3.3 Operational Considerations - -Retrieving the NXT for a delegated name from the parent zone (the -upper NXT) is not a trivial operation. The complication arises due to -having an NXT in the delegatee (the lower NXT) that matches the owner -name of the upper NXT. (The case in which both the parent and child -zones are secured is the only case mentioned here. If both are not -secured, then there will be at most one NXT, which is easily -retrieved.) - -There are two complications to describe. One involves the multiple -NXT sets matching the same owner. The other is the pragmatic issue of -knowing where to get the answer. - -With multiple NXT sets at the same owner, caches may become a problem. -If a (for example) recursive server has cached the lower NXT, any -query for the upper NXT may be confused for a lower NXT query. This -is akin to the issue of the ANY query, where a server with some cached -data will answer with just that and not seek the rest of the data. - -Note that distinguishing between an upper and lower NXT is a trivial -operation, especially so if the SIG RR is available. - -A resolver may know the child's server's addresses and the parent zone -may not be sharing servers with the child. In this case the resolver -will need to be able to locate the parent zones (possibly having to go -to the root servers and descend) in order to obtain the upper NXT -record. - -A potential solution to this is to define an NXT meta-query that will -force a recursive server to find all available NXT RR sets for a given -name. Details of this have not been examined. - -3.4 Interaction with Dynamic Update - -Dynamic update [RFC 2136, draft-ietf-dnsext-simple-secure-update- -xy.txt] defines a means by which a zone can change without undergoing - -Expires October 13, 2000 [Page 8] - DNS Security Extension Clarification on Zone Status April 13, 2000 - -a full reload. This combination of dynamic update and the proposed -use of the NXT record to signify a child's status raises some -concerns. - -First a few elements need to be labeled. There is an off-line signer, -which is the process that signs zone data files away from the name -server. There is an on-line signer, part of a name server, that the -dynamic update mechanism uses to sign the updated data. Finally, -there is an on-line key validator, perhaps a misnomer, which accepts -requests for parent signatures over each child zone's keys. - -The proposal depicted in this draft relies upon the on-line key -validator informing the on-line and off-line signers of the status of -a child, recall that the status of a child has a temporal element. -E.g., a signature may be generated for just the month of July, so the -child is secured for the month of July, but not the month of August. - -The first issues pertain to the way in which an off-line signer comes -to encode a validation in an NXT record. There is a need for the -status information to flow from the on-line validator to the off-line -signer and then be used as input to the signing process. The way that -this information makes the transition is an issue. The second issue -is through what mechanism is this information ingested into the NXT -generating process. Recall that all other information can be derived -by the zone data, the status of the child isn't stored anywhere else -in the parent zone. - -The next issue is the means in which a validation action is reported -to the active zone. On the surface, dynamically updating the NXT -would seem to make sense, but updating the NXT in this manner can lead -to a race condition in the server, this is unstable. The issue here -is deriving a mechanism by which a name server knows to signify that -the child status has changed. Note that this applies to newly -validated keys as well as the granting of a child's request to cancel -a validation. - -The final issue is the operation of the off-line signer. When an NXT -is being regenerated, the old NXT is needed to see what the previous -setting of the child's status had been. The old NXT signature is also -needed to know that, had the child been known to be secured, for what -interval was is it thought to be secured so that the new NXT signature -is appropriately set. Of course, if the reason for updating the NXT -is a change as described in the previous paragraph, the old NXT is of -lesser value. - -The issue raised in the last paragraph leads to a questioning of the -sanity of using signature validity periods to signify the temporal -status of data in a server. What does a server return if the NXT -needed is not currently covered by a valid signature? - -4 NULL keys - -Through the use of the types present to indicate the existence of a -signature validating the KEY set of a child, the need for NULL keys - -Expires October 13, 2000 [Page 9] - DNS Security Extension Clarification on Zone Status April 13, 2000 - -effectively disappears. NULL keys are left as a defined entity, but -are rendered meaningless in DNSSEC. - -5 Experimental Status - -Without NULL keys, an experimentally secured zone cannot be defined as -it is in RFC 2535. The purpose of an experimentally secured zone was -to facilitate the migration from an unsecured zone to a secured zone. - -The objective of facilitating the migration can be achieved without a -special designation of an experimentally secure status. Experimentally -secured is a special case of privately secured. A zone administrator -can achieve this by publishing a zone with signatures and configuring -a set of test resolvers with the corresponding public keys. Even if -the public key is published in a KEY RR, as long as there is no parent -signature, the resolvers will need some preconfiguration to know to -process the signatures. This allows a zone to be secured with in the -sphere of the experiment, yet still be registered as unsecured in the -general Internet. - -6 IANA/ICANN Considerations - -This document does not request any action from an assigned number -authority nor recommends any actions. - -7 Security Considerations - -Without a means to enforce compliance with specified protocols or -recommended actions, declaring a DNS zone to be "completely" secured -is impossible. Even if, assuming an omnipotent view of DNS, one can -declare a zone to be properly configured for security, and all of the -zones up to the root too, a misbehaving resolver could be duped into -believing bad data. If a zone and resolver comply, a non-compliant or -subverted parent could interrupt operations. The best that can be -hoped for is that all parties are prepared to be judged secure and -that security incidents can be traced to the cause in short order. - -8 Acknowledgements - -The need to refine the definition of a secured zone has become -apparent through the efforts of the participants at two DNSSEC -workshops, sponsored by the NIC-SE (.se registrar) and CAIRN (a -DARPA-funded research network). Further discussions leading to the -document include Olafur Gudmundsson, Russ Mundy, Robert Watson, and -Brian Wellington. - -9 References - -[RFC1034] P. Mockapetris, "Domain Names - Concepts and Facilities," -RFC 1034, November 1987. - -[RFC1035] P. Mockapetris, "Domain Names - Implementation and -Specification," RFC 1034, November 1987. - - -Expires October 13, 2000 [Page 10] - DNS Security Extension Clarification on Zone Status April 13, 2000 - -[RFC2119] S. Bradner, "Key words for use in RFCs to Indicate -Requirement Levels," RFC 2119, March 1997 - -[RFC2136] P. Vixie (Ed.), S. Thomson, Y. Rekhter, J. Bound "Dynamic -Updates in the Domain Name System," RFC 2136, April 1997. - -[RFC2535] D. Eastlake, "Domain Name System Security Extensions," RFC -2535, March 1999. - -[draft-ietf-dnsext-simple-secure-update-xy.txt] B. Wellington, "Simple -Secure Domain Name System (DNS) Dynamic Update," version 00, February -2000. - -10 Author Information - -Edward Lewis NAI Labs 3060 Washington Road Glenwood, MD 21738 +1 443 -259 2352 - -11 Full Copyright Statement - -Copyright (C) The Internet Society (1999, 2000). All Rights Reserved. - -This document and translations of it may be copied and furnished to -others, and derivative works that comment on or otherwise explain it -or assist in its implementation may be prepared, copied, published and -distributed, in whole or in part, without restriction of any kind, -provided that the above copyright notice and this paragraph are -included on all such copies and derivative works. However, this -document itself may not be modified in any way, such as by removing -the copyright notice or references to the Internet Society or other -Internet organizations, except as needed for the purpose of developing -Internet standards in which case the procedures for copyrights defined -in the Internet Standards process must be followed, or as required to -translate it into languages other than English. - -The limited permissions granted above are perpetual and will not be -revoked by the Internet Society or its successors or assigns. - -This document and the information contained herein is provided on an -"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING -TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT -NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN -WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF -MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." - - - - - - - - - - - -Expires October 13, 2000 [Page 11] - - diff --git a/doc/draft/draft-ietf-dnsext-zone-status-02.txt b/doc/draft/draft-ietf-dnsext-zone-status-02.txt new file mode 100644 index 0000000000..dc0836b113 --- /dev/null +++ b/doc/draft/draft-ietf-dnsext-zone-status-02.txt @@ -0,0 +1,464 @@ +DNSEXT WG Edward Lewis +INTERNET DRAFT NAI Labs +Category:I-D July 12, 2000 + + DNS Security Extension Clarification on Zone Status + + +Status of this Memo + +This document is an Internet-Draft and is in full conformance with all +provisions of Section 10 of RFC2026. + +Internet-Drafts are working documents of the Internet Engineering Task +Force (IETF), its areas, and its working groups. Note that other +groups may also distribute working documents as Internet-Drafts. + +Internet-Drafts are draft documents valid for a maximum of six months +and may be updated, replaced, or obsoleted by other documents at any +time. It is inappropriate to use Internet-Drafts as reference +material or to cite them other than as "work in progress." + +The list of current Internet-Drafts can be accessed at +http://www.ietf.org/ietf/1id-abstracts.txt + +The list of Internet-Draft Shadow Directories can be accessed at +http://www.ietf.org/shadow.html. + +Comments should be sent to the authors or the DNSIND WG mailing list +namedroppers@internic.net. + +This draft expires on January 12, 2001. + +Copyright Notice + +Copyright (C) The Internet Society (1999, 2000). All rights reserved. + +Abstract + +The definition of a secured zone is presented, updating RFC 2535. +After discussion on the mailing list and other working group +consideration, removed from earlier editions of this draft are a new +interpretation of the NXT record and a proposal to obsolete NULL +keys. Deprecation of "experimentally secure" remains. + +1 Introduction + +Whether a DNS zone is "secured" or not is a question asked in at least +four contexts. A zone administrator asks the question when +configuring a zone to use DNSSEC. A dynamic update server asks the +question when an update request arrives, which may require DNSSEC +processing. A delegating zone asks the question of a child zone when +the parent enters data indicating the status the child. A resolver +asks the question upon receipt of data belonging to the zone. + + + + +Expires July 12, 2000 [Page 1] +^LDNS Security Extension Clarification on Zone Status January 12, 2001 + +1.1 When a Zone's Status is Important + +A zone administrator needs to be able to determine what steps are +needed to make the zone as secure as it can be. Realizing that due to +the distributed nature of DNS and its administration, any single zone +is at the mercy of other zones when it comes to the appearance of +security. This document will define what makes a zone qualify as +secure (absent interaction with other zones). + +A name server performing dynamic updates needs to know whether a zone +being updated is to have signatures added to the updated data, NXT +records applied, and other required processing. In this case, it is +conceivable that the name server is configured with the knowledge, but +being able to determine the status of a zone by examining the data is +a desirable alternative to configuration parameters. + +A delegating zone is required to indicate whether a child zone is +secured. The reason for this requirement lies in the way in which a +resolver makes its own determination about a zone (next paragraph). To +shorten a long story, a parent needs to know whether a child should be +considered secured. This is a two part question, what does a parent +consider a secure child to be, and how does a parent know if the child +conforms? + +A resolver needs to know if a zone is secured when the resolver is +processing data from the zone. Ultimately, a resolver needs to know +whether or not to expect a usable signature covering the data. How +this determination is done is out of the scope of this document, +except that, in some cases, the resolver will need to contact the +parent of the zone to see if the parent states that the child is +secured. + +1.2 Islands of Security + +The goal of DNSSEC is to have each zone secured, from the root zone +and the top-level domains down the hierarchy to the leaf zones. +Transitioning from an unsecured DNS, as we have now, to a fully +secured - or "as much as will be secured" - tree will take some time. +During this time, DNSSEC will be applied in various locations in the +tree, not necessarily "top down." + +For example, at a particular instant, the root zone and the "test." +TLD might be secured, but region1.test. might not be. (For reference, +let's assume that region2.test. is secured.) However, +subarea1.region1.test. may have gone through the process of becoming +secured, along with its delegations. The dilemma here is that +subarea1 cannot get its zone keys properly signed as its parent zone, +region1, is not secured. + +The popular term for the secured zones at or below subarea1 is an +"island of security." The only way in which a DNSSEC resolver will +come to trust any data from this island is if the resolver is +pre-configured with the zone key(s) for subarea1. All other resolvers +will not recognize this island as secured. + +Expires July 12, 2000 [Page 2] +^LDNS Security Extension Clarification on Zone Status January 12, 2001 + +Although both subarea1.region1.test. and region2.test. have both been +properly brought to a secure state by the administering staff, only +the latter of the two is actually fully secured - in the sense that +all DNSSEC resolvers can and will verify its data. The former, +subarea1, will be seen as secured by a subset of those resolvers, just +those appropriately configured. + +In RFC 2535, there is a provision for "certification authorities," +entities that will sign public keys for zones such as subarea1. There +is another draft (currently in last call) that restricts this +activity. Regardless of the other draft, resolvers would still need +proper configuration to be able to use the certification authority to +verify the data for the subarea1 island. + +1.3 Impact on RFC 2535 + +This document updates several sections of RFC 2535. The definition of +a secured zone is an update to section 3.4 of the RFC. Section 3.4 is +updated to eliminate the definition of experimental keys and +illustrate a way to still achieve the functionality they were designed +to provide. Section 3.1.3 is updated by the specifying the value of +the protocol octet in a zone key. + +2 Status of a Zone + +In this section, rules governing a zone's DNSSEC status are presented. +There are three levels of security defined: full, private, and +unsecured. A zone is fully secure when it complies with the strictest +set of DNSSEC processing rules. A zone is privately secured when it +is configured in such a way that only resolvers that are appropriately +configured see the zone as secured. All other zones are unsecured. + +Note: there currently is no document completely defining DNSSEC +verification rules. For the purposes of this document, the strictest +rules are assumed to state that the verification chain of zone keys +parallels the delegation tree up to the root zone. This is not +intended to disallow alternate verification paths, just to establish a +baseline definition. + +To avoid repetition in the rules below, the following terms are +defined. + +2.a. Zone signing KEY RR - A KEY RR whose flag field has the value 01 +for name type (indicating a zone key) and either value 00 or value 01 +for key type (indicating a key permitted to authenticate data). (See +RFC 2535, section 3.1.2). The KEY RR also has a protocol octet value +of DNSSEC (3) or ALL (255). + +The definition updates RFC 2535's definition of a zone key. The +requirement that the protocol field be either DNSSEC or ALL is a new +requirement. + +2.b On-tree Validation - The authorization model in which only the +parent zone can is recognized to supply a DNSSEC-meaningful signature + +Expires July 12, 2000 [Page 3] +^LDNS Security Extension Clarification on Zone Status January 12, 2001 + +that is used by a resolver to build a chain of trust from the child's +keys to a recognized root of security. The term "on-tree" refers to +following up the DNS domain hierarchy to reach a trusted key, +presumably the root key if no other key is available. The term +"validation" refers to the digital signature by the parent to prove +the integrity, authentication and authorization of the child' key to +sign the child's zone data. + +2.c Off-tree Validation - Any authorization model that permits domain +names other than the parent's to provide a signature over a child's +zone keys that will enable a resolver to trust the keys. + +2.1 Fully Secured + +A fully secured zone, in a nutshell, is a zone that uses only +mandatory to implement algorithms (RFC 2535, section 3.2) and relies +on a key certification chain that parallels the delegation tree +(on-tree validation). Fully secured zones are defined by the +following rules. + +2.1.a. The zone's apex MUST have a KEY RR set. There MUST be at least +one zone signing KEY RR (2.a) of a mandatory to implement algorithm in +the set. + +2.1.b. The zone's apex KEY RR set MUST be signed by a private key +belonging to the parent zone. The private key's public companion MUST +be a zone signing KEY RR (2.a) of a mandatory to implement algorithm +and owned by the parent's apex. + +If a zone cannot get a conforming signature from the parent zone, the +child zone cannot be considered fully secured. The only exception to +this is the root zone, for which there is no parent zone. + +2.1.c. NXT records MUST be deployed throughout the zone. (Updates RFC +2535, section 2.3.2.) Note: there is some operational discomfort with +the current NXT record. This requirement is open to modification when +two things happen. First, an alternate mechanism to the NXT is +defined and second, a means by which a zone can indicate that it is +using an alternate method. + +2.1.d. Each RR set that qualifies for zone membership MUST be signed +by a key that is in the apex's KEY RR set and is a zone signing KEY RR +(2.a) of a mandatory to implement algorithm. (Updates 2535, section +2.3.1.) + +Mentioned earlier, the root zone is a special case. Defining what +constitutes a secure root zone is difficult, as the discussion on +securing the root zone has not come to a consensus in an open forum. +However, the security of the root zone will be determined by the +pre-configuration of a trusted key in resolvers. Who generates and +distributes the trusted key is an open issue. + + + + +Expires July 12, 2000 [Page 4] +^LDNS Security Extension Clarification on Zone Status January 12, 2001 + +2.2 Privately Secured + +Note that the term "privately" is open to debate. The term stems from +the likely hood that the only resolvers to be configured for a +particular zone will be resolvers "private" to an organization. +Perhaps the more clumsy "colloquially secure" is more accurate. + +A privately secured zone is a zone that complies with rules like those +for a fully secured zone with the following exceptions. The signing +keys may be of an algorithm that is not mandatory to implement and/or +the verification of the zone keys in use may rely on a verification +chain that is not parallel to the delegation tree (off-tree +validation). + +2.2.a. The zone's apex MUST have a KEY RR set. There MUST be at least +one zone signing KEY RR (2.a) in the set. + +2.2.b. The zone's apex KEY RR set MUST be signed by a private key and +one of the following two subclauses MUST hold true. + +2.2.b.1 The private key's public companion MUST be pre-configured in +all the resolvers of interest. + +2.2.b.2 The private key's public component MUST be a zone signing KEY +RR (2.a) authorized to provide validation of the zone's apex KEY RR +set, as recognized by resolvers of interest. + +The previous sentence is trying to convey the notion of using a +trusted third party to provide validation of keys. If the domain name +owning the validating key is not the parent zone, the domain name must +represent someone the resolver trusts to provide validation. + +2.2.c. NXT records MUST be deployed throughout the zone. (Updates RFC +2535, section 2.3.2.) Note: see the discussion following 2.1.c. + +2.2.d. Each RR set that qualifies for zone membership MUST be signed +by a key that is in the apex's KEY RR set and is a zone signing KEY RR +(2.a). (Updates 2535, section 2.3.1.) + +2.3 Unsecured + +All other zones qualify as unsecured. This includes zones that are +designed to be experimentally secure, as defined in a later section on +that topic. + +2.4 Wrap up + +The designation of fully secured, privately secured, and unsecured are +merely labels to apply to zones, based on their contents. Resolvers, +when determining whether a signature is expected or not, will only see +a zone as secured or unsecured. + +Resolvers that follow the most restrictive DNSSEC verification rules +will only see fully secured zones as secured, and all others as + +Expires July 12, 2000 [Page 5] +^LDNS Security Extension Clarification on Zone Status January 12, 2001 + +unsecured, including zones which are privately secured. Resolvers +that are not as restrictive, such as those that implement algorithms +in addition to the mandatory to implement algorithms, will see some +privately secured zones as secured. + +The intent of the labels "fully" and "privately" is to identify the +specific attributes of a zone. The words are chosen to assist in the +writing of a document recommending the actions a zone administrator +take in making use of the DNS security extensions. The words are +explicitly not intended to convey a state of compliance with DNS +security standards. + +3 Deleted + +4 Deleted + +5 Experimental Status + +The purpose of an experimentally secured zone is to facilitate the +migration from an unsecured zone to a secured zone. This distinction +is dropped. + +The objective of facilitating the migration can be achieved without a +special designation of an experimentally secure status. +Experimentally secured is a special case of privately secured. A zone +administrator can achieve this by publishing a zone with signatures +and configuring a set of test resolvers with the corresponding public +keys. Even if the public key is published in a KEY RR, as long as +there is no parent signature, the resolvers will need some +pre-configuration to know to process the signatures. This allows a +zone to be secured with in the sphere of the experiment, yet still be +registered as unsecured in the general Internet. + +6 IANA/ICANN Considerations + +This document does not request any action from an assigned number +authority nor recommends any actions. + +7 Security Considerations + +Without a means to enforce compliance with specified protocols or +recommended actions, declaring a DNS zone to be "completely" secured +is impossible. Even if, assuming an omnipotent view of DNS, one can +declare a zone to be properly configured for security, and all of the +zones up to the root too, a misbehaving resolver could be duped into +believing bad data. If a zone and resolver comply, a non-compliant or +subverted parent could interrupt operations. The best that can be +hoped for is that all parties are prepared to be judged secure and +that security incidents can be traced to the cause in short order. + +8 Acknowledgements + +The need to refine the definition of a secured zone has become +apparent through the efforts of the participants at two DNSSEC + +Expires July 12, 2000 [Page 6] +^LDNS Security Extension Clarification on Zone Status January 12, 2001 + +workshops, sponsored by the NIC-SE (.se registrar), CAIRN (a +DARPA-funded research network), and other workshops. Further +discussions leading to the document include Olafur Gudmundsson, Russ +Mundy, Robert Watson, and Brian Wellington. Roy Arends, Ted Lindgreen +and others have contributed significant input via the namedroppers +mailing list. + +9 References + +[RFC1034] P. Mockapetris, "Domain Names - Concepts and Facilities," +RFC 1034, November 1987. + +[RFC1035] P. Mockapetris, "Domain Names - Implementation and +Specification," RFC 1034, November 1987. + +[RFC2119] S. Bradner, "Key words for use in RFCs to Indicate +Requirement Levels," RFC 2119, March 1997 + +[RFC2136] P. Vixie (Ed.), S. Thomson, Y. Rekhter, J. Bound "Dynamic +Updates in the Domain Name System," RFC 2136, April 1997. + +[RFC2535] D. Eastlake, "Domain Name System Security Extensions," RFC +2535, March 1999. + +[draft-ietf-dnsext-simple-secure-update-xy.txt] B. Wellington, "Simple +Secure Domain Name System (DNS) Dynamic Update," version 00, February +2000. + +10 Author Information + +Edward Lewis +NAI Labs +3060 Washington Road +Glenwood, MD 21738 ++1 443 259 2352 + + +11 Full Copyright Statement + +Copyright (C) The Internet Society (1999, 2000). All Rights Reserved. + +This document and translations of it may be copied and furnished to +others, and derivative works that comment on or otherwise explain it +or assist in its implementation may be prepared, copied, published and +distributed, in whole or in part, without restriction of any kind, +provided that the above copyright notice and this paragraph are +included on all such copies and derivative works. However, this +document itself may not be modified in any way, such as by removing +the copyright notice or references to the Internet Society or other +Internet organizations, except as needed for the purpose of developing +Internet standards in which case the procedures for copyrights defined +in the Internet Standards process must be followed, or as required to +translate it into languages other than English. + + +Expires July 12, 2000 [Page 7] +^LDNS Security Extension Clarification on Zone Status January 12, 2001 + +The limited permissions granted above are perpetual and will not be +revoked by the Internet Society or its successors or assigns. + +This document and the information contained herein is provided on an +"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING +TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT +NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN +WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF +MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Expires July 12, 2000 [Page 8] From 4b7d316065e104fcc3e9a985514442951b95a8de Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Fri, 14 Jul 2000 21:33:03 +0000 Subject: [PATCH 091/226] A few bug fixes. --- bin/dig/dig.c | 37 ++++++++++++++----------------------- bin/dig/dighost.c | 12 +++++++----- 2 files changed, 21 insertions(+), 28 deletions(-) diff --git a/bin/dig/dig.c b/bin/dig/dig.c index 52036f92a3..1557272a42 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.c,v 1.67 2000/07/14 17:57:23 mws Exp $ */ +/* $Id: dig.c,v 1.68 2000/07/14 21:33:02 mws Exp $ */ #include #include @@ -862,28 +862,19 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { rv++; rc--; } else { - /* - * If we decide to allow query type and class - * to be specified (without -t and -c options) - * before a host is given, all that needs to - * happen is the have_host test here get removed. - * Nothing should break by doing this. - */ - if (have_host) { - if (strncmp(rv[0], "ixfr=", 5) == 0) { - strcpy(lookup->rttext, "ixfr"); - lookup->ixfr_serial = - atoi(&rv[0][5]); - continue; - } - if (istype(rv[0])) { - strncpy(lookup->rttext, rv[0], MXRD); - continue; - } else if (isclass(rv[0])) { - strncpy(lookup->rctext, rv[0], - MXRD); - continue; - } + if (strncmp(rv[0], "ixfr=", 5) == 0) { + strcpy(lookup->rttext, "ixfr"); + lookup->ixfr_serial = + atoi(&rv[0][5]); + continue; + } + if (istype(rv[0])) { + strncpy(lookup->rttext, rv[0], MXRD); + continue; + } else if (isclass(rv[0])) { + strncpy(lookup->rctext, rv[0], + MXRD); + continue; } lookup=clone_lookup(default_lookup, ISC_TRUE); strncpy(lookup->textname, rv[0], MXNAME-1); diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index dbfdf0eadc..ac1ae6de3b 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.88 2000/07/14 20:14:36 mws Exp $ */ +/* $Id: dighost.c,v 1.89 2000/07/14 21:33:03 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -387,7 +387,7 @@ requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { debug("before insertion, init@%p " "-> %p, new@%p -> %p", lookold, lookold->link.next, looknew, looknew->link.next); - ISC_LIST_INSERTAFTER(lookup_list, lookold, looknew, link); + ISC_LIST_PREPEND(lookup_list, looknew, link); debug("after insertion, init -> " "%p, new = %p, new -> %p", lookold, looknew, looknew->link.next); @@ -1504,6 +1504,7 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) { l = query->lookup; clear_query(query); check_next_lookup(l); + UNLOCK_LOOKUP; return; } if (sevent->result != ISC_R_SUCCESS) { @@ -1523,6 +1524,7 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) { INSIST(sockcount >= 0); isc_event_free(&event); check_next_lookup(query->lookup); + UNLOCK_LOOKUP; return; } b = ISC_LIST_HEAD(sevent->bufferlist); @@ -1971,7 +1973,8 @@ recv_done(isc_task_t *task, isc_event_t *event) { * outages won't cause the XFR to abort */ if ((timeout != INT_MAX) && - (l->timer != NULL)) { + (l->timer != NULL) && + l->doing_xfr ) { if (timeout == 0) { if (l->tcp_mode) local_timeout = TCP_TIMEOUT; @@ -2309,7 +2312,7 @@ xfree_lists(void) { dig_server_t *s; dig_searchlist_t *o; - debug("free_lists()"); + debug("xfree_lists()"); REQUIRE(sockcount == 0); REQUIRE(recvcount == 0); @@ -2326,7 +2329,6 @@ xfree_lists(void) { debug("freeing global server %p", s); ptr = s; s = ISC_LIST_NEXT(s, link); - debug("ptr is now %p", ptr); isc_mem_free(mctx, ptr); } o = ISC_LIST_HEAD(search_list); From 0e71d03672596dcf423ed8275e2772190e6d2a2e Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Fri, 14 Jul 2000 22:21:14 +0000 Subject: [PATCH 092/226] Check for DNS_R_NAMETOOLONG when testing names that are too long. --- bin/tests/names/dns_name_fromwire_4_data | 2 +- bin/tests/names/t_names.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/bin/tests/names/dns_name_fromwire_4_data b/bin/tests/names/dns_name_fromwire_4_data index 269924de45..af4d515f75 100644 --- a/bin/tests/names/dns_name_fromwire_4_data +++ b/bin/tests/names/dns_name_fromwire_4_data @@ -29,4 +29,4 @@ # ISC_R_UNEXPECTEDEND # DNS_R_TOOMANYHOPS # -wire_test4.data 550 1 DNS_COMPRESS_ALL vix.com. DNS_R_FORMERR +wire_test4.data 550 1 DNS_COMPRESS_ALL vix.com. DNS_R_NAMETOOLONG diff --git a/bin/tests/names/t_names.c b/bin/tests/names/t_names.c index a9bbc4e0cb..ef0a870464 100644 --- a/bin/tests/names/t_names.c +++ b/bin/tests/names/t_names.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: t_names.c,v 1.25 2000/06/22 21:51:14 tale Exp $ */ +/* $Id: t_names.c,v 1.26 2000/07/14 22:21:14 bwelling Exp $ */ #include @@ -2235,6 +2235,8 @@ t_dns_name_fromwire_x(const char *testfile, size_t buflen) { exp_result = DNS_R_TOOMANYHOPS; else if (! strcmp(tok, "DNS_R_DISALLOWED")) exp_result = DNS_R_DISALLOWED; + else if (! strcmp(tok, "DNS_R_NAMETOOLONG")) + exp_result = DNS_R_NAMETOOLONG; tok = Tokens[3]; dc_method = DNS_COMPRESS_NONE; From 1a92f5c182d2b8970681f799065d4005b5ed76ac Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Fri, 14 Jul 2000 23:16:45 +0000 Subject: [PATCH 093/226] removed dead code --- bin/tests/system/run.sh | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/bin/tests/system/run.sh b/bin/tests/system/run.sh index 3e02164a55..7f58ded286 100644 --- a/bin/tests/system/run.sh +++ b/bin/tests/system/run.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: run.sh,v 1.27 2000/07/05 18:48:55 bwelling Exp $ +# $Id: run.sh,v 1.28 2000/07/14 23:16:45 gson Exp $ # # Run a system test. @@ -49,15 +49,6 @@ then exit 0; fi -# Irix does not have /var/run -#test -f /var/run/system_test_ifsetup || -#test -f /etc/system_test_ifsetup || -# { echo "I:Interfaces not set up. Not trying system tests." >&2; -# echo "R:UNTESTED" >&2 -# echo "E:$test:`date`" >&2 -# exit 0; -# } - $PERL testsock.pl || { echo "I:Interfaces not set up. Not trying system tests." >&2; echo "R:UNTESTED" >&2; From f2c814353bd1de305b5341554c803a85f88d6b72 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Fri, 14 Jul 2000 23:38:14 +0000 Subject: [PATCH 094/226] added resolver/ test directory, with a single regression test for the INSIST(!external) bug --- bin/tests/system/resolver/ans2/ans.pl | 42 ++++++++++++++++++++++++ bin/tests/system/resolver/ans3/ans.pl | 42 ++++++++++++++++++++++++ bin/tests/system/resolver/ns1/named.conf | 34 +++++++++++++++++++ bin/tests/system/resolver/ns1/root.hint | 20 +++++++++++ bin/tests/system/resolver/prereq.sh | 26 +++++++++++++++ bin/tests/system/resolver/tests.sh | 32 ++++++++++++++++++ bin/tests/system/run.sh | 17 ++++++++-- bin/tests/system/start.sh | 35 +++++++++++++++++++- bin/tests/system/stop.sh | 15 ++++++++- 9 files changed, 259 insertions(+), 4 deletions(-) create mode 100644 bin/tests/system/resolver/ans2/ans.pl create mode 100644 bin/tests/system/resolver/ans3/ans.pl create mode 100644 bin/tests/system/resolver/ns1/named.conf create mode 100644 bin/tests/system/resolver/ns1/root.hint create mode 100644 bin/tests/system/resolver/prereq.sh create mode 100644 bin/tests/system/resolver/tests.sh diff --git a/bin/tests/system/resolver/ans2/ans.pl b/bin/tests/system/resolver/ans2/ans.pl new file mode 100644 index 0000000000..63e880db3e --- /dev/null +++ b/bin/tests/system/resolver/ans2/ans.pl @@ -0,0 +1,42 @@ +#!/usr/bin/perl +# +# Ad hoc name server +# + +use IO::File; +use IO::Socket; +use Net::DNS; +use Net::DNS::Packet; + +my $sock = IO::Socket::INET->new(LocalAddr => "10.53.0.2", + LocalPort => 5300, Proto => "udp") or die "$!"; + +my $pidf = new IO::File "ans.pid", "w" or die "cannot write pid file: $!"; +print $pidf "$$\n"; +$pidf->close; +sub rmpid { unlink "ans.pid"; exit 1; }; + +$SIG{INT} = \&rmpid; +$SIG{TERM} = \&rmpid; + +for (;;) { + $sock->recv($buf, 512); + + print "**** request from " , $sock->peerhost, " port ", $sock->peerport, "\n"; + + my ($packet, $err) = new Net::DNS::Packet(\$buf, 0); + $err and die $err; + + print "REQUEST:\n"; + $packet->print; + + $packet->header->qr(1); + $packet->push("authority", new Net::DNS::RR("below.www.example.com 300 NS ns.below.www.example.com")); + $packet->push("additional", new Net::DNS::RR("ns.below.www.example.com 300 A 10.53.0.3")); + + $sock->send($packet->data); + + print "RESPONSE:\n"; + $packet->print; + print "\n"; +} diff --git a/bin/tests/system/resolver/ans3/ans.pl b/bin/tests/system/resolver/ans3/ans.pl new file mode 100644 index 0000000000..ad6ecfce46 --- /dev/null +++ b/bin/tests/system/resolver/ans3/ans.pl @@ -0,0 +1,42 @@ +#!/usr/bin/perl +# +# Ad hoc name server +# + +use IO::File; +use IO::Socket; +use Net::DNS; +use Net::DNS::Packet; + +my $sock = IO::Socket::INET->new(LocalAddr => "10.53.0.3", + LocalPort => 5300, Proto => "udp") or die "$!"; + +my $pidf = new IO::File "ans.pid", "w" or die "cannot write pid file: $!"; +print $pidf "$$\n"; +$pidf->close; +sub rmpid { unlink "ans.pid"; exit 1; }; + +$SIG{INT} = \&rmpid; +$SIG{TERM} = \&rmpid; + +for (;;) { + $sock->recv($buf, 512); + + print "**** request from " , $sock->peerhost, " port ", $sock->peerport, "\n"; + + my ($packet, $err) = new Net::DNS::Packet(\$buf, 0); + $err and die $err; + + print "REQUEST:\n"; + $packet->print; + + $packet->header->qr(1); + + $packet->push("answer", new Net::DNS::RR("www.example.com 300 A 1.2.3.4")); + + $sock->send($packet->data); + + print "RESPONSE:\n"; + $packet->print; + print "\n"; +} diff --git a/bin/tests/system/resolver/ns1/named.conf b/bin/tests/system/resolver/ns1/named.conf new file mode 100644 index 0000000000..bc7e2ecbf8 --- /dev/null +++ b/bin/tests/system/resolver/ns1/named.conf @@ -0,0 +1,34 @@ +/* + * Copyright (C) 2000 Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS + * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE + * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL + * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR + * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS + * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS + * SOFTWARE. + */ + +/* $Id: named.conf,v 1.1 2000/07/14 23:38:14 gson Exp $ */ + +options { + query-source address 10.53.0.1; + port 5300; + directory "."; + pid-file "named.pid"; + listen-on { 10.53.0.1; }; + listen-on-v6 {none;}; + recursion yes; +}; + +zone "." { + type hint; + file "root.hint"; +}; + diff --git a/bin/tests/system/resolver/ns1/root.hint b/bin/tests/system/resolver/ns1/root.hint new file mode 100644 index 0000000000..2b6e550328 --- /dev/null +++ b/bin/tests/system/resolver/ns1/root.hint @@ -0,0 +1,20 @@ +; Copyright (C) 2000 Internet Software Consortium. +; +; Permission to use, copy, modify, and distribute this software for any +; purpose with or without fee is hereby granted, provided that the above +; copyright notice and this permission notice appear in all copies. +; +; THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS +; ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES +; OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE +; CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL +; DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR +; PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS +; ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS +; SOFTWARE. + +; $Id: root.hint,v 1.1 2000/07/14 23:38:14 gson Exp $ + +$TTL 999999 +. IN NS a.root-servers.nil. +a.root-servers.nil. IN A 10.53.0.2 diff --git a/bin/tests/system/resolver/prereq.sh b/bin/tests/system/resolver/prereq.sh new file mode 100644 index 0000000000..979a4440c8 --- /dev/null +++ b/bin/tests/system/resolver/prereq.sh @@ -0,0 +1,26 @@ +#!/bin/sh +# +# Copyright (C) 2000 Internet Software Consortium. +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS +# ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES +# OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE +# CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL +# DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR +# PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS +# ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS +# SOFTWARE. + +# $Id: prereq.sh,v 1.1 2000/07/14 23:38:13 gson Exp $ + +if $PERL -e 'use Net::DNS;' 2>/dev/null +then + : +else + echo "I:This test requires the Net::DNS library." >&2 + exit 1 +fi diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh new file mode 100644 index 0000000000..e3545b5d77 --- /dev/null +++ b/bin/tests/system/resolver/tests.sh @@ -0,0 +1,32 @@ +#!/bin/sh +# +# Copyright (C) 2000 Internet Software Consortium. +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS +# ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES +# OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE +# CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL +# DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR +# PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS +# ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS +# SOFTWARE. + +# $Id: tests.sh,v 1.1 2000/07/14 23:38:13 gson Exp $ + +SYSTEMTESTTOP=.. +. $SYSTEMTESTTOP/conf.sh + +# +# Perform tests +# + +status=0 + +$DIG +tcp example. dig www.example.com. a @10.53.0.1 -p 5300 >/dev/null || status = 1 + +echo "I:exit status: $status" +exit $status diff --git a/bin/tests/system/run.sh b/bin/tests/system/run.sh index 7f58ded286..6eefb0f922 100644 --- a/bin/tests/system/run.sh +++ b/bin/tests/system/run.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: run.sh,v 1.28 2000/07/14 23:16:45 gson Exp $ +# $Id: run.sh,v 1.29 2000/07/14 23:38:09 gson Exp $ # # Run a system test. @@ -54,9 +54,22 @@ $PERL testsock.pl || { echo "R:UNTESTED" >&2; echo "E:$test:`date`" >&2; exit 0; - } + +# Check for test-specific prerequisited. +if + test -f $test/prereq.sh && + ( cd $test && sh prereq.sh "$@" ) +then + : prereqs ok +else + echo "I:Prerequisites for $test missing, skipping test." >&2 + echo "R:UNTESTED" >&2 + echo "E:$test:`date`" >&2 + exit 0 +fi + # Set up any dynamically generated test data if test -f $test/setup.sh then diff --git a/bin/tests/system/start.sh b/bin/tests/system/start.sh index 9ac22da012..a2bbf5fe1a 100644 --- a/bin/tests/system/start.sh +++ b/bin/tests/system/start.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: start.sh,v 1.26 2000/07/10 23:05:51 bwelling Exp $ +# $Id: start.sh,v 1.27 2000/07/14 23:38:10 gson Exp $ # # Start name servers for running system tests. @@ -112,6 +112,39 @@ do ) || exit 1 done +for d in ans* +do + ( + if test ! -d $d + then + break + fi + cd $d + rm -f ans.run && + if test -f ans.pid + then + if kill -0 `cat ans.pid` 2>/dev/null + then + echo "$0: ans pid `cat ans.pid` still running" >&2 + exit 1 + else + rm -f ans.pid + fi + fi + $PERL ./ans.pl > ans.run 2>&1 & + x=1 + while test ! -f ans.pid + do + x=`expr $x + 1` + if [ $x = 5 ]; then + echo "I:Couldn't start ans $d" + exit 1 + fi + sleep 1 + done + ) || exit 1 +done + # Make sure all of the servers are up. status=0 diff --git a/bin/tests/system/stop.sh b/bin/tests/system/stop.sh index b172a40e54..7f1393a313 100644 --- a/bin/tests/system/stop.sh +++ b/bin/tests/system/stop.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: stop.sh,v 1.13 2000/07/12 17:59:08 bwelling Exp $ +# $Id: stop.sh,v 1.14 2000/07/14 23:38:12 gson Exp $ # # Stop name servers. @@ -53,6 +53,19 @@ do fi done +for d in ans* +do + pidfile="$d/ans.pid" + if [ -f $pidfile ]; then + kill -TERM `cat $pidfile` > /dev/null 2>&1 + if [ $? != 0 ]; then + echo "I:$d died before a SIGTERM was sent" + status=`expr $status + 1` + rm -f $pidfile + fi + fi +done + sleep 5 for d in ns* From f427699c6afc042312256a5ef3de36b93590c2e7 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Sat, 15 Jul 2000 00:22:08 +0000 Subject: [PATCH 095/226] fixed prerequisite test --- bin/tests/system/run.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/tests/system/run.sh b/bin/tests/system/run.sh index 6eefb0f922..a218967740 100644 --- a/bin/tests/system/run.sh +++ b/bin/tests/system/run.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: run.sh,v 1.29 2000/07/14 23:38:09 gson Exp $ +# $Id: run.sh,v 1.30 2000/07/15 00:22:08 gson Exp $ # # Run a system test. @@ -59,7 +59,7 @@ $PERL testsock.pl || { # Check for test-specific prerequisited. if - test -f $test/prereq.sh && + test ! -f $test/prereq.sh || ( cd $test && sh prereq.sh "$@" ) then : prereqs ok From 5fff4f8a5492542110dcbe94ffb21c107e624d9a Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Sat, 15 Jul 2000 00:37:23 +0000 Subject: [PATCH 096/226] typo --- bin/tests/system/run.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/tests/system/run.sh b/bin/tests/system/run.sh index a218967740..e221703111 100644 --- a/bin/tests/system/run.sh +++ b/bin/tests/system/run.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: run.sh,v 1.30 2000/07/15 00:22:08 gson Exp $ +# $Id: run.sh,v 1.31 2000/07/15 00:37:23 gson Exp $ # # Run a system test. @@ -57,7 +57,7 @@ $PERL testsock.pl || { } -# Check for test-specific prerequisited. +# Check for test-specific prerequisites. if test ! -f $test/prereq.sh || ( cd $test && sh prereq.sh "$@" ) From 64024eaa4d029b0bd090c435b8b02b45eef5cd89 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Sat, 15 Jul 2000 01:02:25 +0000 Subject: [PATCH 097/226] 333. [bug] The resolver incorrectly accepted referrals to subdomains of the query domain, causing an assertion failure. --- CHANGES | 4 ++++ lib/dns/resolver.c | 38 +++++++++++++++++++++++++++++++++++++- 2 files changed, 41 insertions(+), 1 deletion(-) diff --git a/CHANGES b/CHANGES index 39cd65195d..79b885a920 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ + 333. [bug] The resolver incorrectly accepted referrals to + subdomains of the query domain, causing an + assertion failure. + 332. [func] New function dns_name_reset(). 331. [bug] Only log "recursion denied" if RD is set. (RT #178) diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index d5681da77a..b67ba939da 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: resolver.c,v 1.147 2000/07/14 00:37:27 gson Exp $ */ +/* $Id: resolver.c,v 1.148 2000/07/15 01:02:25 gson Exp $ */ #include @@ -2982,6 +2982,31 @@ dname_target(dns_rdataset_t *rdataset, dns_name_t *qname, dns_name_t *oname, return (dns_name_concatenate(dname, &tname, dname, NULL)); } +/* XXXAG should be public function in name.c */ + +static isc_boolean_t +dns_name_ispropersubdomain(const dns_name_t *name1, const dns_name_t *name2) { + int order; + unsigned int nlabels, nbits; + dns_namereln_t namereln; + + /* + * Is 'name1' a proper subdomain of 'name2'? + * + * Note: It makes no sense for one of the names to be relative and the + * other absolute. If both names are relative, then to be meaningfully + * compared the caller must ensure that they are both relative to the + * same domain. + */ + + namereln = dns_name_fullcompare(name1, name2, &order, &nlabels, + &nbits); + if (namereln == dns_namereln_subdomain) + return (ISC_TRUE); + + return (ISC_FALSE); +} + static isc_result_t noanswer_response(fetchctx_t *fctx, dns_name_t *oqname) { isc_result_t result; @@ -3154,6 +3179,17 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname) { */ if (dns_name_equal(ns_name, &fctx->domain)) return (DNS_R_FORMERR); + + /* + * If the referral name is below the query name, + * we are making too much progress, overshooting + * the target. Consider the responder insane. + */ + if (dns_name_ispropersubdomain(ns_name, &fctx->name)) { + FCTXTRACE("referral name below query name"); + return (DNS_R_FORMERR); + } + /* * Mark any additional data related to this rdataset. * It's important that we do this before we change the From 92103a4e2cda870f4802804202ae30eb837da17f Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Sat, 15 Jul 2000 01:11:37 +0000 Subject: [PATCH 098/226] typo --- bin/tests/system/views/tests.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/tests/system/views/tests.sh b/bin/tests/system/views/tests.sh index 24167f8399..62fd7e68ef 100644 --- a/bin/tests/system/views/tests.sh +++ b/bin/tests/system/views/tests.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: tests.sh,v 1.18 2000/07/12 16:43:03 tale Exp $ +# $Id: tests.sh,v 1.19 2000/07/15 01:11:37 gson Exp $ # # Perform tests @@ -36,7 +36,7 @@ $DIG +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd +noauth \ a.example. @10.53.0.3 any -p 5300 > dig.out.ns3.1 || status=1 grep ";" dig.out.ns3.1 # XXXDCL why is this here? -echo "I:copying in new configuratons for ns2 and ns3" +echo "I:copying in new configurations for ns2 and ns3" rm -f ns2/named.conf ns3/named.conf ns2/example.db cp ns2/named2.conf ns2/named.conf cp ns3/named2.conf ns3/named.conf From 0e65062acb2b0d14ab64e0c7ae7eb4137758339b Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Sun, 16 Jul 2000 18:26:18 +0000 Subject: [PATCH 099/226] strengthened the check added in the previous change: the new query domain must not only be a non-child of the query name, it must be a parent of the query name (or equal to the query name) --- CHANGES | 4 ++-- lib/dns/resolver.c | 37 ++++++------------------------------- 2 files changed, 8 insertions(+), 33 deletions(-) diff --git a/CHANGES b/CHANGES index 79b885a920..60ec76df20 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,6 @@ 333. [bug] The resolver incorrectly accepted referrals to - subdomains of the query domain, causing an - assertion failure. + domains that were not parents of the query name, + causing assertion failures. 332. [func] New function dns_name_reset(). diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index b67ba939da..46faf809df 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: resolver.c,v 1.148 2000/07/15 01:02:25 gson Exp $ */ +/* $Id: resolver.c,v 1.149 2000/07/16 18:26:18 gson Exp $ */ #include @@ -2982,31 +2982,6 @@ dname_target(dns_rdataset_t *rdataset, dns_name_t *qname, dns_name_t *oname, return (dns_name_concatenate(dname, &tname, dname, NULL)); } -/* XXXAG should be public function in name.c */ - -static isc_boolean_t -dns_name_ispropersubdomain(const dns_name_t *name1, const dns_name_t *name2) { - int order; - unsigned int nlabels, nbits; - dns_namereln_t namereln; - - /* - * Is 'name1' a proper subdomain of 'name2'? - * - * Note: It makes no sense for one of the names to be relative and the - * other absolute. If both names are relative, then to be meaningfully - * compared the caller must ensure that they are both relative to the - * same domain. - */ - - namereln = dns_name_fullcompare(name1, name2, &order, &nlabels, - &nbits); - if (namereln == dns_namereln_subdomain) - return (ISC_TRUE); - - return (ISC_FALSE); -} - static isc_result_t noanswer_response(fetchctx_t *fctx, dns_name_t *oqname) { isc_result_t result; @@ -3173,6 +3148,7 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname) { */ if (!negative_response && ns_name != NULL && oqname == NULL) { /* + * We already know ns_name is a subdomain of fctx->domain. * If ns_name is equal to fctx->domain, we're not making * progress. We return DNS_R_FORMERR so that we'll keep * keep trying other servers. @@ -3181,12 +3157,11 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname) { return (DNS_R_FORMERR); /* - * If the referral name is below the query name, - * we are making too much progress, overshooting - * the target. Consider the responder insane. + * If the referral name is not a parent of the query + * name, consider the responder insane. */ - if (dns_name_ispropersubdomain(ns_name, &fctx->name)) { - FCTXTRACE("referral name below query name"); + if (! dns_name_issubdomain(&fctx->name, ns_name)) { + FCTXTRACE("referral to non-parent"); return (DNS_R_FORMERR); } From 9c4cba349f52bb8176c3858b2b5b340f13603802 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Mon, 17 Jul 2000 17:33:39 +0000 Subject: [PATCH 100/226] 334. [func] Added hmac-md5 to libisc. --- CHANGES | 2 + bin/tests/hash_test.c | 37 ++++++++++- lib/isc/Makefile.in | 8 ++- lib/isc/hmacmd5.c | 112 ++++++++++++++++++++++++++++++++ lib/isc/include/isc/Makefile.in | 6 +- lib/isc/include/isc/hmacmd5.h | 60 +++++++++++++++++ util/copyrights | 2 + 7 files changed, 220 insertions(+), 7 deletions(-) create mode 100644 lib/isc/hmacmd5.c create mode 100644 lib/isc/include/isc/hmacmd5.h diff --git a/CHANGES b/CHANGES index 60ec76df20..345b981f2f 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,5 @@ + 334. [func] Added hmac-md5 to libisc. + 333. [bug] The resolver incorrectly accepted referrals to domains that were not parents of the query name, causing assertion failures. diff --git a/bin/tests/hash_test.c b/bin/tests/hash_test.c index 0a6de6d983..416dd58821 100644 --- a/bin/tests/hash_test.c +++ b/bin/tests/hash_test.c @@ -15,12 +15,14 @@ * SOFTWARE. */ -/* $Id: hash_test.c,v 1.4 2000/06/23 16:18:56 tale Exp $ */ +/* $Id: hash_test.c,v 1.5 2000/07/17 17:33:39 bwelling Exp $ */ #include #include +#include +#include #include #include #include @@ -45,9 +47,11 @@ int main(int argc, char **argv) { isc_sha1_t sha1; isc_md5_t md5; + isc_hmacmd5_t hmacmd5; unsigned char digest[20]; unsigned char buffer[1024]; const unsigned char *s; + unsigned char key[20]; UNUSED(argc); UNUSED(argv); @@ -73,5 +77,36 @@ main(int argc, char **argv) { isc_md5_final(&md5, digest); print_digest(buffer, "md5", digest, 4); + /* + * The 3 HMAC-MD5 examples from RFC 2104 + */ + s = "Hi There"; + memset(key, 0x0b, 16); + isc_hmacmd5_init(&hmacmd5, key, 16); + strcpy(buffer, s); + isc_hmacmd5_update(&hmacmd5, buffer, strlen(s)); + isc_hmacmd5_sign(&hmacmd5, digest); + print_digest(buffer, "hmacmd5", digest, 4); + + s = "what do ya want for nothing?"; + strcpy(key, "Jefe"); + isc_hmacmd5_init(&hmacmd5, key, 4); + strcpy(buffer, s); + isc_hmacmd5_update(&hmacmd5, buffer, strlen(s)); + isc_hmacmd5_sign(&hmacmd5, digest); + print_digest(buffer, "hmacmd5", digest, 4); + + s = "\335\335\335\335\335\335\335\335\335\335" + "\335\335\335\335\335\335\335\335\335\335" + "\335\335\335\335\335\335\335\335\335\335" + "\335\335\335\335\335\335\335\335\335\335" + "\335\335\335\335\335\335\335\335\335\335"; + memset(key, 0xaa, 16); + isc_hmacmd5_init(&hmacmd5, key, 16); + strcpy(buffer, s); + isc_hmacmd5_update(&hmacmd5, buffer, strlen(s)); + isc_hmacmd5_sign(&hmacmd5, digest); + print_digest(buffer, "hmacmd5", digest, 4); + return (0); } diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in index 42b9fead4b..a5f5d1abc5 100644 --- a/lib/isc/Makefile.in +++ b/lib/isc/Makefile.in @@ -13,7 +13,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: Makefile.in,v 1.61 2000/06/22 21:56:48 tale Exp $ +# $Id: Makefile.in,v 1.62 2000/07/17 17:33:31 bwelling Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -50,7 +50,8 @@ WIN32OBJS = win32/condition.@O@ win32/dir.@O@ win32/file.@O@ \ # Alphabetically OBJS = @ISC_EXTRA_OBJS@ \ assertions.@O@ base64.@O@ bitstring.@O@ buffer.@O@ \ - bufferlist.@O@ commandline.@O@ error.@O@ event.@O@ heap.@O@ \ + bufferlist.@O@ commandline.@O@ error.@O@ event.@O@ \ + heap.@O@ hmacmd5.@O@ \ lex.@O@ lfsr.@O@ lib.@O@ log.@O@ \ md5.@O@ mem.@O@ mutexblock.@O@ netaddr.@O@ ondestroy.@O@ \ quota.@O@ random.@O@ \ @@ -62,7 +63,8 @@ OBJS = @ISC_EXTRA_OBJS@ \ # Alphabetically SRCS = @ISC_EXTRA_SRCS@ \ assertions.c base64.c bitstring.c buffer.c \ - bufferlist.c commandline.c error.c event.c heap.c \ + bufferlist.c commandline.c error.c event.c \ + heap.c hmacmd5.c \ lex.c lfsr.c lib.c log.c \ md5.c mem.c mutexblock.c netaddr.c ondestroy.c \ quota.c random.c \ diff --git a/lib/isc/hmacmd5.c b/lib/isc/hmacmd5.c new file mode 100644 index 0000000000..f3771c6ed2 --- /dev/null +++ b/lib/isc/hmacmd5.c @@ -0,0 +1,112 @@ +/* + * Copyright (C) 2000 Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS + * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE + * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL + * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR + * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS + * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS + * SOFTWARE. + */ + +/* $Id: hmacmd5.c,v 1.1 2000/07/17 17:33:31 bwelling Exp $ */ + +/* + * This code implements the HMAC-MD5 keyed hash algorithm + * described in RFC 2104. + */ + +#include "config.h" + +#include +#include +#include +#include +#include + +#define PADLEN 64 +#define IPAD 0x36 +#define OPAD 0x5C + +/* + * Start HMAC-MD5 process. Initialize an md5 context and digest the key. + */ +void +isc_hmacmd5_init(isc_hmacmd5_t *ctx, const unsigned char *key, + unsigned int len) +{ + unsigned char ipad[PADLEN]; + int i; + + memset(ctx->key, 0, sizeof (ctx->key)); + if (len > sizeof(ctx->key)) { + isc_md5_t md5ctx; + isc_md5_init(&md5ctx); + isc_md5_update(&md5ctx, key, len); + isc_md5_final(&md5ctx, ctx->key); + } else + memcpy(ctx->key, key, len); + + isc_md5_init(&ctx->md5ctx); + memset(ipad, IPAD, sizeof (ipad)); + for (i = 0; i < PADLEN; i++) + ipad[i] ^= ctx->key[i]; + isc_md5_update(&ctx->md5ctx, ipad, sizeof(ipad)); +} + +void +isc_hmacmd5_invalidate(isc_hmacmd5_t *ctx) { + isc_md5_invalidate(&ctx->md5ctx); + memset(ctx->key, 0, sizeof (ctx->key)); + memset(ctx, 0, sizeof (ctx)); +} + +/* + * Update context to reflect the concatenation of another buffer full + * of bytes. + */ +void +isc_hmacmd5_update(isc_hmacmd5_t *ctx, const unsigned char *buf, + unsigned int len) +{ + isc_md5_update(&ctx->md5ctx, buf, len); +} + +/* + * Compute signature - finalize MD5 operation and reapply MD5. + */ +void +isc_hmacmd5_sign(isc_hmacmd5_t *ctx, unsigned char *digest) { + unsigned char opad[PADLEN]; + int i; + + isc_md5_final(&ctx->md5ctx, digest); + + memset(opad, OPAD, sizeof (opad)); + for (i = 0; i < PADLEN; i++) + opad[i] ^= ctx->key[i]; + + isc_md5_init(&ctx->md5ctx); + isc_md5_update(&ctx->md5ctx, opad, sizeof(opad)); + isc_md5_update(&ctx->md5ctx, digest, ISC_MD5_DIGESTLENGTH); + isc_md5_final(&ctx->md5ctx, digest); + isc_hmacmd5_invalidate(ctx); +} + +/* + * Verify signature - finalize MD5 operation and reapply MD5, then + * compare to the supplied digest. + */ +isc_boolean_t +isc_hmacmd5_verify(isc_hmacmd5_t *ctx, unsigned char *digest) { + unsigned char newdigest[ISC_MD5_DIGESTLENGTH]; + + isc_hmacmd5_sign(ctx, newdigest); + return (ISC_TF(memcmp(digest, newdigest, ISC_MD5_DIGESTLENGTH) == 0)); +} diff --git a/lib/isc/include/isc/Makefile.in b/lib/isc/include/isc/Makefile.in index acd868cfa3..f2a7b3dbca 100644 --- a/lib/isc/include/isc/Makefile.in +++ b/lib/isc/include/isc/Makefile.in @@ -13,7 +13,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: Makefile.in,v 1.39 2000/06/30 00:26:19 gson Exp $ +# $Id: Makefile.in,v 1.40 2000/07/17 17:33:34 bwelling Exp $ srcdir = @srcdir@ VPATH = @srcdir@ @@ -28,8 +28,8 @@ top_srcdir = @top_srcdir@ # HEADERS = assertions.h base64.h bitstring.h boolean.h buffer.h \ bufferlist.h commandline.h error.h event.h eventclass.h \ - file.h formatcheck.h fsaccess.h heap.h interfaceiter.h \ - @ISC_IPV6_H@ lang.h lex.h \ + file.h formatcheck.h fsaccess.h heap.h hmacmd5.h \ + interfaceiter.h @ISC_IPV6_H@ lang.h lex.h \ lfsr.h lib.h list.h log.h magic.h md5.h mem.h msgcat.h \ mutexblock.h netaddr.h ondestroy.h os.h \ print.h quota.h random.h ratelimiter.h region.h \ diff --git a/lib/isc/include/isc/hmacmd5.h b/lib/isc/include/isc/hmacmd5.h new file mode 100644 index 0000000000..3ea5b5c004 --- /dev/null +++ b/lib/isc/include/isc/hmacmd5.h @@ -0,0 +1,60 @@ +/* + * Copyright (C) 2000 Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS + * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE + * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL + * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR + * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS + * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS + * SOFTWARE. + */ + +/* $Id: hmacmd5.h,v 1.1 2000/07/17 17:33:32 bwelling Exp $ */ + +/* + * This is the header file for the HMAC-MD5 keyed hash algorithm + * described in RFC 2104. + */ + +#ifndef ISC_HMACMD5_H +#define ISC_HMACMD5_H 1 + +#include +#include +#include + +#define ISC_HMACMD5_KEYLENGTH 64 + +typedef struct { + isc_md5_t md5ctx; + unsigned char key[ISC_HMACMD5_KEYLENGTH]; +} isc_hmacmd5_t; + +ISC_LANG_BEGINDECLS + +void +isc_hmacmd5_init(isc_hmacmd5_t *ctx, const unsigned char *key, + unsigned int len); + +void +isc_hmacmd5_invalidate(isc_hmacmd5_t *ctx); + +void +isc_hmacmd5_update(isc_hmacmd5_t *ctx, const unsigned char *buf, + unsigned int len); + +void +isc_hmacmd5_sign(isc_hmacmd5_t *ctx, unsigned char *digest); + +isc_boolean_t +isc_hmacmd5_verify(isc_hmacmd5_t *ctx, unsigned char *digest); + +ISC_LANG_ENDDECLS + +#endif /* ISC_HMACMD5_H */ diff --git a/util/copyrights b/util/copyrights index baa81c0b50..7e4e8ceda6 100644 --- a/util/copyrights +++ b/util/copyrights @@ -994,6 +994,7 @@ ./lib/isc/event.c C 1998,1999,2000 ./lib/isc/fsaccess.c C 2000 ./lib/isc/heap.c C 1997,1998,1999,2000 +./lib/isc/hmacmd5.c C 2000 ./lib/isc/include/.cvsignore X 1999,2000 ./lib/isc/include/Makefile.in MAKE 1998,1999,2000 ./lib/isc/include/isc/.cvsignore X 1999,2000 @@ -1013,6 +1014,7 @@ ./lib/isc/include/isc/formatcheck.h C 2000 ./lib/isc/include/isc/fsaccess.h C 2000 ./lib/isc/include/isc/heap.h C 1997,1998,1999,2000 +./lib/isc/include/isc/hmacmd5.h C 2000 ./lib/isc/include/isc/interfaceiter.h C 1999,2000 ./lib/isc/include/isc/ipv6.h C 1999,2000 ./lib/isc/include/isc/lang.h C 1999,2000 From bd2a38d6af3ded9a355a316c06b15511729ef2d2 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Mon, 17 Jul 2000 17:42:54 +0000 Subject: [PATCH 101/226] Use isc_base64_decodestring() instead of explicitly creating a lexer. --- bin/nsupdate/nsupdate.c | 19 +++---------------- 1 file changed, 3 insertions(+), 16 deletions(-) diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c index 205fb66697..9656331bb0 100644 --- a/bin/nsupdate/nsupdate.c +++ b/bin/nsupdate/nsupdate.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: nsupdate.c,v 1.29 2000/07/09 16:17:13 tale Exp $ */ +/* $Id: nsupdate.c,v 1.30 2000/07/17 17:42:54 bwelling Exp $ */ #include @@ -248,8 +248,6 @@ setup_key() { if (keystr != NULL) { isc_buffer_t keynamesrc; char *secretstr; - isc_buffer_t secretsrc; - isc_lex_t *lex = NULL; char *s; debug("Creating key..."); @@ -275,27 +273,16 @@ setup_key() { if (secret == NULL) fatal("out of memory"); - isc_buffer_init(&secretsrc, secretstr, strlen(secretstr)); - isc_buffer_add(&secretsrc, strlen(secretstr)); - isc_buffer_init(&secretbuf, secret, secretlen); - - result = isc_lex_create(mctx, strlen(secretstr), &lex); - check_result(result, "isc_lex_create"); - result = isc_lex_openbuffer(lex, &secretsrc); - check_result(result, "isc_lex_openbuffer"); - result = isc_base64_tobuffer(lex, &secretbuf, -1); + result = isc_base64_decodestring(mctx, secretstr, &secretbuf); if (result != ISC_R_SUCCESS) { fprintf(stderr, "Couldn't create key from %s: %s\n", keystr, isc_result_totext(result)); - isc_lex_close(lex); - isc_lex_destroy(&lex); goto failure; } + secretlen = isc_buffer_usedlength(&secretbuf); debug("close"); - isc_lex_close(lex); - isc_lex_destroy(&lex); } else { dst_key_t *dstkey = NULL; From d987e0d8e88bef4da99536a8a5c94a7c0a004a68 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Mon, 17 Jul 2000 17:49:25 +0000 Subject: [PATCH 102/226] reviewed and edited; removed lwres intro material that is better covered in lwres(3) --- bin/named/lwresd.8 | 84 ++++++++++++++++---------------------------- doc/man/bin/lwresd.8 | 84 ++++++++++++++++---------------------------- 2 files changed, 60 insertions(+), 108 deletions(-) diff --git a/bin/named/lwresd.8 b/bin/named/lwresd.8 index c361880eaf..7163b0c6ea 100644 --- a/bin/named/lwresd.8 +++ b/bin/named/lwresd.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: lwresd.8,v 1.3 2000/07/12 19:39:49 tale Exp $ +.\" $Id: lwresd.8,v 1.4 2000/07/17 17:49:25 gson Exp $ .\" .Dd Jun 30, 2000 .Dt LWRESD 8 @@ -36,22 +36,15 @@ .Op Fl u Ar user-id .Sh DESCRIPTION .Nm lwresd -is the daemon for processes that use the BIND 9 lightweight resolver -library. -The daemon is actually a DNS name server, -.Nm named , -though when it operates as the lightweight resolver server -.Nm lwresd , -it is functionally and logically distinct from an actual name server. -It does not handle conventional DNS lookups in the wire format defined -in RFC1035 or listen for queries on the default name server port number. -.Nm lwresd -only handles requests that are in the canonical -format for the lightweight resolver protocol. +is the daemon providing name lookup services to clients that use +the BIND 9 lightweight resolver library. +It is essentially a stripped-down, caching-only name server that +answers queries using the BIND 9 lightweight resolver protocol +rather than the DNS protocol. .Pp -When listening for lightweight resolver queries, .Nm lwresd -uses a UDP port on the IPv4 loopback interface, 127.0.0.1. +listens for resolver queries on a UDP port on the IPv4 loopback +interface, 127.0.0.1. This means that .Nm lwresd can only be used by processes running on the local machine. @@ -67,40 +60,21 @@ encodes the answers from the name servers in the lightweight resolver format and returns them to the client that made the original request. .Pp -The lightweight resolver daemon is comparable to a forwarding name server -except that it receives requests in the lightweight resolver format -rather than conventional DNS queries. -It reads +If .Pa /etc/resolv.conf -and uses the +contains any .Sy nameserver -entries to determine which IP addresses to use when making DNS -lookups. -If no -.Pa /etc/resolv.conf -is present, +entries, .Nm lwresd -uses its built-in list of root name servers. -In this mode of operation, +sends recursive DNS queries to those servers. This +is similar to the use of forwarders in a chaching name +server. If no +.Sy nameserver +entries are present, or if forwarding fails, .Nm lwresd -analogous to a caching-only name server, albeit one that does not -receive conventional DNS queries. -.Pp -The lightweight resolver simplifies the task of looking up hostnames -or IP addresses in the DNS. -Clients construct simple questions like \*qwhat is the hostname for -the following address?\*q or \*qwhat are the addresses of hostname -.Dv host.example.com?\*q and send them to -.Nm lwresd . -This saves them from a number of possible complications and perhaps -having to make many DNS queries to resolve the hostname or IP address. -Without the lightweight resolver, clients would be expected to deal -with the complexities of -processing the DNS resource records used for IPv6 addresses, dealing -with DNAME records and deciphering DNSSEC. -Instead of directly handling those complications, clients can make -.Nm lwresd -do the work for them. +resolves the queries autonomously starting at the +root name servers, using a compiled-in list of root +servers hints. .Pp The options to .Nm lwresd @@ -122,23 +96,25 @@ run .Nm lwresd in the foreground. .It Fl g -also runs the lightweight resolver daemon in the foreground, but -logs to +run +.Nm lwresd +in the foreground and force all logging to .Dv stderr . .It Fl i write the daemon's process id to .Ar pid-file instead of the default pathname. .It Fl n -create threads that use +create .Ar #cpus -CPUs if the hardware and software permits this. -When -.Ar #cpus -is set to zero, +worker threads to take advantage of multiple CPUs. +If no option is given, .Nm lwresd -will try to determine the number of CPUs present and use 1 if this -attempt fails. +will try to determine the number of CPUs present and create +one thread per CPU. If +.Nm lwresd +is unable to determine the number of CPUs, a single worker thread +is created. .It Fl P send DNS lookups to port number .Ar query-port# diff --git a/doc/man/bin/lwresd.8 b/doc/man/bin/lwresd.8 index c361880eaf..7163b0c6ea 100644 --- a/doc/man/bin/lwresd.8 +++ b/doc/man/bin/lwresd.8 @@ -14,7 +14,7 @@ .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: lwresd.8,v 1.3 2000/07/12 19:39:49 tale Exp $ +.\" $Id: lwresd.8,v 1.4 2000/07/17 17:49:25 gson Exp $ .\" .Dd Jun 30, 2000 .Dt LWRESD 8 @@ -36,22 +36,15 @@ .Op Fl u Ar user-id .Sh DESCRIPTION .Nm lwresd -is the daemon for processes that use the BIND 9 lightweight resolver -library. -The daemon is actually a DNS name server, -.Nm named , -though when it operates as the lightweight resolver server -.Nm lwresd , -it is functionally and logically distinct from an actual name server. -It does not handle conventional DNS lookups in the wire format defined -in RFC1035 or listen for queries on the default name server port number. -.Nm lwresd -only handles requests that are in the canonical -format for the lightweight resolver protocol. +is the daemon providing name lookup services to clients that use +the BIND 9 lightweight resolver library. +It is essentially a stripped-down, caching-only name server that +answers queries using the BIND 9 lightweight resolver protocol +rather than the DNS protocol. .Pp -When listening for lightweight resolver queries, .Nm lwresd -uses a UDP port on the IPv4 loopback interface, 127.0.0.1. +listens for resolver queries on a UDP port on the IPv4 loopback +interface, 127.0.0.1. This means that .Nm lwresd can only be used by processes running on the local machine. @@ -67,40 +60,21 @@ encodes the answers from the name servers in the lightweight resolver format and returns them to the client that made the original request. .Pp -The lightweight resolver daemon is comparable to a forwarding name server -except that it receives requests in the lightweight resolver format -rather than conventional DNS queries. -It reads +If .Pa /etc/resolv.conf -and uses the +contains any .Sy nameserver -entries to determine which IP addresses to use when making DNS -lookups. -If no -.Pa /etc/resolv.conf -is present, +entries, .Nm lwresd -uses its built-in list of root name servers. -In this mode of operation, +sends recursive DNS queries to those servers. This +is similar to the use of forwarders in a chaching name +server. If no +.Sy nameserver +entries are present, or if forwarding fails, .Nm lwresd -analogous to a caching-only name server, albeit one that does not -receive conventional DNS queries. -.Pp -The lightweight resolver simplifies the task of looking up hostnames -or IP addresses in the DNS. -Clients construct simple questions like \*qwhat is the hostname for -the following address?\*q or \*qwhat are the addresses of hostname -.Dv host.example.com?\*q and send them to -.Nm lwresd . -This saves them from a number of possible complications and perhaps -having to make many DNS queries to resolve the hostname or IP address. -Without the lightweight resolver, clients would be expected to deal -with the complexities of -processing the DNS resource records used for IPv6 addresses, dealing -with DNAME records and deciphering DNSSEC. -Instead of directly handling those complications, clients can make -.Nm lwresd -do the work for them. +resolves the queries autonomously starting at the +root name servers, using a compiled-in list of root +servers hints. .Pp The options to .Nm lwresd @@ -122,23 +96,25 @@ run .Nm lwresd in the foreground. .It Fl g -also runs the lightweight resolver daemon in the foreground, but -logs to +run +.Nm lwresd +in the foreground and force all logging to .Dv stderr . .It Fl i write the daemon's process id to .Ar pid-file instead of the default pathname. .It Fl n -create threads that use +create .Ar #cpus -CPUs if the hardware and software permits this. -When -.Ar #cpus -is set to zero, +worker threads to take advantage of multiple CPUs. +If no option is given, .Nm lwresd -will try to determine the number of CPUs present and use 1 if this -attempt fails. +will try to determine the number of CPUs present and create +one thread per CPU. If +.Nm lwresd +is unable to determine the number of CPUs, a single worker thread +is created. .It Fl P send DNS lookups to port number .Ar query-port# From 178f73169a27ac031f58863ae12cdb33dc15f6c4 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Mon, 17 Jul 2000 18:43:32 +0000 Subject: [PATCH 103/226] 335. [bug] named would occasionally attempt recursion when it was disallowed or undesired. --- CHANGES | 3 +++ bin/named/client.c | 4 +++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/CHANGES b/CHANGES index 345b981f2f..33a8bd6e63 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,6 @@ + 335. [bug] named would occasionally attempt recursion when + it was disallowed or undesired. + 334. [func] Added hmac-md5 to libisc. 333. [bug] The resolver incorrectly accepted referrals to diff --git a/bin/named/client.c b/bin/named/client.c index 9f565a20a4..8ccca0c162 100644 --- a/bin/named/client.c +++ b/bin/named/client.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: client.c,v 1.100 2000/07/14 02:26:22 marka Exp $ */ +/* $Id: client.c,v 1.101 2000/07/17 18:43:30 bwelling Exp $ */ #include @@ -1053,6 +1053,8 @@ client_request(isc_task_t *task, isc_event_t *event) { if (ra == ISC_TRUE) client->attributes |= NS_CLIENTATTR_RA; + else + client->attributes &= ~NS_CLIENTATTR_RA; /* * Dispatch the request. From bf68c5151b5c4f7d6b2783584434e61045a88d7f Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Mon, 17 Jul 2000 19:31:23 +0000 Subject: [PATCH 104/226] 336. [bug] "dig -f" used 64 k of memory for each line in the file. It now uses much less, though still proportionally to the file size. --- CHANGES | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGES b/CHANGES index 33a8bd6e63..ff48a854f3 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,8 @@ + + 336. [bug] "dig -f" used 64 k of memory for each line in + the file. It now uses much less, though still + proportionally to the file size. + 335. [bug] named would occasionally attempt recursion when it was disallowed or undesired. From c49e3222b0912479015161e8b54a67a1abf9a0ff Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Mon, 17 Jul 2000 19:44:50 +0000 Subject: [PATCH 105/226] 337. [bug] dig did not recognize nsap-ptr as an RR type on the command line. --- CHANGES | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGES b/CHANGES index ff48a854f3..2e633c9050 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,7 @@ + 337. [bug] "dig" did not recognize "nsap-ptr" as an RR type + on the command line. + 336. [bug] "dig -f" used 64 k of memory for each line in the file. It now uses much less, though still proportionally to the file size. From 3668b37b8b7769a577a17b429cb34431b4bcc47d Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Mon, 17 Jul 2000 23:19:14 +0000 Subject: [PATCH 106/226] cleaner, but more invasive, fix to 335. --- bin/named/client.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/bin/named/client.c b/bin/named/client.c index 8ccca0c162..3df33b3bec 100644 --- a/bin/named/client.c +++ b/bin/named/client.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: client.c,v 1.101 2000/07/17 18:43:30 bwelling Exp $ */ +/* $Id: client.c,v 1.102 2000/07/17 23:19:14 gson Exp $ */ #include @@ -488,6 +488,12 @@ ns_client_endrequest(ns_client_t *client) { if (client->recursionquota != NULL) isc_quota_detach(&client->recursionquota); + + /* + * Clear all client attributes that are specific to + * the request; that's all except the TCP flag. + */ + client->attributes &= NS_CLIENTATTR_TCP; } static void @@ -847,13 +853,9 @@ client_request(isc_task_t *task, isc_event_t *event) { if ((devent->attributes & ISC_SOCKEVENTATTR_PKTINFO) != 0) { client->attributes |= NS_CLIENTATTR_PKTINFO; client->pktinfo = devent->pktinfo; - } else { - client->attributes &= ~NS_CLIENTATTR_PKTINFO; } if ((devent->attributes & ISC_SOCKEVENTATTR_MULTICAST) != 0) client->attributes |= NS_CLIENTATTR_MULTICAST; - else - client->attributes &= ~NS_CLIENTATTR_MULTICAST; } else { INSIST(TCP_CLIENT(client)); REQUIRE(event->ev_type == DNS_EVENT_TCPMSG); @@ -1053,8 +1055,6 @@ client_request(isc_task_t *task, isc_event_t *event) { if (ra == ISC_TRUE) client->attributes |= NS_CLIENTATTR_RA; - else - client->attributes &= ~NS_CLIENTATTR_RA; /* * Dispatch the request. From f6579931b38b357013736ce3efc79a34480af5ce Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Mon, 17 Jul 2000 23:25:35 +0000 Subject: [PATCH 107/226] Added calls to isc_log_wouldlog() in additional logging functions. --- lib/dns/dispatch.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c index 3b2ef22338..ac7e974918 100644 --- a/lib/dns/dispatch.c +++ b/lib/dns/dispatch.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dispatch.c,v 1.59 2000/07/13 01:16:22 gson Exp $ */ +/* $Id: dispatch.c,v 1.60 2000/07/17 23:25:35 bwelling Exp $ */ #include @@ -175,6 +175,9 @@ mgr_log(dns_dispatchmgr_t *mgr, int level, const char *fmt, ...) { char msgbuf[2048]; va_list ap; + if (! isc_log_wouldlog(dns_lctx, level)) + return; + va_start(ap, fmt); vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap); va_end(ap); @@ -209,6 +212,9 @@ request_log(dns_dispatch_t *disp, dns_dispentry_t *resp, char peerbuf[256]; va_list ap; + if (! isc_log_wouldlog(dns_lctx, level)) + return; + va_start(ap, fmt); vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap); va_end(ap); From 7a184cd4e5a54a4e530f9bff8a4e46be392d0b52 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 18 Jul 2000 00:44:52 +0000 Subject: [PATCH 108/226] don't copy a name structure, copy a pointer. --- bin/named/tsigconf.c | 14 ++++++++------ lib/dns/tsigconf.c | 14 ++++++++------ 2 files changed, 16 insertions(+), 12 deletions(-) diff --git a/bin/named/tsigconf.c b/bin/named/tsigconf.c index 3b0763b948..4861d8dd3d 100644 --- a/bin/named/tsigconf.c +++ b/bin/named/tsigconf.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: tsigconf.c,v 1.7 2000/06/22 21:54:51 tale Exp $ */ +/* $Id: tsigconf.c,v 1.8 2000/07/18 00:44:52 bwelling Exp $ */ #include @@ -43,13 +43,12 @@ add_initial_keys(dns_c_kdeflist_t *list, dns_tsig_keyring_t *ring, key = ISC_LIST_HEAD(list->keydefs); while (key != NULL) { dns_name_t keyname; - dns_name_t alg; + dns_name_t *alg, tempalg; char keynamedata[1024], algdata[1024]; isc_buffer_t keynamesrc, keynamebuf, algsrc, algbuf; isc_buffer_t secretsrc, secretbuf; dns_name_init(&keyname, NULL); - dns_name_init(&alg, NULL); /* * Create the key name. @@ -66,16 +65,19 @@ add_initial_keys(dns_c_kdeflist_t *list, dns_tsig_keyring_t *ring, * Create the algorithm. */ if (strcasecmp(key->algorithm, "hmac-md5") == 0) - alg = *dns_tsig_hmacmd5_name; + alg = dns_tsig_hmacmd5_name; else { + dns_name_init(&tempalg, NULL); isc_buffer_init(&algsrc, key->algorithm, strlen(key->algorithm)); isc_buffer_add(&algsrc, strlen(key->algorithm)); isc_buffer_init(&algbuf, algdata, sizeof(algdata)); - ret = dns_name_fromtext(&alg, &algsrc, dns_rootname, + ret = dns_name_fromtext(&tempalg, &algsrc, + dns_rootname, ISC_TRUE, &algbuf); if (ret != ISC_R_SUCCESS) goto failure; + alg = &tempalg; } if (strlen(key->secret) % 4 != 0) { @@ -105,7 +107,7 @@ add_initial_keys(dns_c_kdeflist_t *list, dns_tsig_keyring_t *ring, isc_lex_destroy(&lex); isc_stdtime_get(&now); - ret = dns_tsigkey_create(&keyname, &alg, secret, secretlen, + ret = dns_tsigkey_create(&keyname, alg, secret, secretlen, ISC_FALSE, NULL, now, now, mctx, ring, NULL); isc_mem_put(mctx, secret, secretalloc); diff --git a/lib/dns/tsigconf.c b/lib/dns/tsigconf.c index 3b0763b948..4861d8dd3d 100644 --- a/lib/dns/tsigconf.c +++ b/lib/dns/tsigconf.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: tsigconf.c,v 1.7 2000/06/22 21:54:51 tale Exp $ */ +/* $Id: tsigconf.c,v 1.8 2000/07/18 00:44:52 bwelling Exp $ */ #include @@ -43,13 +43,12 @@ add_initial_keys(dns_c_kdeflist_t *list, dns_tsig_keyring_t *ring, key = ISC_LIST_HEAD(list->keydefs); while (key != NULL) { dns_name_t keyname; - dns_name_t alg; + dns_name_t *alg, tempalg; char keynamedata[1024], algdata[1024]; isc_buffer_t keynamesrc, keynamebuf, algsrc, algbuf; isc_buffer_t secretsrc, secretbuf; dns_name_init(&keyname, NULL); - dns_name_init(&alg, NULL); /* * Create the key name. @@ -66,16 +65,19 @@ add_initial_keys(dns_c_kdeflist_t *list, dns_tsig_keyring_t *ring, * Create the algorithm. */ if (strcasecmp(key->algorithm, "hmac-md5") == 0) - alg = *dns_tsig_hmacmd5_name; + alg = dns_tsig_hmacmd5_name; else { + dns_name_init(&tempalg, NULL); isc_buffer_init(&algsrc, key->algorithm, strlen(key->algorithm)); isc_buffer_add(&algsrc, strlen(key->algorithm)); isc_buffer_init(&algbuf, algdata, sizeof(algdata)); - ret = dns_name_fromtext(&alg, &algsrc, dns_rootname, + ret = dns_name_fromtext(&tempalg, &algsrc, + dns_rootname, ISC_TRUE, &algbuf); if (ret != ISC_R_SUCCESS) goto failure; + alg = &tempalg; } if (strlen(key->secret) % 4 != 0) { @@ -105,7 +107,7 @@ add_initial_keys(dns_c_kdeflist_t *list, dns_tsig_keyring_t *ring, isc_lex_destroy(&lex); isc_stdtime_get(&now); - ret = dns_tsigkey_create(&keyname, &alg, secret, secretlen, + ret = dns_tsigkey_create(&keyname, alg, secret, secretlen, ISC_FALSE, NULL, now, now, mctx, ring, NULL); isc_mem_put(mctx, secret, secretalloc); From 49c8a96fba8d85810d470fdc7dd3388f0c767c9e Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 18 Jul 2000 00:46:03 +0000 Subject: [PATCH 109/226] Don't require that tsig keys must be on a keyring. Also some other cleanup. --- lib/dns/include/dns/tsig.h | 4 +- lib/dns/tsig.c | 104 +++++++++++++++++++------------------ 2 files changed, 55 insertions(+), 53 deletions(-) diff --git a/lib/dns/include/dns/tsig.h b/lib/dns/include/dns/tsig.h index 4bff2e0db3..633aa2a78f 100644 --- a/lib/dns/include/dns/tsig.h +++ b/lib/dns/include/dns/tsig.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: tsig.h,v 1.24 2000/06/22 21:56:17 tale Exp $ */ +/* $Id: tsig.h,v 1.25 2000/07/18 00:46:03 bwelling Exp $ */ #ifndef DNS_TSIG_H #define DNS_TSIG_H 1 @@ -93,7 +93,7 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm, * 'length' is an integer greater than 0 * 'creator' points to a valid dns_name_t or is NULL * 'mctx' is a valid memory context - * 'ring' is a valid TSIG keyring + * 'ring' is a valid TSIG keyring or NULL * 'key' or '*key' must be NULL * * Returns: diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c index 53793d9d55..a96a72caee 100644 --- a/lib/dns/tsig.c +++ b/lib/dns/tsig.c @@ -16,7 +16,7 @@ */ /* - * $Id: tsig.c,v 1.72 2000/06/23 00:48:28 bwelling Exp $ + * $Id: tsig.c,v 1.73 2000/07/18 00:46:01 bwelling Exp $ * Principal Author: Brian Wellington */ @@ -47,11 +47,23 @@ static isc_once_t once = ISC_ONCE_INIT; static dns_name_t hmacmd5_name; -dns_name_t *dns_tsig_hmacmd5_name = NULL; +dns_name_t *dns_tsig_hmacmd5_name = &hmacmd5_name; static isc_result_t tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg); +static void +dns_tsig_inithmac(void) { + isc_constregion_t r; + const char *str = "\010HMAC-MD5\007SIG-ALG\003REG\003INT"; + + dns_name_init(&hmacmd5_name, NULL); + r.base = str; + r.length = strlen(str) + 1; + dns_name_fromregion(&hmacmd5_name, (isc_region_t *)&r); + dns_tsig_hmacmd5_name = &hmacmd5_name; +} + isc_result_t dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm, unsigned char *secret, int length, isc_boolean_t generated, @@ -72,6 +84,7 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm, REQUIRE(secret != NULL); REQUIRE(mctx != NULL); + RUNTIME_CHECK(isc_once_do(&once, dns_tsig_inithmac) == ISC_R_SUCCESS); if (!dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME)) return (ISC_R_NOTFOUND); else @@ -109,8 +122,10 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm, else tkey->creator = NULL; + ISC_LINK_INIT(tkey, link); tkey->key = NULL; - tkey->ring = NULL; + tkey->ring = ring; + if (length > 0) { dns_tsigkey_t *tmp; @@ -123,23 +138,23 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm, if (ret != ISC_R_SUCCESS) goto cleanup_algorithm; - ISC_LINK_INIT(tkey, link); - isc_rwlock_lock(&ring->lock, isc_rwlocktype_write); - tmp = ISC_LIST_HEAD(ring->keys); - while (tmp != NULL) { - if (dns_name_equal(&tkey->name, &tmp->name) && - !tmp->deleted) - { - ret = ISC_R_EXISTS; - isc_rwlock_unlock(&ring->lock, - isc_rwlocktype_write); - goto cleanup_algorithm; + if (ring != NULL) { + RWLOCK(&ring->lock, isc_rwlocktype_write); + tmp = ISC_LIST_HEAD(ring->keys); + while (tmp != NULL) { + if (dns_name_equal(&tkey->name, &tmp->name) && + !tmp->deleted) + { + ret = ISC_R_EXISTS; + RWUNLOCK(&ring->lock, + isc_rwlocktype_write); + goto cleanup_algorithm; + } + tmp = ISC_LIST_NEXT(tmp, link); } - tmp = ISC_LIST_NEXT(tmp, link); + ISC_LIST_APPEND(ring->keys, tkey, link); + RWUNLOCK(&ring->lock, isc_rwlocktype_write); } - ISC_LIST_APPEND(ring->keys, tkey, link); - isc_rwlock_unlock(&ring->lock, isc_rwlocktype_write); - tkey->ring = ring; } tkey->refs = 0; @@ -180,9 +195,9 @@ dns_tsigkey_attach(dns_tsigkey_t *source, dns_tsigkey_t **targetp) { REQUIRE(VALID_TSIG_KEY(source)); REQUIRE(targetp != NULL && *targetp == NULL); - isc_mutex_lock(&source->lock); + LOCK(&source->lock); source->refs++; - isc_mutex_unlock(&source->lock); + UNLOCK(&source->lock); *targetp = source; } @@ -194,10 +209,10 @@ tsigkey_free(dns_tsigkey_t *key) { ring = key->ring; key->magic = 0; - if (key->key != NULL) { - isc_rwlock_lock(&ring->lock, isc_rwlocktype_write); + if (ring != NULL) { + RWLOCK(&ring->lock, isc_rwlocktype_write); ISC_LIST_UNLINK(ring->keys, key, link); - isc_rwlock_unlock(&ring->lock, isc_rwlocktype_write); + RWUNLOCK(&ring->lock, isc_rwlocktype_write); } dns_name_free(&key->name, key->mctx); dns_name_free(&key->algorithm, key->mctx); @@ -213,28 +228,28 @@ tsigkey_free(dns_tsigkey_t *key) { void dns_tsigkey_detach(dns_tsigkey_t **key) { dns_tsigkey_t *tkey; + isc_boolean_t should_free = ISC_FALSE; REQUIRE(key != NULL); REQUIRE(VALID_TSIG_KEY(*key)); tkey = *key; *key = NULL; - isc_mutex_lock(&tkey->lock); + LOCK(&tkey->lock); tkey->refs--; - if (tkey->refs > 0 || (!tkey->deleted && tkey->key != NULL)) { - isc_mutex_unlock(&tkey->lock); - return; - } - isc_mutex_unlock(&tkey->lock); - tsigkey_free(tkey); + if (tkey->refs == 0 && (tkey->deleted || tkey->key == NULL)) + should_free = ISC_TRUE; + UNLOCK(&tkey->lock); + if (should_free) + tsigkey_free(tkey); } void dns_tsigkey_setdeleted(dns_tsigkey_t *key) { INSIST(VALID_TSIG_KEY(key)); - isc_mutex_lock(&key->lock); + LOCK(&key->lock); key->deleted = ISC_TRUE; - isc_mutex_unlock(&key->lock); + UNLOCK(&key->lock); } isc_result_t @@ -637,7 +652,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg, ret = dns_tsigkey_create(keyname, &tsig.algorithm, NULL, 0, ISC_FALSE, NULL, now, now, - mctx, dring, &msg->tsigkey); + mctx, NULL, &msg->tsigkey); if (ret != ISC_R_SUCCESS) return (ret); return (DNS_R_TSIGVERIFYFAILURE); @@ -1021,7 +1036,7 @@ dns_tsigkey_find(dns_tsigkey_t **tsigkey, dns_name_t *name, REQUIRE(ring != NULL); isc_stdtime_get(&now); - isc_rwlock_lock(&ring->lock, isc_rwlocktype_read); + RWLOCK(&ring->lock, isc_rwlocktype_read); key = ISC_LIST_HEAD(ring->keys); while (key != NULL) { if (dns_name_equal(&key->name, name) && @@ -1038,32 +1053,20 @@ dns_tsigkey_find(dns_tsigkey_t **tsigkey, dns_name_t *name, key->deleted = ISC_TRUE; continue; } - isc_mutex_lock(&key->lock); + LOCK(&key->lock); key->refs++; - isc_mutex_unlock(&key->lock); + UNLOCK(&key->lock); *tsigkey = key; - isc_rwlock_unlock(&ring->lock, isc_rwlocktype_read); + RWUNLOCK(&ring->lock, isc_rwlocktype_read); return (ISC_R_SUCCESS); } key = ISC_LIST_NEXT(key, link); } - isc_rwlock_unlock(&ring->lock, isc_rwlocktype_read); + RWUNLOCK(&ring->lock, isc_rwlocktype_read); *tsigkey = NULL; return (ISC_R_NOTFOUND); } -static void -dns_tsig_inithmac(void) { - isc_constregion_t r; - const char *str = "\010HMAC-MD5\007SIG-ALG\003REG\003INT"; - - dns_name_init(&hmacmd5_name, NULL); - r.base = str; - r.length = strlen(str) + 1; - dns_name_fromregion(&hmacmd5_name, (isc_region_t *)&r); - dns_tsig_hmacmd5_name = &hmacmd5_name; -} - isc_result_t dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsig_keyring_t **ring) { isc_result_t ret; @@ -1072,7 +1075,6 @@ dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsig_keyring_t **ring) { REQUIRE(ring != NULL); REQUIRE(*ring == NULL); - RUNTIME_CHECK(isc_once_do(&once, dns_tsig_inithmac) == ISC_R_SUCCESS); *ring = isc_mem_get(mctx, sizeof(dns_tsig_keyring_t)); if (ring == NULL) return (ISC_R_NOMEMORY); From 2b8f0e9facc476b2a0d1d372da295dd26decd4ba Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 18 Jul 2000 00:47:00 +0000 Subject: [PATCH 110/226] Don't allocate and use a tsig keyring, since it's no longer needed. --- bin/nsupdate/nsupdate.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c index 9656331bb0..8f5249346c 100644 --- a/bin/nsupdate/nsupdate.c +++ b/bin/nsupdate/nsupdate.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: nsupdate.c,v 1.30 2000/07/17 17:42:54 bwelling Exp $ */ +/* $Id: nsupdate.c,v 1.31 2000/07/18 00:47:00 bwelling Exp $ */ #include @@ -95,7 +95,6 @@ static dns_name_t *origin; /* Points to one of above, or dns_rootname */ static dns_fixedname_t fuserzone; static dns_name_t *userzone = NULL; static dns_tsigkey_t *key = NULL; -static dns_tsig_keyring_t *keyring = NULL; static lwres_context_t *lwctx = NULL; static lwres_conf_t *lwconf; static isc_sockaddr_t *servers; @@ -242,9 +241,6 @@ setup_key() { dns_fixedname_t fkeyname; dns_name_t *keyname; - result = dns_tsigkeyring_create(mctx, &keyring); - check_result(result, "dns_tsigkeyringcreate"); - if (keystr != NULL) { isc_buffer_t keynamesrc; char *secretstr; @@ -310,7 +306,7 @@ setup_key() { debug("keycreate"); result = dns_tsigkey_create(keyname, dns_tsig_hmacmd5_name, secret, secretlen, ISC_TRUE, NULL, 0, 0, - mctx, keyring, &key); + mctx, NULL, &key); if (result != ISC_R_SUCCESS) { char *str; if (keystr != NULL) @@ -327,7 +323,6 @@ setup_key() { if (secret != NULL) isc_mem_free(mctx, secret); - dns_tsigkeyring_destroy(&keyring); } static void @@ -1325,11 +1320,6 @@ cleanup(void) { dns_tsigkey_detach(&key); } - if (keyring != NULL) { - debug("Freeing keyring %lx", keyring); - dns_tsigkeyring_destroy(&keyring); - } - if (updatemsg != NULL) dns_message_destroy(&updatemsg); From 9df7d74e421cf715c6e3cbbad2aba6d33a5d1c9b Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 18 Jul 2000 01:14:17 +0000 Subject: [PATCH 111/226] Use isc_base64_decodestring() instead of an explicit lexer. --- bin/named/tsigconf.c | 22 ++++------------------ lib/dns/tsigconf.c | 22 ++++------------------ 2 files changed, 8 insertions(+), 36 deletions(-) diff --git a/bin/named/tsigconf.c b/bin/named/tsigconf.c index 4861d8dd3d..d21410edfd 100644 --- a/bin/named/tsigconf.c +++ b/bin/named/tsigconf.c @@ -15,13 +15,12 @@ * SOFTWARE. */ -/* $Id: tsigconf.c,v 1.8 2000/07/18 00:44:52 bwelling Exp $ */ +/* $Id: tsigconf.c,v 1.9 2000/07/18 01:14:17 bwelling Exp $ */ #include #include #include -#include #include #include @@ -32,7 +31,6 @@ static isc_result_t add_initial_keys(dns_c_kdeflist_t *list, dns_tsig_keyring_t *ring, isc_mem_t *mctx) { - isc_lex_t *lex = NULL; dns_c_kdef_t *key; unsigned char *secret = NULL; int secretalloc = 0; @@ -46,7 +44,7 @@ add_initial_keys(dns_c_kdeflist_t *list, dns_tsig_keyring_t *ring, dns_name_t *alg, tempalg; char keynamedata[1024], algdata[1024]; isc_buffer_t keynamesrc, keynamebuf, algsrc, algbuf; - isc_buffer_t secretsrc, secretbuf; + isc_buffer_t secretbuf; dns_name_init(&keyname, NULL); @@ -90,21 +88,11 @@ add_initial_keys(dns_c_kdeflist_t *list, dns_tsig_keyring_t *ring, ret = ISC_R_NOMEMORY; goto failure; } - isc_buffer_init(&secretsrc, key->secret, strlen(key->secret)); - isc_buffer_add(&secretsrc, strlen(key->secret)); isc_buffer_init(&secretbuf, secret, secretlen); - ret = isc_lex_create(mctx, strlen(key->secret), &lex); - if (ret != ISC_R_SUCCESS) - goto failure; - ret = isc_lex_openbuffer(lex, &secretsrc); - if (ret != ISC_R_SUCCESS) - goto failure; - ret = isc_base64_tobuffer(lex, &secretbuf, -1); + ret = isc_base64_decodestring(mctx, key->secret, &secretbuf); if (ret != ISC_R_SUCCESS) goto failure; secretlen = isc_buffer_usedlength(&secretbuf); - isc_lex_close(lex); - isc_lex_destroy(&lex); isc_stdtime_get(&now); ret = dns_tsigkey_create(&keyname, alg, secret, secretlen, @@ -119,10 +107,8 @@ add_initial_keys(dns_c_kdeflist_t *list, dns_tsig_keyring_t *ring, return (ISC_R_SUCCESS); failure: - if (lex != NULL) - isc_lex_destroy(&lex); if (secret != NULL) - isc_mem_put(mctx, secret, secretlen); + isc_mem_put(mctx, secret, secretalloc); return (ret); } diff --git a/lib/dns/tsigconf.c b/lib/dns/tsigconf.c index 4861d8dd3d..d21410edfd 100644 --- a/lib/dns/tsigconf.c +++ b/lib/dns/tsigconf.c @@ -15,13 +15,12 @@ * SOFTWARE. */ -/* $Id: tsigconf.c,v 1.8 2000/07/18 00:44:52 bwelling Exp $ */ +/* $Id: tsigconf.c,v 1.9 2000/07/18 01:14:17 bwelling Exp $ */ #include #include #include -#include #include #include @@ -32,7 +31,6 @@ static isc_result_t add_initial_keys(dns_c_kdeflist_t *list, dns_tsig_keyring_t *ring, isc_mem_t *mctx) { - isc_lex_t *lex = NULL; dns_c_kdef_t *key; unsigned char *secret = NULL; int secretalloc = 0; @@ -46,7 +44,7 @@ add_initial_keys(dns_c_kdeflist_t *list, dns_tsig_keyring_t *ring, dns_name_t *alg, tempalg; char keynamedata[1024], algdata[1024]; isc_buffer_t keynamesrc, keynamebuf, algsrc, algbuf; - isc_buffer_t secretsrc, secretbuf; + isc_buffer_t secretbuf; dns_name_init(&keyname, NULL); @@ -90,21 +88,11 @@ add_initial_keys(dns_c_kdeflist_t *list, dns_tsig_keyring_t *ring, ret = ISC_R_NOMEMORY; goto failure; } - isc_buffer_init(&secretsrc, key->secret, strlen(key->secret)); - isc_buffer_add(&secretsrc, strlen(key->secret)); isc_buffer_init(&secretbuf, secret, secretlen); - ret = isc_lex_create(mctx, strlen(key->secret), &lex); - if (ret != ISC_R_SUCCESS) - goto failure; - ret = isc_lex_openbuffer(lex, &secretsrc); - if (ret != ISC_R_SUCCESS) - goto failure; - ret = isc_base64_tobuffer(lex, &secretbuf, -1); + ret = isc_base64_decodestring(mctx, key->secret, &secretbuf); if (ret != ISC_R_SUCCESS) goto failure; secretlen = isc_buffer_usedlength(&secretbuf); - isc_lex_close(lex); - isc_lex_destroy(&lex); isc_stdtime_get(&now); ret = dns_tsigkey_create(&keyname, alg, secret, secretlen, @@ -119,10 +107,8 @@ add_initial_keys(dns_c_kdeflist_t *list, dns_tsig_keyring_t *ring, return (ISC_R_SUCCESS); failure: - if (lex != NULL) - isc_lex_destroy(&lex); if (secret != NULL) - isc_mem_put(mctx, secret, secretlen); + isc_mem_put(mctx, secret, secretalloc); return (ret); } From aa6054ec74819f754bcf19442ca9b39d948171ad Mon Sep 17 00:00:00 2001 From: Michael Sawyer Date: Tue, 18 Jul 2000 01:28:20 +0000 Subject: [PATCH 112/226] Clean up type and class code. (No more ugly istype() and isclass() functions) Minor changes to timeout handling code. Don't preload batch file. --- bin/dig/dig.c | 147 ++++++++++++++++++------ bin/dig/dighost.c | 236 +++++++++++++------------------------- bin/dig/host.c | 74 ++++++------ bin/dig/include/dig/dig.h | 23 +--- bin/dig/nslookup.c | 91 +++++++++------ 5 files changed, 293 insertions(+), 278 deletions(-) diff --git a/bin/dig/dig.c b/bin/dig/dig.c index 1557272a42..05eaa7b14c 100644 --- a/bin/dig/dig.c +++ b/bin/dig/dig.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.c,v 1.68 2000/07/14 21:33:02 mws Exp $ */ +/* $Id: dig.c,v 1.69 2000/07/18 01:28:15 mws Exp $ */ #include #include @@ -30,6 +30,7 @@ #include #include #include +#include #include @@ -67,9 +68,13 @@ extern isc_boolean_t validated; extern isc_taskmgr_t *taskmgr; extern isc_task_t *global_task; extern isc_boolean_t free_now; +dig_lookup_t *default_lookup = NULL; extern isc_boolean_t debugging; extern isc_boolean_t isc_mem_debugging; +char *batchname = NULL; +FILE *batchfp = NULL; +char *argv0; isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE; @@ -168,12 +173,6 @@ show_usage(void) { , stderr); } -void -dighost_shutdown(void) { - free_lists(); - isc_app_shutdown(); -} - void received(int bytes, int frmsize, char *frm, dig_query_t *query) { isc_uint64_t diff; @@ -540,13 +539,14 @@ reorder_args(int argc, char *argv[]) { static void parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { isc_boolean_t have_host = ISC_FALSE; + isc_result_t result; + isc_textregion_t tr; dig_server_t *srv = NULL, *s, *s2; dig_lookup_t *lookup = NULL; - static dig_lookup_t *default_lookup = NULL; - char *batchname = NULL; + dns_rdatatype_t rdtype; + dns_rdataclass_t rdclass; char batchline[MXNAME]; char address[MXNAME]; - FILE *fp = NULL; int bargc; char *bargv[16]; int i, n; @@ -665,7 +665,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { lookup->section_additional = ISC_FALSE; lookup->section_authority = ISC_FALSE; lookup->section_question = ISC_FALSE; - strcpy(lookup->rttext, "soa"); + lookup->rdtype = dns_rdatatype_soa; short_form = ISC_TRUE; } else if (strncmp(rv[0], "+nons", 6) == 0) { lookup->ns_search_only = ISC_FALSE; @@ -754,24 +754,47 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { lookup->comments = ISC_FALSE; } else if (strncmp(rv[0], "-c", 2) == 0) { if (rv[0][2] != 0) { - strncpy(lookup->rctext, &rv[0][2], - MXRD); + ptr = &rv[0][2]; } else { - strncpy(lookup->rctext, rv[1], - MXRD); + ptr = rv[1]; rv++; rc--; } + tr.base = ptr; + tr.length = strlen(ptr); + result = dns_rdataclass_fromtext(&rdclass, + (isc_textregion_t *)&tr); + if (result == ISC_R_SUCCESS) + lookup->rdclass = rdclass; + else + fprintf (stderr, ";; Warning, ignoring " + "invalid class %s\n", + ptr); } else if (strncmp(rv[0], "-t", 2) == 0) { if (rv[0][2] != 0) { - strncpy(lookup->rttext, &rv[0][2], - MXRD); + ptr = &rv[0][2]; } else { - strncpy(lookup->rttext, rv[1], - MXRD); + ptr = rv[1]; rv++; rc--; } + tr.base = ptr; + tr.length = strlen(ptr); + if (strncmp(rv[0], "ixfr=", 5) == 0) { + lookup->rdtype = dns_rdatatype_ixfr; + lookup->ixfr_serial = + atoi(&rv[0][5]); + } else { + result = dns_rdatatype_fromtext(&rdtype, + (isc_textregion_t *)&tr); + if ((result == ISC_R_SUCCESS) && + (rdtype != dns_rdatatype_ixfr)) + lookup->rdtype = rdtype; + else + fprintf (stderr, ";; Warning, " + "ignoring invalid type %s\n", + ptr); + } } else if (strncmp(rv[0], "-f", 2) == 0) { if (rv[0][2] != 0) { batchname = &rv[0][2]; @@ -853,8 +876,8 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { debug("looking up %s", lookup->textname); lookup->trace_root = ISC_TF(lookup->trace || lookup->ns_search_only); - strcpy(lookup->rttext, "ptr"); - strcpy(lookup->rctext, "in"); + lookup->rdtype = dns_rdatatype_ptr; + lookup->rdclass = dns_rdataclass_in; lookup->new_search = ISC_TRUE; ISC_LIST_APPEND(lookup_list, lookup, link); @@ -862,18 +885,25 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { rv++; rc--; } else { + tr.base = rv[0]; + tr.length = strlen(rv[0]); if (strncmp(rv[0], "ixfr=", 5) == 0) { - strcpy(lookup->rttext, "ixfr"); + lookup->rdtype = dns_rdatatype_ixfr; lookup->ixfr_serial = atoi(&rv[0][5]); continue; } - if (istype(rv[0])) { - strncpy(lookup->rttext, rv[0], MXRD); + result = dns_rdatatype_fromtext(&rdtype, + (isc_textregion_t *)&tr); + if ((result == ISC_R_SUCCESS) && + (rdtype != dns_rdatatype_ixfr)) { + lookup->rdtype = rdtype; continue; - } else if (isclass(rv[0])) { - strncpy(lookup->rctext, rv[0], - MXRD); + } + result = dns_rdataclass_fromtext(&rdclass, + (isc_textregion_t *)&tr); + if (result == ISC_R_SUCCESS) { + lookup->rdclass = rdclass; continue; } lookup=clone_lookup(default_lookup, ISC_TRUE); @@ -886,15 +916,20 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { debug("looking up %s", lookup->textname); } } - if (batchname != NULL) { - fp = fopen(batchname, "r"); - if (fp == NULL) { + /* + * If we have a batchfile, seed the lookup list with the + * first entry, then trust the callback in dighost_shutdown + * to get the rest + */ + if ((batchname != NULL) && !(is_batchfile)) { + batchfp = fopen(batchname, "r"); + if (batchfp == NULL) { perror(batchname); if (exitcode < 10) exitcode = 10; fatal("Couldn't open specified batch file"); } - while (fgets(batchline, sizeof(batchline), fp) != 0) { + if (fgets(batchline, sizeof(batchline), batchfp) != 0) { debug("batch line %s", batchline); bargc = 1; bargv[bargc] = strtok(batchline, " \t\r\n"); @@ -904,6 +939,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { } bargv[0] = argv[0]; + argv0 = argv[0]; reorder_args(bargc, (char **)bargv); parse_args(ISC_TRUE, bargc, (char **)bargv); @@ -915,7 +951,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { lookup->ns_search_only); lookup->new_search = ISC_TRUE; strcpy(lookup->textname, "."); - strcpy(lookup->rttext, "NS"); + lookup->rdtype = dns_rdatatype_ns; ISC_LIST_APPEND(lookup_list, lookup, link); } if (!is_batchfile) { @@ -930,7 +966,47 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { (dig_server_t *)s2, link); isc_mem_free(mctx, s2); } - isc_mem_free(mctx, default_lookup); + } +} + +void +dighost_shutdown(void) { + char batchline[MXNAME]; + int bargc; + char *bargv[16]; + + + if (batchname == NULL) { + isc_app_shutdown(); + return; + } + + if (feof(batchfp)) { + batchname = NULL; + isc_app_shutdown(); + fclose(batchfp); + return; + } + + if (fgets(batchline, sizeof(batchline), batchfp) != 0) { + debug("batch line %s", batchline); + bargc = 1; + bargv[bargc] = strtok(batchline, " \t\r\n"); + while ((bargv[bargc] != NULL) && (bargc < 14 )) { + bargc++; + bargv[bargc] = strtok(NULL, " \t\r\n"); + } + + bargv[0] = argv0; + + reorder_args(bargc, (char **)bargv); + parse_args(ISC_TRUE, bargc, (char **)bargv); + start_lookup(); + } else { + batchname = NULL; + fclose(batchfp); + isc_app_shutdown(); + return; } } @@ -950,6 +1026,11 @@ main(int argc, char **argv) { result = isc_app_onrun(mctx, global_task, onrun_callback, NULL); check_result(result, "isc_app_onrun"); isc_app_run(); + isc_mem_free(mctx, default_lookup); + if (batchname != NULL) { + fclose(batchfp); + batchname = NULL; + } cancel_all(); destroy_libs(); isc_app_finish(); diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index ac1ae6de3b..700608c35b 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dighost.c,v 1.89 2000/07/14 21:33:03 mws Exp $ */ +/* $Id: dighost.c,v 1.90 2000/07/18 01:28:16 mws Exp $ */ /* * Notice to programmers: Do not use this code as an example of how to @@ -92,7 +92,7 @@ int sendcount = 0; int recvcount = 0; int sockcount = 0; int ndots = -1; -int tries = 3; +int tries = 2; int lookup_counter = 0; char fixeddomain[MXNAME] = ""; int exitcode = 9; @@ -202,51 +202,6 @@ check_result(isc_result_t result, const char *msg) { } } -isc_boolean_t -isclass(char *text) { - /* - * Tests if a field is a class, without needing isc libs - * initialized. This list will have to be manually kept in - * sync with what the libs support. - */ - const char *classlist[] = { "in", "hs", "chaos" }; - const int numclasses = 3; - int i; - - for (i = 0; i < numclasses; i++) - if (strcasecmp(text, classlist[i]) == 0) - return (ISC_TRUE); - - return (ISC_FALSE); -} - -isc_boolean_t -istype(char *text) { - /* - * Tests if a field is a type, without needing isc libs - * initialized. This list will have to be manually kept in - * sync with what the libs support. - */ - const char *typelist[] = {"a", "ns", "md", "mf", "cname", - "soa", "mb", "mg", "mr", "null", - "wks", "ptr", "hinfo", "minfo", - "mx", "txt", "rp", "afsdb", - "x25", "isdn", "rt", "nsap", - "nsap_ptr", "sig", "key", "px", - "gpos", "aaaa", "loc", "nxt", - "srv", "naptr", "kx", "cert", - "a6", "dname", "opt", "unspec", - "tkey", "tsig", "axfr", "any"}; - const int numtypes = 42; - int i; - - for (i = 0; i < numtypes; i++) { - if (strcasecmp(text, typelist[i]) == 0) - return (ISC_TRUE); - } - return (ISC_FALSE); -} - dig_server_t * make_server(const char *servname) { dig_server_t *srv; @@ -291,8 +246,8 @@ make_empty_lookup(void) { __FILE__, __LINE__); looknew->pending = ISC_TRUE; looknew->textname[0]=0; - looknew->rttext[0]=0; - looknew->rctext[0]=0; + looknew->rdtype=dns_rdatatype_a; + looknew->rdclass=dns_rdataclass_in; looknew->sendspace = NULL; looknew->sendmsg = NULL; looknew->name = NULL; @@ -343,8 +298,8 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) { looknew = make_empty_lookup(); INSIST(looknew != NULL); strncpy(looknew->textname, lookold-> textname, MXNAME); - strncpy(looknew->rttext, lookold-> rttext, 32); - strncpy(looknew->rctext, lookold-> rctext, 32); + looknew->rdtype = lookold->rdtype; + looknew->rdclass = lookold->rdclass; looknew->doing_xfr = lookold->doing_xfr; looknew->ixfr_serial = lookold->ixfr_serial; looknew->defname = lookold->defname; @@ -1055,12 +1010,9 @@ void setup_lookup(dig_lookup_t *lookup) { isc_result_t result, res2; int len; - dns_rdatatype_t rdtype; - dns_rdataclass_t rdclass; dig_server_t *serv; dig_query_t *query; isc_region_t r; - isc_constregion_t tr; isc_buffer_t b; char store[MXNAME]; @@ -1167,10 +1119,6 @@ setup_lookup(dig_lookup_t *lookup) { isc_buffer_usedregion(&b, &r); trying((int)r.length, (char *)r.base, lookup); ENSURE(dns_name_isabsolute(lookup->name)); - if (lookup->rctext[0] == 0) - strcpy(lookup->rctext, "IN"); - if (lookup->rttext[0] == 0) - strcpy(lookup->rttext, "A"); lookup->sendmsg->id = (unsigned short)(random() & 0xFFFF); lookup->sendmsg->opcode = dns_opcode_query; @@ -1203,36 +1151,21 @@ setup_lookup(dig_lookup_t *lookup) { DNS_SECTION_QUESTION); if (lookup->trace_root) { - debug("doing trace_root"); - tr.base = "SOA"; - tr.length = 3; - } else { - tr.base = lookup->rttext; - tr.length = strlen(lookup->rttext); + lookup->rdtype = dns_rdatatype_soa; + lookup->rdclass = dns_rdataclass_in; } - debug("data type is %s", lookup->rttext); - result = dns_rdatatype_fromtext(&rdtype, (isc_textregion_t *)&tr); - check_result(result, "dns_rdatatype_fromtext"); - if ((rdtype == dns_rdatatype_axfr) || - (rdtype == dns_rdatatype_ixfr)) { + if ((lookup->rdtype == dns_rdatatype_axfr) || + (lookup->rdtype == dns_rdatatype_ixfr)) { lookup->doing_xfr = ISC_TRUE; /* * Force TCP mode if we're doing an xfr. */ lookup->tcp_mode = ISC_TRUE; } - if (lookup->trace_root) { - tr.base = "IN"; - tr.length = 2; - } else { - tr.base = lookup->rctext; - tr.length = strlen(lookup->rctext); - } - result = dns_rdataclass_fromtext(&rdclass, (isc_textregion_t *)&tr); - check_result(result, "dns_rdataclass_fromtext"); - add_question(lookup->sendmsg, lookup->name, rdclass, rdtype); + add_question(lookup->sendmsg, lookup->name, lookup->rdclass, + lookup->rdtype); - if (rdtype == dns_rdatatype_ixfr) + if (lookup->rdtype == dns_rdatatype_ixfr) insert_soa(lookup); if (key != NULL) { @@ -1283,7 +1216,6 @@ setup_lookup(dig_lookup_t *lookup) { query->second_rr_rcvd = ISC_FALSE; query->second_rr_serial = 0; query->servname = serv->servername; - ISC_LIST_INIT(query->sendlist); ISC_LIST_INIT(query->recvlist); ISC_LIST_INIT(query->lengthlist); query->sock = NULL; @@ -1362,46 +1294,65 @@ recv_done(isc_task_t *task, isc_event_t *event); static void connect_timeout(isc_task_t *task, isc_event_t *event); -void -send_udp(dig_lookup_t *lookup) { +static void +send_udp(dig_lookup_t *lookup, isc_boolean_t make_recv) { dig_query_t *query; isc_result_t result; unsigned int local_timeout; debug("send_udp()"); - if (timeout != INT_MAX) { - if (timeout == 0) { - if (lookup->tcp_mode) - local_timeout = TCP_TIMEOUT; - else + /* + * If the timer already exists, that means we're calling this + * a second time (for a retry). Don't need to recreate it, + * just reset it. + */ + if (lookup->timer == NULL) { + if (timeout != INT_MAX) { + if (timeout == 0) { local_timeout = UDP_TIMEOUT; - } else - local_timeout = timeout; - debug("have local timeout of %d", local_timeout); - isc_interval_set(&lookup->interval, local_timeout, 0); - result = isc_timer_create(timermgr, isc_timertype_once, NULL, - &lookup->interval, global_task, - connect_timeout, lookup, - &lookup->timer); - check_result(result, "isc_timer_create"); + } else + local_timeout = timeout; + debug("have local timeout of %d", local_timeout); + isc_interval_set(&lookup->interval, local_timeout, 0); + result = isc_timer_create(timermgr, + isc_timertype_once, NULL, + &lookup->interval, + global_task, + connect_timeout, lookup, + &lookup->timer); + check_result(result, "isc_timer_create"); + } + + } else { + result = isc_timer_reset(lookup->timer, isc_timertype_once, + NULL, &lookup->interval, + ISC_TRUE); + check_result(result, "isc_timer_reset"); } for (query = ISC_LIST_HEAD(lookup->q); query != NULL; query = ISC_LIST_NEXT(query, link)) { debug("working on lookup %p, query %p", query->lookup, query); - ISC_LIST_ENQUEUE(query->recvlist, &query->recvbuf, link); - query->working = ISC_TRUE; - debug("recving with lookup=%p, query=%p, sock=%p", - query->lookup, query, - query->sock); - result = isc_socket_recvv(query->sock, &query->recvlist, 1, - global_task, recv_done, query); - check_result(result, "isc_socket_recvv"); - recvcount++; - debug("recvcount=%d", recvcount); - ISC_LIST_ENQUEUE(query->sendlist, &lookup->sendbuf, link); + if (make_recv) { + ISC_LIST_ENQUEUE(query->recvlist, &query->recvbuf, + link); + query->working = ISC_TRUE; + debug("recving with lookup=%p, query=%p, sock=%p", + query->lookup, query, + query->sock); + result = isc_socket_recvv(query->sock, + &query->recvlist, 1, + global_task, recv_done, + query); + check_result(result, "isc_socket_recvv"); + recvcount++; + debug("recvcount=%d", recvcount); + } + ISC_LIST_INIT(query->sendlist); + ISC_LIST_ENQUEUE(query->sendlist, &lookup->sendbuf, + link); debug("sending a request"); result = isc_time_now(&query->time_sent); check_result(result, "isc_time_now"); @@ -1420,11 +1371,8 @@ send_udp(dig_lookup_t *lookup) { static void connect_timeout(isc_task_t *task, isc_event_t *event) { dig_lookup_t *lookup=NULL; - dig_query_t *q=NULL; - isc_result_t result; - isc_buffer_t *b=NULL; - isc_region_t r; + UNUSED(task); REQUIRE(event->ev_type == ISC_TIMEREVENT_IDLE); debug("connect_timeout()"); @@ -1433,44 +1381,22 @@ connect_timeout(isc_task_t *task, isc_event_t *event) { lookup = event->ev_arg; isc_event_free(&event); - debug("buffer allocate connect_timeout"); - result = isc_buffer_allocate(mctx, &b, 256); - check_result(result, "isc_buffer_allocate"); - for (q = ISC_LIST_HEAD(lookup->q); - q != NULL; - q = ISC_LIST_NEXT(q, link)) { - if (q->working) { - INSIST(!free_now); - isc_buffer_clear(b); - result = isc_sockaddr_totext(&q->sockaddr, b); - check_result(result, "isc_sockaddr_totext"); - isc_buffer_usedregion(b, &r); - if ((q->lookup->retries > 1) && - (!q->lookup->tcp_mode)) - printf(";; Connection to %.*s(%s) " - "for %s timed out. " - "Retrying %d.\n", - (int)r.length, r.base, - q->servname, - q->lookup->textname, - q->lookup->retries-1); - else { - printf(";; Connection to " - "%.*s(%s) " - "for %s timed out. " - "Giving up.\n", - (int)r.length, r.base, - q->servname, - q->lookup->textname); - } - isc_socket_cancel(q->sock, task, - ISC_SOCKCANCEL_ALL); + INSIST(!free_now); + if (lookup->retries > 1) { + if (!lookup->tcp_mode) { + lookup->retries--; + debug("resending UDP request"); + send_udp(lookup, ISC_FALSE); + } else { + debug("making new TCP request"); + cancel_lookup(lookup); + lookup->retries--; + requeue_lookup(lookup, ISC_TRUE); } } - INSIST(lookup->timer != NULL); - isc_timer_detach(&lookup->timer); - isc_buffer_free(&b); - debug("done with connect_timeout()"); + else { + cancel_lookup(lookup); + } UNLOCK_LOOKUP; } @@ -1581,6 +1507,7 @@ launch_next_query(dig_query_t *query, isc_boolean_t include_question) { isc_buffer_clear(&query->slbuf); isc_buffer_clear(&query->lengthbuf); isc_buffer_putuint16(&query->slbuf, query->lookup->sendbuf.used); + ISC_LIST_INIT(query->sendlist); ISC_LIST_ENQUEUE(query->sendlist, &query->slbuf, link); if (include_question) { ISC_LIST_ENQUEUE(query->sendlist, &query->lookup->sendbuf, @@ -2056,6 +1983,7 @@ recv_done(isc_task_t *task, isc_event_t *event) { dns_message_destroy(&msg); clear_query(query); cancel_lookup(l); + check_next_lookup(l); } if (msg != NULL) dns_message_destroy(&msg); @@ -2163,10 +2091,7 @@ do_lookup_tcp(dig_lookup_t *lookup) { lookup->pending = ISC_TRUE; if (timeout != INT_MAX) { if (timeout == 0) { - if (lookup->tcp_mode) local_timeout = TCP_TIMEOUT; - else - local_timeout = UDP_TIMEOUT; } else local_timeout = timeout; debug("have local timeout of %d", local_timeout); @@ -2242,7 +2167,7 @@ do_lookup_udp(dig_lookup_t *lookup) { check_result(result, "isc_socket_bind"); } - send_udp(lookup); + send_udp(lookup, ISC_TRUE); } void @@ -2392,10 +2317,3 @@ destroy_libs(void) { if (mctx != NULL) isc_mem_destroy(&mctx); } - -/* - * Dummy function, soon to go away - */ -void -free_lists(void) { -} diff --git a/bin/dig/host.c b/bin/dig/host.c index 0364fcfe3e..d43b83e331 100644 --- a/bin/dig/host.c +++ b/bin/dig/host.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: host.c,v 1.41 2000/07/14 17:57:26 mws Exp $ */ +/* $Id: host.c,v 1.42 2000/07/18 01:28:17 mws Exp $ */ #include #include @@ -32,7 +32,9 @@ extern int h_errno; #include #include #include +#include #include +#include #include @@ -58,10 +60,7 @@ extern char *progname; extern isc_task_t *global_task; isc_boolean_t - short_form = ISC_TRUE, - filter = ISC_FALSE, - showallsoa = ISC_FALSE, - tcpmode = ISC_FALSE; +short_form = ISC_TRUE; static const char *opcodetext[] = { "QUERY", @@ -231,7 +230,6 @@ show_usage(void) { void dighost_shutdown(void) { - free_lists(); isc_app_shutdown(); } @@ -538,40 +536,60 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) { static void parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { - isc_boolean_t recursion = ISC_TRUE; char hostname[MXNAME]; - char querytype[32] = ""; - char queryclass[32] = ""; dig_server_t *srv; dig_lookup_t *lookup; int i, c, n, adrs[4]; char store[MXNAME]; + isc_textregion_t tr; + isc_result_t result; + dns_rdatatype_t rdtype; + dns_rdataclass_t rdclass; UNUSED(is_batchfile); + lookup = make_empty_lookup(); + while ((c = isc_commandline_parse(argc, argv, "lvwrdt:c:aTCN:R:W:D")) != EOF) { switch (c) { case 'l': - tcpmode = ISC_TRUE; - filter = ISC_TRUE; - strcpy(querytype, "axfr"); + lookup->tcp_mode = ISC_TRUE; + lookup->rdtype = dns_rdatatype_axfr; break; case 'v': case 'd': short_form = ISC_FALSE; break; case 'r': - recursion = ISC_FALSE; + lookup->recurse = ISC_FALSE; break; case 't': - strncpy (querytype, isc_commandline_argument, 32); + tr.base = isc_commandline_argument; + tr.length = strlen(isc_commandline_argument); + result = dns_rdatatype_fromtext(&rdtype, + (isc_textregion_t *)&tr); + + if (result != ISC_R_SUCCESS) + fprintf (stderr,"Warning: invalid type: %s\n", + isc_commandline_argument); + else + lookup->rdtype = rdtype; break; case 'c': - strncpy (queryclass, isc_commandline_argument, 32); + tr.base = isc_commandline_argument; + tr.length = strlen(isc_commandline_argument); + result = dns_rdataclass_fromtext(&rdclass, + (isc_textregion_t *)&tr); + + if (result != ISC_R_SUCCESS) + fprintf (stderr,"Warning: invalid class: %s\n", + isc_commandline_argument); + else + lookup->rdclass = rdclass; break; case 'a': - strcpy (querytype, "any"); + lookup->rdtype = dns_rdatatype_any; short_form = ISC_FALSE; break; case 'w': @@ -592,15 +610,14 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { tries = 1; break; case 'T': - tcpmode = ISC_TRUE; + lookup->tcp_mode = ISC_TRUE; break; case 'C': debug("showing all SOAs"); - if (querytype[0] == 0) - strcpy(querytype, "soa"); - if (queryclass[0] == 0) - strcpy(queryclass, "in"); - showallsoa = ISC_TRUE; + lookup->rdtype = dns_rdatatype_soa; + lookup->rdclass = dns_rdataclass_in; + lookup->ns_search_only = ISC_TRUE; + lookup->trace_root = ISC_TRUE; show_details = ISC_TRUE; break; case 'N': @@ -623,7 +640,6 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { ISC_LIST_APPEND(server_list, srv, link); } - lookup = make_empty_lookup(); lookup->pending = ISC_FALSE; /* * XXXMWS Add IPv6 translation here, probably using inet_pton @@ -643,20 +659,10 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) { strncat(lookup->textname, store, MXNAME); } strncat(lookup->textname, "in-addr.arpa.", MXNAME); - if (querytype[0] == 0) - strcpy(querytype, "ptr"); + lookup->rdtype = dns_rdatatype_ptr; } else { strncpy(lookup->textname, hostname, MXNAME); } - if (querytype[0] == 0) - strcpy(querytype, "a"); - if (queryclass[0] == 0) - strcpy(queryclass, "in"); - strncpy(lookup->rttext, querytype, 32); - strncpy(lookup->rctext, queryclass, 32); - lookup->ns_search_only = showallsoa; - lookup->trace_root = showallsoa; - lookup->tcp_mode = tcpmode; lookup->new_search = ISC_TRUE; ISC_LIST_APPEND(lookup_list, lookup, link); } diff --git a/bin/dig/include/dig/dig.h b/bin/dig/include/dig/dig.h index d3d37c0598..5c5bb40618 100644 --- a/bin/dig/include/dig/dig.h +++ b/bin/dig/include/dig/dig.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: dig.h,v 1.35 2000/07/14 17:57:27 mws Exp $ */ +/* $Id: dig.h,v 1.36 2000/07/18 01:28:20 mws Exp $ */ #ifndef DIG_H #define DIG_H @@ -43,8 +43,8 @@ /* * Default timeout values */ -#define TCP_TIMEOUT 60 -#define UDP_TIMEOUT 30 +#define TCP_TIMEOUT 10 +#define UDP_TIMEOUT 5 #define LOOKUP_LIMIT 64 /* @@ -92,8 +92,8 @@ struct dig_lookup { section_additional, new_search; char textname[MXNAME]; /* Name we're going to be looking up */ - char rttext[MXRD]; /* rdata type text */ - char rctext[MXRD]; /* rdata class text */ + dns_rdatatype_t rdtype; + dns_rdataclass_t rdclass; char namespace[BUFSIZE]; char onamespace[BUFSIZE]; isc_buffer_t namebuf; @@ -131,7 +131,6 @@ struct dig_query { first_repeat_rcvd; isc_uint32_t first_rr_serial; isc_uint32_t second_rr_serial; - int retries; char *servname; isc_bufferlist_t sendlist, recvlist, @@ -173,12 +172,6 @@ debug(const char *format, ...); void check_result(isc_result_t result, const char *msg); -isc_boolean_t -isclass(char *text); - -isc_boolean_t -istype(char *text); - void setup_lookup(dig_lookup_t *lookup); @@ -191,9 +184,6 @@ start_lookup(void); void onrun_callback(isc_task_t *task, isc_event_t *event); -void -send_udp(dig_lookup_t *lookup); - int dhmain(int argc, char **argv); @@ -203,9 +193,6 @@ setup_libs(void); void setup_system(void); -void -free_lists(void); - dig_lookup_t * requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers); diff --git a/bin/dig/nslookup.c b/bin/dig/nslookup.c index 003af850b1..0ed73cbb42 100644 --- a/bin/dig/nslookup.c +++ b/bin/dig/nslookup.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: nslookup.c,v 1.25 2000/07/14 16:35:29 mws Exp $ */ +/* $Id: nslookup.c,v 1.26 2000/07/18 01:28:19 mws Exp $ */ #include @@ -23,11 +23,6 @@ extern int h_errno; -#include -#include -#include -#include -#include #include #include #include @@ -38,6 +33,13 @@ extern int h_errno; #include #include +#include +#include +#include +#include +#include +#include + #include extern ISC_LIST(dig_lookup_t) lookup_list; @@ -533,7 +535,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) { printsection(query, msg, headers, DNS_SECTION_ANSWER); if (((msg->flags & DNS_MESSAGEFLAG_AA) == 0) && - (strcasecmp(query->lookup->rttext,"a") != 0)) { + (query->lookup->rdtype != dns_rdatatype_a)) { puts ("\nAuthorative answers can be found from:"); printsection(query, msg, headers, DNS_SECTION_AUTHORITY); @@ -570,19 +572,44 @@ show_settings(isc_boolean_t full) { printf ("\t %s\t\t\t%s\t\t%s\n", tcpmode?"vc":"novc", short_form?"nodebug":"debug", debugging?"d2":"nod2"); - printf ("\t %s\t\t%s\t\t%s\n", + printf ("\t %s\t\t%s\t%s\n", defname?"defname":"nodefname", - usesearch?"search":"nosearch", + usesearch?"search ":"nosearch", recurse?"recurse":"norecurse"); printf ("\t timeout = %d\t\tretry = %d\tport = %d\n", timeout, tries, port); - printf ("\t querytype = %-8s\tclass=%s\n",deftype, defclass); + printf ("\t querytype = %-8s\tclass = %s\n",deftype, defclass); #if 0 printf ("\t domain = %s\n", fixeddomain); #endif } +static isc_boolean_t +testtype(char *typetext) { + isc_result_t result; + isc_textregion_t tr; + dns_rdatatype_t rdtype; + + tr.base = typetext; + tr.length = strlen(typetext); + result = dns_rdatatype_fromtext(&rdtype, &tr); + return (result == ISC_R_SUCCESS); +} + +static isc_boolean_t +testclass(char *typetext) { + isc_result_t result; + isc_textregion_t tr; + dns_rdataclass_t rdclass; + + tr.base = typetext; + tr.length = strlen(typetext); + result = dns_rdataclass_fromtext(&rdclass, &tr); + return (result == ISC_R_SUCCESS); +} + + static void setoption(char *opt) { @@ -593,9 +620,11 @@ setoption(char *opt) { } else if (strncasecmp(opt, "cl=", 3) == 0) { strncpy(defclass, &opt[3], MXRD); } else if (strncasecmp(opt, "type=", 5) == 0) { - strncpy(deftype, &opt[5], MXRD); + if (testtype(&opt[5])) + strncpy(deftype, &opt[5], MXRD); } else if (strncasecmp(opt, "ty=", 3) == 0) { - strncpy(deftype, &opt[3], MXRD); + if (testclass(&opt[3])) + strncpy(defclass, &opt[3], MXRD); } else if (strncasecmp(opt, "querytype=", 10) == 0) { strncpy(deftype, &opt[10], MXRD); } else if (strncasecmp(opt, "query=", 6) == 0) { @@ -641,38 +670,32 @@ setoption(char *opt) { static void addlookup(char *opt) { dig_lookup_t *lookup; + isc_result_t result; + isc_textregion_t tr; + dns_rdatatype_t rdtype; + dns_rdataclass_t rdclass; debug ("addlookup()"); - lookup = isc_mem_allocate(mctx, sizeof(struct dig_lookup)); - if (lookup == NULL) - fatal("Memory allocation failure."); - lookup->pending = ISC_FALSE; + tr.base = deftype; + tr.length = strlen(deftype); + result = dns_rdatatype_fromtext(&rdtype, &tr); + INSIST(result == ISC_R_SUCCESS); + tr.base = defclass; + tr.length = strlen(defclass); + result = dns_rdataclass_fromtext(&rdclass, &tr); + INSIST(result == ISC_R_SUCCESS); + lookup = make_empty_lookup(); strncpy(lookup->textname, opt, MXNAME-1); - strncpy (lookup->rttext, deftype, MXNAME); - strncpy (lookup->rctext, defclass, MXNAME); - lookup->namespace[0]=0; - lookup->sendspace = NULL; - lookup->sendmsg=NULL; - lookup->name=NULL; - lookup->oname=NULL; - lookup->timer = NULL; - lookup->xfr_q = NULL; - lookup->origin = NULL; - lookup->querysig = NULL; - lookup->doing_xfr = ISC_FALSE; - lookup->ixfr_serial = 0; - lookup->defname = ISC_FALSE; + lookup->rdtype = rdtype; + lookup->rdclass = rdclass; lookup->trace = ISC_TF(trace || ns_search_only); lookup->trace_root = trace; lookup->ns_search_only = ns_search_only; lookup->identify = identify; lookup->recurse = recurse; lookup->aaonly = aaonly; - lookup->adflag = ISC_FALSE; - lookup->cdflag = ISC_FALSE; lookup->retries = tries; lookup->udpsize = bufsize; - lookup->nsfound = 0; lookup->comments = comments; lookup->tcp_mode = tcpmode; lookup->stats = stats; @@ -877,7 +900,7 @@ main(int argc, char **argv) { puts (""); debug ("done, and starting to shut down"); - free_lists(); + destroy_libs(); isc_mutex_destroy(&lock); isc_condition_destroy(&cond); if (taskmgr != NULL) { From 4ca8537286abaafff44ee9ec8489e8b2656093ec Mon Sep 17 00:00:00 2001 From: James Brister Date: Tue, 18 Jul 2000 13:19:27 +0000 Subject: [PATCH 113/226] Removed some debugging cruft. Fixed handling of octal/hexadecimal numbers on input. --- lib/dns/config/confndc.c | 40 ++----------------------------- lib/dns/config/confparser.y | 48 ++----------------------------------- 2 files changed, 4 insertions(+), 84 deletions(-) diff --git a/lib/dns/config/confndc.c b/lib/dns/config/confndc.c index a73c720391..2be79c991d 100644 --- a/lib/dns/config/confndc.c +++ b/lib/dns/config/confndc.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: confndc.c,v 1.21 2000/07/11 20:13:09 brister Exp $ */ +/* $Id: confndc.c,v 1.22 2000/07/18 13:19:26 brister Exp $ */ /* ** options { @@ -1381,7 +1381,7 @@ parser_setup(ndcpcontext *pctx, isc_mem_t *mem, const char *filename) { pctx->thecontext = NULL; pctx->errors = 0; pctx->warnings = 0; - pctx->debug_lexer = ISC_TF(getenv("DEBUG_LEXER") != NULL); + pctx->debug_lexer = ISC_FALSE; pctx->prevtok = pctx->currtok = 0; @@ -1610,9 +1610,6 @@ getnexttoken(ndcpcontext *pctx) { case ISC_R_SUCCESS: switch (token.type) { case isc_tokentype_unknown: - if (pctx->debug_lexer) - fprintf(stderr, "unknown token\n"); - result = ISC_R_FAILURE; break; @@ -1629,12 +1626,6 @@ getnexttoken(ndcpcontext *pctx) { tokstr[CONF_MAX_IDENT - 1] = '\0'; } - if (pctx->debug_lexer) - fprintf(stderr, "lexer token: %s : %s\n", - (token.type == isc_tokentype_special ? - "special" : "string"), - tokstr); - result = isc_symtab_lookup(pctx->thekeywords, tokstr, KEYWORD_SYM_TYPE, &keywordtok); @@ -1659,11 +1650,6 @@ getnexttoken(ndcpcontext *pctx) { pctx->currtok = L_INTEGER; sprintf(pctx->tokstr, "%lu", (unsigned long)pctx->intval); - - if(pctx->debug_lexer) - fprintf(stderr, "lexer token: number : %lu\n", - (unsigned long)pctx->intval); - break; case isc_tokentype_qstring: @@ -1672,12 +1658,6 @@ getnexttoken(ndcpcontext *pctx) { CONF_MAX_IDENT); pctx->tokstr[CONF_MAX_IDENT - 1] = '\0'; pctx->currtok = L_QSTRING; - - if (pctx->debug_lexer) - fprintf(stderr, - "lexer token: qstring : \"%s\"\n", - pctx->tokstr); - break; case isc_tokentype_eof: @@ -1690,39 +1670,23 @@ getnexttoken(ndcpcontext *pctx) { * The only way to tell that we closed the * main file and not an included file. */ - if (pctx->debug_lexer) - fprintf(stderr, "lexer token: EOF\n"); - pctx->currtok = L_END_INPUT; } else { - if (pctx->debug_lexer) - fprintf(stderr, - "lexer token: EOF (main)\n"); - pctx->currtok = L_END_INCLUDE; } result = ISC_R_SUCCESS; break; case isc_tokentype_initialws: - if (pctx->debug_lexer) - fprintf(stderr, "lexer token: initial ws\n"); - result = ISC_R_FAILURE; break; case isc_tokentype_eol: - if (pctx->debug_lexer) - fprintf(stderr, "lexer token: eol\n"); - result = ISC_R_FAILURE; break; case isc_tokentype_nomore: - if (pctx->debug_lexer) - fprintf(stderr, "lexer token: nomore\n"); - result = ISC_R_FAILURE; break; } diff --git a/lib/dns/config/confparser.y b/lib/dns/config/confparser.y index 06d503566b..9411eed4d8 100644 --- a/lib/dns/config/confparser.y +++ b/lib/dns/config/confparser.y @@ -16,7 +16,7 @@ * SOFTWARE. */ -/* $Id: confparser.y,v 1.101 2000/07/07 23:11:45 brister Exp $ */ +/* $Id: confparser.y,v 1.102 2000/07/18 13:19:27 brister Exp $ */ #include @@ -122,7 +122,6 @@ static isc_lexspecials_t specials; static isc_result_t tmpres; -static int debug_lexer; static in_port_t default_port; int yyparse(void); @@ -5351,12 +5350,6 @@ dns_c_parse_namedconf(const char *filename, isc_mem_t *mem, INSIST(keywords == NULL); INSIST(callbacks == NULL); -#if 1 - if (getenv("DEBUG_LEXER") != NULL) { /* XXX debug */ - debug_lexer++; - } -#endif - specials['{'] = 1; specials['}'] = 1; specials[';'] = 1; @@ -5515,6 +5508,7 @@ yylex(void) isc_result_t res; int options = (ISC_LEXOPT_EOF | ISC_LEXOPT_NUMBER | + ISC_LEXOPT_CNUMBER | ISC_LEXOPT_QSTRING | ISC_LEXOPT_NOMORE); @@ -5764,10 +5758,6 @@ token_value(isc_token_t *token, isc_symtab_t *symtable) switch (token->type) { case isc_tokentype_unknown: - if (debug_lexer) { - fprintf(stderr, "unknown lexer token\n"); - } - res = -1; break; @@ -5789,24 +5779,11 @@ token_value(isc_token_t *token, isc_symtab_t *symtable) } else { res = keywordtok.as_integer; } - - if (debug_lexer) { - fprintf(stderr, "lexer token: %s : %s (%d)\n", - (token->type == isc_tokentype_special ? - "special" : "string"), tokstring, res); - } - break; case isc_tokentype_number: yylval.ul_int = (isc_uint32_t)token->value.as_ulong; res = L_INTEGER; - - if(debug_lexer) { - fprintf(stderr, "lexer token: number : %lu\n", - (unsigned long)yylval.ul_int); - } - break; case isc_tokentype_qstring: @@ -5817,12 +5794,6 @@ token_value(isc_token_t *token, isc_symtab_t *symtable) } else { res = L_QSTRING; } - - if (debug_lexer) { - fprintf(stderr, "lexer token: qstring : \"%s\"\n", - yylval.text); - } - break; case isc_tokentype_eof: @@ -5833,36 +5804,21 @@ token_value(isc_token_t *token, isc_symtab_t *symtable) /* the only way to tell that we * closed the main file and not an included file */ - if (debug_lexer) { - fprintf(stderr, "lexer token: EOF\n"); - } res = 0; } else { - if (debug_lexer) { - fprintf(stderr, "lexer token: EOF (main)\n"); - } res = L_END_INCLUDE; } break; case isc_tokentype_initialws: - if (debug_lexer) { - fprintf(stderr, "lexer token: initial ws\n"); - } res = -1; break; case isc_tokentype_eol: - if (debug_lexer) { - fprintf(stderr, "lexer token: eol\n"); - } res = -1; break; case isc_tokentype_nomore: - if (debug_lexer) { - fprintf(stderr, "lexer token: nomore\n"); - } res = -1; break; } From e54e6744d67ed777ada1193f73e42d2a6f0c760a Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Tue, 18 Jul 2000 17:13:40 +0000 Subject: [PATCH 114/226] do two queries; added comments --- bin/tests/system/resolver/tests.sh | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh index e3545b5d77..ce6fa8cbd0 100644 --- a/bin/tests/system/resolver/tests.sh +++ b/bin/tests/system/resolver/tests.sh @@ -15,7 +15,7 @@ # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS # SOFTWARE. -# $Id: tests.sh,v 1.1 2000/07/14 23:38:13 gson Exp $ +# $Id: tests.sh,v 1.2 2000/07/18 17:13:40 gson Exp $ SYSTEMTESTTOP=.. . $SYSTEMTESTTOP/conf.sh @@ -26,7 +26,11 @@ SYSTEMTESTTOP=.. status=0 -$DIG +tcp example. dig www.example.com. a @10.53.0.1 -p 5300 >/dev/null || status = 1 +# If the server has the "INSIST(!external)" bug, this query will kill it. +$DIG +tcp example. dig www.example.com. a @10.53.0.1 -p 5300 >/dev/null || status=1 + +# Query once more to see if the server is still alive. +$DIG +tcp example. dig www.example.com. a @10.53.0.1 -p 5300 >/dev/null || status=1 echo "I:exit status: $status" exit $status From 663841abe0bb1cc8040e552597ef721c35b799e5 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 18 Jul 2000 17:50:02 +0000 Subject: [PATCH 115/226] 338. [bug] lwresd logged to syslog as named, not lwresd. --- CHANGES | 2 ++ bin/named/main.c | 4 ++-- bin/named/unix/include/named/os.h | 4 ++-- bin/named/unix/os.c | 10 +++++----- 4 files changed, 11 insertions(+), 9 deletions(-) diff --git a/CHANGES b/CHANGES index 2e633c9050..fa09378c45 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,6 @@ + 338. [bug] lwresd logged to syslog as named, not lwresd. + 337. [bug] "dig" did not recognize "nsap-ptr" as an RR type on the command line. diff --git a/bin/named/main.c b/bin/named/main.c index 7ea819e798..0bc590f453 100644 --- a/bin/named/main.c +++ b/bin/named/main.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: main.c,v 1.73 2000/07/10 11:34:56 tale Exp $ */ +/* $Id: main.c,v 1.74 2000/07/18 17:49:59 bwelling Exp $ */ #include @@ -483,7 +483,7 @@ main(int argc, char *argv[]) { isc_error_setfatal(library_fatal_error); isc_error_setunexpected(library_unexpected_error); - ns_os_init(); + ns_os_init(program_name); result = isc_app_start(); if (result != ISC_R_SUCCESS) diff --git a/bin/named/unix/include/named/os.h b/bin/named/unix/include/named/os.h index 7082dd575d..be275f2215 100644 --- a/bin/named/unix/include/named/os.h +++ b/bin/named/unix/include/named/os.h @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: os.h,v 1.8 2000/07/01 00:48:06 tale Exp $ */ +/* $Id: os.h,v 1.9 2000/07/18 17:50:02 bwelling Exp $ */ #ifndef NS_OS_H #define NS_OS_H 1 @@ -23,7 +23,7 @@ #include void -ns_os_init(void); +ns_os_init(const char *progname); void ns_os_daemonize(void); diff --git a/bin/named/unix/os.c b/bin/named/unix/os.c index 024b542838..d79508a4a4 100644 --- a/bin/named/unix/os.c +++ b/bin/named/unix/os.c @@ -15,7 +15,7 @@ * SOFTWARE. */ -/* $Id: os.c,v 1.26 2000/07/08 00:12:21 bwelling Exp $ */ +/* $Id: os.c,v 1.27 2000/07/18 17:50:01 bwelling Exp $ */ #include @@ -175,7 +175,7 @@ linux_keepcaps(void) { static void -setup_syslog(void) { +setup_syslog(const char *progname) { int options; options = LOG_PID; @@ -183,12 +183,12 @@ setup_syslog(void) { options |= LOG_NDELAY; #endif - openlog("named", options, LOG_DAEMON); + openlog(progname, options, LOG_DAEMON); } void -ns_os_init(void) { - setup_syslog(); +ns_os_init(const char *progname) { + setup_syslog(progname); #ifdef HAVE_LINUX_CAPABILITY_H linux_initialprivs(); #endif From 209ec709f3940c37f4a1c301b0f2471ef3ce8235 Mon Sep 17 00:00:00 2001 From: Brian Wellington Date: Tue, 18 Jul 2000 18:15:27 +0000 Subject: [PATCH 116/226] Use the isc hmac library instead of a separate implementation (not that the separate implementation was especially complicated). dst hmac-md5 should really go away at some point. --- lib/dns/sec/dst/hmac_link.c | 68 +++++++++++++------------------------ 1 file changed, 24 insertions(+), 44 deletions(-) diff --git a/lib/dns/sec/dst/hmac_link.c b/lib/dns/sec/dst/hmac_link.c index 6471cbb925..19f26b2384 100644 --- a/lib/dns/sec/dst/hmac_link.c +++ b/lib/dns/sec/dst/hmac_link.c @@ -19,11 +19,13 @@ /* * Principal Author: Brian Wellington - * $Id: hmac_link.c,v 1.39 2000/07/03 23:27:45 bwelling Exp $ + * $Id: hmac_link.c,v 1.40 2000/07/18 18:15:27 bwelling Exp $ */ #include +#include +#include #include #include #include @@ -46,60 +48,45 @@ typedef struct hmackey { static isc_result_t hmacmd5_createctx(dst_key_t *key, dst_context_t *dctx) { - isc_md5_t *md5ctx; + isc_hmacmd5_t *hmacmd5ctx; HMAC_Key *hkey = key->opaque; - unsigned char ipad[HMAC_LEN]; - int i; - md5ctx = isc_mem_get(dctx->mctx, sizeof(isc_md5_t)); - if (md5ctx == NULL) + hmacmd5ctx = isc_mem_get(dctx->mctx, sizeof(isc_hmacmd5_t)); + if (hmacmd5ctx == NULL) return (ISC_R_NOMEMORY); - isc_md5_init(md5ctx); - memset(ipad, HMAC_IPAD, sizeof ipad); - for (i = 0; i < HMAC_LEN; i++) - ipad[i] ^= hkey->key[i]; - isc_md5_update(md5ctx, ipad, HMAC_LEN); - dctx->opaque = md5ctx; + isc_hmacmd5_init(hmacmd5ctx, hkey->key, HMAC_LEN); + dctx->opaque = hmacmd5ctx; return (ISC_R_SUCCESS); } static void hmacmd5_destroyctx(dst_context_t *dctx) { - isc_md5_t *md5ctx = dctx->opaque; + isc_hmacmd5_t *hmacmd5ctx = dctx->opaque; - if (md5ctx != NULL) { - isc_md5_invalidate(md5ctx); - isc_mem_put(dctx->mctx, md5ctx, sizeof(isc_md5_t)); + if (hmacmd5ctx != NULL) { + isc_hmacmd5_invalidate(hmacmd5ctx); + isc_mem_put(dctx->mctx, hmacmd5ctx, sizeof(isc_hmacmd5_t)); dctx->opaque = NULL; } } static isc_result_t hmacmd5_adddata(dst_context_t *dctx, const isc_region_t *data) { - isc_md5_t *md5ctx = dctx->opaque; + isc_hmacmd5_t *hmacmd5ctx = dctx->opaque; - isc_md5_update(md5ctx, data->base, data->length); + isc_hmacmd5_update(hmacmd5ctx, data->base, data->length); return (ISC_R_SUCCESS); } static isc_result_t hmacmd5_sign(dst_context_t *dctx, isc_buffer_t *sig) { - isc_md5_t *md5ctx = dctx->opaque; - dst_key_t *key = dctx->key; - HMAC_Key *hkey = key->opaque; - unsigned char opad[HMAC_LEN]; - unsigned char digest[ISC_MD5_DIGESTLENGTH]; - int i; + isc_hmacmd5_t *hmacmd5ctx = dctx->opaque; + char *digest; - isc_md5_final(md5ctx, digest); - - memset(opad, HMAC_OPAD, sizeof opad); - for (i = 0; i < HMAC_LEN; i++) - opad[i] ^= hkey->key[i]; - isc_md5_init(md5ctx); - isc_md5_update(md5ctx, opad, HMAC_LEN); - isc_md5_update(md5ctx, digest, ISC_MD5_DIGESTLENGTH); - isc_md5_final(md5ctx, isc_buffer_used(sig)); + if (isc_buffer_availablelength(sig) < ISC_MD5_DIGESTLENGTH) + return (ISC_R_NOSPACE); + digest = isc_buffer_used(sig); + isc_hmacmd5_sign(hmacmd5ctx, digest); isc_buffer_add(sig, ISC_MD5_DIGESTLENGTH); return (ISC_R_SUCCESS); @@ -107,22 +94,15 @@ hmacmd5_sign(dst_context_t *dctx, isc_buffer_t *sig) { static isc_result_t hmacmd5_verify(dst_context_t *dctx, const isc_region_t *sig) { - isc_result_t result; - unsigned char digest[ISC_MD5_DIGESTLENGTH]; - isc_buffer_t b; + isc_hmacmd5_t *hmacmd5ctx = dctx->opaque; if (sig->length < ISC_MD5_DIGESTLENGTH) return (DST_R_VERIFYFAILURE); - isc_buffer_init(&b, digest, sizeof(digest)); - result = hmacmd5_sign(dctx, &b); - if (result != ISC_R_SUCCESS) - return (result); - - if (memcmp(digest, sig->base, ISC_MD5_DIGESTLENGTH) != 0) + if (isc_hmacmd5_verify(hmacmd5ctx, sig->base)) + return (ISC_R_SUCCESS); + else return (DST_R_VERIFYFAILURE); - - return (ISC_R_SUCCESS); } static isc_boolean_t From 0ade7651fcd9c76c1ac7a168adee6b83648b84b3 Mon Sep 17 00:00:00 2001 From: Andreas Gustafsson Date: Tue, 18 Jul 2000 18:16:19 +0000 Subject: [PATCH 117/226] hint zones do go in views; match_clients -> match-clients --- doc/arm/Bv9ARM.6.html | 17 +++-------------- doc/arm/Bv9ARM.txt | 9 ++------- 2 files changed, 5 insertions(+), 21 deletions(-) diff --git a/doc/arm/Bv9ARM.6.html b/doc/arm/Bv9ARM.6.html index d38394114b..35b0331062 100644 --- a/doc/arm/Bv9ARM.6.html +++ b/doc/arm/Bv9ARM.6.html @@ -16,7 +16,7 @@ - SOFTWARE. --> - + @@ -3886,7 +3886,7 @@ view 

  view view name {
-      match_clients { address_match_list } ; 
+      match-clients { address_match_list } ; 
       [view_option; ...]
       [zone_statement; ...]]
 };
@@ -3964,18 +3964,7 @@ zone
  statements must occur inside 
 view
  statements.

-

-
-
-A 
-zone
- statement of type 
-hint
- for the root zone (`
-.
-') does not strictly define a zone. Therefore, it should not be included in a 
-view
- statement.

+
 

 
 
diff --git a/doc/arm/Bv9ARM.txt b/doc/arm/Bv9ARM.txt
index 884c776151..dfb62a15e7 100644
--- a/doc/arm/Bv9ARM.txt
+++ b/doc/arm/Bv9ARM.txt
@@ -734,9 +734,7 @@ The key{} statement has two clauses: algorithm and secret.  While the
 configuration parser will accept any string as the argument to algorithm,
 currently only the string "hmac-md5" has any meaning.  The secret is a
 base-64 encoded string, typically generated with either dnssec-keygen or
-mmencode.  The parser will happily accept an invalid base-64 string, but it
-will never work with the server because the server validates the
-base-64 of the secret for itself when loading its own configuration file.
+mmencode.
 
 The server{} statement uses the key clause to associate a key{}-defined key
 with a server.  The argument to the server{} statement is a host name or
@@ -2920,7 +2918,7 @@ representation of the key data.
 6.2.17 view Statement Grammar
 
  view view name {
-      match_clients { address_match_list } ;
+      match-clients { address_match_list } ;
       [view_option; ...]
       [zone_statement; ...]]
 };
@@ -2958,9 +2956,6 @@ statements specified on the top level of the configuration file are
 considered to be part of this default view. If any explicit view statements
 are present, all zone statements must occur inside view statements.
 
-A zone statement of type hint for the root zone ('.') does not strictly
-define a zone. Therefore, it should not be included in a view statement.
-
 Here is an example of a typical split DNS setup implemented using view
 statements.
 

From 5e804988e97fad716f50b8471ba8a2faf90eea5f Mon Sep 17 00:00:00 2001
From: Michael Sawyer 
Date: Tue, 18 Jul 2000 18:51:40 +0000
Subject: [PATCH 118/226] Add comments to source code

---
 bin/dig/dig.c     |  29 +++++-
 bin/dig/dighost.c | 237 ++++++++++++++++++++++++++++++++--------------
 2 files changed, 192 insertions(+), 74 deletions(-)

diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index 05eaa7b14c..cbaa07af80 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dig.c,v 1.69 2000/07/18 01:28:15 mws Exp $ */
+/* $Id: dig.c,v 1.70 2000/07/18 18:51:38 mws Exp $ */
 
 #include 
 #include 
@@ -173,6 +173,9 @@ show_usage(void) {
 , stderr);
 }				
 
+/*
+ * Callback from dighost.c to print the received message.
+ */
 void
 received(int bytes, int frmsize, char *frm, dig_query_t *query) {
 	isc_uint64_t diff;
@@ -208,6 +211,10 @@ received(int bytes, int frmsize, char *frm, dig_query_t *query) {
 	}
 }
 
+/*
+ * Callback from dighost.c to print that it is trying a server.
+ * Not used in dig.
+ */
 void
 trying(int frmsize, char *frm, dig_lookup_t *lookup) {
 	UNUSED(frmsize);
@@ -215,6 +222,9 @@ trying(int frmsize, char *frm, dig_lookup_t *lookup) {
 	UNUSED(lookup);
 }
 
+/*
+ * Internal print routine used to print short form replies.
+ */
 static isc_result_t
 say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	isc_result_t result;
@@ -244,6 +254,9 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	return (ISC_R_SUCCESS);
 }
 
+/*
+ * short_form message print handler.  Calls above say_message()
+ */
 static isc_result_t
 short_answer(dns_message_t *msg, dns_messagetextflag_t flags,
 	     isc_buffer_t *buf, dig_query_t *query)
@@ -293,7 +306,9 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags,
 	return (ISC_R_SUCCESS);
 }
 
-
+/*
+ * Callback from dighost.c to print the reply from a server
+ */
 isc_result_t
 printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	isc_boolean_t did_flag = ISC_FALSE;
@@ -478,6 +493,9 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	return (result);
 }
 
+/*
+ * print the greeting message when the program first starts up.
+ */
 static void
 printgreeting(int argc, char **argv) {
 	int i = 1;
@@ -534,7 +552,7 @@ reorder_args(int argc, char *argv[]) {
 /*
  * We're not using isc_commandline_parse() here since the command line
  * syntax of dig is quite a bit different from that which can be described
- * that routine.  There is a portability issue here.
+ * that routine.
  */
 static void
 parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
@@ -969,6 +987,11 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 	}
 }
 
+/*
+ * Callback from dighost.c to allow program-specific shutdown code.  Here,
+ * Here, we're possibly reading from a batch file, then shutting down for
+ * real if there's nothing in the batch file to read.
+ */
 void
 dighost_shutdown(void) {
 	char batchline[MXNAME];
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 700608c35b..0eae6d3a7d 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.90 2000/07/18 01:28:16 mws Exp $ */
+/* $Id: dighost.c,v 1.91 2000/07/18 18:51:40 mws Exp $ */
 
 /*
  * Notice to programmers:  Do not use this code as an example of how to
@@ -128,6 +128,12 @@ dig_lookup_t *current_lookup = NULL;
 static void
 cancel_lookup(dig_lookup_t *lookup);
 
+static void
+recv_done(isc_task_t *task, isc_event_t *event);
+
+static void
+connect_timeout(isc_task_t *task, isc_event_t *event);
+
 static int
 count_dots(char *string) {
 	char *s;
@@ -170,15 +176,6 @@ fatal(const char *format, ...) {
 	fprintf(stderr, "\n");
 	if (exitcode == 0)
 		exitcode = 8;
-#ifdef NEVER
-	dighost_shutdown();
-	free_lists(exitcode);
-	if (mctx != NULL) {
-		if (isc_mem_debugging)
-			isc_mem_stats(mctx, stderr);
-		isc_mem_destroy(&mctx);
-	}
-#endif
 	exit(exitcode);
 }
 
@@ -202,6 +199,11 @@ check_result(isc_result_t result, const char *msg) {
 	}
 }
 
+/*
+ * Create a server structure, which is part of the lookup structure.
+ * This is little more than a linked list of servers to query in hopes
+ * of finding the answer the user is looking for
+ */
 dig_server_t *
 make_server(const char *servname) {
 	dig_server_t *srv;
@@ -217,6 +219,10 @@ make_server(const char *servname) {
 	return (srv);
 }
 
+/* 
+ * Produce a cloned server list.  The dest list must have already had
+ * ISC_LIST_INIT applied.
+ */
 void
 clone_server_list(dig_serverlist_t src, 
 		  dig_serverlist_t *dest)
@@ -232,6 +238,12 @@ clone_server_list(dig_serverlist_t src,
 	}
 }
 
+/*
+ * Create an empty lookup structure, which holds all the information needed
+ * to get an answer to a user's question.  This structure contains two
+ * linked lists: the server list (servers to query) and the query list
+ * (outstanding queries which have been made to the listed servers).
+ */
 dig_lookup_t *
 make_empty_lookup(void) {
 	dig_lookup_t *looknew;
@@ -284,6 +296,9 @@ make_empty_lookup(void) {
 }
 
 /*
+ * Clone a lookup, perhaps copying the server list.  This does not clone
+ * the query list, since it will be regenerated by the setup_lookup()
+ * function, nor does it queue up the new lookup for processing.
  * Caution: If you don't clone the servers, you MUST clone the server
  * list seperately from somewhere else, or construct it by hand.
  */
@@ -326,6 +341,14 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	return (looknew);
 }
 
+/*
+ * Requeue a lookup for further processing, perhaps copying the server
+ * list.  The new lookup structure is returned to the caller, and is
+ * queued for processing.  If servers are not cloned in the requeue, they
+ * must be added before allowing the current event to complete, since the
+ * completion of the event may result in the next entry on the lookup
+ * queue getting run.
+ */
 dig_lookup_t *
 requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	dig_lookup_t *looknew;
@@ -349,6 +372,10 @@ requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	return (looknew);
 }	
 
+/*
+ * Setup the system as a whole, reading key information and resolv.conf
+ * settings.
+ */
 void
 setup_system(void) {
 	char rcinput[MXNAME];
@@ -542,6 +569,9 @@ setup_system(void) {
 	}
 }
 	
+/*
+ * Setup the ISC and DNS libraries for use by the system.
+ */
 void
 setup_libs(void) {
 	isc_result_t result;
@@ -601,6 +631,10 @@ setup_libs(void) {
 	check_result(result, "isc_mutex_init");
 }
 
+/*
+ * Add EDNS0 option record to a message.  Currently, the only supported
+ * option is UDP buffer size.
+ */
 static void
 add_opt(dns_message_t *msg, isc_uint16_t udpsize) {
 	dns_rdataset_t *rdataset = NULL;
@@ -631,6 +665,10 @@ add_opt(dns_message_t *msg, isc_uint16_t udpsize) {
 	check_result(result, "dns_message_setopt");
 }
 
+/*
+ * Add a question section to a message, asking for the specified name, 
+ * type, and class.
+ */
 static void
 add_question(dns_message_t *message, dns_name_t *name,
 	     dns_rdataclass_t rdclass, dns_rdatatype_t rdtype)
@@ -648,7 +686,12 @@ add_question(dns_message_t *message, dns_name_t *name,
 }
 
 /*
- * We're done iff all the counts are zero and the lookup list is empty
+ * Check if we're done with all the queued lookups, which is true iff
+ * all sockets, sends, and recvs are accounted for (counters == 0),
+ * and the lookup list is empty.
+ * If we are done, pass control back out to dighost_shutdown() (which is
+ * part of dig.c, host.c, or nslookup.c) to either shutdown the system as
+ * a whole or reseed the lookup list.
  */
 static void
 check_if_done(void) {
@@ -696,6 +739,11 @@ clear_query(dig_query_t *query) {
 	isc_mem_free(mctx, query);
 }
 	
+/*
+ * Try and clear out a lookup if we're done with it.  Return ISC_TRUE if
+ * the lookup was successfully cleared.  If ISC_TRUE is returned, the
+ * lookup pointer has been invalidated.
+ */
 static isc_boolean_t
 try_clear_lookup(dig_lookup_t *lookup) {
 	dig_server_t *s;
@@ -751,7 +799,8 @@ try_clear_lookup(dig_lookup_t *lookup) {
 /*
  * If we can, start the next lookup in the queue running.
  * This assumes that the lookup on the head of the queue hasn't been
- * started yet.
+ * started yet.  It also moves the lookup from the head of the queue
+ * off, setting the current_lookup pointer pointing to it.
  */
 void
 start_lookup(void) {
@@ -782,9 +831,8 @@ start_lookup(void) {
 }
 
 /*
- * WARNING: The following routine may invalidate the lookup pointer.
- * Never depend on being able to reference lookup or query pointers on the
- * current lookup after calling this.
+ * If we can, clear the current lookup and start the next one running.
+ * This calls try_clear_lookup, so may invalidate the lookup pointer.
  */
 static void
 check_next_lookup(dig_lookup_t *lookup) {
@@ -810,6 +858,12 @@ check_next_lookup(dig_lookup_t *lookup) {
 	}
 }
 
+/*
+ * Create and queue a new lookup as a followup to the current lookup,
+ * based on the supplied message and section.  This is used in trace and
+ * name server search modes to start a new lookup using servers from
+ * NS records in a reply.
+ */
 static void
 followup_lookup(dns_message_t *msg, dig_query_t *query,
 		dns_section_t section) {
@@ -920,6 +974,10 @@ followup_lookup(dns_message_t *msg, dig_query_t *query,
 		followup_lookup(msg, query, DNS_SECTION_AUTHORITY);
 }
 
+/*
+ * Create and queue a new lookup using the next origin from the origin
+ * list, read in setup_system().
+ */
 static void
 next_origin(dns_message_t *msg, dig_query_t *query) {
 	dig_lookup_t *lookup;
@@ -944,7 +1002,10 @@ next_origin(dns_message_t *msg, dig_query_t *query) {
 	lookup->origin = ISC_LIST_NEXT(query->lookup->origin, link);
 }
 
-
+/*
+ * Insert an SOA record into the sendmessage in a lookup.  Used for
+ * creating IXFR queries.
+ */
 static void
 insert_soa(dig_lookup_t *lookup) {
 	isc_result_t result;
@@ -1006,6 +1067,12 @@ insert_soa(dig_lookup_t *lookup) {
 	dns_message_addname(lookup->sendmsg, soaname, DNS_SECTION_AUTHORITY);
 }
 
+/*
+ * Setup the supplied lookup structure, making it ready to start sending
+ * queries to servers.  Create and initialize the message to be sent as
+ * well as the query structures and buffer space for the replies.  If the
+ * server list is empty, clone it from the system default list.
+ */
 void
 setup_lookup(dig_lookup_t *lookup) {
 	isc_result_t result, res2;
@@ -1235,6 +1302,13 @@ setup_lookup(dig_lookup_t *lookup) {
 	}
 }	
 
+/*
+ * Event handler for send completion.  Track send counter, and clear out
+ * the query if the send was canceled.
+ * XXXMWS Possible race condition!  When the send gets canceled, doesn't the
+ * recv also, so it will also be trying to clear out the query?
+ * Not really sure that this should touch the query at all.
+ */
 static void
 send_done(isc_task_t *task, isc_event_t *event) {
 	isc_socketevent_t *sevent = NULL;
@@ -1267,6 +1341,11 @@ send_done(isc_task_t *task, isc_event_t *event) {
 	UNLOCK_LOOKUP;
 }
 
+/*
+ * Cancel a lookup, sending isc_socket_cancel() requests to all outstanding
+ * IO sockets.  The cancel handlers should take care of cleaning up the
+ * query and lookup structures
+ */
 void
 cancel_lookup(dig_lookup_t *lookup) {
 	dig_query_t *query = NULL;
@@ -1288,12 +1367,11 @@ cancel_lookup(dig_lookup_t *lookup) {
 	lookup->retries = 0;
 }
 
-static void
-recv_done(isc_task_t *task, isc_event_t *event);
-
-static void
-connect_timeout(isc_task_t *task, isc_event_t *event);
-
+/*
+ * Send a UDP packet to the remote nameserver, possible starting the
+ * recv action as well.  Also make sure that the timer is running and
+ * is properly reset.
+ */
 static void
 send_udp(dig_lookup_t *lookup, isc_boolean_t make_recv) {
 	dig_query_t *query;
@@ -1366,7 +1444,9 @@ send_udp(dig_lookup_t *lookup, isc_boolean_t make_recv) {
 }
 
 /*
- * connect_timeout is used for both UDP recieves and TCP connects.
+ * IO timeout handler, used for both connect and recv timeouts.  If
+ * retries are still allowed, either resend the UDP packet or queue a
+ * new TCP lookup.  Otherwise, cancel the lookup.
  */
 static void
 connect_timeout(isc_task_t *task, isc_event_t *event) {
@@ -1400,6 +1480,10 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 	UNLOCK_LOOKUP;
 }
 
+/*
+ * Event handler for the TCP recv which gets the length header of TCP
+ * packets.  Start the next recv of length bytes.
+ */
 static void
 tcp_length_done(isc_task_t *task, isc_event_t *event) { 
 	isc_socketevent_t *sevent;
@@ -1481,6 +1565,10 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
 	UNLOCK_LOOKUP;
 }
 
+/*
+ * For transfers that involve multiple recvs (XFR's in particular),
+ * launch the next recv.
+ */
 static void
 launch_next_query(dig_query_t *query, isc_boolean_t include_question) {
 	isc_result_t result;
@@ -1521,7 +1609,7 @@ launch_next_query(dig_query_t *query, isc_boolean_t include_question) {
 	recvcount++;
 	debug("recvcount=%d",recvcount);
 	if (!query->first_soa_rcvd) {
-		debug("sending a request");
+		debug("sending a request in launch_next_query");
 		result = isc_time_now(&query->time_sent);
 		check_result(result, "isc_time_now");
 		result = isc_socket_sendv(query->sock, &query->sendlist,
@@ -1531,10 +1619,17 @@ launch_next_query(dig_query_t *query, isc_boolean_t include_question) {
 		debug("sendcount=%d", sendcount);
 	}
 	query->waiting_connect = ISC_FALSE;
+#if 0
 	check_next_lookup(query->lookup);
+#endif
 	return;
 }
 	
+/*
+ * Event handler for TCP connect complete.  Make sure the connection was
+ * successful, then pass into launch_next_query to actually send the
+ * question.
+ */
 static void
 connect_done(isc_task_t *task, isc_event_t *event) {
 	isc_result_t result;
@@ -1593,32 +1688,11 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 	UNLOCK_LOOKUP;
 }
 
-
-#if 0
-static isc_boolean_t
-msg_contains_soa(dns_message_t *msg, dig_query_t *query) {
-	isc_result_t result;
-	dns_name_t *name=NULL;
-	
-	debug("msg_contains_soa()");
-	
-	result = dns_message_findname(msg, DNS_SECTION_ANSWER,
-				      query->lookup->name, dns_rdatatype_soa,
-				      0, &name, NULL);
-	if (result == ISC_R_SUCCESS) {
-		debug("found SOA", stderr);
-		return (ISC_TRUE);
-	} else {
-		debug("didn't find SOA, result=%d:%s",
-		      result, dns_result_totext(result));
-		return (ISC_FALSE);
-	}
-	
-}
-#endif
-
 /*
- * Returns true if we should call cancel_lookup().  This is a hack.
+ * Check if the ongoing XFR needs more data before it's complete, using
+ * the semantics of IXFR and AXFR protocols.  Much of the complexity of
+ * this routine comes from determining when an IXFR is complete.
+ * ISC_TRUE means more data is on the way, and the recv has been issued.
  */
 static isc_boolean_t
 check_for_more_data(dig_query_t *query, dns_message_t *msg,
@@ -1649,9 +1723,6 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 		query->working = ISC_FALSE;
 		return (ISC_TRUE);
 	}
-#ifdef NEVER
-	check_result(result, "dns_message_firstname");
-#endif
 	do {
 		dns_name_t *name = NULL;
 		dns_message_currentname(msg, DNS_SECTION_ANSWER,
@@ -1773,6 +1844,10 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 	return (ISC_FALSE);
 }
 
+/*
+ * Event handler for recv complete.  Perform whatever actions are necessary,
+ * based on the specifics of the user's request.
+ */
 static void
 recv_done(isc_task_t *task, isc_event_t *event) {
 	isc_socketevent_t *sevent = NULL;
@@ -2040,6 +2115,11 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	      isc_result_totext(sevent->result));
 }
 
+/*
+ * Turn a name into an address, using system-supplied routines.  This is
+ * used in looking up server names, etc... and needs to use system-supplied
+ * routines, since they may be using a non-DNS system for these lookups.
+ */
 void
 get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr) {
 	struct in_addr in4;
@@ -2081,6 +2161,9 @@ get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr) {
 	}
 }
 
+/*
+ * Initiate a TCP lookup, starting all of the queries running
+ */
 static void
 do_lookup_tcp(dig_lookup_t *lookup) {
 	dig_query_t *query;
@@ -2133,6 +2216,9 @@ do_lookup_tcp(dig_lookup_t *lookup) {
 	}
 }
 
+/*
+ * Initiate a UDP lookup, starting all of the queries running
+ */
 static void
 do_lookup_udp(dig_lookup_t *lookup) {
 	dig_query_t *query;
@@ -2170,6 +2256,9 @@ do_lookup_udp(dig_lookup_t *lookup) {
 	send_udp(lookup, ISC_TRUE);
 }
 
+/*
+ * Initiate either a TCP or UDP lookup
+ */
 void
 do_lookup(dig_lookup_t *lookup) {
 
@@ -2182,6 +2271,9 @@ do_lookup(dig_lookup_t *lookup) {
 		do_lookup_udp(lookup);
 }
 
+/*
+ * Start everything in action upon task startup.
+ */
 void
 onrun_callback(isc_task_t *task, isc_event_t *event) {
 	UNUSED(task);
@@ -2192,7 +2284,8 @@ onrun_callback(isc_task_t *task, isc_event_t *event) {
 }
 
 /*
- * This will be used in the SIGINT handler, and perhaps other places.
+ * Make everything on the lookup queue go away.  Mainly used by the
+ * SIGINT handler.
  */
 void
 cancel_all(void) {
@@ -2231,14 +2324,30 @@ cancel_all(void) {
 	UNLOCK_LOOKUP;
 }
 
-static void
-xfree_lists(void) {
+/*
+ * Destroy all of the libs we are using, and get everything ready for a 
+ * clean shutdown.
+ */
+void
+destroy_libs(void) {
 	void *ptr;
 	dig_server_t *s;
 	dig_searchlist_t *o;
 
-	debug("xfree_lists()");
-
+	debug("destroy_libs()");
+	if (global_task != NULL) {
+		debug("freeing task");
+		isc_task_detach(&global_task);
+	}
+	/*
+	 * The taskmgr_destroy() call blocks until all events are cleared
+	 * from the task.
+	 */
+	if (taskmgr != NULL) {
+		debug("Freeing taskmgr");
+		isc_taskmgr_destroy(&taskmgr);
+        }
+	LOCK_LOOKUP;
 	REQUIRE(sockcount == 0);
 	REQUIRE(recvcount == 0);
 	REQUIRE(sendcount == 0);
@@ -2296,21 +2405,7 @@ xfree_lists(void) {
 		debug("detach from entropy");
 		isc_entropy_detach(&entp);
 	}
-}
 
-void
-destroy_libs(void) {
-	debug("destroy_libs()");
-	if (global_task != NULL) {
-		debug("freeing task");
-		isc_task_detach(&global_task);
-	}
-	if (taskmgr != NULL) {
-		debug("Freeing taskmgr");
-		isc_taskmgr_destroy(&taskmgr);
-        }
-	LOCK_LOOKUP;
-	xfree_lists();
 	isc_mutex_destroy(&lookup_lock);
 	if (isc_mem_debugging)
 		isc_mem_stats(mctx, stderr);

From 70c2802fd7b9b77eda8a8366014afa4c559fd551 Mon Sep 17 00:00:00 2001
From: Brian Wellington 
Date: Tue, 18 Jul 2000 22:24:45 +0000
Subject: [PATCH 119/226] In query_addbestns, check that both the rdataset and
 sigrdataset are not pending before adding them.

---
 bin/named/query.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/bin/named/query.c b/bin/named/query.c
index b553fa1b58..5f4e79c641 100644
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: query.c,v 1.114 2000/07/10 18:33:25 gson Exp $ */
+/* $Id: query.c,v 1.115 2000/07/18 22:24:45 bwelling Exp $ */
 
 #include 
 
@@ -1682,7 +1682,8 @@ query_addbestns(ns_client_t *client) {
 	}
 
 	if ((client->message->flags & DNS_MESSAGEFLAG_CD) == 0 &&
-	    rdataset->trust == dns_trust_pending)
+	    (rdataset->trust == dns_trust_pending ||
+	     sigrdataset->trust == dns_trust_pending))
 		goto cleanup;
 
 	query_addrrset(client, &fname, &rdataset, &sigrdataset, dbuf,

From 68f0d29d61a730222ec6c370ea1aff7ab0c36a4e Mon Sep 17 00:00:00 2001
From: Michael Sawyer 
Date: Wed, 19 Jul 2000 17:52:27 +0000
Subject: [PATCH 120/226] Fix a minor race condition in SIGINT handling Allow
 dig to used name key files Allow SIGINT in nslookup

---
 bin/dig/dig.c     |  14 +++-
 bin/dig/dighost.c | 210 ++++++++++++++++++++++++++--------------------
 bin/dig/host.c    |   4 +-
 3 files changed, 133 insertions(+), 95 deletions(-)

diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index cbaa07af80..1e3b5481bc 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dig.c,v 1.70 2000/07/18 18:51:38 mws Exp $ */
+/* $Id: dig.c,v 1.71 2000/07/19 17:52:24 mws Exp $ */
 
 #include 
 #include 
@@ -62,6 +62,7 @@ extern char fixeddomain[MXNAME];
 extern int exitcode;
 extern isc_sockaddr_t bind_address;
 extern char keynametext[MXNAME];
+extern char keyfile[MXNAME];
 extern char keysecret[MXNAME];
 extern dns_tsigkey_t *key;
 extern isc_boolean_t validated;
@@ -841,6 +842,15 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 				exit(exitcode);
 			}
 			strncpy(keysecret, ptr, MXNAME);
+		} else if (strncmp(rv[0], "-k", 2) == 0) {
+			if (rv[0][2] != 0)
+				ptr = &rv[0][2];
+			else {
+				ptr = rv[1];
+				rv++;
+				rc--;
+			}
+			strncpy(keyfile, ptr, MXNAME);
 		} else if (strncmp(rv[0], "-p", 2) == 0) {
 			if (rv[0][2] != 0) {	
 				port = atoi(&rv[0][2]);
@@ -1043,6 +1053,8 @@ main(int argc, char **argv) {
 
 	debug("main()");
 	progname = argv[0];
+	result = isc_app_start();
+	check_result(result, "isc_app_start");
 	setup_libs();
 	parse_args(ISC_FALSE, argc, argv);
 	setup_system();
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 0eae6d3a7d..6bcd477d80 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.91 2000/07/18 18:51:40 mws Exp $ */
+/* $Id: dighost.c,v 1.92 2000/07/19 17:52:25 mws Exp $ */
 
 /*
  * Notice to programmers:  Do not use this code as an example of how to
@@ -52,7 +52,6 @@ extern int h_errno;
 #include 
 #include 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -97,6 +96,7 @@ int lookup_counter = 0;
 char fixeddomain[MXNAME] = "";
 int exitcode = 9;
 char keynametext[MXNAME];
+char keyfile[MXNAME] = "";
 char keysecret[MXNAME] = "";
 dns_name_t keyname;
 dns_tsig_keyring_t *keyring = NULL;
@@ -372,6 +372,117 @@ requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	return (looknew);
 }	
 
+
+static void
+setup_text_key(void) {
+	isc_result_t result;
+	isc_buffer_t secretbuf;
+	int secretsize;
+	unsigned char *secretstore;
+	isc_stdtime_t now;
+
+	debug("setup_text_key()");
+	result = dns_tsigkeyring_create(mctx, &keyring);
+	check_result(result, "dns_tsigkeyring_create");
+	result = isc_buffer_allocate(mctx, &namebuf, MXNAME);
+	check_result(result, "isc_buffer_allocate");
+	dns_name_init(&keyname, NULL);
+	check_result(result, "dns_name_init");
+	isc_buffer_putstr(namebuf, keynametext);
+	secretsize = strlen(keysecret) * 3 / 4;
+	secretstore = isc_mem_get(mctx, secretsize);
+	if (secretstore == NULL)
+		fatal("Memory allocation failure in %s:%d",
+		      __FILE__, __LINE__);
+	isc_buffer_init(&secretbuf, secretstore, secretsize);
+	result = isc_base64_decodestring(mctx, keysecret,
+					 &secretbuf);
+	if (result != ISC_R_SUCCESS) {
+		printf(";; Couldn't create key %s: %s\n",
+		       keynametext, isc_result_totext(result));
+		goto SYSSETUP_FAIL;
+	}
+	secretsize = isc_buffer_usedlength(&secretbuf);
+	isc_stdtime_get(&now);
+	
+	result = dns_name_fromtext(&keyname, namebuf,
+				   dns_rootname, ISC_FALSE,
+				   namebuf);
+	if (result != ISC_R_SUCCESS) {
+		printf(";; Couldn't create key %s: %s\n",
+		       keynametext, dns_result_totext(result));
+		goto SYSSETUP_FAIL;
+	}
+	result = dns_tsigkey_create(&keyname, dns_tsig_hmacmd5_name,
+				    secretstore, secretsize,
+				    ISC_TRUE, NULL, now, now, mctx,
+				    keyring, &key);
+	if (result != ISC_R_SUCCESS) {
+		printf(";; Couldn't create key %s: %s\n",
+		       keynametext, dns_result_totext(result));
+	}
+	isc_mem_put(mctx, secretstore, secretsize);
+	dns_name_invalidate(&keyname);
+	isc_buffer_free(&namebuf);
+	return;
+ SYSSETUP_FAIL:
+	isc_mem_put(mctx, secretstore, secretsize);
+	dns_name_invalidate(&keyname);
+	isc_buffer_free(&namebuf);
+	dns_tsigkeyring_destroy(&keyring);
+	return;
+}
+
+
+static void
+setup_file_key(void) {
+	isc_result_t result;
+	isc_buffer_t secretbuf;
+	unsigned char *secretstore = NULL;
+	int secretlen;
+	dst_key_t *dstkey = NULL;
+	isc_stdtime_t now;
+
+	
+	debug("setup_file_key()");
+	result = dns_tsigkeyring_create(mctx, &keyring);
+	check_result(result, "dns_tsigkeyring_create");
+	result = dst_key_fromnamedfile(keyfile, DST_TYPE_PRIVATE,
+				       mctx, &dstkey);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "Couldn't read key from %s: %s\n",
+			keyfile, isc_result_totext(result));
+		goto failure;
+	}
+	secretlen = (dst_key_size(dstkey) + 7) >> 3;
+	secretstore = isc_mem_allocate(mctx, secretlen);
+	if (secretstore == NULL)
+		fatal("out of memory");
+	isc_buffer_init(&secretbuf, secretstore, secretlen);
+	result = dst_key_tobuffer(dstkey, &secretbuf);
+	if (result != ISC_R_SUCCESS) {
+		fprintf(stderr, "Couldn't read key from %s: %s\n",
+			keyfile, isc_result_totext(result));
+		goto failure;
+	}
+	isc_stdtime_get(&now);
+	dns_name_init(&keyname, NULL);
+	dns_name_clone(dst_key_name(dstkey), &keyname);
+	result = dns_tsigkey_create(&keyname, dns_tsig_hmacmd5_name,
+				    secretstore, secretlen,
+				    ISC_TRUE, NULL, now, now, mctx,
+				    keyring, &key);
+	if (result != ISC_R_SUCCESS) {
+		printf(";; Couldn't create key %s: %s\n",
+		       keynametext, dns_result_totext(result));
+	}
+ failure:
+	if (dstkey != NULL)
+		dst_key_free(&dstkey);
+	if (secretstore != NULL)
+		isc_mem_free(mctx, secretstore);
+}
+
 /*
  * Setup the system as a whole, reading key information and resolv.conf
  * settings.
@@ -385,13 +496,6 @@ setup_system(void) {
 	dig_searchlist_t *search;
 	dig_lookup_t *l;
 	isc_boolean_t get_servers;
-	isc_result_t result;
-	isc_buffer_t secretsrc;
-	isc_buffer_t secretbuf;
-	int secretsize;
-	unsigned char *secretstore;
-	isc_lex_t *lex = NULL;
-	isc_stdtime_t now;
 	
 	debug("setup_system()");
 
@@ -499,74 +603,10 @@ setup_system(void) {
 	     l -> origin = ISC_LIST_HEAD(search_list);
 	}
 
-	if (keysecret[0] != 0) {
-		debug("keyring");
-		result = dns_tsigkeyring_create(mctx, &keyring);
-		check_result(result, "dns_tsigkeyring_create");
-		debug("buffer");
-		result = isc_buffer_allocate(mctx, &namebuf, MXNAME);
-		check_result(result, "isc_buffer_allocate");
-		debug("name");
-		dns_name_init(&keyname, NULL);
-		check_result(result, "dns_name_init");
-		isc_buffer_putstr(namebuf, keynametext);
-		secretsize = strlen(keysecret) * 3 / 4;
-		debug("secretstore");
-		secretstore = isc_mem_get(mctx, secretsize);
-		if (secretstore == NULL)
-			fatal("Memory allocation failure in %s:%d",
-			      __FILE__, __LINE__);
-		isc_buffer_init(&secretsrc, keysecret, strlen(keysecret));
-		isc_buffer_add(&secretsrc, strlen(keysecret));
-		isc_buffer_init(&secretbuf, secretstore, secretsize);
-		debug("lex");
-		result = isc_lex_create(mctx, strlen(keysecret), &lex);
-		check_result(result, "isc_lex_create");
-		result = isc_lex_openbuffer(lex, &secretsrc);
-		check_result(result, "isc_lex_openbuffer");
-		result = isc_base64_tobuffer(lex, &secretbuf, -1);
-		if (result != ISC_R_SUCCESS) {
-			printf(";; Couldn't create key %s: %s\n",
-			       keynametext, isc_result_totext(result));
-			isc_lex_close(lex);
-			isc_lex_destroy(&lex);
-			goto SYSSETUP_FAIL;
-		}
-		secretsize = isc_buffer_usedlength(&secretbuf);
-		debug("close");
-		isc_lex_close(lex);
-		isc_lex_destroy(&lex);
-		isc_stdtime_get(&now);
-		
-		debug("namefromtext");
-		result = dns_name_fromtext(&keyname, namebuf,
-					   dns_rootname, ISC_FALSE,
-					   namebuf);
-		if (result != ISC_R_SUCCESS) {
-			printf(";; Couldn't create key %s: %s\n",
-				keynametext, dns_result_totext(result));
-			goto SYSSETUP_FAIL;
-		}
-		debug("tsigkey");
-		result = dns_tsigkey_create(&keyname, dns_tsig_hmacmd5_name,
-					    secretstore, secretsize,
-					    ISC_TRUE, NULL, now, now, mctx,
-					    keyring, &key);
-		if (result != ISC_R_SUCCESS) {
-			printf(";; Couldn't create key %s: %s\n",
-			       keynametext, dns_result_totext(result));
-		}
-		isc_mem_put(mctx, secretstore, secretsize);
-		dns_name_invalidate(&keyname);
-		isc_buffer_free(&namebuf);
-		return;
-	SYSSETUP_FAIL:
-		isc_mem_put(mctx, secretstore, secretsize);
-		dns_name_invalidate(&keyname);
-		isc_buffer_free(&namebuf);
-		dns_tsigkeyring_destroy(&keyring);
-		return;
-	}
+	if (keyfile[0] != 0)
+		setup_file_key();
+	else if (keysecret[0] != 0)
+		setup_text_key();
 }
 	
 /*
@@ -585,9 +625,6 @@ setup_libs(void) {
 	 */
 	srandom(getpid() + (int)&setup_libs);
 
-	result = isc_app_start();
-	check_result(result, "isc_app_start");
-
 	result = isc_net_probeipv4();
 	check_result(result, "isc_net_probeipv4");
 
@@ -1305,15 +1342,11 @@ setup_lookup(dig_lookup_t *lookup) {
 /*
  * Event handler for send completion.  Track send counter, and clear out
  * the query if the send was canceled.
- * XXXMWS Possible race condition!  When the send gets canceled, doesn't the
- * recv also, so it will also be trying to clear out the query?
- * Not really sure that this should touch the query at all.
  */
 static void
 send_done(isc_task_t *task, isc_event_t *event) {
 	isc_socketevent_t *sevent = NULL;
 	dig_query_t *query;
-	dig_lookup_t *l;
 
 	REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE);
 
@@ -1329,15 +1362,6 @@ send_done(isc_task_t *task, isc_event_t *event) {
 	sendcount--;
 	debug("sendcount=%d",sendcount);
 	INSIST(sendcount >= 0);
-
-	if (sevent->result == ISC_R_CANCELED) {
-		debug("in send cancel handler");
-		query->working = ISC_FALSE;
-		query->waiting_connect = ISC_FALSE;
-		l = query->lookup;
-		clear_query(query);
-		check_next_lookup(l);
-	}
 	UNLOCK_LOOKUP;
 }
 
diff --git a/bin/dig/host.c b/bin/dig/host.c
index d43b83e331..e9968af6d1 100644
--- a/bin/dig/host.c
+++ b/bin/dig/host.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: host.c,v 1.42 2000/07/18 01:28:17 mws Exp $ */
+/* $Id: host.c,v 1.43 2000/07/19 17:52:27 mws Exp $ */
 
 #include 
 #include 
@@ -677,6 +677,8 @@ main(int argc, char **argv) {
 
 	debug("main()");
 	progname = argv[0];
+	result = isc_app_start();
+	check_result(result, "isc_app_start");
 	setup_libs();
 	parse_args(ISC_FALSE, argc, argv);
 	setup_system();

From 3caa2d83622f23f6b8777d850e67280f4b26d687 Mon Sep 17 00:00:00 2001
From: Michael Sawyer 
Date: Wed, 19 Jul 2000 18:24:40 +0000
Subject: [PATCH 121/226] Probably no need to call srandom() if we never call
 random().

---
 bin/nsupdate/nsupdate.c | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 8f5249346c..d51510d1ab 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: nsupdate.c,v 1.31 2000/07/18 00:47:00 bwelling Exp $ */
+/* $Id: nsupdate.c,v 1.32 2000/07/19 18:24:40 mws Exp $ */
 
 #include 
 
@@ -335,15 +335,6 @@ setup_system(void) {
 
 	ddebug("setup_system()");
 
-	/*
-	 * Warning: This is not particularly good randomness.  We'll
-	 * just use random() now for getting id values, but doing so
-	 * does NOT insure that id's can't be guessed.
-	 *
-	 * XXX Shouldn't random() be called somewhere if this is here?
-	 */
-	srandom(getpid() + (int)&setup_system);
-
 	result = isc_net_probeipv4();
 	check_result(result, "isc_net_probeipv4");
 

From 8b2d2acbffe466d7662522213b1e34c23c9010f8 Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Wed, 19 Jul 2000 19:54:50 +0000
Subject: [PATCH 122/226] in the multi-stage positive validation test, allow
 the recursive server to omit the authority section

---
 bin/tests/system/dnssec/tests.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index 15e1a9a3aa..05649e1939 100644
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -15,7 +15,7 @@
 # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 # SOFTWARE.
 
-# $Id: tests.sh,v 1.21 2000/07/11 00:36:44 bwelling Exp $
+# $Id: tests.sh,v 1.22 2000/07/19 19:54:50 gson Exp $
 
 #
 # Perform tests
@@ -65,8 +65,8 @@ status=`expr $status + $ret`
 
 echo "I:checking multi-stage positive validation"
 ret=0
-$DIG $DIGOPTS a.secure.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
-$DIG $DIGOPTS a.secure.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
+$DIG $DIGOPTS +noauth a.secure.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+$DIG $DIGOPTS +noauth a.secure.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi

From b0e67b302024428dd4453870ee92ff4d856a98a0 Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Wed, 19 Jul 2000 20:34:14 +0000
Subject: [PATCH 123/226] removed unnecessary call to isc_socket_cancel()

---
 bin/named/interfacemgr.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
index 8eba7fd9b7..8d86e2ba40 100644
--- a/bin/named/interfacemgr.c
+++ b/bin/named/interfacemgr.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: interfacemgr.c,v 1.45 2000/06/30 02:48:06 gson Exp $ */
+/* $Id: interfacemgr.c,v 1.46 2000/07/19 20:34:14 gson Exp $ */
 
 #include 
 
@@ -369,7 +369,6 @@ ns_interface_destroy(ns_interface_t *ifp) {
 	if (ifp->udpdispatch != NULL)
 		dns_dispatch_detach(&ifp->udpdispatch);
 	if (ifp->tcpsocket != NULL) {
-		isc_socket_cancel(ifp->tcpsocket, NULL, ISC_SOCKCANCEL_ALL);
 		isc_socket_detach(&ifp->tcpsocket);
 	}
 

From c7d445ce7f4db5262ba3412eac7b1ee9d053b93d Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Wed, 19 Jul 2000 20:34:40 +0000
Subject: [PATCH 124/226] edited

---
 doc/dev/release | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/doc/dev/release b/doc/dev/release
index ccb6cb3580..d6be7e965b 100644
--- a/doc/dev/release
+++ b/doc/dev/release
@@ -1,7 +1,7 @@
 Copyright (C) 2000  Internet Software Consortium.
 See COPYRIGHT in the source root or http://www.isc.org/copyright for terms.
 
-$Id: release,v 1.10 2000/07/10 16:16:25 gson Exp $
+$Id: release,v 1.11 2000/07/19 20:34:40 gson Exp $
 
 Preparing a bind9 release
 
@@ -104,12 +104,13 @@ release.
    and sign them with the ISC signing PGP key:
    "pgp -sba bind-9.0.0b3.tar.gz -u 0x51BAB2ED"
 
- - Fix the perissions permissions on the signature file:
+ - Fix the permissions permissions on the signature file:
 
 	chmod 644 bind-9.0.0b3.tar.gz.asc
 
  - Verify the PGP signature:
-   pgp bind-9.0.0b3.tar.gz.asc bind-9.0.0b3.tar.gz
+
+	pgp bind-9.0.0b3.tar.gz.asc bind-9.0.0b3.tar.gz
 
  - Prepare a release announcement based on the previous one
 
@@ -121,7 +122,7 @@ release.
      scp bind-9.0.0b4.tar.gz bind-9.0.0b4.tar.gz.asc \
 	isrv4.pa.vix.com:/udir/ftp/isc/bind9/9.0.0b4   
 
- - Download using FTP and verify the PGP signature again
+ - Download using FTP (or Netscape) and verify the PGP signature again
 
  - Increment the version in the file "version"
 

From aa5940281af3719fa1e87fee07b3d7b8194bf9ea Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Wed, 19 Jul 2000 23:19:05 +0000
Subject: [PATCH 125/226] When handling the response to an ANY query in a
 secure zone, deal with the multiple answer RRsets by validating each one
 separately.  Also, eliminated the "done" variable in answer_response()
 because in the rare situations where it got set to ISC_TRUE, it caused the
 function to return prematurely by exiting a loop with a result of
 ISC_R_SUCCESS and hitting a "if (result != ISC_R_NOMORE) return (result);"
 test immediately following following the loop.

This should fix [RT #109], "ANY query in secure zone crashes server".
---
 lib/dns/resolver.c | 111 ++++++++++++++++++++++++++++++++-------------
 1 file changed, 79 insertions(+), 32 deletions(-)

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 46faf809df..9bb3380b9a 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: resolver.c,v 1.149 2000/07/16 18:26:18 gson Exp $ */
+/* $Id: resolver.c,v 1.150 2000/07/19 23:19:05 gson Exp $ */
 
 #include 
 
@@ -170,7 +170,6 @@ struct fetchctx {
 	dns_adbaddrinfolist_t		forwaddrs;
 	isc_sockaddrlist_t		forwarders;
 	isc_sockaddrlist_t		bad;
-	dns_validator_t *		validator;	
 	/*
 	 * # of events we're waiting for.
 	 */
@@ -678,7 +677,6 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	INSIST(fctx->validator == NULL); /* Validator needs rmessage. */
 	dns_message_reset(fctx->rmessage, DNS_MESSAGE_INTENTPARSE);
 
 	query = isc_mem_get(res->mctx, sizeof *query);
@@ -1693,7 +1691,6 @@ fctx_destroy(fetchctx_t *fctx) {
 	REQUIRE(fctx->pending == 0);
 	REQUIRE(fctx->validating == 0);
 	REQUIRE(fctx->references == 0);
-	REQUIRE(fctx->validator == NULL);
 
 	FCTXTRACE("destroy");
 
@@ -2049,7 +2046,6 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
 	ISC_LIST_INIT(fctx->forwaddrs);
 	ISC_LIST_INIT(fctx->forwarders);
 	ISC_LIST_INIT(fctx->bad);
-	fctx->validator = NULL;
 	fctx->find = NULL;
 	fctx->pending = 0;
 	fctx->validating = 0;
@@ -2270,6 +2266,7 @@ validated(isc_task_t *task, isc_event_t *event) {
 	dns_rdataset_t *ardataset = NULL;
 	dns_rdataset_t *asigrdataset = NULL;
 	dns_dbnode_t *node = NULL;
+	isc_boolean_t negative;
 
         UNUSED(task); /* for now */
 
@@ -2279,17 +2276,18 @@ validated(isc_task_t *task, isc_event_t *event) {
         REQUIRE(fctx->validating > 0);
 
         vevent = (dns_validatorevent_t *)event;
-	INSIST(vevent->validator == fctx->validator);
 	
-        fctx->validating--;
+	FCTXTRACE("received validation completion event");
 
-	INSIST(fctx->validating == 0);
-	
 	/*
 	 * Destroy the validator early so that we can
 	 * destroy the fctx if necessary.
 	 */
-	dns_validator_destroy(&fctx->validator);
+	dns_validator_destroy(&vevent->validator);
+
+        fctx->validating--;
+
+	negative = ISC_TF(vevent->rdataset == NULL);
 
         /*
          * If shutting down, ignore the results.  Check to see if we're
@@ -2304,12 +2302,20 @@ validated(isc_task_t *task, isc_event_t *event) {
 	/*
          * We're not shutting down.
          */
-	FCTXTRACE("received validation completion event");
 
 	hevent = ISC_LIST_HEAD(fctx->events);
 	if (hevent != NULL) {
-		ardataset = hevent->rdataset;
-		asigrdataset = hevent->sigrdataset;
+		if (!negative &&
+		    (fctx->type == dns_rdatatype_any ||
+		     fctx->type == dns_rdatatype_sig)) {
+			/*
+			 * Don't bind rdatasets; the caller
+			 * will iterate the node.
+			 */
+		} else {
+			ardataset = hevent->rdataset;
+			asigrdataset = hevent->sigrdataset;
+		}
 	}
 
         if (vevent->result != ISC_R_SUCCESS) {
@@ -2320,7 +2326,7 @@ validated(isc_task_t *task, isc_event_t *event) {
 
 	isc_stdtime_get(&now);
 
-	if (vevent->rdataset == NULL) {
+	if (negative) {
 		dns_rdatatype_t covers;
 		FCTXTRACE("nonexistence validation OK");
 
@@ -2374,7 +2380,19 @@ validated(isc_task_t *task, isc_event_t *event) {
 		    result != DNS_R_UNCHANGED)
 			goto noanswer_response;
 	}
-	
+
+        if (fctx->validating > 0) {
+		INSIST(!negative);
+		INSIST(fctx->type == dns_rdatatype_any ||
+		       fctx->type == dns_rdatatype_sig);
+		/*
+		 * Don't send a response yet - we have
+		 * more rdatasets that still need to
+		 * be validated.
+		 */
+		goto cleanup_event;
+	}
+		
 	result = ISC_R_SUCCESS;
 
  answer_response:
@@ -2419,6 +2437,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) {
 	dns_fetchevent_t *event;
 	unsigned int options;
 	isc_task_t *task;
+	dns_validator_t *validator;
 
 	/*
 	 * The appropriate bucket lock must be held.
@@ -2428,6 +2447,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) {
 	need_validation = ISC_FALSE;
 	have_answer = ISC_FALSE;
 	eresult = ISC_R_SUCCESS;
+	task = res->buckets[fctx->bucketnum].task;
 
 	/*
 	 * Is DNSSEC validation required for this name?
@@ -2550,16 +2570,45 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) {
 					break;
 			}
 			if (ANSWER(rdataset)) {
-				/*
-				 * This is the answer.  We will
-				 * validate it, but first we cache
-				 * the rest of the response - it may
-				 * contain useful keys.
-				 */
-				INSIST(valrdataset == NULL &&
-				       valsigrdataset == NULL);
-				valrdataset = rdataset;
-				valsigrdataset = sigrdataset;
+				if (fctx->type != dns_rdatatype_any &&
+				    fctx->type != dns_rdatatype_sig) {
+					/*
+					 * This is The Answer.  We will
+					 * validate it, but first we cache
+					 * the rest of the response - it may
+					 * contain useful keys.
+					 */
+					INSIST(valrdataset == NULL &&
+					       valsigrdataset == NULL);
+					valrdataset = rdataset;
+					valsigrdataset = sigrdataset;
+				} else {
+					/*
+					 * This is one of (potentially)
+					 * multiple answers to an ANY
+					 * or SIG query.  To keep things
+					 * simple, we just start the
+					 * validator right away rather
+					 * than caching first and
+					 * having to remember which
+					 * rdatasets needed validation.
+					 */
+					validator = NULL;
+					result = dns_validator_create(
+						res->view,
+						name,
+						rdataset->type,
+						rdataset,
+						sigrdataset,
+						fctx->rmessage,
+						0,
+						task,
+						validated,
+						fctx,
+						&validator);
+					if (result == ISC_R_SUCCESS)
+						fctx->validating++;
+				}
 			}
 		} else if (!EXTERNAL(rdataset)) {
 			/*
@@ -2624,7 +2673,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) {
 	}
 
 	if (valrdataset != NULL) {
-		task = res->buckets[fctx->bucketnum].task;
+		validator = NULL;		
 		result = dns_validator_create(res->view,
 					      name,
 					      fctx->type,
@@ -2635,11 +2684,10 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) {
 					      task,
 					      validated,
 					      fctx,
-					      &fctx->validator);
+					      &validator);
 		if (result == ISC_R_SUCCESS)
 			fctx->validating++;
 	}
-	
 
 	if (result == ISC_R_SUCCESS && have_answer) {
 		fctx->attributes |= FCTX_ATTR_HAVEANSWER;
@@ -2778,12 +2826,13 @@ ncache_message(fetchctx_t *fctx, dns_rdatatype_t covers, isc_stdtime_t now) {
 		/*
 		 * Do negative response validation.
 		 */
+		dns_validator_t *validator = NULL;		
                 isc_task_t *task = res->buckets[fctx->bucketnum].task;
                 result = dns_validator_create(res->view, name, fctx->type,
 					      NULL, NULL,
                                               fctx->rmessage, 0, task,
                                               validated, fctx,
-                                              &fctx->validator);
+                                              &validator);
                 if (result != ISC_R_SUCCESS)
                         return (result);
                 fctx->validating++;
@@ -3227,7 +3276,6 @@ answer_response(fetchctx_t *fctx) {
 	 * part of the answer and should be cached.
 	 */
 
-	done = ISC_FALSE;
 	chaining = ISC_FALSE;
 	have_answer = ISC_FALSE;
 	want_chaining = ISC_FALSE;
@@ -3238,7 +3286,7 @@ answer_response(fetchctx_t *fctx) {
 	qname = &fctx->name;
 	type = fctx->type;
 	result = dns_message_firstname(message, DNS_SECTION_ANSWER);
-	while (!done && result == ISC_R_SUCCESS) {
+	while (result == ISC_R_SUCCESS) {
 		name = NULL;
 		dns_message_currentname(message, DNS_SECTION_ANSWER, &name);
 		external = ISC_TF(!dns_name_issubdomain(name, &fctx->domain));
@@ -3255,7 +3303,6 @@ answer_response(fetchctx_t *fctx) {
 					 * We've found an ordinary answer.
 					 */
 					found = ISC_TRUE;
-					done = ISC_TRUE;
 					aflag = DNS_RDATASETATTR_ANSWER;
 				} else if (rdataset->type == dns_rdatatype_sig
 					   && rdataset->covers == type) {

From 99eba32b06d21623b14161bd6543c91201d9cbaf Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Thu, 20 Jul 2000 00:05:32 +0000
Subject: [PATCH 126/226] Removed the code added in revision 1.57:

  "Store CNAMEs and their SIGs (if any) in their own name structure on
  the name list.  I.e. do not mix CNAMEs with non-CNAME data.  Do the
  same thing for DNAMEs."

because it caused DNSSEC validation of responses to ANY queries at
nodes with CNAME records to fail, and no one was able to figure out
why it was added in the first place.  As a beneficial side effect,
findname() now finds names even if they have attribute bits set
differently from the one being searched for.  This supersedes
the fix of revision 1.133.
---
 lib/dns/message.c | 88 +++++++----------------------------------------
 1 file changed, 12 insertions(+), 76 deletions(-)

diff --git a/lib/dns/message.c b/lib/dns/message.c
index 699313a881..1123b71e1f 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: message.c,v 1.134 2000/07/10 20:46:02 explorer Exp $ */
+/* $Id: message.c,v 1.135 2000/07/20 00:05:32 gson Exp $ */
 
 /***
  *** Imports
@@ -740,7 +740,7 @@ dns_message_destroy(dns_message_t **msgp) {
 }
 
 static isc_result_t
-simple_findname(dns_name_t **foundname, dns_name_t *target,
+findname(dns_name_t **foundname, dns_name_t *target,
 	 dns_namelist_t *section)
 {
 	dns_name_t *curr;
@@ -758,26 +758,6 @@ simple_findname(dns_name_t **foundname, dns_name_t *target,
 	return (ISC_R_NOTFOUND);
 }
 
-static isc_result_t
-findname(dns_name_t **foundname, dns_name_t *target, unsigned int attributes,
-	 dns_namelist_t *section)
-{
-	dns_name_t *curr;
-
-	for (curr = ISC_LIST_TAIL(*section) ;
-	     curr != NULL ;
-	     curr = ISC_LIST_PREV(curr, link)) {
-		if (dns_name_equal(curr, target) &&
-		    (curr->attributes & attributes) == attributes) {
-			if (foundname != NULL)
-				*foundname = curr;
-			return (ISC_R_SUCCESS);
-		}
-	}
-
-	return (ISC_R_NOTFOUND);
-}
-
 isc_result_t
 dns_message_findtype(dns_name_t *name, dns_rdatatype_t type,
 		     dns_rdatatype_t covers, dns_rdataset_t **rdataset)
@@ -954,7 +934,7 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx)
 		 * name since we no longer need it, and set our name pointer
 		 * to point to the name we found.
 		 */
-		result = findname(&name2, name, 0, section);
+		result = findname(&name2, name, section);
 
 		/*
 		 * If it is the first name in the section, accept it.
@@ -1079,7 +1059,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 	   dns_section_t sectionid, isc_boolean_t preserve_order)
 {
 	isc_region_t r;
-	unsigned int count, rdatalen, attributes;
+	unsigned int count, rdatalen;
 	dns_name_t *name;
 	dns_name_t *name2;
 	dns_rdataset_t *rdataset;
@@ -1234,32 +1214,18 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			result = ISC_R_NOMEMORY;
 			goto cleanup;
 		}
-		attributes = 0;
-		if (rdtype != dns_rdatatype_tsig) {
-			if (rdtype == dns_rdatatype_cname) {
-				name->attributes |= DNS_NAMEATTR_CNAME;
-				attributes = DNS_NAMEATTR_CNAME;
-				skip_name_search = ISC_TRUE;
-			} else if (rdtype == dns_rdatatype_dname) {
-				name->attributes |= DNS_NAMEATTR_DNAME;
-				attributes = DNS_NAMEATTR_DNAME;
-				skip_name_search = ISC_TRUE;
-			}
-			result = getrdata(source, msg, dctx, msg->rdclass,
-					  rdtype, rdatalen, rdata);
-		} else
+		if (rdtype == dns_rdatatype_tsig)
 			result = getrdata(source, msg, dctx, rdclass,
 					  rdtype, rdatalen, rdata);
+		else
+			result = getrdata(source, msg, dctx, msg->rdclass,
+					  rdtype, rdatalen, rdata);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
 		rdata->rdclass = rdclass;
 		if (rdtype == dns_rdatatype_sig && rdata->length > 0) {
 			covers = dns_rdata_covers(rdata);
-			if (covers == dns_rdatatype_cname)
-				attributes = DNS_NAMEATTR_CNAME;
-			else if (covers == dns_rdatatype_dname)
-				attributes = DNS_NAMEATTR_DNAME;
-			else if (covers == 0 &&
+			if (covers == 0 &&
 				 sectionid == DNS_SECTION_ADDITIONAL)
 			{
 				if (msg->sig0 != NULL) {
@@ -1294,7 +1260,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			 * allocated name since we no longer need it, and set
 			 * our name pointer to point to the name we found.
 			 */
-			result = findname(&name2, name, attributes, section);
+			result = findname(&name2, name, section);
 
 			/*
 			 * If it is a new name, append to the section.
@@ -2023,39 +1989,9 @@ dns_message_findname(dns_message_t *msg, dns_section_t section,
 			REQUIRE(*rdataset == NULL);
 	}
 
-	if (msg->from_to_wire == DNS_MESSAGE_INTENTPARSE) {
-		dns_rdatatype_t atype;
-		unsigned int attributes;
-		
-		/*
-		 * Figure out what attributes we should look for.
-		 */
-		if (type == dns_rdatatype_sig)
-			atype = covers;
-		else
-			atype = type;
-		attributes = 0;
-		if (atype == dns_rdatatype_cname)
-			attributes = DNS_NAMEATTR_CNAME;
-		else if (atype == dns_rdatatype_cname)
-			attributes = DNS_NAMEATTR_DNAME;
+	result = findname(&foundname, target,
+			  &msg->sections[section]);
 
-		/*
-		 * Search through, looking for the name.
-		 */
-		result = findname(&foundname, target, attributes,
-				  &msg->sections[section]);
-	} else {
-		/*
-		 * The message was not built by dns_message_parse()
-		 * and therefore does not have CNAMEs and DNAMEs
-		 * as separate names, and no DNS_NAMEATTR_CNAME
-		 * and DNS_NAMEATTR_DNAME attributes are maintained.
-		 * Therefore, we should not compare attributes.
-		 */
-		result = simple_findname(&foundname, target,
-					 &msg->sections[section]);
-	}
 	if (result == ISC_R_NOTFOUND)
 		return (DNS_R_NXDOMAIN);
 	else if (result != ISC_R_SUCCESS)

From 9a8fea7bc8fb79ff1d31f0a2ba3c9694041c6f3a Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Thu, 20 Jul 2000 00:06:28 +0000
Subject: [PATCH 127/226] When handling the response to an ANY query in a
 secure zone, deal with the multiple answer RRsets by validating each one
 separately.  Also, eliminated the "done" variable in answer_response()
 because in the rare situations where it got set to ISC_TRUE, it caused the
 function to return prematurely by exiting a loop with a result of
 ISC_R_SUCCESS and hitting a "if (result != ISC_R_NOMORE) return (result);"
 test immediately following following the loop.

This should fix [RT #109], "ANY query in secure zone crashes server".
---
 CHANGES | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGES b/CHANGES
index fa09378c45..9f9ac56d99 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,8 @@
 
+ 339.	[bug]		DNSSEC validation of the response to an ANY
+			query at a name with a CNAME RR in a secure
+			zone triggered an assertion failure.
+
  338.	[bug]		lwresd logged to syslog as named, not lwresd.
 
  337.	[bug]		"dig" did not recognize "nsap-ptr" as an RR type

From dae5ce6ddb0a3c425865d3b6f0f13c4126eacc17 Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Thu, 20 Jul 2000 00:41:50 +0000
Subject: [PATCH 128/226]  340.   [bug]           The top-level COPYRIGHT file
 was missing from                         the distribution.

---
 CHANGES     | 3 +++
 Makefile.in | 4 ++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 9f9ac56d99..03ecb8c67d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,7 @@
 
+ 340.	[bug]		The top-level COPYRIGHT file was missing from
+			the distribution.
+
  339.	[bug]		DNSSEC validation of the response to an ANY
 			query at a name with a CNAME RR in a secure
 			zone triggered an assertion failure.
diff --git a/Makefile.in b/Makefile.in
index f75867aa96..9b9e83dc46 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -13,7 +13,7 @@
 # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 # SOFTWARE.
 
-# $Id: Makefile.in,v 1.25 2000/06/27 00:09:58 gson Exp $
+# $Id: Makefile.in,v 1.26 2000/07/20 00:41:50 gson Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -23,7 +23,7 @@ top_srcdir =	@top_srcdir@
 
 SUBDIRS =	make lib bin
 TARGETS =
-DISTFILES =	CHANGES Makefile.in README \
+DISTFILES =	CHANGES COPYRIGHT Makefile.in README \
 		acconfig.h aclocal.m4 config.guess config.h.in config.h.win32 \
 		config.status.win32 config.sub configure configure.in \
 		isc-config.sh.in install-sh libtool.m4 ltconfig ltmain.sh \

From f969863d54ae3f0ddccce84c6dd054fe1e792cf7 Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Thu, 20 Jul 2000 01:14:48 +0000
Subject: [PATCH 129/226] replaced the hash function in dns_name_hash() by one
 that is simpler, faster, and produces a much more even distribution,
 particularly when the data to hash ends with a null byte like domain names
 often do

---
 lib/dns/name.c | 21 +++++----------------
 1 file changed, 5 insertions(+), 16 deletions(-)

diff --git a/lib/dns/name.c b/lib/dns/name.c
index 2f47192f16..a7cd880142 100644
--- a/lib/dns/name.c
+++ b/lib/dns/name.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: name.c,v 1.95 2000/07/14 19:12:53 tale Exp $ */
+/* $Id: name.c,v 1.96 2000/07/20 01:14:48 gson Exp $ */
 
 #include 
 
@@ -448,7 +448,6 @@ dns_name_hash(dns_name_t *name, isc_boolean_t case_sensitive) {
 	unsigned int length;
 	const unsigned char *s;
 	unsigned int h = 0;
-	unsigned int g;
 	unsigned char c;
 
 	/*
@@ -463,30 +462,20 @@ dns_name_hash(dns_name_t *name, isc_boolean_t case_sensitive) {
 		length = 16;
 
 	/*
-	 * P. J. Weinberger's hash function, adapted from p. 436 of
-	 * _Compilers: Principles, Techniques, and Tools_, Aho, Sethi
-	 * and Ullman, Addison-Wesley, 1986, ISBN 0-201-10088-6.
+	 * This hash function is similar to the one Ousterhout
+	 * uses in Tcl.
 	 */
-
 	s = name->ndata;
 	if (case_sensitive) {
 		while (length > 0) {
-			h = ( h << 4 ) + *s;
-			if ((g = ( h & 0xf0000000 )) != 0) {
-				h = h ^ (g >> 24);
-				h = h ^ g;
-			}
+			h += ( h << 4 ) + *s;
 			s++;
 			length--;
 		}
 	} else {
 		while (length > 0) {
 			c = maptolower[*s];
-			h = ( h << 4 ) + c;
-			if ((g = ( h & 0xf0000000 )) != 0) {
-				h = h ^ (g >> 24);
-				h = h ^ g;
-			}
+			h += ( h << 4 ) + c;
 			s++;
 			length--;
 		}

From b7ebc6a127becc7c3ad93d3b1f143132cf1d3609 Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Thu, 20 Jul 2000 01:15:25 +0000
Subject: [PATCH 130/226] minor tweak to hash function of previous change

---
 lib/dns/name.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/dns/name.c b/lib/dns/name.c
index a7cd880142..47cc1a9e64 100644
--- a/lib/dns/name.c
+++ b/lib/dns/name.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: name.c,v 1.96 2000/07/20 01:14:48 gson Exp $ */
+/* $Id: name.c,v 1.97 2000/07/20 01:15:25 gson Exp $ */
 
 #include 
 
@@ -468,14 +468,14 @@ dns_name_hash(dns_name_t *name, isc_boolean_t case_sensitive) {
 	s = name->ndata;
 	if (case_sensitive) {
 		while (length > 0) {
-			h += ( h << 4 ) + *s;
+			h += ( h << 3 ) + *s;
 			s++;
 			length--;
 		}
 	} else {
 		while (length > 0) {
 			c = maptolower[*s];
-			h += ( h << 4 ) + c;
+			h += ( h << 3 ) + c;
 			s++;
 			length--;
 		}

From 26cebf34820993f2ceddafaf485c74e1bd39bdb8 Mon Sep 17 00:00:00 2001
From: Michael Sawyer 
Date: Thu, 20 Jul 2000 17:56:20 +0000
Subject: [PATCH 131/226] Slight bug in batch processing

---
 bin/dig/dig.c     | 30 +++++++++++++++++-------------
 bin/dig/dighost.c |  7 +------
 2 files changed, 18 insertions(+), 19 deletions(-)

diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index 1e3b5481bc..0d6596d251 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dig.c,v 1.71 2000/07/19 17:52:24 mws Exp $ */
+/* $Id: dig.c,v 1.72 2000/07/20 17:56:19 mws Exp $ */
 
 #include 
 #include 
@@ -560,7 +560,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 	isc_boolean_t have_host = ISC_FALSE;
 	isc_result_t result;
 	isc_textregion_t tr;
-	dig_server_t *srv = NULL, *s, *s2;
+	dig_server_t *srv = NULL;
 	dig_lookup_t *lookup = NULL;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
@@ -585,8 +585,11 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 	 * anywhere, except for cloning into new lookups
 	 */
 
-	if (!is_batchfile)
+	debug("parse_args()");
+	if (!is_batchfile) {
+		debug("making new lookup");
 		default_lookup = make_empty_lookup();
+	}
 
 	lookup = default_lookup;
 
@@ -984,16 +987,6 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 	}
 	if (!is_batchfile) {
 		printgreeting(argc, argv);
-		s = ISC_LIST_HEAD(default_lookup->my_server_list);
-		while (s != NULL) {
-			debug("freeing server %p belonging to %p",
-			      s, default_lookup);
-			s2 = s;
-			s = ISC_LIST_NEXT(s, link);
-			ISC_LIST_DEQUEUE(default_lookup->my_server_list, 
-					 (dig_server_t *)s2, link);
-			isc_mem_free(mctx, s2);
-		}
 	}
 }
 
@@ -1046,6 +1039,7 @@ dighost_shutdown(void) {
 int
 main(int argc, char **argv) {
 	isc_result_t result;
+	dig_server_t *s, *s2;
 
 	ISC_LIST_INIT(lookup_list);
 	ISC_LIST_INIT(server_list);
@@ -1061,6 +1055,16 @@ main(int argc, char **argv) {
 	result = isc_app_onrun(mctx, global_task, onrun_callback, NULL);
 	check_result(result, "isc_app_onrun");
 	isc_app_run();
+	s = ISC_LIST_HEAD(default_lookup->my_server_list);
+	while (s != NULL) {
+		debug("freeing server %p belonging to %p",
+		      s, default_lookup);
+		s2 = s;
+		s = ISC_LIST_NEXT(s, link);
+		ISC_LIST_DEQUEUE(default_lookup->my_server_list, 
+				 (dig_server_t *)s2, link);
+		isc_mem_free(mctx, s2);
+	}
 	isc_mem_free(mctx, default_lookup);
 	if (batchname != NULL) {
 		fclose(batchfp);
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 6bcd477d80..0d3e7b7701 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.92 2000/07/19 17:52:25 mws Exp $ */
+/* $Id: dighost.c,v 1.93 2000/07/20 17:56:20 mws Exp $ */
 
 /*
  * Notice to programmers:  Do not use this code as an example of how to
@@ -421,15 +421,10 @@ setup_text_key(void) {
 		printf(";; Couldn't create key %s: %s\n",
 		       keynametext, dns_result_totext(result));
 	}
-	isc_mem_put(mctx, secretstore, secretsize);
-	dns_name_invalidate(&keyname);
-	isc_buffer_free(&namebuf);
-	return;
  SYSSETUP_FAIL:
 	isc_mem_put(mctx, secretstore, secretsize);
 	dns_name_invalidate(&keyname);
 	isc_buffer_free(&namebuf);
-	dns_tsigkeyring_destroy(&keyring);
 	return;
 }
 

From e860332b07e9126880a826952aaa76942c3b4871 Mon Sep 17 00:00:00 2001
From: Brian Wellington 
Date: Thu, 20 Jul 2000 17:58:59 +0000
Subject: [PATCH 132/226] A call to isc_mem_put could pass a different size
 than was gotten.  Use isc_mem_allocate instead.

---
 bin/dig/dighost.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 0d3e7b7701..f380f716cf 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.93 2000/07/20 17:56:20 mws Exp $ */
+/* $Id: dighost.c,v 1.94 2000/07/20 17:58:59 bwelling Exp $ */
 
 /*
  * Notice to programmers:  Do not use this code as an example of how to
@@ -390,7 +390,7 @@ setup_text_key(void) {
 	check_result(result, "dns_name_init");
 	isc_buffer_putstr(namebuf, keynametext);
 	secretsize = strlen(keysecret) * 3 / 4;
-	secretstore = isc_mem_get(mctx, secretsize);
+	secretstore = isc_mem_allocate(mctx, secretsize);
 	if (secretstore == NULL)
 		fatal("Memory allocation failure in %s:%d",
 		      __FILE__, __LINE__);
@@ -422,7 +422,7 @@ setup_text_key(void) {
 		       keynametext, dns_result_totext(result));
 	}
  SYSSETUP_FAIL:
-	isc_mem_put(mctx, secretstore, secretsize);
+	isc_mem_free(mctx, secretstore);
 	dns_name_invalidate(&keyname);
 	isc_buffer_free(&namebuf);
 	return;

From a5e73f3e9d909e86baca18713c5697f52aca87ca Mon Sep 17 00:00:00 2001
From: Brian Wellington 
Date: Thu, 20 Jul 2000 19:32:57 +0000
Subject: [PATCH 133/226] Having a non-noerror value inn the tsig error field
 should always return DNS_R_TSIGERRORSET in dns_tsig_verify.  Change the
 result text to reflect this.

---
 lib/dns/result.c |  4 ++--
 lib/dns/tsig.c   | 13 ++++---------
 2 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/lib/dns/result.c b/lib/dns/result.c
index b1ed52d2bf..12e45deec6 100644
--- a/lib/dns/result.c
+++ b/lib/dns/result.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: result.c,v 1.65 2000/07/13 02:41:19 bwelling Exp $ */
+/* $Id: result.c,v 1.66 2000/07/20 19:32:57 bwelling Exp $ */
 
 #include 
 
@@ -65,7 +65,7 @@ static const char *text[DNS_R_NRESULTS] = {
 	"more data",				/* 36 */
 	"up to date",				/* 37 */
 	"tsig verify failure",			/* 38 */
-	"tsig error set in query",		/* 39 */
+	"tsig indicates error",			/* 39 */
 	"SIG failed to verify",			/* 40 */
 	"SIG has expired",			/* 41 */
 	"SIG validity period has not begun",	/* 42 */
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index a96a72caee..b606594858 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tsig.c,v 1.73 2000/07/18 00:46:01 bwelling Exp $
+ * $Id: tsig.c,v 1.74 2000/07/20 19:32:56 bwelling Exp $
  * Principal Author: Brian Wellington
  */
 
@@ -30,6 +30,7 @@
 #include 
 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -798,14 +799,8 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 
 	msg->tsigstatus = dns_rcode_noerror;
 
-	if (tsig.error != dns_rcode_noerror) {
-		if (is_response(msg)) {
-			/* XXXBEW Log a message */
-			return (ISC_R_SUCCESS);
-		}
-		else
-			return (DNS_R_TSIGERRORSET);
-	}
+	if (tsig.error != dns_rcode_noerror)
+		return (DNS_R_TSIGERRORSET);
 
 	msg->verified_sig = 1;
 

From d6e6858bb906a96439ae1e0408903b2b65453e14 Mon Sep 17 00:00:00 2001
From: Brian Wellington 
Date: Thu, 20 Jul 2000 19:34:16 +0000
Subject: [PATCH 134/226] If dns_request_getresponse() fails, log it.

---
 lib/dns/zone.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 2b4f375340..12a45df3f4 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.157 2000/07/13 00:30:58 bwelling Exp $ */
+/* $Id: zone.c,v 1.158 2000/07/20 19:34:16 bwelling Exp $ */
 
 #include 
 
@@ -2310,8 +2310,12 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 	if (result != ISC_R_SUCCESS)
 		goto next_master;
 	result = dns_request_getresponse(revent->request, msg, ISC_FALSE);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
+		zone_log(zone, me, ISC_LOG_INFO,
+			 "failure in request to %s: %s",
+			 master, dns_result_totext(result));
 		goto next_master;
+	}
 
 	/*
 	 * Unexpected rcode.

From 390132bd9888c521fea59529001fa2662dbf2f5b Mon Sep 17 00:00:00 2001
From: Michael Sawyer 
Date: Thu, 20 Jul 2000 19:38:05 +0000
Subject: [PATCH 135/226] Run resolver test in make tests

---
 bin/tests/system/conf.sh.in | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
index 354f6c3f09..948a8afe01 100644
--- a/bin/tests/system/conf.sh.in
+++ b/bin/tests/system/conf.sh.in
@@ -15,7 +15,7 @@
 # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 # SOFTWARE.
 
-# $Id: conf.sh.in,v 1.9 2000/07/10 17:01:15 gson Exp $
+# $Id: conf.sh.in,v 1.10 2000/07/20 19:38:05 mws Exp $
 
 # 
 # Common configuration data for system tests, to be sourced into
@@ -37,7 +37,8 @@ KEYGEN=$TOP/bin/dnssec/dnssec-keygen
 SIGNER=$TOP/bin/dnssec/dnssec-signzone
 KEYSIGNER=$TOP/bin/dnssec/dnssec-signkey
 KEYSETTOOL=$TOP/bin/dnssec/dnssec-makekeyset
-SUBDIRS="dnssec glue limits lwresd notify nsupdate stub views xfer xferquota"
+SUBDIRS="dnssec glue limits lwresd notify nsupdate resolver stub views xfer \
+    xferquota"
 
 # PERL will be an empty string if no perl interpreter was found.
 PERL=@PERL@

From 8bf0f722f83894b7808011dd700e3f8fce45e65d Mon Sep 17 00:00:00 2001
From: Michael Sawyer 
Date: Thu, 20 Jul 2000 19:41:44 +0000
Subject: [PATCH 136/226] Count and possibly limit how many names and rr's in a
 xfr. (Needed by GDIB folks)

---
 bin/dig/dig.c             | 24 ++++++++++++++++++++++--
 bin/dig/dighost.c         | 25 ++++++++++++++++++++++---
 bin/dig/include/dig/dig.h |  4 +++-
 3 files changed, 47 insertions(+), 6 deletions(-)

diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index 0d6596d251..c13945a1c2 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dig.c,v 1.72 2000/07/20 17:56:19 mws Exp $ */
+/* $Id: dig.c,v 1.73 2000/07/20 19:41:41 mws Exp $ */
 
 #include 
 #include 
@@ -70,6 +70,8 @@ extern isc_taskmgr_t *taskmgr;
 extern isc_task_t *global_task;
 extern isc_boolean_t free_now;
 dig_lookup_t *default_lookup = NULL;
+extern isc_uint32_t name_limit;
+extern isc_uint32_t rr_limit;
 
 extern isc_boolean_t debugging;
 extern isc_boolean_t isc_mem_debugging;
@@ -169,6 +171,8 @@ show_usage(void) {
 "                 +[no]nssearch       (Search all authorative nameservers)\n"
 "                 +[no]identify       (ID responders in short answers)\n"
 "                 +[no]trace          (Trace delegation down from root)\n"
+"                 +rrlimit=###        (Limit number of rr's in xfr)\n"
+"                 +namelimit=###      (Limit number of names in xfr)\n"
 "        global d-opts and servers (before host name) affect all queries.\n"
 "        local d-opts and servers (after host name) affect only that lookup.\n"
 , stderr);
@@ -194,7 +198,13 @@ received(int bytes, int frmsize, char *frm, dig_query_t *query) {
 		       query->servname);
 		time(&tnow);
 		printf(";; WHEN: %s", ctime(&tnow));
-		printf(";; MSG SIZE  rcvd: %d\n", bytes);
+		if (query->lookup->doing_xfr) {
+			printf(";; XFR size: %d names, %d rrs\n",
+			       query->name_count, query->rr_count);
+		} else {
+			printf(";; MSG SIZE  rcvd: %d\n", bytes);
+	
+		}
 		if (key != NULL) {
 			if (!validated)
 				puts(";; WARNING -- Some TSIG could not "
@@ -643,6 +653,16 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			lookup->retries = atoi(&rv[0][7]);
 			if (lookup->retries <= 0)
 				lookup->retries = 1;
+		} else if (strncmp(rv[0], "+namelimit=", 11) == 0) {
+			name_limit = atoi(&rv[0][11]);
+		} else if (strncmp(rv[0], "+rrlimit=", 9) == 0) {
+			rr_limit = atoi(&rv[0][9]);
+		} else if (strncmp(rv[0], "+buf=", 5) == 0) {
+			lookup->udpsize = atoi(&rv[0][5]);
+			if (lookup->udpsize <= 0)
+				lookup->udpsize = 0;
+			if (lookup->udpsize > COMMSIZE)
+				lookup->udpsize = COMMSIZE;
 		} else if (strncmp(rv[0], "+buf=", 5) == 0) {
 			lookup->udpsize = atoi(&rv[0][5]);
 			if (lookup->udpsize <= 0)
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index f380f716cf..8e78b5da37 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.94 2000/07/20 17:58:59 bwelling Exp $ */
+/* $Id: dighost.c,v 1.95 2000/07/20 19:41:42 mws Exp $ */
 
 /*
  * Notice to programmers:  Do not use this code as an example of how to
@@ -110,6 +110,8 @@ isc_boolean_t debugging = ISC_FALSE;
 char *progname = NULL;
 isc_mutex_t lookup_lock;
 dig_lookup_t *current_lookup = NULL;
+isc_uint32_t name_limit = INT_MAX;
+isc_uint32_t rr_limit = INT_MAX;
 
 /*
  * Apply and clear locks at the event level in global task.
@@ -1315,6 +1317,8 @@ setup_lookup(dig_lookup_t *lookup) {
 		query->second_rr_rcvd = ISC_FALSE;
 		query->second_rr_serial = 0;
 		query->servname = serv->servername;
+		query->name_count = 0;
+		query->rr_count = 0;
 		ISC_LIST_INIT(query->recvlist);
 		ISC_LIST_INIT(query->lengthlist);
 		query->sock = NULL;
@@ -1689,7 +1693,7 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 		isc_socket_detach(&query->sock);
 		sockcount--;
 		INSIST(sockcount >= 0);
-		if (exitcode < 9)
+		if (exitcode < 7)
 			exitcode = 9;
 		debug("sockcount=%d",sockcount);
 		isc_buffer_free(&b);
@@ -1711,7 +1715,7 @@ connect_done(isc_task_t *task, isc_event_t *event) {
  * Check if the ongoing XFR needs more data before it's complete, using
  * the semantics of IXFR and AXFR protocols.  Much of the complexity of
  * this routine comes from determining when an IXFR is complete.
- * ISC_TRUE means more data is on the way, and the recv has been issued.
+ * ISC_FALSE means more data is on the way, and the recv has been issued.
  */
 static isc_boolean_t
 check_for_more_data(dig_query_t *query, dns_message_t *msg,
@@ -1724,6 +1728,7 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 	isc_buffer_t b;
 	isc_region_t r;
 	char *abspace[MXNAME];
+	isc_boolean_t atlimit=ISC_FALSE;
 
 	debug("check_for_more_data()");
 
@@ -1753,6 +1758,9 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 			if (result != ISC_R_SUCCESS)
 				continue;
 			do {
+				query->rr_count++;
+				if (query->rr_count >= rr_limit)
+					atlimit = ISC_TRUE;
 				dns_rdataset_current(rdataset, &rdata);
 				/*
 				 * If this is the first rr, make sure
@@ -1831,6 +1839,9 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 						 (char *)r.base, query);
 					query->working = ISC_FALSE;
 					dns_rdata_freestruct(&soa);
+					if (atlimit) {
+						exitcode = 7;
+					}
 					return (ISC_TRUE);
 				}
 				/*
@@ -1857,8 +1868,16 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 				result = dns_rdataset_next(rdataset);
 			} while (result == ISC_R_SUCCESS);
 		}
+		query->name_count++;
+		if (query->name_count >= name_limit) {
+			debug("name_count(%d) > name_limit(%d)",
+			      query->name_count, name_limit);
+			atlimit = ISC_TRUE;
+		}
 		result = dns_message_nextname(msg, DNS_SECTION_ANSWER);
 	} while (result == ISC_R_SUCCESS);
+	if (atlimit)
+		goto xfr_done;
 	launch_next_query(query, ISC_FALSE);
 	return (ISC_FALSE);
 }
diff --git a/bin/dig/include/dig/dig.h b/bin/dig/include/dig/dig.h
index 5c5bb40618..60edaf9c9d 100644
--- a/bin/dig/include/dig/dig.h
+++ b/bin/dig/include/dig/dig.h
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dig.h,v 1.36 2000/07/18 01:28:20 mws Exp $ */
+/* $Id: dig.h,v 1.37 2000/07/20 19:41:44 mws Exp $ */
 
 #ifndef DIG_H
 #define DIG_H
@@ -131,6 +131,8 @@ struct dig_query {
 		first_repeat_rcvd;
 	isc_uint32_t first_rr_serial;
 	isc_uint32_t second_rr_serial;
+	isc_uint32_t rr_count;
+	isc_uint32_t name_count;
 	char *servname;
 	isc_bufferlist_t sendlist,
 		recvlist,

From 9b72c4648fb25234362db3453526926279bbb492 Mon Sep 17 00:00:00 2001
From: Michael Sawyer 
Date: Fri, 21 Jul 2000 18:47:23 +0000
Subject: [PATCH 137/226] Internal code for masters with key entries.  Not
 wired into config yet.

---
 bin/named/zoneconf.c       | 13 ++++--
 lib/dns/include/dns/zone.h | 10 ++++-
 lib/dns/zone.c             | 91 +++++++++++++++++++++++++++++++++++---
 lib/dns/zoneconf.c         | 13 ++++--
 4 files changed, 113 insertions(+), 14 deletions(-)

diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index ab0702384b..beffe2045c 100644
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: zoneconf.c,v 1.43 2000/06/22 21:54:57 tale Exp $ */
+/* $Id: zoneconf.c,v 1.44 2000/07/21 18:47:22 mws Exp $ */
 
 #include 
 
@@ -267,7 +267,13 @@ dns_zone_configure(dns_c_ctx_t *cctx, dns_c_view_t *cview,
 		iplist = NULL;
 		result = dns_c_zone_getmasterips(czone, &iplist);
 		if (result == ISC_R_SUCCESS)
-			result = dns_zone_setmasters(zone, iplist->ips,
+#if 0
+			result = dns_zone_setmasterswithkeys(zone,
+							     iplist->ips,
+							     iplist->keys,
+							     iplist->nextidx);
+#endif
+		        result = dns_zone_setmasters(zone, iplist->ips,
 						     iplist->nextidx);
 		else
 			result = dns_zone_setmasters(zone, NULL, 0);
@@ -275,7 +281,8 @@ dns_zone_configure(dns_c_ctx_t *cctx, dns_c_view_t *cview,
 
 		result = dns_c_zone_getmaxtranstimein(czone, &uintval);
 		if (result != ISC_R_SUCCESS) 
-			result = dns_c_ctx_getmaxtransfertimein(cctx, &uintval);
+			result = dns_c_ctx_getmaxtransfertimein(cctx,
+								&uintval);
 		if (result != ISC_R_SUCCESS)
 			uintval = MAX_XFER_TIME;
 		dns_zone_setmaxxfrin(zone, uintval);
diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
index 6f16f4f344..c6bfeb7d8a 100644
--- a/lib/dns/include/dns/zone.h
+++ b/lib/dns/include/dns/zone.h
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: zone.h,v 1.59 2000/06/22 21:56:25 tale Exp $ */
+/* $Id: zone.h,v 1.60 2000/07/21 18:47:23 mws Exp $ */
 
 #ifndef DNS_ZONE_H
 #define DNS_ZONE_H 1
@@ -351,6 +351,9 @@ dns_zone_maintenance(dns_zone_t *zone);
 isc_result_t
 dns_zone_setmasters(dns_zone_t *zone, isc_sockaddr_t *masters,
 		    isc_uint32_t count);
+isc_result_t
+dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters,
+			    dns_name_t **keynames, isc_uint32_t count);
 /*
  *	Set the list of master servers for the zone.
  *
@@ -358,12 +361,17 @@ dns_zone_setmasters(dns_zone_t *zone, isc_sockaddr_t *masters,
  *	'zone' to be a valid zone.
  *	'masters' array of isc_sockaddr_t with port set or NULL.
  *	'count' the number of masters.
+ *      'keynames' array of dns_name_t's for tsig keys or NULL.
+ *
+ *      dns_zone_setmasters() is just a wrapper to setmasterswithkeys(),
+ *      passing NULL in the keynames field.
  *
  * 	If 'masters' is NULL then 'count' must be zero.
  *
  * Returns:
  *	ISC_R_SUCCESS
  *	ISC_R_NOMEMORY
+ *      Any result dns_name_dup() can return, if keynames!=NULL
  */
 
 isc_result_t
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 12a45df3f4..34ab594a5f 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.158 2000/07/20 19:34:16 bwelling Exp $ */
+/* $Id: zone.c,v 1.159 2000/07/21 18:47:20 mws Exp $ */
 
 #include 
 
@@ -36,6 +36,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -121,6 +122,7 @@ struct dns_zone {
 	isc_uint32_t		expire;
 	isc_uint32_t		minimum;
 	isc_sockaddr_t		*masters;
+	dns_name_t              **masterkeynames;
 	unsigned int		masterscnt;
 	unsigned int		curmaster;
 	isc_sockaddr_t		masteraddr;
@@ -1250,36 +1252,91 @@ dns_zone_setalsonotify(dns_zone_t *zone, isc_sockaddr_t *notify,
 isc_result_t
 dns_zone_setmasters(dns_zone_t *zone, isc_sockaddr_t *masters,
 		    isc_uint32_t count)
+{
+	isc_result_t result;
+
+	result = dns_zone_setmasterswithkeys(zone, masters, NULL, count);
+	return (result);
+}
+
+isc_result_t
+dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters,
+			    dns_name_t **keynames, isc_uint32_t count)
 {
 	isc_sockaddr_t *new;
+	dns_name_t **newname;
+	isc_result_t result = ISC_R_SUCCESS;
+	unsigned int i;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE((masters == NULL && count == 0) ||
 		(masters != NULL && count != 0));
+	if (keynames != NULL) {
+		REQUIRE(count != 0);
+	}
 	
 	LOCK(&zone->lock);
 	if (zone->masters != NULL) {
 		isc_mem_put(zone->mctx, zone->masters,
 			    zone->masterscnt * sizeof *new);
 		zone->masters = NULL;
-		zone->masterscnt = 0;
 	}
+	if (zone->masterkeynames != NULL) {
+		for (i = 0; i < zone->masterscnt; i++)
+			dns_name_free(zone->masterkeynames[i],
+				      zone->mctx);
+		isc_mem_put(zone->mctx, zone->masterkeynames,
+			    zone->masterscnt * sizeof *newname);
+		zone->masterkeynames = NULL;
+	}
+	zone->masterscnt = 0;
 	if (masters == NULL)
 		goto unlock;
 
-	new = isc_mem_get(zone->mctx, count * sizeof *new);
+	new = isc_mem_get(zone->mctx,
+			  count * sizeof (isc_sockaddr_t));
 	if (new == NULL) {
-		UNLOCK(&zone->lock);
-		return (ISC_R_NOMEMORY);
+		result = ISC_R_NOMEMORY;
+		goto unlock;
 	}
 	memcpy(new, masters, count * sizeof *new);
 	zone->masters = new;
 	zone->masterscnt = count;
 	zone->flags &= ~DNS_ZONEFLG_NOMASTERS;
 
+	if (keynames != NULL) {
+		newname = isc_mem_get(zone->mctx,
+				      count * sizeof (dns_name_t*));
+		if (newname == NULL) {
+			result = ISC_R_NOMEMORY;
+			isc_mem_put(zone->mctx, zone->masters,
+				    count * sizeof *new);
+			goto unlock;
+		}
+		memset(newname, 0, count * sizeof (dns_name_t*));
+		for (i = 0; i < count; i++) {
+			if (keynames[i] != NULL) {
+				result = dns_name_dup(keynames[i], zone->mctx,
+						      newname[i]);
+				if (result != ISC_R_SUCCESS) {
+					for (i = 0; i < count; i++)
+						if (newname[i] != NULL)
+							dns_name_free(
+							       newname[i],
+							       zone->mctx);
+					isc_mem_put(zone->mctx, zone->masters,
+						    count * sizeof *new);
+					isc_mem_put(zone->mctx, newname,
+						    count * sizeof *newname);
+					goto unlock;
+				}
+			}
+		}
+		zone->masterkeynames = newname;
+	}
  unlock:
 	UNLOCK(&zone->lock);
-	return (ISC_R_SUCCESS);
+	return (result);
 }
 
 isc_result_t
@@ -3932,8 +3989,28 @@ got_transfer_quota(isc_task_t *task, isc_event_t *event) {
 
 	/*
 	 * Determine if we should attempt to sign the request with TSIG.
+	 * First, look for a tsig key in the master statement, then
+	 * try for a server key.
 	 */
-	if (peer != NULL && dns_peer_getkey(peer, &keyname) == ISC_R_SUCCESS) {
+	if ((zone->masterkeynames != NULL) &&
+	    (zone->masterkeynames[zone->curmaster] != NULL)) {
+		dns_view_t *view = dns_zone_getview(zone);
+		keyname = zone->masterkeynames[zone->curmaster];
+		result = dns_tsigkey_find(&tsigkey, keyname, NULL,
+					  view->statickeys);
+		if (result == ISC_R_NOTFOUND)
+			result = dns_tsigkey_find(&tsigkey, keyname, NULL,
+						  view->dynamickeys);
+		if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
+			zone_log(zone, me, ISC_LOG_ERROR,
+				 "error getting tsig keys "
+				 "for zone transfer: %s",
+				 isc_result_totext(result));
+			goto cleanup;
+		}
+	}
+	else if (peer != NULL &&
+		 dns_peer_getkey(peer, &keyname) == ISC_R_SUCCESS) {
 		dns_view_t *view = dns_zone_getview(zone);
 		result = dns_tsigkey_find(&tsigkey, keyname, NULL,
 					  view->statickeys);
diff --git a/lib/dns/zoneconf.c b/lib/dns/zoneconf.c
index ab0702384b..beffe2045c 100644
--- a/lib/dns/zoneconf.c
+++ b/lib/dns/zoneconf.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: zoneconf.c,v 1.43 2000/06/22 21:54:57 tale Exp $ */
+/* $Id: zoneconf.c,v 1.44 2000/07/21 18:47:22 mws Exp $ */
 
 #include 
 
@@ -267,7 +267,13 @@ dns_zone_configure(dns_c_ctx_t *cctx, dns_c_view_t *cview,
 		iplist = NULL;
 		result = dns_c_zone_getmasterips(czone, &iplist);
 		if (result == ISC_R_SUCCESS)
-			result = dns_zone_setmasters(zone, iplist->ips,
+#if 0
+			result = dns_zone_setmasterswithkeys(zone,
+							     iplist->ips,
+							     iplist->keys,
+							     iplist->nextidx);
+#endif
+		        result = dns_zone_setmasters(zone, iplist->ips,
 						     iplist->nextidx);
 		else
 			result = dns_zone_setmasters(zone, NULL, 0);
@@ -275,7 +281,8 @@ dns_zone_configure(dns_c_ctx_t *cctx, dns_c_view_t *cview,
 
 		result = dns_c_zone_getmaxtranstimein(czone, &uintval);
 		if (result != ISC_R_SUCCESS) 
-			result = dns_c_ctx_getmaxtransfertimein(cctx, &uintval);
+			result = dns_c_ctx_getmaxtransfertimein(cctx,
+								&uintval);
 		if (result != ISC_R_SUCCESS)
 			uintval = MAX_XFER_TIME;
 		dns_zone_setmaxxfrin(zone, uintval);

From 5813d091e9ba03390afdc01711deeeac2e32bb22 Mon Sep 17 00:00:00 2001
From: Michael Sawyer 
Date: Fri, 21 Jul 2000 20:10:03 +0000
Subject: [PATCH 138/226] Spacing changes replace memset with slightly more
 portable NULL initialization properly NULL masterkeynames when zone is
 created

---
 lib/dns/zone.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 34ab594a5f..34c79d9bb0 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.159 2000/07/21 18:47:20 mws Exp $ */
+/* $Id: zone.c,v 1.160 2000/07/21 20:10:03 mws Exp $ */
 
 #include 
 
@@ -351,6 +351,7 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) {
 	zone->expire = 0;
 	zone->minimum = 0;
 	zone->masters = NULL;
+	zone->masterkeynames = NULL;
 	zone->masterscnt = 0;
 	zone->curmaster = 0;
 	zone->notify = NULL;
@@ -426,7 +427,7 @@ zone_free(dns_zone_t *zone) {
 	if (zone->db != NULL)
 		dns_db_detach(&zone->db);
 	dns_zone_cleardbargs(zone);
-	dns_zone_setmasters(zone, NULL, 0);
+	dns_zone_setmasterswithkeys(zone, NULL, NULL, 0);
 	dns_zone_setalsonotify(zone, NULL, 0);
 	zone->check_names = dns_severity_ignore;
 	if (zone->update_acl != NULL)
@@ -1294,7 +1295,7 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters,
 		goto unlock;
 
 	new = isc_mem_get(zone->mctx,
-			  count * sizeof (isc_sockaddr_t));
+			  count * sizeof(isc_sockaddr_t));
 	if (new == NULL) {
 		result = ISC_R_NOMEMORY;
 		goto unlock;
@@ -1306,14 +1307,15 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters,
 
 	if (keynames != NULL) {
 		newname = isc_mem_get(zone->mctx,
-				      count * sizeof (dns_name_t*));
+				      count * sizeof(dns_name_t *));
 		if (newname == NULL) {
 			result = ISC_R_NOMEMORY;
 			isc_mem_put(zone->mctx, zone->masters,
 				    count * sizeof *new);
 			goto unlock;
 		}
-		memset(newname, 0, count * sizeof (dns_name_t*));
+		for (i = 0; i < count; i++)
+			newname[i] = NULL;
 		for (i = 0; i < count; i++) {
 			if (keynames[i] != NULL) {
 				result = dns_name_dup(keynames[i], zone->mctx,

From 4be64854b4a3da0465bf962caa8488699e0e0681 Mon Sep 17 00:00:00 2001
From: Brian Wellington 
Date: Fri, 21 Jul 2000 20:32:12 +0000
Subject: [PATCH 139/226] The wrong name was being duped when a tsig key was
 generated using tkey.

---
 lib/dns/tsig.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index b606594858..181ee96581 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tsig.c,v 1.74 2000/07/20 19:32:56 bwelling Exp $
+ * $Id: tsig.c,v 1.75 2000/07/21 20:32:12 bwelling Exp $
  * Principal Author: Brian Wellington
  */
 
@@ -114,7 +114,7 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm,
 			goto cleanup_algorithm;
 		}
 		dns_name_init(tkey->creator, NULL);
-		ret = dns_name_dup(algorithm, mctx, tkey->creator);
+		ret = dns_name_dup(creator, mctx, tkey->creator);
 		if (ret != ISC_R_SUCCESS) {
 			isc_mem_put(mctx, tkey->creator, sizeof(dns_name_t));
 			goto cleanup_algorithm;

From 84a47e20aedd16ba86feb25848732338ad618b16 Mon Sep 17 00:00:00 2001
From: Brian Wellington 
Date: Fri, 21 Jul 2000 20:33:13 +0000
Subject: [PATCH 140/226] If the request was signed with a tsig key, verify the
 signature on the response.

---
 lib/dns/request.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/dns/request.c b/lib/dns/request.c
index 4a9c6192c0..f896bd3824 100644
--- a/lib/dns/request.c
+++ b/lib/dns/request.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: request.c,v 1.26 2000/06/22 21:54:44 tale Exp $ */
+/* $Id: request.c,v 1.27 2000/07/21 20:33:13 bwelling Exp $ */
 
 #include 
 
@@ -734,6 +734,8 @@ isc_result_t
 dns_request_getresponse(dns_request_t *request, dns_message_t *message,
 			isc_boolean_t preserve_order)
 {
+	isc_result_t result;
+
 	REQUIRE(VALID_REQUEST(request));
 	REQUIRE(request->answer != NULL);
 
@@ -742,7 +744,13 @@ dns_request_getresponse(dns_request_t *request, dns_message_t *message,
 
 	dns_message_setquerytsig(message, request->tsig);
 	dns_message_settsigkey(message, request->tsigkey);
-	return (dns_message_parse(message, request->answer, preserve_order));
+	result = dns_message_parse(message, request->answer, preserve_order);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+	if (request->tsigkey != NULL)
+		result = dns_tsig_verify(request->answer, message,
+					 NULL, request->tsigkey->ring);
+	return (result);
 }
 
 isc_boolean_t

From e30c4dbe6f478828878abf6faf267a931818c1e7 Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Fri, 21 Jul 2000 20:37:01 +0000
Subject: [PATCH 141/226] typos

---
 lib/dns/include/dns/rbt.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/dns/include/dns/rbt.h b/lib/dns/include/dns/rbt.h
index f6ba548d4f..54a5c1b798 100644
--- a/lib/dns/include/dns/rbt.h
+++ b/lib/dns/include/dns/rbt.h
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: rbt.h,v 1.42 2000/07/07 00:25:47 tale Exp $ */
+/* $Id: rbt.h,v 1.43 2000/07/21 20:37:01 gson Exp $ */
 
 #ifndef DNS_RBT_H
 #define DNS_RBT_H 1
@@ -365,8 +365,8 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname,
  *
  *	If the chain parameter is non-NULL, then the path through the tree
  *	to the DNSSEC predecessor of the searched for name is maintained,
- *	unless the DNS_RBT_NOPREDECESSOR or DNS_RBT_NOEXACT option is used.
- *	(For more details on those options, see below.)
+ *	unless the DNS_RBTFIND_NOPREDECESSOR or DNS_RBTFIND_NOEXACT option 
+ *	is used. (For more details on those options, see below.)
  *
  *	If there is no predecessor, then the chain will point to nowhere, as
  *	indicated by chain->end being NULL or dns_rbtnodechain_current

From 42b98b222cb2aef0a74e6282c63b8a51aaaef506 Mon Sep 17 00:00:00 2001
From: Brian Wellington 
Date: Fri, 21 Jul 2000 20:38:30 +0000
Subject: [PATCH 142/226] The call to dns_tsigkey_setdeleted is no longer
 needed.

---
 bin/nsupdate/nsupdate.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index d51510d1ab..7630d86384 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: nsupdate.c,v 1.32 2000/07/19 18:24:40 mws Exp $ */
+/* $Id: nsupdate.c,v 1.33 2000/07/21 20:38:30 bwelling Exp $ */
 
 #include 
 
@@ -1307,7 +1307,6 @@ cleanup(void) {
 
 	if (key != NULL) {
 		debug("Freeing key");
-		dns_tsigkey_setdeleted(key);
 		dns_tsigkey_detach(&key);
 	}
 

From b6e3718b20bc0ece824683502c119be5307fbd00 Mon Sep 17 00:00:00 2001
From: Michael Sawyer 
Date: Fri, 21 Jul 2000 20:51:44 +0000
Subject: [PATCH 143/226] Should really allocate memory before trying to use
 it.

---
 lib/dns/zone.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 34c79d9bb0..e74cff1137 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.160 2000/07/21 20:10:03 mws Exp $ */
+/* $Id: zone.c,v 1.161 2000/07/21 20:51:44 mws Exp $ */
 
 #include 
 
@@ -1283,9 +1283,13 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters,
 		zone->masters = NULL;
 	}
 	if (zone->masterkeynames != NULL) {
-		for (i = 0; i < zone->masterscnt; i++)
+		for (i = 0; i < zone->masterscnt; i++) {
 			dns_name_free(zone->masterkeynames[i],
 				      zone->mctx);
+			isc_mem_put(zone->mctx, zone->masterkeynames[i],
+				    sizeof(dns_name_t));
+			zone->masterkeynames[i] = NULL;
+		}
 		isc_mem_put(zone->mctx, zone->masterkeynames,
 			    zone->masterscnt * sizeof *newname);
 		zone->masterkeynames = NULL;
@@ -1318,9 +1322,15 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters,
 			newname[i] = NULL;
 		for (i = 0; i < count; i++) {
 			if (keynames[i] != NULL) {
+				newname[i] = isc_mem_get(zone->mctx,
+							 sizeof(dns_name_t));
+				if (newname[i] == NULL)
+					goto allocfail;
+				dns_name_init(newname[i], NULL);
 				result = dns_name_dup(keynames[i], zone->mctx,
 						      newname[i]);
 				if (result != ISC_R_SUCCESS) {
+				allocfail:
 					for (i = 0; i < count; i++)
 						if (newname[i] != NULL)
 							dns_name_free(

From a49acbf201a411a47e18d136b38bbea8cf283ada Mon Sep 17 00:00:00 2001
From: Brian Wellington 
Date: Fri, 21 Jul 2000 20:53:59 +0000
Subject: [PATCH 144/226] Store tsig keys in an rbt, not a list.

---
 lib/dns/include/dns/tsig.h |  26 +++--
 lib/dns/tsig.c             | 194 ++++++++++++++++++++-----------------
 2 files changed, 116 insertions(+), 104 deletions(-)

diff --git a/lib/dns/include/dns/tsig.h b/lib/dns/include/dns/tsig.h
index 633aa2a78f..07b54032c9 100644
--- a/lib/dns/include/dns/tsig.h
+++ b/lib/dns/include/dns/tsig.h
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: tsig.h,v 1.25 2000/07/18 00:46:03 bwelling Exp $ */
+/* $Id: tsig.h,v 1.26 2000/07/21 20:53:59 bwelling Exp $ */
 
 #ifndef DNS_TSIG_H
 #define DNS_TSIG_H 1
@@ -42,7 +42,7 @@ extern dns_name_t *dns_tsig_hmacmd5_name;
 #define DNS_TSIG_FUDGE			300
 
 struct dns_tsig_keyring {
-	ISC_LIST(dns_tsigkey_t) keys;
+	dns_rbt_t *keys;
 	isc_rwlock_t lock;
 	isc_mem_t *mctx;
 }; 
@@ -61,10 +61,8 @@ struct dns_tsigkey {
 	dns_tsig_keyring_t	*ring;		/* the enclosing keyring */
 	isc_mutex_t		lock;
 	/* Locked */
-	isc_boolean_t		deleted;	/* has this been deleted? */
 	isc_uint32_t		refs;		/* reference counter */
 	/* Unlocked */
-	ISC_LINK(dns_tsigkey_t)	link;
 };
 
 #define dns_tsigkey_empty(tsigkey) ((tsigkey)->key == NULL)
@@ -116,25 +114,25 @@ dns_tsigkey_attach(dns_tsigkey_t *source, dns_tsigkey_t **targetp);
  */
 
 void
-dns_tsigkey_detach(dns_tsigkey_t **key);
+dns_tsigkey_detach(dns_tsigkey_t **keyp);
 /*
  *	Detaches from the tsig key structure pointed to by '*key'.
  *
  *	Requires:
- *		'key' not NULL and '*key' is a valid TSIG key
+ *		'keyp' is not NULL and '*keyp' is a valid TSIG key
  *
  *	Ensures:
- *		'key' points to NULL
+ *		'keyp' points to NULL
  */
 
 void
 dns_tsigkey_setdeleted(dns_tsigkey_t *key);
 /*
- *	Marks this key as deleted.  It will be deleted when no references
- *	exist.
+ *	Prevents this key from being used again.  It will be deleted when
+ *	no references *	exist.
  *
  *	Requires:
- *		'key' is a valid TSIG key
+ *		'key' is a valid TSIG key on a keyring
  */
 
 isc_result_t
@@ -201,13 +199,13 @@ dns_tsigkey_find(dns_tsigkey_t **tsigkey, dns_name_t *name,
 
 
 isc_result_t
-dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsig_keyring_t **ring);
+dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsig_keyring_t **ringp);
 /*
  *	Create an empty TSIG key ring.
  *
  *	Requires:
  *		'mctx' is not NULL
- *		'ring' is not NULL, and '*ring' is NULL
+ *		'ringp' is not NULL, and '*ringp' is NULL
  *
  *	Returns:
  *		ISC_R_SUCCESS
@@ -216,12 +214,12 @@ dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsig_keyring_t **ring);
 
 
 void
-dns_tsigkeyring_destroy(dns_tsig_keyring_t **ring);
+dns_tsigkeyring_destroy(dns_tsig_keyring_t **ringp);
 /*
  *	Destroy a TSIG key ring.
  *
  *	Requires:
- *		'ring' is not NULL
+ *		'ringp' is not NULL
  */
 
 ISC_LANG_ENDDECLS
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index 181ee96581..8e6547893a 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tsig.c,v 1.75 2000/07/21 20:32:12 bwelling Exp $
+ * $Id: tsig.c,v 1.76 2000/07/21 20:53:58 bwelling Exp $
  * Principal Author: Brian Wellington
  */
 
@@ -32,6 +32,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -123,12 +124,12 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm,
 	else
 		tkey->creator = NULL;
 
-	ISC_LINK_INIT(tkey, link);
 	tkey->key = NULL;
 	tkey->ring = ring;
+	tkey->refs = 0;
 
 	if (length > 0) {
-		dns_tsigkey_t *tmp;
+		dns_tsigkey_t *tmp = NULL;
 
 		isc_buffer_init(&b, secret, length);
 		isc_buffer_add(&b, length);
@@ -141,30 +142,31 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm,
 
 		if (ring != NULL) {
 			RWLOCK(&ring->lock, isc_rwlocktype_write);
-			tmp = ISC_LIST_HEAD(ring->keys);
-			while (tmp != NULL) {
-				if (dns_name_equal(&tkey->name, &tmp->name) &&
-				    !tmp->deleted)
-				{
-					ret = ISC_R_EXISTS;
-					RWUNLOCK(&ring->lock,
-						 isc_rwlocktype_write);
-					goto cleanup_algorithm;
-				}
-				tmp = ISC_LIST_NEXT(tmp, link);
+			ret = dns_rbt_findname(ring->keys, name, 0, NULL,
+					       (void *)&tmp);
+			if (ret == ISC_R_SUCCESS) {
+				ret = ISC_R_EXISTS;
+				RWUNLOCK(&ring->lock, isc_rwlocktype_write);
+				goto cleanup_algorithm;
 			}
-			ISC_LIST_APPEND(ring->keys, tkey, link);
+			INSIST(ret == ISC_R_NOTFOUND ||
+			       ret == DNS_R_PARTIALMATCH);
+			ret = dns_rbt_addname(ring->keys, name, tkey);
+			if (ret != ISC_R_SUCCESS) {
+				ret = ISC_R_EXISTS;
+				RWUNLOCK(&ring->lock, isc_rwlocktype_write);
+				goto cleanup_algorithm;
+			}
+			tkey->refs++;
 			RWUNLOCK(&ring->lock, isc_rwlocktype_write);
 		}
 	}
 
-	tkey->refs = 0;
 	if (key != NULL)
 		tkey->refs++;
 	tkey->generated = generated;
 	tkey->inception = inception;
 	tkey->expire = expire;
-	tkey->deleted = ISC_FALSE;
 	tkey->mctx = mctx;
 	ret = isc_mutex_init(&tkey->lock);
 	if (ret != ISC_R_SUCCESS) {
@@ -204,17 +206,9 @@ dns_tsigkey_attach(dns_tsigkey_t *source, dns_tsigkey_t **targetp) {
 
 static void
 tsigkey_free(dns_tsigkey_t *key) {
-	dns_tsig_keyring_t *ring;
-
 	REQUIRE(VALID_TSIG_KEY(key));
-	ring = key->ring;
 
 	key->magic = 0;
-	if (ring != NULL) {
-		RWLOCK(&ring->lock, isc_rwlocktype_write);
-		ISC_LIST_UNLINK(ring->keys, key, link);
-		RWUNLOCK(&ring->lock, isc_rwlocktype_write);
-	}
 	dns_name_free(&key->name, key->mctx);
 	dns_name_free(&key->algorithm, key->mctx);
 	if (key->key != NULL)
@@ -227,30 +221,32 @@ tsigkey_free(dns_tsigkey_t *key) {
 }
 
 void
-dns_tsigkey_detach(dns_tsigkey_t **key) {
-	dns_tsigkey_t *tkey;
+dns_tsigkey_detach(dns_tsigkey_t **keyp) {
+	dns_tsigkey_t *key;
 	isc_boolean_t should_free = ISC_FALSE;
 
-	REQUIRE(key != NULL);
-	REQUIRE(VALID_TSIG_KEY(*key));
-	tkey = *key;
-	*key = NULL;
+	REQUIRE(keyp != NULL);
+	REQUIRE(VALID_TSIG_KEY(*keyp));
+	key = *keyp;
+	*keyp = NULL;
 
-	LOCK(&tkey->lock);
-	tkey->refs--;
-	if (tkey->refs == 0 && (tkey->deleted || tkey->key == NULL))
+	LOCK(&key->lock);
+	key->refs--;
+	if (key->refs == 0)
 		should_free = ISC_TRUE;
-	UNLOCK(&tkey->lock);
+	UNLOCK(&key->lock);
 	if (should_free)
-		tsigkey_free(tkey);
+		tsigkey_free(key);
 }
 
 void
 dns_tsigkey_setdeleted(dns_tsigkey_t *key) {
-	INSIST(VALID_TSIG_KEY(key));
-	LOCK(&key->lock);
-	key->deleted = ISC_TRUE;
-	UNLOCK(&key->lock);
+	REQUIRE(VALID_TSIG_KEY(key));
+	REQUIRE(key->ring != NULL);
+
+	RWLOCK(&key->ring->lock, isc_rwlocktype_write);
+	(void)dns_rbt_deletename(key->ring->keys, &key->name, ISC_FALSE);
+	RWUNLOCK(&key->ring->lock, isc_rwlocktype_write);
 }
 
 isc_result_t
@@ -1024,6 +1020,7 @@ dns_tsigkey_find(dns_tsigkey_t **tsigkey, dns_name_t *name,
 {
 	dns_tsigkey_t *key;
 	isc_stdtime_t now;
+	isc_result_t result;
 
 	REQUIRE(tsigkey != NULL);
 	REQUIRE(*tsigkey == NULL);
@@ -1032,79 +1029,96 @@ dns_tsigkey_find(dns_tsigkey_t **tsigkey, dns_name_t *name,
 
 	isc_stdtime_get(&now);
 	RWLOCK(&ring->lock, isc_rwlocktype_read);
-	key = ISC_LIST_HEAD(ring->keys);
-	while (key != NULL) {
-		if (dns_name_equal(&key->name, name) &&
-		    (algorithm == NULL ||
-		     dns_name_equal(&key->algorithm, algorithm)) &&
-		    !key->deleted)
-		{
-			if (key->inception != key->expire &&
-			    key->expire < now)
-			{
-				/*
-				 * The key has expired.
-				 */
-				key->deleted = ISC_TRUE;
-				continue;
-			}
-			LOCK(&key->lock);
-			key->refs++;
-			UNLOCK(&key->lock);
-			*tsigkey = key;
-			RWUNLOCK(&ring->lock, isc_rwlocktype_read);
-			return (ISC_R_SUCCESS);
-		}
-		key = ISC_LIST_NEXT(key, link);
+	key = NULL;
+	result = dns_rbt_findname(ring->keys, name, 0, NULL, (void *)&key);
+	if (result == DNS_R_PARTIALMATCH || result == ISC_R_NOTFOUND) {
+		RWUNLOCK(&ring->lock, isc_rwlocktype_read);
+		return (ISC_R_NOTFOUND);
 	}
+	if (algorithm != NULL && !dns_name_equal(&key->algorithm, algorithm)) {
+		RWUNLOCK(&ring->lock, isc_rwlocktype_read);
+		return (ISC_R_NOTFOUND);
+	}
+	if (key->inception != key->expire && key->expire < now) {
+		/*
+		 * The key has expired.
+		 */
+		RWUNLOCK(&ring->lock, isc_rwlocktype_read);
+		LOCK(&key->lock);
+		key->refs--;
+		UNLOCK(&key->lock);
+		RWLOCK(&ring->lock, isc_rwlocktype_write);
+		(void) dns_rbt_deletename(ring->keys, name, ISC_FALSE);
+		RWUNLOCK(&ring->lock, isc_rwlocktype_write);
+		return (ISC_R_NOTFOUND);
+	}
+
+	LOCK(&key->lock);
+	key->refs++;
+	UNLOCK(&key->lock);
 	RWUNLOCK(&ring->lock, isc_rwlocktype_read);
-	*tsigkey = NULL;
-	return (ISC_R_NOTFOUND);
+	*tsigkey = key;
+	return (ISC_R_SUCCESS);
+}
+
+static void
+free_tsignode(void *node, void *_unused) {
+	dns_tsigkey_t *key;
+
+	UNUSED(_unused);
+
+	REQUIRE(node != NULL);
+
+	key = node;
+	dns_tsigkey_detach(&key);
 }
 
 isc_result_t
-dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsig_keyring_t **ring) {
-	isc_result_t ret;
+dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsig_keyring_t **ringp) {
+	isc_result_t result;
+	dns_tsig_keyring_t *ring;
 	
 	REQUIRE(mctx != NULL);
-	REQUIRE(ring != NULL);
-	REQUIRE(*ring == NULL);
+	REQUIRE(ringp != NULL);
+	REQUIRE(*ringp == NULL);
 
-	*ring = isc_mem_get(mctx, sizeof(dns_tsig_keyring_t));
+	ring = isc_mem_get(mctx, sizeof(dns_tsig_keyring_t));
 	if (ring == NULL)
 		return (ISC_R_NOMEMORY);
 		
-	ret = isc_rwlock_init(&(*ring)->lock, 0, 0);
-	if (ret != ISC_R_SUCCESS) {
+	result = isc_rwlock_init(&ring->lock, 0, 0);
+	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_rwlock_init() failed: %s",
-				 isc_result_totext(ret));
+				 isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
 	
-	ISC_LIST_INIT((*ring)->keys);
+	ring->keys = NULL;
+	result = dns_rbt_create(mctx, free_tsignode, NULL, &ring->keys);
+	if (result != ISC_R_SUCCESS) {
+		isc_rwlock_destroy(&ring->lock);
+		isc_mem_put(mctx, ring, sizeof(dns_tsig_keyring_t));
+		return (result);
+	}
 
-	(*ring)->mctx = mctx;
+	ring->mctx = mctx;
 
+	*ringp = ring;
 	return (ISC_R_SUCCESS);
 }
 
 void
-dns_tsigkeyring_destroy(dns_tsig_keyring_t **ring) {
-	isc_mem_t *mctx;
+dns_tsigkeyring_destroy(dns_tsig_keyring_t **ringp) {
+	dns_tsig_keyring_t *ring;
 
-	REQUIRE(ring != NULL);
-	REQUIRE(*ring != NULL);
+	REQUIRE(ringp != NULL);
+	REQUIRE(*ringp != NULL);
 
-	while (!ISC_LIST_EMPTY((*ring)->keys)) {
-		dns_tsigkey_t *key = ISC_LIST_HEAD((*ring)->keys);
-		key->refs = 0;
-		key->deleted = ISC_TRUE;
-		tsigkey_free(key);
-	}
-	isc_rwlock_destroy(&(*ring)->lock);
-	mctx = (*ring)->mctx;
-	isc_mem_put(mctx, *ring, sizeof(dns_tsig_keyring_t));
+	ring = *ringp;
+	*ringp = NULL;
 
-	*ring = NULL;
+	dns_rbt_destroy(&ring->keys);
+	isc_rwlock_destroy(&ring->lock);
+	isc_mem_put(ring->mctx, ring, sizeof(dns_tsig_keyring_t));
 }

From c3c57248e0a53d69e6005df1581d0c18448e2e67 Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Fri, 21 Jul 2000 21:02:15 +0000
Subject: [PATCH 145/226] missing NULL initialization

---
 bin/tests/rbt_test.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/bin/tests/rbt_test.c b/bin/tests/rbt_test.c
index 9656726d53..3a850fee23 100644
--- a/bin/tests/rbt_test.c
+++ b/bin/tests/rbt_test.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: rbt_test.c,v 1.31 2000/06/22 21:50:44 tale Exp $ */
+/* $Id: rbt_test.c,v 1.32 2000/07/21 21:02:15 gson Exp $ */
 
 #include 
 
@@ -260,12 +260,12 @@ iterate(dns_rbt_t *rbt, isc_boolean_t forward) {
 				printf("... %s\n", dns_result_totext(r));
 
 int
-main (int argc, char **argv) {
+main(int argc, char **argv) {
 	char *command, *arg, buffer[1024];
 	const char *whitespace;
 	dns_name_t *name, *foundname;
 	dns_fixedname_t fixedname;
-	dns_rbt_t *rbt;
+	dns_rbt_t *rbt = NULL;
 	int length, ch;
 	isc_boolean_t show_final_mem = ISC_FALSE;
 	isc_result_t result;

From 87ab7fb07d49cbfc49c283686b61c01fd2f812b4 Mon Sep 17 00:00:00 2001
From: Brian Wellington 
Date: Fri, 21 Jul 2000 21:02:46 +0000
Subject: [PATCH 146/226] The keys weren't properly freed.  Also added a "-p
 port" option and did some other cleanup.

---
 bin/tests/tkey_test.c | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/bin/tests/tkey_test.c b/bin/tests/tkey_test.c
index aedf918381..c4ad72d022 100644
--- a/bin/tests/tkey_test.c
+++ b/bin/tests/tkey_test.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: tkey_test.c,v 1.26 2000/06/22 21:50:57 tale Exp $ */
+/* $Id: tkey_test.c,v 1.27 2000/07/21 21:02:46 bwelling Exp $ */
 
 /*
  * Principal Author: Brian Wellington (core copied from res_test.c)
@@ -72,7 +72,7 @@ isc_sockaddr_t address;
 dns_message_t *query, *response, *query2, *response2;
 isc_mem_t *mctx;
 isc_entropy_t *ectx;
-dns_tsigkey_t *tsigkey;
+dns_tsigkey_t *tsigkey, *initialkey;
 isc_log_t *log = NULL;
 isc_logconfig_t *logconfig = NULL;
 dns_tsig_keyring_t *ring = NULL;
@@ -81,6 +81,7 @@ isc_buffer_t *nonce = NULL;
 dns_view_t *view = NULL;
 char output[10 * 1024];
 isc_buffer_t outbuf;
+in_port_t port = 53;
 
 static void
 senddone(isc_task_t *task, isc_event_t *event) {
@@ -114,6 +115,8 @@ recvdone(isc_task_t *task, isc_event_t *event) {
 	isc_buffer_init(&source, sevent->region.base, sevent->region.length);
 	isc_buffer_add(&source, sevent->n);
 
+	isc_event_free(&event);
+
 	response = NULL;
 	result = dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &response);
 	CHECK("dns_message_create", result);
@@ -138,8 +141,6 @@ recvdone(isc_task_t *task, isc_event_t *event) {
 	dns_message_destroy(&query);
 	dns_message_destroy(&response);
 
-	isc_event_free(&event);
-
 	buildquery2();
 }
 
@@ -176,6 +177,8 @@ recvdone2(isc_task_t *task, isc_event_t *event) {
 	isc_buffer_init(&source, sevent->region.base, sevent->region.length);
 	isc_buffer_add(&source, sevent->n);
 
+	isc_event_free(&event);
+
 	response = NULL;
 	result = dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &response2);
 	result = dns_message_getquerytsig(query2, mctx, &tsigbuf);
@@ -205,8 +208,6 @@ recvdone2(isc_task_t *task, isc_event_t *event) {
 	dns_message_destroy(&query2);
 	dns_message_destroy(&response2);
 
-	isc_event_free(&event);
-
 	isc_app_shutdown();
 }
 
@@ -217,7 +218,6 @@ buildquery(void) {
 	isc_region_t r, inr;
 	isc_result_t result;
 	dns_fixedname_t keyname;
-	dns_tsigkey_t *key = NULL;
 	isc_buffer_t namestr, keybuf, keybufin;
 	isc_lex_t *lex = NULL;
 	unsigned char keydata[3];
@@ -247,10 +247,11 @@ buildquery(void) {
 
 	isc_buffer_usedregion(&keybuf, &r);
 
+	initialkey = NULL;
 	result = dns_tsigkey_create(dns_fixedname_name(&keyname),
 				    DNS_TSIG_HMACMD5_NAME,
 				    r.base, r.length, ISC_FALSE,
-				    NULL, 0, 0, mctx, ring, &key);
+				    NULL, 0, 0, mctx, ring, &initialkey);
 	CHECK("dns_tsigkey_create", result);
 
 	result = isc_buffer_allocate(mctx, &nonce, 16);
@@ -265,7 +266,7 @@ buildquery(void) {
 	result = dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &query);
 	CHECK("dns_message_create", result);
 
-	dns_message_settsigkey(query, key);
+	dns_message_settsigkey(query, initialkey);
 
 	result = dns_tkey_builddhquery(query, ourkey, dns_rootname,
 				       DNS_TSIG_HMACMD5_NAME, nonce, 3600);
@@ -382,7 +383,7 @@ main(int argc, char *argv[]) {
 		exit(-1);
 	}
 
-	while ((ch = isc_commandline_parse(argc, argv, "vw:")) != -1) {
+	while ((ch = isc_commandline_parse(argc, argv, "vp:w:")) != -1) {
 		switch (ch) {
 		case 'v':
 			verbose = ISC_TRUE;
@@ -390,6 +391,9 @@ main(int argc, char *argv[]) {
 		case 'w':
 			workers = (unsigned int)atoi(isc_commandline_argument);
 			break;
+		case 'p':
+			port = (unsigned int)atoi(isc_commandline_argument);
+			break;
 		}
 	}
 
@@ -433,7 +437,7 @@ main(int argc, char *argv[]) {
 		      ISC_R_SUCCESS);
 
 	inaddr.s_addr = htonl(INADDR_LOOPBACK);
-	isc_sockaddr_fromin(&address, &inaddr, 53);
+	isc_sockaddr_fromin(&address, &inaddr, port);
 
 	dns_fixedname_init(&fname);
 	name = dns_fixedname_name(&fname);
@@ -468,6 +472,9 @@ main(int argc, char *argv[]) {
 
 	dst_key_free(&ourkey);
 
+	dns_tsigkey_detach(&initialkey);
+	dns_tsigkey_detach(&tsigkey);
+
 	dns_tkeyctx_destroy(&tctx);
 
 	dns_view_detach(&view);

From b6dcb3d24342d78e02b84a109dad7b5634471d8c Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Fri, 21 Jul 2000 21:13:40 +0000
Subject: [PATCH 147/226] print_name() formatted text into a buffer of 256
 character pointers, not 256 characters; also changed it to use
 dns_name_format()

---
 bin/tests/rbt_test.c | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/bin/tests/rbt_test.c b/bin/tests/rbt_test.c
index 3a850fee23..6cae01eb8b 100644
--- a/bin/tests/rbt_test.c
+++ b/bin/tests/rbt_test.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: rbt_test.c,v 1.32 2000/07/21 21:02:15 gson Exp $ */
+/* $Id: rbt_test.c,v 1.33 2000/07/21 21:13:40 gson Exp $ */
 
 #include 
 
@@ -93,17 +93,9 @@ delete_name(void *data, void *arg) {
 
 static void
 print_name(dns_name_t *name) {
-	isc_buffer_t target;
-	char *buffer[256];
-
-	isc_buffer_init(&target, buffer, sizeof(buffer));
-
-	/*
-	 * ISC_FALSE means absolute names have the final dot added.
-	 */
-	dns_name_totext(name, ISC_FALSE, &target);
-
-	printf("%.*s", (int)target.used, (char *)target.base);
+	char buffer[1024];
+	dns_name_format(name, buffer, sizeof(buffer));
+	printf("%s", buffer);
 }
 
 static void

From baf50a721077b53e1e026214290f77bee477c893 Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Fri, 21 Jul 2000 21:21:26 +0000
Subject: [PATCH 148/226] removed unsightly spaces

---
 bin/dig/dig.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index c13945a1c2..fefcaa9e1f 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dig.c,v 1.73 2000/07/20 19:41:41 mws Exp $ */
+/* $Id: dig.c,v 1.74 2000/07/21 21:21:26 gson Exp $ */
 
 #include 
 #include 
@@ -984,7 +984,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			debug("batch line %s", batchline);
 			bargc = 1;
 			bargv[bargc] = strtok(batchline, " \t\r\n");
-			while ((bargv[bargc] != NULL) && (bargc < 14 )) {
+			while ((bargv[bargc] != NULL) && (bargc < 14)) {
 				bargc++;
 				bargv[bargc] = strtok(NULL, " \t\r\n");
 			}
@@ -1038,7 +1038,7 @@ dighost_shutdown(void) {
 		debug("batch line %s", batchline);
 		bargc = 1;
 		bargv[bargc] = strtok(batchline, " \t\r\n");
-		while ((bargv[bargc] != NULL) && (bargc < 14 )) {
+		while ((bargv[bargc] != NULL) && (bargc < 14)) {
 			bargc++;
 			bargv[bargc] = strtok(NULL, " \t\r\n");
 		}

From c35f1e59379ff961b56163dd463b623898e2d0f6 Mon Sep 17 00:00:00 2001
From: James Brister 
Date: Fri, 21 Jul 2000 21:25:01 +0000
Subject: [PATCH 149/226]  341.   [func]          Support 'key' clause in
 named.conf zone masters                         statement:

                                masters {
                                        10.0.0.1 port 666 key "foo";
                                        10.0.0.2 ;
                                };
---
 CHANGES                        |   7 ++
 bin/tests/named.conf           |   5 +-
 lib/dns/config/confip.c        | 123 +++++++++++++++++++++++++++++++--
 lib/dns/config/confparser.y    |  35 +++++++---
 lib/dns/config/confzone.c      |   9 ++-
 lib/dns/include/dns/confip.h   |   9 ++-
 lib/dns/include/dns/confzone.h |  15 ++--
 7 files changed, 177 insertions(+), 26 deletions(-)

diff --git a/CHANGES b/CHANGES
index 03ecb8c67d..828b5f6158 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,10 @@
+ 341.	[func]		Support 'key' clause in named.conf zone masters 
+			statement:
+
+				masters { 
+					10.0.0.1 port 666 key "foo";
+					10.0.0.2 ;
+				};
 
  340.	[bug]		The top-level COPYRIGHT file was missing from
 			the distribution.
diff --git a/bin/tests/named.conf b/bin/tests/named.conf
index 3887ae02bc..2e67ce21c2 100644
--- a/bin/tests/named.conf
+++ b/bin/tests/named.conf
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.41 2000/07/11 19:09:01 brister Exp $ */
+/* $Id: named.conf,v 1.42 2000/07/21 21:24:55 brister Exp $ */
 
 /*
  * This is a worthless, nonrunnable example of a named.conf file that has
@@ -232,8 +232,9 @@ zone "slave.demo.zone" {
 	file "slave.demo.zone";
 	ixfr-base  "slave.demo.zone.ixfr";  // File name for IXFR transaction log file
 	masters {
-		1.2.3.4;		// where to zone transfer from
+		1.2.3.4 port 10 key "foo"; // where to zone transfer from
 		5.6.7.8;
+		6.7.8.9 key "zippo";
 	};
 	transfer-source 10.0.0.53;	// fixes multihoming problems
 	check-names warn;
diff --git a/lib/dns/config/confip.c b/lib/dns/config/confip.c
index ce429ebbe6..fbac6d7ded 100644
--- a/lib/dns/config/confip.c
+++ b/lib/dns/config/confip.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: confip.c,v 1.27 2000/06/06 15:21:46 tale Exp $ */
+/* $Id: confip.c,v 1.28 2000/07/21 21:24:56 brister Exp $ */
 
 #include 
 
@@ -775,6 +775,7 @@ isc_result_t
 dns_c_iplist_new(isc_mem_t *mem, int length, dns_c_iplist_t **newlist) {
 	dns_c_iplist_t *list;
 	size_t bytes;
+	int i;
 
 	REQUIRE(mem != NULL);
 	REQUIRE(length > 0);
@@ -791,9 +792,20 @@ dns_c_iplist_new(isc_mem_t *mem, int length, dns_c_iplist_t **newlist) {
 		isc_mem_put(mem, list, sizeof *list);
 		return (ISC_R_NOMEMORY);
 	}
-
 	memset(list->ips, 0x0, bytes);
 
+
+	bytes = sizeof (dns_name_t *) * length;
+	list->keys = isc_mem_get(mem, bytes);
+	if (list->keys == NULL) {
+		isc_mem_put(mem, list->ips, sizeof (isc_sockaddr_t) * length);
+		isc_mem_put(mem, list, sizeof *list);
+		return (ISC_R_NOMEMORY);
+	}
+	for (i = 0 ; i < length ; i++)
+		list->keys[i] = NULL;
+
+
 	list->magic = DNS_C_IPLIST_MAGIC;
 	list->size = length;
 	list->nextidx = 0;
@@ -808,6 +820,8 @@ dns_c_iplist_new(isc_mem_t *mem, int length, dns_c_iplist_t **newlist) {
 isc_result_t
 dns_c_iplist_detach(dns_c_iplist_t **list) {
 	dns_c_iplist_t *l ;
+	unsigned int i;
+	
 
 	REQUIRE(list != NULL);
 	REQUIRE(*list != NULL);
@@ -820,6 +834,16 @@ dns_c_iplist_detach(dns_c_iplist_t **list) {
 	l->refcount--;
 
 	if (l->refcount == 0) {
+		for (i = 0 ; i < l->size ; i++) {
+			if (l->keys[i] != NULL) {
+				dns_name_free(l->keys[i], l->mem);
+				isc_mem_put(l->mem, l->keys[i],
+					    sizeof (dns_name_t));
+				l->keys[i] = NULL;
+			}
+		}
+		
+		isc_mem_put(l->mem, l->keys, sizeof (dns_name_t *) * l->size);
 		isc_mem_put(l->mem, l->ips, sizeof (isc_sockaddr_t) * l->size);
 		isc_mem_put(l->mem, l, sizeof *l);
 	}
@@ -829,6 +853,26 @@ dns_c_iplist_detach(dns_c_iplist_t **list) {
 	return (ISC_R_SUCCESS);
 }
 
+
+isc_boolean_t
+dns_c_iplist_haskeys(dns_c_iplist_t *list)
+{
+	unsigned int i;
+
+	if (list->keys == NULL) {
+		return (ISC_FALSE);
+	}
+	
+	for (i = 0 ; i < list->nextidx ; i++) {
+		if (list->keys[i] != NULL) {
+			return (ISC_TRUE);
+		}
+	}
+
+	return (ISC_FALSE);
+}
+
+	
 void
 dns_c_iplist_attach(dns_c_iplist_t *source, dns_c_iplist_t **target) {
 	REQUIRE(DNS_C_IPLIST_VALID(source));
@@ -854,7 +898,22 @@ dns_c_iplist_copy(isc_mem_t *mem, dns_c_iplist_t **dest, dns_c_iplist_t *src) {
 
 	for (i = 0 ; i < src->nextidx ; i++) {
 		newl->ips[i] = src->ips[i];
+		if (src->keys[i] != NULL) {
+			newl->keys[i] = isc_mem_get(mem, sizeof (dns_name_t));
+			if (newl->keys[i] == NULL) {
+				dns_c_iplist_detach(&newl);
+				return (ISC_R_NOMEMORY);
+			} else {
+				res = dns_name_dup(src->keys[i], mem,
+						   newl->keys[i]);
+				if (res != ISC_R_SUCCESS) {
+					dns_c_iplist_detach(&newl);
+					return (res);
+				}
+			}
+		}
 	}
+	
 	newl->nextidx = src->nextidx;
 
 	*dest = newl;
@@ -875,6 +934,14 @@ dns_c_iplist_equal(dns_c_iplist_t *list1, dns_c_iplist_t *list2) {
 	for (i = 0 ; i < list1->nextidx ; i++) {
 		if (!isc_sockaddr_equal(&list1->ips[i], &list2->ips[i]))
 			return (ISC_FALSE);
+
+		if ((list1->keys[i] == NULL && list2->keys[i] != NULL) ||
+		    (list1->keys[i] != NULL && list2->keys[i] == NULL))
+			return (ISC_FALSE);
+
+		if (list1->keys[i] != NULL &&
+		    !dns_name_equal(list1->keys[i], list2->keys[i]))
+			return (ISC_FALSE);
 	}
 
 	return (ISC_TRUE);
@@ -924,6 +991,11 @@ dns_c_iplist_printfully(FILE *fp, int indent, isc_boolean_t porttoo,
 				fprintf(fp, " port %d",
 					isc_sockaddr_getport(&list->ips[i]));
 			}
+			if (list->keys[i] != NULL) {
+				fprintf(fp, " key \"");
+				dns_name_print(list->keys[i], fp);
+				fprintf(fp, "\" ");
+			}
 			fprintf(fp, ";\n");
 		}
 		dns_c_printtabs(fp, indent - 1);
@@ -939,8 +1011,10 @@ dns_c_iplist_print(FILE *fp, int indent, dns_c_iplist_t *list) {
 }
 
 isc_result_t
-dns_c_iplist_append(dns_c_iplist_t *list, isc_sockaddr_t newaddr) {
+dns_c_iplist_append(dns_c_iplist_t *list, isc_sockaddr_t newaddr,
+		    const char *key) {
 	isc_uint32_t i;
+	isc_result_t res;
 
 	REQUIRE(DNS_C_IPLIST_VALID(list));
 
@@ -956,6 +1030,7 @@ dns_c_iplist_append(dns_c_iplist_t *list, isc_sockaddr_t newaddr) {
 
 	if (list->nextidx == list->size) {
 		isc_sockaddr_t *newlist;
+		dns_name_t     **newkeys;
 		size_t newbytes;
 		size_t oldbytes = list->size * sizeof (list->ips[0]);
 		size_t newsize = list->size + 10;
@@ -971,15 +1046,46 @@ dns_c_iplist_append(dns_c_iplist_t *list, isc_sockaddr_t newaddr) {
 
 		isc_mem_put(list->mem, list->ips, oldbytes);
 		list->ips = newlist;
+
+		oldbytes = list->size * sizeof(list->keys[0]);
+		newbytes = sizeof (list->ips[0]) * newsize;
+		newkeys = isc_mem_get(list->mem, newbytes);
+		if (newkeys == NULL) {
+			return (ISC_R_NOMEMORY);
+		}
+
+		memcpy(newkeys, list->keys, oldbytes);
+		for (i = list->size ; i < newsize ; i++)
+			list->keys[i] = NULL;
+		isc_mem_put(list->mem, list->keys, oldbytes);
+		list->keys = newkeys;
+
+		i = list->size;
 		list->size = newsize;
 	}
+
 	
 	list->ips[i] = newaddr;
 	list->nextidx++;
 
-	return (ISC_R_SUCCESS);
+	res = ISC_R_SUCCESS;
+	
+	if (key != NULL) {
+		if (list->keys[i] != NULL) {
+			dns_name_free(list->keys[i], list->mem);
+			isc_mem_put(list->mem, list->keys, 
+				    sizeof (dns_name_t));
+			list->keys[i] = NULL;
+		}
+		
+		res = dns_c_charptoname(list->mem, key, &list->keys[i]);
+	}
+
+	return (res);
 }
 
+
+
 isc_result_t
 dns_c_iplist_remove(dns_c_iplist_t *list, isc_sockaddr_t newaddr) {
 	isc_uint32_t i;
@@ -987,7 +1093,7 @@ dns_c_iplist_remove(dns_c_iplist_t *list, isc_sockaddr_t newaddr) {
 	REQUIRE(DNS_C_IPLIST_VALID(list));
 	
 	for (i = 0 ; i < list->nextidx ; i++) {
-		if (memcmp(&list->ips[0], &newaddr, sizeof newaddr) == 0) {
+		if (memcmp(&list->ips[i], &newaddr, sizeof newaddr) == 0) {
 			break;
 		}
 	}
@@ -997,8 +1103,15 @@ dns_c_iplist_remove(dns_c_iplist_t *list, isc_sockaddr_t newaddr) {
 	}
 
 	list->nextidx--;
+
+	if (list->keys[i] != NULL) {
+		dns_name_reset(list->keys[i]);
+		isc_mem_put(list->mem, list->keys[i], sizeof (dns_name_t));
+	}
+	
 	for ( /* nothing */ ; i < list->nextidx ; i++) {
 		list->ips[i] = list->ips[i + 1];
+		list->keys[i] = list->keys[i + 1];
 	}
 
 	return (ISC_R_SUCCESS);
diff --git a/lib/dns/config/confparser.y b/lib/dns/config/confparser.y
index 9411eed4d8..6ec5d2f6e1 100644
--- a/lib/dns/config/confparser.y
+++ b/lib/dns/config/confparser.y
@@ -16,7 +16,7 @@
  * SOFTWARE.
  */
 
-/* $Id: confparser.y,v 1.102 2000/07/18 13:19:27 brister Exp $ */
+/* $Id: confparser.y,v 1.103 2000/07/21 21:24:57 brister Exp $ */
 
 #include 
 
@@ -443,6 +443,7 @@ static isc_boolean_t	int_too_big(isc_uint32_t base, isc_uint32_t mult);
 %type 		channel_name
 %type 		domain_name
 %type 		key_value
+%type 		maybe_key
 %type 		control_keys
 %type 		keyid_list
 %type 		ordering_name
@@ -1646,6 +1647,15 @@ transfer_format: L_ONE_ANSWER
 	;
 
 
+maybe_key: /* nothing */
+	{
+		$$ = NULL;
+	}
+	| L_SEC_KEY any_string
+	{
+		$$ = $2;
+	};
+
 maybe_wild_addr: ip4_address
 	| ip6_address
 	| L_STRING
@@ -1748,7 +1758,7 @@ ip_and_port_element: ip_address maybe_zero_port
 	};
 
 
-ip_and_port_list: ip_and_port_element L_EOS
+ip_and_port_list: ip_and_port_element maybe_key L_EOS
 	{
 		dns_c_iplist_t *list;
 
@@ -1759,24 +1769,32 @@ ip_and_port_list: ip_and_port_element L_EOS
 			YYABORT;
 		}
 
-		tmpres = dns_c_iplist_append(list, $1);
+		tmpres = dns_c_iplist_append(list, $1, $2);
 		if (tmpres != ISC_R_SUCCESS) {
 			parser_error(ISC_TRUE,
 				     "failed to append master address");
 			YYABORT;
 		}
 
+		if ($2 != NULL) {
+			isc_mem_free(memctx, $2);
+		}
+		
 		$$ = list;
 	}
-	| ip_and_port_list ip_and_port_element L_EOS
+	| ip_and_port_list ip_and_port_element maybe_key L_EOS
 	{
-		tmpres = dns_c_iplist_append($1, $2);
+		tmpres = dns_c_iplist_append($1, $2, $3);
 		if (tmpres != ISC_R_SUCCESS) {
 			parser_error(ISC_TRUE,
 				     "failed to append master address");
 			YYABORT;
 		}
 
+		if ($3 != NULL) {
+			isc_mem_free(memctx, $3);
+		}
+		
 		$$ = $1;
 	}
 	;
@@ -2113,7 +2131,8 @@ forwarders_in_addr_list: forwarders_in_addr L_EOS
 
 forwarders_in_addr: ip_address
 	{
-		tmpres = dns_c_iplist_append(currcfg->options->forwarders, $1);
+		tmpres = dns_c_iplist_append(currcfg->options->forwarders,
+					     $1, NULL);
 		if (tmpres != ISC_R_SUCCESS) {
 			parser_error(ISC_FALSE,
 				     "failed to add forwarders "
@@ -4945,7 +4964,7 @@ in_addr_list: in_addr_elem L_EOS
 			YYABORT;
 		}
 
-		tmpres = dns_c_iplist_append(list, $1);
+		tmpres = dns_c_iplist_append(list, $1, NULL);
 		if (tmpres != ISC_R_SUCCESS) {
 			parser_error(ISC_TRUE,
 				     "failed to append master address");
@@ -4956,7 +4975,7 @@ in_addr_list: in_addr_elem L_EOS
 	}
 	| in_addr_list in_addr_elem L_EOS
 	{
-		tmpres = dns_c_iplist_append($1, $2);
+		tmpres = dns_c_iplist_append($1, $2, NULL);
 		if (tmpres != ISC_R_SUCCESS) {
 			parser_error(ISC_TRUE,
 				     "failed to append master address");
diff --git a/lib/dns/config/confzone.c b/lib/dns/config/confzone.c
index 057ff831ec..a5fddf7822 100644
--- a/lib/dns/config/confzone.c
+++ b/lib/dns/config/confzone.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: confzone.c,v 1.47 2000/06/05 09:17:09 brister Exp $ */
+/* $Id: confzone.c,v 1.48 2000/07/21 21:24:59 brister Exp $ */
 
 #include 
 
@@ -596,7 +596,7 @@ dns_c_zone_validate(dns_c_zone_t *zone)
 	
 		
 	/*
-	 * Check for allow-update and update-policty together
+	 * Check for allow-update and update-policy together
 	 */
 	if (zone->ztype == dns_c_zone_master) {
 		tmpres = dns_c_zone_getallowupd(zone, &ipmlist);
@@ -633,6 +633,11 @@ dns_c_zone_validate(dns_c_zone_t *zone)
 		}
 	}
 
+
+	/* XXX TODO make sure no 'key' clauses were given on any iplist
+	   except for masters{}; */ 
+		
+
 	return (result);
 }
 
diff --git a/lib/dns/include/dns/confip.h b/lib/dns/include/dns/confip.h
index e94e972492..4d6833f239 100644
--- a/lib/dns/include/dns/confip.h
+++ b/lib/dns/include/dns/confip.h
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: confip.h,v 1.22 2000/06/23 02:59:04 tale Exp $ */
+/* $Id: confip.h,v 1.23 2000/07/21 21:25:00 brister Exp $ */
 
 #ifndef DNS_CONFIP_H
 #define DNS_CONFIP_H 1
@@ -59,6 +59,7 @@
 #include 
 
 #include 
+#include 
 
 #define DNS_C_IPLIST_MAGIC 0x49706c73		/* Ipls */
 #define DNS_C_IPMDIRECT_MAGIC 0x49506d64	/* IPmd */
@@ -94,6 +95,7 @@ struct dns_c_iplist {
 	isc_mem_t	       *mem;
 	int			refcount;
 	isc_sockaddr_t	       *ips;
+	dns_name_t	       **keys;
 	isc_uint32_t		size;
 	isc_uint32_t		nextidx;
 };
@@ -225,9 +227,12 @@ isc_result_t dns_c_iplist_detach(dns_c_iplist_t **list);
 isc_result_t dns_c_iplist_copy(isc_mem_t *mem, dns_c_iplist_t **dest,
 			       dns_c_iplist_t *src);
 
+isc_boolean_t dns_c_iplist_haskeys(dns_c_iplist_t *list);
+
 void dns_c_iplist_attach(dns_c_iplist_t *source, dns_c_iplist_t **target);
 
-isc_result_t dns_c_iplist_append(dns_c_iplist_t *list, isc_sockaddr_t newaddr);
+isc_result_t dns_c_iplist_append(dns_c_iplist_t *list,
+				 isc_sockaddr_t newaddr, const char *key);
 
 isc_result_t dns_c_iplist_remove(dns_c_iplist_t *list, isc_sockaddr_t newaddr);
 
diff --git a/lib/dns/include/dns/confzone.h b/lib/dns/include/dns/confzone.h
index c6ce0f6cec..7f18cebca3 100644
--- a/lib/dns/include/dns/confzone.h
+++ b/lib/dns/include/dns/confzone.h
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: confzone.h,v 1.35 2000/06/22 21:55:31 tale Exp $ */
+/* $Id: confzone.h,v 1.36 2000/07/21 21:25:01 brister Exp $ */
 
 #ifndef DNS_CONFZONE_H
 #define DNS_CONFZONE_H 1
@@ -79,18 +79,14 @@ typedef struct dns_c_hint_zone		dns_c_hintzone_t;
 typedef struct dns_c_zone		dns_c_zone_t;
 typedef struct dns_c_zonelem		dns_c_zonelem_t;
 
-#if 0
-/* this typedef moved to confcommon.h for confview.h to get at (circular
- * include dependencies between view and zone structures.
- */
-typedef struct dns_c_zone_list		dns_c_zonelist_t;
-#endif
+
 
 struct dns_c_zonelem {
 	dns_c_zone_t	*thezone;
 	ISC_LINK(dns_c_zonelem_t) next;
 };
 
+
 struct dns_c_zone_list {
 	isc_int32_t 		magic;
 	isc_mem_t	       *mem;
@@ -98,6 +94,7 @@ struct dns_c_zone_list {
 	ISC_LIST(dns_c_zonelem_t)	zones;
 };
 
+
 struct dns_c_master_zone {
 	char		       *file;
 	dns_severity_t	check_names;
@@ -223,6 +220,10 @@ struct dns_c_zone {
 ISC_LANG_BEGINDECLS
 
 
+
+/*
+ */
+
 isc_result_t dns_c_zonelist_new(isc_mem_t *mem, dns_c_zonelist_t **zlist);
 isc_result_t dns_c_zonelist_delete(dns_c_zonelist_t **zlist);
 isc_result_t dns_c_zonelist_checkzones(dns_c_zonelist_t *zlist);

From 5aa7bca7337901ad986c5da6c3ab75e59973793f Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Fri, 21 Jul 2000 22:08:42 +0000
Subject: [PATCH 150/226] dns_rbt_printnode() formatted the node name into a
 buffer of 255 char pointers, not 255 chars; changed it to use
 dns_name_format()

---
 lib/dns/rbt.c | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
index 9665df316e..4ecaf2055a 100644
--- a/lib/dns/rbt.c
+++ b/lib/dns/rbt.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: rbt.c,v 1.85 2000/07/14 19:17:39 tale Exp $ */
+/* $Id: rbt.c,v 1.86 2000/07/21 22:08:42 gson Exp $ */
 
 /* Principal Authors: DCL */
 
@@ -1841,26 +1841,19 @@ dns_rbt_indent(int depth) {
 
 static void
 dns_rbt_printnodename(dns_rbtnode_t *node) {
-	char *buffer[255];
-	isc_buffer_t target;
 	isc_region_t r;
 	dns_name_t name;
-	dns_offsets_t offsets;
+	char buffer[1024];
 
 	r.length = NAMELEN(node);
 	r.base = NAME(node);
 
-	dns_name_init(&name, offsets);
+	dns_name_init(&name, NULL);
 	dns_name_fromregion(&name, &r);
 
-	isc_buffer_init(&target, buffer, 255);
+	dns_name_format(&name, buffer, sizeof(buffer));
 
-	/*
-	 * ISC_FALSE means absolute names have the final dot added.
-	 */
-	dns_name_totext(&name, ISC_FALSE, &target);
-
-	printf("%.*s", (int)target.used, (char *)target.base);
+	printf("%s", buffer);
 }
 
 static void

From 2483a850e8b82230331defb0e22c67f6b46cfb38 Mon Sep 17 00:00:00 2001
From: Brian Wellington 
Date: Fri, 21 Jul 2000 22:22:55 +0000
Subject: [PATCH 151/226] The call to dns_tsig_verify doesn't need a keyring.

---
 lib/dns/request.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/lib/dns/request.c b/lib/dns/request.c
index f896bd3824..fb140e73f3 100644
--- a/lib/dns/request.c
+++ b/lib/dns/request.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: request.c,v 1.27 2000/07/21 20:33:13 bwelling Exp $ */
+/* $Id: request.c,v 1.28 2000/07/21 22:22:55 bwelling Exp $ */
 
 #include 
 
@@ -748,8 +748,7 @@ dns_request_getresponse(dns_request_t *request, dns_message_t *message,
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	if (request->tsigkey != NULL)
-		result = dns_tsig_verify(request->answer, message,
-					 NULL, request->tsigkey->ring);
+		result = dns_tsig_verify(request->answer, message, NULL, NULL);
 	return (result);
 }
 

From f840a7bd0d50ba1fd87e92d8e07a7fd221491e87 Mon Sep 17 00:00:00 2001
From: Michael Sawyer 
Date: Fri, 21 Jul 2000 22:25:15 +0000
Subject: [PATCH 152/226] Remove unused variable, fix char*[] variable

---
 bin/dig/dighost.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 8e78b5da37..dd0678994c 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.95 2000/07/20 19:41:42 mws Exp $ */
+/* $Id: dighost.c,v 1.96 2000/07/21 22:25:15 mws Exp $ */
 
 /*
  * Notice to programmers:  Do not use this code as an example of how to
@@ -85,7 +85,6 @@ isc_timermgr_t *timermgr = NULL;
 isc_socketmgr_t *socketmgr = NULL;
 isc_sockaddr_t bind_address;
 isc_sockaddr_t bind_any;
-char *rootspace[BUFSIZE];
 isc_buffer_t rootbuf;
 int sendcount = 0;
 int recvcount = 0;
@@ -1727,7 +1726,7 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 	isc_result_t result;
 	isc_buffer_t b;
 	isc_region_t r;
-	char *abspace[MXNAME];
+	char abspace[MXNAME];
 	isc_boolean_t atlimit=ISC_FALSE;
 
 	debug("check_for_more_data()");

From 4e160a846f7bf8b18abf56c39206f5e35a73ddf5 Mon Sep 17 00:00:00 2001
From: Brian Wellington 
Date: Fri, 21 Jul 2000 22:26:08 +0000
Subject: [PATCH 153/226] Removed the tsig keyring, since it's no longer
 needed.

---
 bin/dig/dighost.c | 18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index dd0678994c..98786b42ec 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.96 2000/07/21 22:25:15 mws Exp $ */
+/* $Id: dighost.c,v 1.97 2000/07/21 22:26:08 bwelling Exp $ */
 
 /*
  * Notice to programmers:  Do not use this code as an example of how to
@@ -98,7 +98,6 @@ char keynametext[MXNAME];
 char keyfile[MXNAME] = "";
 char keysecret[MXNAME] = "";
 dns_name_t keyname;
-dns_tsig_keyring_t *keyring = NULL;
 isc_buffer_t *namebuf = NULL;
 dns_tsigkey_t *key = NULL;
 isc_boolean_t validated = ISC_TRUE;
@@ -383,8 +382,6 @@ setup_text_key(void) {
 	isc_stdtime_t now;
 
 	debug("setup_text_key()");
-	result = dns_tsigkeyring_create(mctx, &keyring);
-	check_result(result, "dns_tsigkeyring_create");
 	result = isc_buffer_allocate(mctx, &namebuf, MXNAME);
 	check_result(result, "isc_buffer_allocate");
 	dns_name_init(&keyname, NULL);
@@ -417,7 +414,7 @@ setup_text_key(void) {
 	result = dns_tsigkey_create(&keyname, dns_tsig_hmacmd5_name,
 				    secretstore, secretsize,
 				    ISC_TRUE, NULL, now, now, mctx,
-				    keyring, &key);
+				    NULL, &key);
 	if (result != ISC_R_SUCCESS) {
 		printf(";; Couldn't create key %s: %s\n",
 		       keynametext, dns_result_totext(result));
@@ -441,8 +438,6 @@ setup_file_key(void) {
 
 	
 	debug("setup_file_key()");
-	result = dns_tsigkeyring_create(mctx, &keyring);
-	check_result(result, "dns_tsigkeyring_create");
 	result = dst_key_fromnamedfile(keyfile, DST_TYPE_PRIVATE,
 				       mctx, &dstkey);
 	if (result != ISC_R_SUCCESS) {
@@ -467,7 +462,7 @@ setup_file_key(void) {
 	result = dns_tsigkey_create(&keyname, dns_tsig_hmacmd5_name,
 				    secretstore, secretlen,
 				    ISC_TRUE, NULL, now, now, mctx,
-				    keyring, &key);
+				    NULL, &key);
 	if (result != ISC_R_SUCCESS) {
 		printf(";; Couldn't create key %s: %s\n",
 		       keynametext, dns_result_totext(result));
@@ -1985,7 +1980,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 			debug("querysig 2 is %p", l->querysig);
 			debug("before verify");
 			result = dns_tsig_verify(&query->recvbuf, msg,
-						 NULL, keyring);
+						 NULL, NULL);
 			debug("after verify");
 			if (result != ISC_R_SUCCESS) {
 				printf(";; Couldn't verify signature: %s\n",
@@ -2423,16 +2418,11 @@ destroy_libs(void) {
 	}
 	if (key != NULL) {
 		debug("freeing key %p", key);
-		dns_tsigkey_setdeleted(key);
 		dns_tsigkey_detach(&key);
 	}
 	if (namebuf != NULL)
 		isc_buffer_free(&namebuf);
 
-	if (keyring != NULL) {
-		debug("freeing keyring %p", keyring);
-		dns_tsigkeyring_destroy(&keyring);
-	}
 	if (is_dst_up) {
 		debug("destroy DST lib");
 		dst_lib_destroy();

From 87f4c7933fd2962cca3b9b7e046327f3c6306b84 Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Fri, 21 Jul 2000 22:31:12 +0000
Subject: [PATCH 154/226]  343.   [bug]           Although zone maintenance SOA
 queries and                         notify requests were signed with TSIG
 keys                         when configured for the server in case,         
                the TSIG was not verified on the response.

 342.   [bug]           The wrong name was being passed to
                        dns_name_dup() when generating a TSIG
                        key using TKEY.
---
 CHANGES | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/CHANGES b/CHANGES
index 828b5f6158..1da32eaecc 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,12 @@
+ 343.	[bug]		Although zone maintenance SOA queries and
+			notify requests were signed with TSIG keys
+			when configured for the server in case,
+			the TSIG was not verified on the response.
+
+ 342.	[bug]		The wrong name was being passed to
+			dns_name_dup() when generating a TSIG
+			key using TKEY.
+
  341.	[func]		Support 'key' clause in named.conf zone masters 
 			statement:
 

From 3b2efab212088496d5588ca5ed2d802c72d21a08 Mon Sep 17 00:00:00 2001
From: Brian Wellington 
Date: Fri, 21 Jul 2000 22:38:31 +0000
Subject: [PATCH 155/226] There's no real difference between the "sring" and
 "dring" parameters, so call them "ring1" and "ring2" instead.  Also remove a
 bogus assertion.

---
 lib/dns/include/dns/tsig.h |  7 +++----
 lib/dns/tsig.c             | 14 ++++++--------
 2 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/lib/dns/include/dns/tsig.h b/lib/dns/include/dns/tsig.h
index 07b54032c9..3a02ba2854 100644
--- a/lib/dns/include/dns/tsig.h
+++ b/lib/dns/include/dns/tsig.h
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: tsig.h,v 1.26 2000/07/21 20:53:59 bwelling Exp $ */
+/* $Id: tsig.h,v 1.27 2000/07/21 22:38:31 bwelling Exp $ */
 
 #ifndef DNS_TSIG_H
 #define DNS_TSIG_H 1
@@ -155,7 +155,7 @@ dns_tsig_sign(dns_message_t *msg);
 
 isc_result_t
 dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
-		dns_tsig_keyring_t *sring, dns_tsig_keyring_t *dring);
+		dns_tsig_keyring_t *ring1, dns_tsig_keyring_t *ring2);
 /*
  *	Verifies the TSIG record in this message
  *
@@ -165,8 +165,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
  *		'msg->tsigkey' is a valid TSIG key if this is a response
  *		'msg->tsig' is NULL
  *		'msg->querytsig' is not NULL if this is a response
- *		'sring' is a valid keyring or NULL
- *		'dring' is a valid keyring or NULL
+ *		'ring1' and 'ring2' are each either a valid keyring or NULL
  *
  *	Returns:
  *		ISC_R_SUCCESS
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index 8e6547893a..90599f1097 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tsig.c,v 1.76 2000/07/21 20:53:58 bwelling Exp $
+ * $Id: tsig.c,v 1.77 2000/07/21 22:38:29 bwelling Exp $
  * Principal Author: Brian Wellington
  */
 
@@ -549,7 +549,7 @@ cleanup_other:
 
 isc_result_t
 dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
-		dns_tsig_keyring_t *sring, dns_tsig_keyring_t *dring)
+		dns_tsig_keyring_t *ring1, dns_tsig_keyring_t *ring2)
 {
 	dns_rdata_any_tsig_t tsig, querytsig;
 	isc_region_t r, source_r, header_r, sig_r;
@@ -636,15 +636,13 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 	 */
 	if (tsigkey == NULL) {
 		ret = ISC_R_NOTFOUND;
-		if (sring != NULL)
+		if (ring1 != NULL)
 			ret = dns_tsigkey_find(&tsigkey, keyname,
-					       &tsig.algorithm, sring); 
-		if (ret == ISC_R_NOTFOUND && dring != NULL)
+					       &tsig.algorithm, ring1); 
+		if (ret == ISC_R_NOTFOUND && ring2 != NULL)
 			ret = dns_tsigkey_find(&tsigkey, keyname,
-					       &tsig.algorithm, dring);
+					       &tsig.algorithm, ring2);
 		if (ret != ISC_R_SUCCESS) {
-			if (dring == NULL)
-				return (DNS_R_TSIGVERIFYFAILURE);
 			msg->tsigstatus = dns_tsigerror_badkey;
 			ret = dns_tsigkey_create(keyname, &tsig.algorithm,
 						 NULL, 0, ISC_FALSE, NULL,

From 9bef4575d71a084edf59ac681e53e35ae1b72166 Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Fri, 21 Jul 2000 22:45:44 +0000
Subject: [PATCH 156/226]  344.   [bug]           When shutting down, lwresd
 sometimes tried                         to shut down its client tasks twice, 
                        triggering an assertion. (fixed in lwresd.c 1.11)

---
 CHANGES | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/CHANGES b/CHANGES
index 1da32eaecc..e92adf5038 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+
+ 344.	[bug]		When shutting down, lwresd sometimes tried
+			to shut down its client tasks twice, 
+			triggering an assertion.
+
  343.	[bug]		Although zone maintenance SOA queries and
 			notify requests were signed with TSIG keys
 			when configured for the server in case,

From c27767a7b946f4c6f08d33129691e2d6339e8350 Mon Sep 17 00:00:00 2001
From: Brian Wellington 
Date: Fri, 21 Jul 2000 23:00:31 +0000
Subject: [PATCH 157/226] tsig keys were not properly ref counted

---
 lib/dns/request.c | 7 +++++--
 lib/dns/xfrin.c   | 9 +++++++--
 lib/dns/zone.c    | 9 ++++++++-
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/lib/dns/request.c b/lib/dns/request.c
index fb140e73f3..8f73003cd2 100644
--- a/lib/dns/request.c
+++ b/lib/dns/request.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: request.c,v 1.28 2000/07/21 22:22:55 bwelling Exp $ */
+/* $Id: request.c,v 1.29 2000/07/21 23:00:26 bwelling Exp $ */
 
 #include 
 
@@ -493,7 +493,8 @@ dns_request_create(dns_requestmgr_t *requestmgr, dns_message_t *message,
 	request->event->ev_sender = task;
 	request->event->request = request;
 	request->event->result = ISC_R_FAILURE;
-	request->tsigkey = key;
+	if (key != NULL)
+		dns_tsigkey_attach(key, &request->tsigkey);
 	
  use_tcp:
 	if ((options & DNS_REQUESTOPT_TCP) != 0) {
@@ -934,6 +935,8 @@ req_destroy(dns_request_t *request) {
 		isc_timer_detach(&request->timer);
 	if (request->tsig != NULL)
 		isc_buffer_free(&request->tsig);
+	if (request->tsigkey != NULL)
+		dns_tsigkey_detach(&request->tsigkey);
 	requestmgr_detach(&request->requestmgr);
 	mctx = request->mctx;
 	isc_mem_put(mctx, request, sizeof(*request));
diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
index 278b5d506d..cd50bfe4d3 100644
--- a/lib/dns/xfrin.c
+++ b/lib/dns/xfrin.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: xfrin.c,v 1.83 2000/07/13 00:27:17 bwelling Exp $ */
+/* $Id: xfrin.c,v 1.84 2000/07/21 23:00:29 bwelling Exp $ */
 
 #include 
 
@@ -653,7 +653,9 @@ xfrin_create(isc_mem_t *mctx,
 
 	xfr->nmsg = 0;
 
-	xfr->tsigkey = tsigkey;
+	xfr->tsigkey = NULL;
+	if (tsigkey != NULL)
+		dns_tsigkey_attach(tsigkey, &xfr->tsigkey);
 	xfr->lasttsig = NULL;
 	xfr->tsigctx = NULL;
 	xfr->sincetsig = 0;
@@ -1154,6 +1156,9 @@ maybe_free(dns_xfrin_ctx_t *xfr) {
 	if (xfr->task != NULL)
 		isc_task_detach(&xfr->task);
 
+	if (xfr->tsigkey != NULL)
+		dns_tsigkey_detach(&xfr->tsigkey);
+
 	if (xfr->lasttsig != NULL)
 		isc_buffer_free(&xfr->lasttsig);
 
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index e74cff1137..1df798bc6e 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.161 2000/07/21 20:51:44 mws Exp $ */
+/* $Id: zone.c,v 1.162 2000/07/21 23:00:31 bwelling Exp $ */
 
 #include 
 
@@ -1862,6 +1862,8 @@ notify_send_toaddr(isc_task_t *task, isc_event_t *event) {
 				    notify->zone->task,
 				    notify_done, notify,
 				    ¬ify->request);
+	if (key != NULL)
+		dns_tsigkey_detach(&key);
 	dns_message_destroy(&message);
  cleanup:
 	if (result != ISC_R_SUCCESS)
@@ -2725,6 +2727,8 @@ soa_query(isc_task_t *task, isc_event_t *event) {
 			 dns_result_totext(result));
 		goto cleanup;
 	}
+	if (key != NULL)
+		dns_tsigkey_detach(&key);
 	dns_message_destroy(&message);
 	isc_event_free(&event);
 	dns_zone_idetach(&zone);
@@ -4050,6 +4054,9 @@ got_transfer_quota(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (result != ISC_R_SUCCESS)
 		zone_xfrdone(zone, result);
+
+	if (tsigkey != NULL)
+		dns_tsigkey_detach(&tsigkey);
 	
 	isc_event_free(&event);
 

From 3f290e501ef10202d3dec02da333c568c3a93acc Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Fri, 21 Jul 2000 23:04:44 +0000
Subject: [PATCH 158/226] don't use initial capital letter in log message

---
 bin/dig/dighost.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 98786b42ec..21e4c73a9e 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.97 2000/07/21 22:26:08 bwelling Exp $ */
+/* $Id: dighost.c,v 1.98 2000/07/21 23:04:44 gson Exp $ */
 
 /*
  * Notice to programmers:  Do not use this code as an example of how to
@@ -2376,7 +2376,7 @@ destroy_libs(void) {
 	 * from the task.
 	 */
 	if (taskmgr != NULL) {
-		debug("Freeing taskmgr");
+		debug("freeing taskmgr");
 		isc_taskmgr_destroy(&taskmgr);
         }
 	LOCK_LOOKUP;

From 03710795136598c0acd0cff6119e1f1205b9083b Mon Sep 17 00:00:00 2001
From: Michael Sawyer 
Date: Fri, 21 Jul 2000 23:13:59 +0000
Subject: [PATCH 159/226] Wire up key option in masters line.

---
 bin/named/zoneconf.c |  6 +-----
 lib/dns/zone.c       | 40 +++++++++++++++++++---------------------
 lib/dns/zoneconf.c   |  6 +-----
 3 files changed, 21 insertions(+), 31 deletions(-)

diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index beffe2045c..8fcf1357de 100644
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: zoneconf.c,v 1.44 2000/07/21 18:47:22 mws Exp $ */
+/* $Id: zoneconf.c,v 1.45 2000/07/21 23:13:59 mws Exp $ */
 
 #include 
 
@@ -267,14 +267,10 @@ dns_zone_configure(dns_c_ctx_t *cctx, dns_c_view_t *cview,
 		iplist = NULL;
 		result = dns_c_zone_getmasterips(czone, &iplist);
 		if (result == ISC_R_SUCCESS)
-#if 0
 			result = dns_zone_setmasterswithkeys(zone,
 							     iplist->ips,
 							     iplist->keys,
 							     iplist->nextidx);
-#endif
-		        result = dns_zone_setmasters(zone, iplist->ips,
-						     iplist->nextidx);
 		else
 			result = dns_zone_setmasters(zone, NULL, 0);
 		RETERR(result);
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 1df798bc6e..296e21edaa 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.162 2000/07/21 23:00:31 bwelling Exp $ */
+/* $Id: zone.c,v 1.163 2000/07/21 23:13:58 mws Exp $ */
 
 #include 
 
@@ -1284,14 +1284,17 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters,
 	}
 	if (zone->masterkeynames != NULL) {
 		for (i = 0; i < zone->masterscnt; i++) {
-			dns_name_free(zone->masterkeynames[i],
-				      zone->mctx);
-			isc_mem_put(zone->mctx, zone->masterkeynames[i],
-				    sizeof(dns_name_t));
-			zone->masterkeynames[i] = NULL;
+			if (zone->masterkeynames[i] != NULL) {
+				dns_name_free(zone->masterkeynames[i],
+					      zone->mctx);
+				isc_mem_put(zone->mctx,
+					    zone->masterkeynames[i],
+					    sizeof(dns_name_t));
+				zone->masterkeynames[i] = NULL;
+			}
 		}
 		isc_mem_put(zone->mctx, zone->masterkeynames,
-			    zone->masterscnt * sizeof *newname);
+			    zone->masterscnt * sizeof(dns_name_t *));
 		zone->masterkeynames = NULL;
 	}
 	zone->masterscnt = 0;
@@ -3957,6 +3960,8 @@ got_transfer_quota(isc_task_t *task, isc_event_t *event) {
 	dns_rdatatype_t xfrtype;
 	dns_zone_t *zone = event->ev_arg;
 	isc_netaddr_t masterip;
+	isc_boolean_t gotkey = ISC_FALSE;
+	dns_view_t *view = NULL;
 	
 	UNUSED(task);
 	
@@ -4010,24 +4015,17 @@ got_transfer_quota(isc_task_t *task, isc_event_t *event) {
 	 */
 	if ((zone->masterkeynames != NULL) &&
 	    (zone->masterkeynames[zone->curmaster] != NULL)) {
-		dns_view_t *view = dns_zone_getview(zone);
+		view = dns_zone_getview(zone);
 		keyname = zone->masterkeynames[zone->curmaster];
-		result = dns_tsigkey_find(&tsigkey, keyname, NULL,
-					  view->statickeys);
-		if (result == ISC_R_NOTFOUND)
-			result = dns_tsigkey_find(&tsigkey, keyname, NULL,
-						  view->dynamickeys);
-		if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
-			zone_log(zone, me, ISC_LOG_ERROR,
-				 "error getting tsig keys "
-				 "for zone transfer: %s",
-				 isc_result_totext(result));
-			goto cleanup;
-		}
+		gotkey = ISC_TRUE;
 	}
 	else if (peer != NULL &&
 		 dns_peer_getkey(peer, &keyname) == ISC_R_SUCCESS) {
-		dns_view_t *view = dns_zone_getview(zone);
+		view = dns_zone_getview(zone);
+		gotkey = ISC_TRUE;
+	}
+
+	if (gotkey) {
 		result = dns_tsigkey_find(&tsigkey, keyname, NULL,
 					  view->statickeys);
 		if (result == ISC_R_NOTFOUND)
diff --git a/lib/dns/zoneconf.c b/lib/dns/zoneconf.c
index beffe2045c..8fcf1357de 100644
--- a/lib/dns/zoneconf.c
+++ b/lib/dns/zoneconf.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: zoneconf.c,v 1.44 2000/07/21 18:47:22 mws Exp $ */
+/* $Id: zoneconf.c,v 1.45 2000/07/21 23:13:59 mws Exp $ */
 
 #include 
 
@@ -267,14 +267,10 @@ dns_zone_configure(dns_c_ctx_t *cctx, dns_c_view_t *cview,
 		iplist = NULL;
 		result = dns_c_zone_getmasterips(czone, &iplist);
 		if (result == ISC_R_SUCCESS)
-#if 0
 			result = dns_zone_setmasterswithkeys(zone,
 							     iplist->ips,
 							     iplist->keys,
 							     iplist->nextidx);
-#endif
-		        result = dns_zone_setmasters(zone, iplist->ips,
-						     iplist->nextidx);
 		else
 			result = dns_zone_setmasters(zone, NULL, 0);
 		RETERR(result);

From f5925504984d2dc56a701ea573572d0808ae6d0d Mon Sep 17 00:00:00 2001
From: Michael Sawyer 
Date: Sat, 22 Jul 2000 00:27:40 +0000
Subject: [PATCH 160/226] Add comments and make a slight REQUIRE change

---
 lib/dns/zone.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 296e21edaa..a608ccf1dd 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.163 2000/07/21 23:13:58 mws Exp $ */
+/* $Id: zone.c,v 1.164 2000/07/22 00:27:40 mws Exp $ */
 
 #include 
 
@@ -1270,7 +1270,7 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters,
 	unsigned int i;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
-	REQUIRE((masters == NULL && count == 0) ||
+	REQUIRE((count == 0) ||
 		(masters != NULL && count != 0));
 	if (keynames != NULL) {
 		REQUIRE(count != 0);
@@ -1298,9 +1298,16 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters,
 		zone->masterkeynames = NULL;
 	}
 	zone->masterscnt = 0;
-	if (masters == NULL)
+	/*
+	 * If count == 0, don't allocate any space for masters or keynames
+	 * so internally, those pointers are NULL if count == 0
+	 */
+	if (count == 0)
 		goto unlock;
 
+	/*
+	 * masters must countain count elements!
+	 */
 	new = isc_mem_get(zone->mctx,
 			  count * sizeof(isc_sockaddr_t));
 	if (new == NULL) {
@@ -1312,6 +1319,9 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters,
 	zone->masterscnt = count;
 	zone->flags &= ~DNS_ZONEFLG_NOMASTERS;
 
+	/*
+	 * if keynames is non-NULL, it must contain count elements!
+	 */
 	if (keynames != NULL) {
 		newname = isc_mem_get(zone->mctx,
 				      count * sizeof(dns_name_t *));

From 2f0bfccf31589ed2b8090fcba797cf7d3c7de06e Mon Sep 17 00:00:00 2001
From: Michael Sawyer 
Date: Sat, 22 Jul 2000 00:40:39 +0000
Subject: [PATCH 161/226] Remove dead REQUIRE

---
 lib/dns/zone.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index a608ccf1dd..c44fa0e007 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.164 2000/07/22 00:27:40 mws Exp $ */
+/* $Id: zone.c,v 1.165 2000/07/22 00:40:39 mws Exp $ */
 
 #include 
 
@@ -1270,8 +1270,7 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone, isc_sockaddr_t *masters,
 	unsigned int i;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
-	REQUIRE((count == 0) ||
-		(masters != NULL && count != 0));
+	REQUIRE(count == 0 || masters != NULL);
 	if (keynames != NULL) {
 		REQUIRE(count != 0);
 	}

From 1b1775921e4f2ad64bb5c06400a0daac1ea05085 Mon Sep 17 00:00:00 2001
From: Brian Wellington 
Date: Mon, 24 Jul 2000 05:30:30 +0000
Subject: [PATCH 162/226] If a message is built for one host, which isn't
 powered on, the tsig object wasn't removed until the xfer object was deleted,
 so when the xfer tried the second master, it asserted.

---
 lib/dns/xfrin.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
index cd50bfe4d3..cffb324df2 100644
--- a/lib/dns/xfrin.c
+++ b/lib/dns/xfrin.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: xfrin.c,v 1.84 2000/07/21 23:00:29 bwelling Exp $ */
+/* $Id: xfrin.c,v 1.85 2000/07/24 05:30:30 bwelling Exp $ */
 
 #include 
 
@@ -866,6 +866,12 @@ xfrin_send_request(dns_xfrin_ctx_t *xfr) {
 
 	CHECK(render(msg, &xfr->qbuffer));
 
+	/*
+	 * Free the last tsig, if there is one.
+	 */
+	if (xfr->lasttsig != NULL)
+		isc_buffer_free(&xfr->lasttsig);
+
 	/*
 	 * Save the query TSIG and don't let message_destroy free it.
 	 */

From 375f19cfb2f9cf5a9efbc65b557a8ce865de85c2 Mon Sep 17 00:00:00 2001
From: Michael Sawyer 
Date: Mon, 24 Jul 2000 18:06:35 +0000
Subject: [PATCH 163/226]  345.   [bug]           Large-scale changes/cleanups
 to dig:                         * Significantly improve structure handling   
                      * Don't pre-load entire batch files                     
    * Add name/rr counting/limiting                         * Fix SIGINT
 handling                         * Shorten timeouts to match v8's behavior

---
 CHANGES | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGES b/CHANGES
index e92adf5038..9513b9e2ed 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,9 @@
+ 345.	[bug]		Large-scale changes/cleanups to dig:
+			* Significantly improve structure handling
+			* Don't pre-load entire batch files
+			* Add name/rr counting/limiting
+			* Fix SIGINT handling
+			* Shorten timeouts to match v8's behavior
 
  344.	[bug]		When shutting down, lwresd sometimes tried
 			to shut down its client tasks twice, 

From a056a85de001b41557d997dd953b94a84a0248a0 Mon Sep 17 00:00:00 2001
From: Michael Sawyer 
Date: Mon, 24 Jul 2000 18:07:03 +0000
Subject: [PATCH 164/226] Improve searchlist code

---
 bin/dig/dig.c     |  6 ++---
 bin/dig/dighost.c | 63 +++++++++++++++++++++++++++--------------------
 2 files changed, 38 insertions(+), 31 deletions(-)

diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index fefcaa9e1f..d2baccf383 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dig.c,v 1.74 2000/07/21 21:21:26 gson Exp $ */
+/* $Id: dig.c,v 1.75 2000/07/24 18:07:01 mws Exp $ */
 
 #include 
 #include 
@@ -1005,9 +1005,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 		lookup->rdtype = dns_rdatatype_ns;
 		ISC_LIST_APPEND(lookup_list, lookup, link);
 	}
-	if (!is_batchfile) {
-		printgreeting(argc, argv);
-	}
+	printgreeting(argc, argv);
 }
 
 /*
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 21e4c73a9e..2fff54ecb1 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.98 2000/07/21 23:04:44 gson Exp $ */
+/* $Id: dighost.c,v 1.99 2000/07/24 18:07:03 mws Exp $ */
 
 /*
  * Notice to programmers:  Do not use this code as an example of how to
@@ -74,7 +74,8 @@ isc_boolean_t
 	show_details = ISC_FALSE,
 	usesearch = ISC_FALSE,
 	qr = ISC_FALSE,
-	is_dst_up = ISC_FALSE;
+	is_dst_up = ISC_FALSE,
+	have_domain = ISC_FALSE;
 
 in_port_t port = 53;
 unsigned int timeout = 0;
@@ -485,7 +486,6 @@ setup_system(void) {
 	char *ptr;
 	dig_server_t *srv;
 	dig_searchlist_t *search;
-	dig_lookup_t *l;
 	isc_boolean_t get_servers;
 	
 	debug("setup_system()");
@@ -530,10 +530,11 @@ setup_system(void) {
 							       ndots);
 						}
 					}
-				} else if ((strcasecmp(ptr, "search") == 0)
-					   && usesearch){
+				} else if (strcasecmp(ptr, "search") == 0){
 					while ((ptr = strtok(NULL, " \t\r\n"))
 					       != NULL) {
+						debug("adding search %s",
+						      ptr);
 						search = isc_mem_allocate(
 						   mctx, sizeof(struct
 								dig_server));
@@ -554,6 +555,7 @@ setup_system(void) {
 					}
 				} else if ((strcasecmp(ptr, "domain") == 0) &&
 					   (fixeddomain[0] == 0 )){
+					have_domain = ISC_TRUE;
 					while ((ptr = strtok(NULL, " \t\r\n"))
 					       != NULL) {
 						search = isc_mem_allocate(
@@ -588,12 +590,6 @@ setup_system(void) {
 		ISC_LIST_APPEND(server_list, srv, link);
 	}
 
-	for (l = ISC_LIST_HEAD(lookup_list) ;
-	     l != NULL;
-	     l = ISC_LIST_NEXT(l, link) ) {
-	     l -> origin = ISC_LIST_HEAD(search_list);
-	}
-
 	if (keyfile[0] != 0)
 		setup_file_key();
 	else if (keysecret[0] != 0)
@@ -1006,7 +1002,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query,
  * Create and queue a new lookup using the next origin from the origin
  * list, read in setup_system().
  */
-static void
+static isc_boolean_t
 next_origin(dns_message_t *msg, dig_query_t *query) {
 	dig_lookup_t *lookup;
 
@@ -1017,17 +1013,22 @@ next_origin(dns_message_t *msg, dig_query_t *query) {
 	debug("next_origin()"); 
 	debug("following up %s", query->lookup->textname);
 
-	if (query->lookup->origin == NULL) {
+	if (!usesearch)
+		/*
+		 * We're not using a search list, so don't even think
+		 * about finding the next entry.
+		 */
+		return (ISC_FALSE);
+	if (query->lookup->origin == NULL)
 		/*
 		 * Then we just did rootorg; there's nothing left.
 		 */
-		debug("made it to the root with nowhere to go");
-		return;
-	}
+		return (ISC_FALSE);
 	cancel_lookup(query->lookup);
 	lookup = requeue_lookup(query->lookup, ISC_TRUE);
 	lookup->defname = ISC_FALSE;
 	lookup->origin = ISC_LIST_NEXT(query->lookup->origin, link);
+	return (ISC_TRUE);
 }
 
 /*
@@ -1142,9 +1143,18 @@ setup_lookup(dig_lookup_t *lookup) {
 	isc_buffer_init(&lookup->onamebuf, lookup->onamespace,
 			sizeof(lookup->onamespace));
 
+	/*
+	 * If the name has too many dots, rotce the origin to be NULL
+	 * (which produces a root lookup).  Otherwise, take the origin
+	 * we have if there's one in the struct already.  If it's NULL,
+	 * take the first entry in the searchlist iff either usesearch
+	 * is TRUE or we got a domain line in the resolv.conf file.
+	 */
 	if ((count_dots(lookup->textname) >= ndots) || lookup->defname)
 		lookup->origin = NULL; /* Force root lookup */
-	debug("lookup->origin = %p", lookup->origin);
+	else if (lookup->origin == NULL && lookup->new_search &&
+		 (usesearch || have_domain))
+		lookup -> origin = ISC_LIST_HEAD(search_list);
 	if (lookup->origin != NULL) {
 		debug("trying origin %s", lookup->origin->origin);
 		result = dns_message_gettempname(lookup->sendmsg,
@@ -2045,7 +2055,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 				}
 				if ((msg->rcode != 0) &&
 				    (l->origin != NULL)) {
-					next_origin(msg, query);
+					if (!next_origin(msg, query))
+						printmessage(query, msg,
+							     ISC_TRUE);
 				} else {
 					result = dns_message_firstname
 						(msg,DNS_SECTION_ANSWER);
@@ -2056,7 +2068,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 				}
 			} else if ((msg->rcode != 0) &&
 				 (l->origin != NULL)) {
-				next_origin(msg, query);
+				if (!next_origin(msg, query))
+					printmessage(query, msg,
+						     ISC_TRUE);
 				if (show_details) {
 				       printmessage(query, msg, ISC_TRUE);
 				}
@@ -2104,14 +2118,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 							     &ab);
 				check_result(result, "isc_sockaddr_totext");
 				isc_buffer_usedregion(&ab, &r);
-				if ((dns_message_firstname(msg,
-							   DNS_SECTION_ANSWER)
-				      == ISC_R_SUCCESS) ||
-				    query->lookup->trace ) {
-					received(b->used, r.length,
-						 (char *)r.base,
-						 query);
-				}
+				received(b->used, r.length,
+					 (char *)r.base,
+					 query);
 			}
 			query->working = ISC_FALSE;
 			query->lookup->pending = ISC_FALSE;

From 4abad71e79583ebbeb61daaf7adf30b814031534 Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Mon, 24 Jul 2000 18:45:50 +0000
Subject: [PATCH 165/226] bumped recursive client quota from 100 to 1000

---
 bin/named/server.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bin/named/server.c b/bin/named/server.c
index 8d2fd56a82..8dee42d380 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: server.c,v 1.203 2000/07/10 22:02:38 tale Exp $ */
+/* $Id: server.c,v 1.204 2000/07/24 18:45:50 gson Exp $ */
 
 #include 
 
@@ -1149,7 +1149,7 @@ load_configuration(const char *filename, ns_server_t *server,
 	configure_server_quota(cctx, dns_c_ctx_gettcpclients,
 				     &server->tcpquota, 100);
 	configure_server_quota(cctx, dns_c_ctx_getrecursiveclients,
-				     &server->recursionquota, 100);
+				     &server->recursionquota, 1000);
 
 	/*
 	 * Configure the zone manager.

From 8303a2a9fff2f6acf56ec5d8a1903e7136c242b7 Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson 
Date: Mon, 24 Jul 2000 19:06:48 +0000
Subject: [PATCH 166/226] bumped recursive client quota from 100 to 1000

---
 doc/arm/Bv9ARM.6.html | 4 ++--
 doc/arm/Bv9ARM.txt    | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/arm/Bv9ARM.6.html b/doc/arm/Bv9ARM.6.html
index 35b0331062..30401a1f21 100644
--- a/doc/arm/Bv9ARM.6.html
+++ b/doc/arm/Bv9ARM.6.html
@@ -16,7 +16,7 @@
  - SOFTWARE.
 -->
 
-
+
 
 
 
@@ -3090,7 +3090,7 @@ recursive-clients
 
 
 The maximum number of simultaneous recursive lookups the server will perform on behalf of clients.  The default is 
-100
+1000
 .