This partly reverts commit 1d807d84f1 "Shrink decompression contexts",
and while I am adjusting nearly all the calls to dns_name_fromwire()
it seems like a good time to remove all the unused `options`
arguments, to reduce the amount of cleanup churn.
I reworked the code that calls dns_decompress_setpermitted() at least
twice before I understood that it's a no-op. Good grief!
Before this year's changes, the decompression modes were ANY (which
became ALWAYS), NONE (became NEVER), and STRICT, which meant "strictly
follow RFC 3579" wrt whether or not a name is allowed to be compressed
in RDATA. (STRICT became DEFAULT, which in retrospect was a misnomer.)
STRICT was the only mode in which dns_decompress_setmethods() had any
effect, but decompression contexts were not initialized to STRICT and
later toggled (except in the tests), so all this machinery was not
actually used in production.
In practice, we either expect no names to be compressed, or permit any
name to be compressed. This is not entirely Postel's law: there were
compatibility issues around the time RFC 3579 was written, so RRtypes
allocated between RFC 1035 and RFC 3579 might legitimately have compressed
RDATA even though that is formally discouraged.
So after another round of refactoring, "ALWAYS" is now indicated by
the presence of a decompression context, and "NEVER" is indicated by a
NULL dctx pointer, and the mutable mode only remains in a vesigial
place-holder form.
After deprecating the operating system limits settings (coresize,
datasize, files and stacksize), mark them as ancient and remove the code
that sets the values from config.
After change 5995, zone transfers were using a small
compression context that only had space for the first
few dozen names in each message. They now use a large
compression context with enough space for every name.
Remove the text from the ARM and DNSSEC guide that describes how to do
key and denial of existence operations using dynamic update. Add a new
section about DNSSEC multi-signer models, but no longer suggest using
dynamic update and auto-dnssec allow.
It was possible to set operating system limits (RLIMIT_DATA,
RLIMIT_STACK, RLIMIT_CORE and RLIMIT_NOFILE) from named.conf. It's
better to leave these untouched as setting these is responsibility of
the operating system and/or supervisor.
Deprecate the configuration options and remove them in future BIND 9
release.
From now on all per-version notes link to the global list
of Known Issues. If there is a new note it should be listed twice:
In the per-version list, and in the global list.
_dns SVBC records have additional constrains which should be checked
when records are being added. This adds those constraint checks but
allows the user to override them using 'check-svcb no'.
Tony FinchandTony Finch
Ondřej Surý
Mark Andrews
Matthijs Mekking
Michal Nowak
Petr Špaček
Michał Kępień
Aram Sargsyan