Commit Graph

36548 Commits

Author SHA1 Message Date
Petr Špaček
0bbbdc6244 Remove auto-generated rst files in repo in favour of grammar pretty printer 2022-07-01 08:59:23 +02:00
Petr Špaček
7b4ad8a3ff Warn about experimental and deprecated options 2022-07-01 08:59:23 +02:00
Petr Špaček
c6fe8970f6 Render statement's grammar
This is replacement for auto-generated *.rst files stored in the repo.
2022-07-01 08:59:23 +02:00
Petr Špaček
eba3b1ad16 Render list of blocks accepting a given statement 2022-07-01 08:59:23 +02:00
Petr Špaček
d61d998e3b Detect unsupported statement:: directives with multiple names 2022-07-01 08:59:23 +02:00
Petr Špaček
ebe6ede2ec Warn about statements not found in the grammar 2022-07-01 08:59:23 +02:00
Petr Špaček
cbad1803a5 Warn about statements in grammar not described in docs
Skip over obsolete options.
2022-07-01 08:59:22 +02:00
Petr Špaček
1c6f2c5ad1 Give Sphinx configuration domains access to grammar 2022-07-01 08:59:22 +02:00
Petr Špaček
a691ebd0c9 Add helper to unify options and zone block grammars
A helper is needed to combine cfg_test output for generic options and
all the type-dependent zone block variants.
2022-07-01 08:59:22 +02:00
Petr Špaček
190004e46c Add pretty printer for JSON grammar
It produces the same format as cfg_test --grammar. The advantage is that
it allows to print any node in configuration the tree, not just whole
blocks.
2022-07-01 08:59:22 +02:00
Petr Špaček
8960d51aa3 Add utility to search for context-dependent configuration statements
The utility detects statements which use the same name (e.g.
max-zone-ttl) but use different grammar in different contexts. These
typically need special case in docs.
2022-07-01 08:59:22 +02:00
Petr Špaček
df08982930 Add a new library to parse grammar format produced by cfg_test
It transforms named.conf/rndc.conf grammar from text format into Python
dictionary. This allows granular access to grammar elements.

Beware: It heavity depens on cfg_test output format!
2022-07-01 08:59:04 +02:00
Petr Špaček
fb474de3ab Add rndc.conf grammar into doc/misc
It uses the same mechanism as all other grammars, but the file is named
differently to distinguish it from named.conf grammars.
2022-07-01 08:56:35 +02:00
Petr Špaček
699570cdec Un-format grammar files in doc/misc
The next commit is going to add parser for ISC configuration format.
To simplify the parser the grammar files in doc/misc are no longer
line-wrapped as handling it would make the grammar parser unnecessairly
complicated.

This affects visible output in the ARM, but in the end we are going to
replace the auto-generated .rst files with grammar pretty printed, so
formatting of these files does not matter in practical terms.
2022-07-01 08:56:33 +02:00
Petr Špaček
af3683f436 Add missing comment markers to doc/misc/ grammar files
These files can be consumed by scripts, so obviously missing comment
markers wreak havoc.
2022-06-30 19:00:17 +02:00
Petr Špaček
b18fa6c7b2 Merge branch 'sgoldlust/arm-tag-query-transfer' into 'main'
Add tags and short descriptions for query and transfer statements

See merge request isc-projects/bind9!6502
2022-06-30 16:11:30 +00:00
Petr Špaček
563eb8e1b9 Accept rst syntax in .. statement:: short: text
Nested rst syntax is now parsed and rendered. E.g.:

.. namedconf:statement:: example
   :short: Use ``this`` **cool** syntax!
2022-06-30 18:04:44 +02:00
Petr Špaček
0e7ca5b5e0 Disambiguate address_match_list link anchor
Let's keep just the :term: produced by grammar glossary.
2022-06-30 18:04:41 +02:00
Suzanne Goldlust
3cf976bd78 Add the :tags: and :short: descriptions for the category "transfer" 2022-06-30 18:04:40 +02:00
Suzanne Goldlust
7187a5cf77 Add the :tags: and :short: descriptions for the category "query" 2022-06-30 18:04:40 +02:00
Petr Špaček
2630cf8e76 Resurrect DNS NOTIFY chapter in the ARM
It was accidentally removed in the heat of
25eb91d23c.
2022-06-30 18:04:40 +02:00
Michał Kępień
692fb3eedd Merge branch '2147-obsolete-the-glue-cache-option' into 'main'
Obsolete the "glue-cache" option

Closes #2147

See merge request isc-projects/bind9!6500
2022-06-30 13:27:54 +00:00
Michał Kępień
f0d2d3c03f Add CHANGES entry and release note for GL #2147 2022-06-30 15:24:08 +02:00
Michał Kępień
887c666caf Obsolete the "glue-cache" option
The "glue-cache" option was marked as deprecated by commit
5ae33351f2 (first released in BIND 9.17.6,
back in October 2020), so now obsolete that option, removing all code
and documentation related to it.

Note: this causes the glue cache feature to be permanently enabled, not
disabled.
2022-06-30 15:24:08 +02:00
Michal Nowak
3fb7ab8476 Merge branch '2371-add-stress-testing-with-rpz' into 'main'
Run the "stress" test in RPZ mode in GitLab CI

Closes #2371

See merge request isc-projects/bind9!4526
2022-06-28 18:36:30 +00:00
Michal Nowak
d272574653 Add stress testing with RPZ 2022-06-28 20:32:37 +02:00
Petr Špaček
accc2440ee Merge branch '3408-drop-debian-9-stretch' into 'main'
Drop support for Debian 9 (Stretch)

See merge request isc-projects/bind9!6486
2022-06-28 15:56:06 +00:00
Petr Špaček
4ce1f25210 Declare Debian 9 (Stretch) community-maintained 2022-06-28 17:54:48 +02:00
Petr Špaček
aa86a8bcf0 Drop Debian 9 (Stretch) from CI 2022-06-28 17:54:44 +02:00
Artem Boldariev
7a90169fee Merge branch '3415-update-http-listeners-on-reconfig' into 'main'
Update HTTP listeners settings on reconfiguration

Closes #3415

See merge request isc-projects/bind9!6482
2022-06-28 13:10:20 +00:00
Artem Boldariev
7822670d0f doth test: extend with HTTP endpoints reconfiguration check
This commit add a check which verifies that HTTP endpoints are being
picked up properly by the BIND instance on a reconfiguration.
2022-06-28 15:43:19 +03:00
Artem Boldariev
502c78c339 Update CHANGES [GL #3415]
Mention that the settings are now applied properly on reconfiguration.
2022-06-28 15:43:18 +03:00
Artem Boldariev
d2e13ddf22 Update the set of HTTP endpoints on reconfiguration
This commit ensures that on reconfiguration the set of HTTP
endpoints (=paths) is being updated within HTTP listeners.
2022-06-28 15:42:38 +03:00
Artem Boldariev
e72962d5f1 Update max concurrent streams limit in HTTP listeners on reconfig
This commit ensures that HTTP listeners concurrent streams limit gets
updated properly on reconfiguration.
2022-06-28 15:42:38 +03:00
Artem Boldariev
a2379135fa Update HTTP listeners quotas on reconfiguration
This commit ensures that on reconfiguration a proper value for HTTP
connections limit is picked up.

The commit also refactors how listeners settings are updated so that
there is less code duplication.
2022-06-28 15:42:38 +03:00
Artem Boldariev
3f0b310772 Store HTTP quota size inside a listenlist instead of the quota
This way only quota size is passed to the interface/listener
management code instead of a quota object. Thus, we can implement
updating the quota object size instead of recreating the object.
2022-06-28 15:42:38 +03:00
Matthijs Mekking
806b89abe1 Merge branch 'matthijs-dnssec-policy-defaults-in-config-dot-c' into 'main'
Move built-in dnssec-policies into defaultconf

See merge request isc-projects/bind9!6467
2022-06-28 12:35:46 +00:00
Matthijs Mekking
d8dae61832 Add isccfg duration utility functions
Add function isccfg_duration_toseconds and isccfg_parse_duration to get
rid of code duplication.
2022-06-28 11:56:31 +02:00
Matthijs Mekking
8e18fa5874 Fix a bug in the duration_fromtext function
The function actually did not enforce that the duration string starts
with a P (or p), just that there is a P (or p) in the string.
2022-06-28 11:56:31 +02:00
Matthijs Mekking
c2a7950417 Also inherit from "default" for "insecure" policy
Remove the duplication from the defaultconf and inherit the values
not set in the "insecure" policy from the "default" policy. Therefore,
we must insist that the first read built-in policy is the default one.
2022-06-28 11:56:31 +02:00
Matthijs Mekking
80b55f9cfa Add change entry for dnssec-policy in defaultconf 2022-06-28 11:56:31 +02:00
Matthijs Mekking
5d6f0de84b Nit changes in keymgr and kasp
Use the ISC_MAX define instead of "x = a > b ? a : b" paradigm.

Remove an unneeded include.
2022-06-28 11:56:31 +02:00
Matthijs Mekking
20acb8d3a3 When loading dnssec-policies, inherit from default
Most of the settings (durations) are already inheriting from the default
because they use the constants from lib/dns/kasp.h. We need them as
constants so we can use them in named-checkconf to verify the policy
parameters.

The NSEC(3) parameters and keys should come from the actual default
policy. Change the call to cfg_kasp_fromconfig() to include the default
kasp. We also no longer need to corner case where config is NULL we load
the built-in policy: the built-in policies are now loaded when config is
set to named_g_config.

Finally, add a debug log (it is useful to see which policies are being
loaded).
2022-06-28 11:56:31 +02:00
Matthijs Mekking
5ff414e986 Store built-in dnssec-policies in defaultconf
Update the defaultconf with the built-in policies. These will now be
printed with "named -C".

Change the defines in kasp.h to be strings, so they can be concatenated
in the defaultconf. This means when creating a kasp structure, we no
longer initialize the defaults (this is fine because only kaspconf.c
uses dns_kasp_create() and it inherits from the default policy).

In kaspconf.c, the default values now need to be parsed from string.

Introduce some variables so we don't need to do get_duration multiple
times on the same configuration option.

Finally, clang-format-14 decided to do some random formatting changes.
2022-06-28 11:56:31 +02:00
Matthijs Mekking
a28d919503 Move duration structure to libisccfg/duration
Having the duration structure and parsing code here, it becomes
more accessible to be used in other places.
2022-06-28 11:56:31 +02:00
Michał Kępień
1854bd93ba Merge branch '3216-run-sslyze-in-gitlab-ci' into 'main'
[CVE-2022-1183] Run sslyze in GitLab CI

Closes #3216

See merge request isc-projects/bind9!6365
2022-06-27 21:08:40 +00:00
Michał Kępień
4f12892740 Also test DNS-over-TLS code using sslyze
Since sslyze can test any TLS-enabled server, also use it for exercising
DNS-over-TLS code rather than just DNS-over-HTTPS code.
2022-06-27 22:50:00 +02:00
Michał Kępień
e97b4697cf Add regression test for CVE-2022-1183
If sslyze is available in PATH, run it in a loop as part of the "doth"
system test.
2022-06-27 22:50:00 +02:00
Matthijs Mekking
c7146ce90a Merge branch '3422-dnssec-policy-clarifications' into 'main'
Add some clarifications wrt dynamic zones

Closes #3422

See merge request isc-projects/bind9!6487
2022-06-27 09:03:54 +00:00
Matthijs Mekking
fb517eb52a Add some clarifications wrt dynamic zones
These were suggested by GitLab user @elmaimbo.
2022-06-27 11:01:33 +02:00