Commit Graph

37215 Commits

Author SHA1 Message Date
Mark Andrews
1849a8a526 Add CHANGES note for [GL #3569] 2022-09-30 02:19:52 +00:00
Mark Andrews
033057ba9d Create a key directory in /tmp
Access to the source tree is not available with oss_fuzz.  Have
fuzz/dns_message_checksig build and populate a key directory for
the fuzzer to use.  This contains a key pair and a zone file which
has the public key from the key pair.  Clean it up on shutdown.
2022-09-30 02:19:52 +00:00
Ondřej Surý
39ae4a145b Merge branch 'ondrej-remove-debug-print-from-run_server' into 'main'
Remove debugging fprintf from run_server()

See merge request isc-projects/bind9!6843
2022-09-29 12:23:11 +00:00
Ondřej Surý
36cdeb7656 Remove debugging fprintf from run_server()
In the loopmgr branch, we forgot the scissors^Hdebugging output in the
patient^Hnamed, remove it.
2022-09-29 14:22:58 +02:00
Tony Finch
2ffeb0248b Merge branch 'fanf-free-non-null' into 'main'
Improve DBC in isc_mem_free

See merge request isc-projects/bind9!6839
2022-09-29 10:07:46 +00:00
Tony Finch
a4930e1969 Improve DBC in isc_mem_free
Unlike standard free(), isc_mem_free() is not a no-op when passed a
NULL pointer. For size accounting purposes it calls sallocx(), which
crashes when passed a NULL pointer. To get more helpful diagnostics,
REQUIRE() that the pointer is not NULL so that when the programmer
makes a mistake they get a backtrace that shows what went wrong.
2022-09-29 10:07:34 +00:00
Ondřej Surý
05d60071a7 Merge branch '3534-make-the-isc_nm_udp_send-on-shutdown-callback-asynchronous' into 'main'
Call the isc__nm_udp_send() callbacks asynchronously on shutdown

Closes #3534

See merge request isc-projects/bind9!6828
2022-09-29 10:04:40 +00:00
Ondřej Surý
b4a43bf2f2 Add developer documentation on the netmgr callbacks
Extra care must be taken when executing the callbacks to prevent the
deadlocks on the caller's side.  Add a paragraph that addresses when we
can and when we cannot call the callbacks directly.
2022-09-29 11:12:15 +02:00
Ondřej Surý
173c352452 Call the isc__nm_udp_send() callbacks asynchronously on shutdown
The isc__nm_udp_send() callback would be called synchronously when
shutting down or when the socket has been closed.  This could lead to
double locking in the calling code and thus those callbacks needs to be
called asynchronously.
2022-09-29 11:06:58 +02:00
Arаm Sаrgsyаn
cd32969138 Merge branch '3512-xot-breaks-ddns-update-forwarding' into 'main'
Resolve "XoT breaks DDNS update forwarding"

Closes #3512

See merge request isc-projects/bind9!6710
2022-09-28 10:28:05 +00:00
Aram Sargsyan
504529dfa9 Add a release note for [GL #3512] 2022-09-28 09:36:24 +00:00
Aram Sargsyan
aa4319f263 Add a CHANGES note for [GL #3512] 2022-09-28 09:36:24 +00:00
Aram Sargsyan
ae4296729c Test dynamic update forwarding when using a TLS-enabled primary
Add several test cases in the 'upforwd' system test to make sure
that different scenarios of Dynamic DNS update forwarding are
tested, in particular when both the original and forwarded requests
are over Do53, or DoT, or they use different transports.
2022-09-28 09:36:24 +00:00
Aram Sargsyan
3d7103bd21 Fix dynamic update forwarding when using a TLS-enabled primary
Now that the 'dns_request' supports using TLS transport, implement
dynamic update forwarding using DoT when the primary server is
configured to use a TLS transport.

Previously, when using such configuration, the dynamic update forwarding
feature was broken.
2022-09-28 09:01:05 +00:00
Mark Andrews
445aeee58d Merge branch '3562-assign-default-value-to-suffix' into 'main'
Resolve "suffix may be used before being assigned in qmin/ans3/ans.py"

Closes #3562

See merge request isc-projects/bind9!6811
2022-09-28 00:09:28 +00:00
Mark Andrews
432064f63c Suffix may be used before it is assigned a value
CID 350722 (#5 of 7): Bad use of null-like value (FORWARD_NULL)
        12. invalid_operation: Invalid operation on null-like value suffix.
    145        r.authority.append(
    146            dns.rrset.from_text(
    147                "icky.ptang.zoop.boing." + suffix,
    148                1,
    149                IN,
    150                NS,
    151                "a.bit.longer.ns.name." + suffix,
    152            )
    153        )
2022-09-27 23:47:12 +00:00
Mark Andrews
edc804b9b8 Merge branch '3551-missing-rsa_free-call-in-opensslrsa_verify2' into 'main'
Resolve "Missing RSA_free call in opensslrsa_verify2"

Closes #3551

See merge request isc-projects/bind9!6810
2022-09-27 23:46:26 +00:00
Mark Andrews
1e3680193a Add CHANGES note for [GL #3551] 2022-09-28 09:25:13 +10:00
Mark Andrews
a47235f4f5 Check BN_dup results in rsa_check 2022-09-28 09:24:34 +10:00
Mark Andrews
483c5a1978 Free 'n' on error path in rsa_check 2022-09-28 09:24:34 +10:00
Mark Andrews
db70c30213 Check that 'e' and 'n' are allocated in opensslrsa_fromdns 2022-09-28 09:24:34 +10:00
Mark Andrews
5603cd69d1 Check that 'e' and 'n' are non-NULL in opensslrsa_todns 2022-09-28 09:24:34 +10:00
Mark Andrews
a2b51ca6ac Free 'rsa' if 'e' is NULL in opensslrsa_verify2 2022-09-28 09:24:34 +10:00
Ondřej Surý
1f670f4b69 Merge branch '3559-provide-custom-isc_mem-based-allocators-for-external-libraries' into 'main'
Use custom isc_mem based allocator for libuv, OpenSSL, and libxml2

Closes #3559

See merge request isc-projects/bind9!6807
2022-09-27 15:55:09 +00:00
Ondřej Surý
be3a159b54 Add CHANGES note for [GL #3559] 2022-09-27 17:53:04 +02:00
Ondřej Surý
3b31f7f563 Add autoconf option to enable memory leak detection in libraries
There's a known memory leak in the engine_pkcs11 at the time of writing
this and it interferes with the named ability to check for memory leaks
in the OpenSSL memory context by default.

Add an autoconf option to explicitly enable the memory leak detection,
and use it in the CI except for pkcs11 enabled builds.  When this gets
fixed in the engine_pkc11, the option can be enabled by default.
2022-09-27 17:53:04 +02:00
Ondřej Surý
d1cc847ab0 Check the libuv, OpenSSL and libxml2 memory context on exit
As we can't check the deallocations done in the library memory contexts
by default because it would always fail on non-clean exit (that happens
on error or by calling exit() early), we just want to enable the checks
to be done on normal exit.
2022-09-27 17:10:42 +02:00
Ondřej Surý
e537fea861 Use custom isc_mem based allocator for libxml2
The libxml2 library provides a way to replace the default allocator with
user supplied allocator (malloc, realloc, strdup and free).

Create a memory context specifically for libxml2 to allow tracking the
memory usage that has originated from within libxml2.  This will provide
a separate memory context for libxml2 to track the allocations and when
shutting down the application it will check that all libxml2 allocations
were returned to the allocator.

Additionally, move the xmlInitParser() and xmlCleanupParser() calls from
bin/named/main.c to library constructor/destructor in libisc library.
2022-09-27 17:10:42 +02:00
Ondřej Surý
236d4b7739 Use custom isc_mem based allocator for OpenSSL
The OpenSSL library provides a way to replace the default allocator with
user supplied allocator (malloc, realloc, and free).

Create a memory context specifically for OpenSSL to allow tracking the
memory usage that has originated from within OpenSSL.  This will provide
a separate memory context for OpenSSL to track the allocations and when
shutting down the application it will check that all OpenSSL allocations
were returned to the allocator.
2022-09-27 17:10:42 +02:00
Ondřej Surý
a32d06dd42 Use custom isc_mem based allocator for libuv
The libuv library provides a way to replace the default allocator with
user supplied allocator (malloc, realloc, calloc and free).

Create a memory context specifically for libuv to allow tracking the
memory usage that has originated from within libuv.  This requires
libuv >= 1.38.0 which provides uv_library_shutdown() function that
assures no more allocations will be made.
2022-09-27 17:10:42 +02:00
Ondřej Surý
a30e75db86 Check for working __builtin_mul_overflow() implementation
Instead of using generic HAVE_BUILTIN_OVERFLOW, we need to check whether
the overflow functions actually work as there was a bug in GCC that it
would not detect mul overflow when compiled with `-m32` option without
optimizations and the bug was fixed only for GCC 6.5+ and 7.3+/8+.

For further details see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82274
2022-09-27 17:10:42 +02:00
Ondřej Surý
2d2022a509 Make the debugging flags local to the memory context
Previously, the isc_mem_debugging would be single global variable that
would affect the behavior of the memory context whenever it would be
changed which could be after some allocation were already done.

Change the memory debugging options to be local to the memory context
and immutable, so all allocations within the same memory context are
treated the same.
2022-09-27 17:10:41 +02:00
Ondřej Surý
56f9c886aa Merge branch '3567-bump-the-minimal-libuv-version-to-1.34.0' into 'main'
Bump the libuv requirement to libuv >= 1.34.0

Closes #3567

See merge request isc-projects/bind9!6826
2022-09-27 15:09:53 +00:00
Ondřej Surý
178e0317a6 Add CHANGES and release note for [GL #3567] 2022-09-27 17:09:11 +02:00
Ondřej Surý
0086ebf3fc Bump the libuv requirement to libuv >= 1.34.0
By bumping the minimum libuv version to 1.34.0, it allows us to remove
all libuv shims we ever had and makes the code much cleaner.  The
up-to-date libuv is available in all distributions supported by BIND
9.19+ either natively or as a backport.
2022-09-27 17:09:10 +02:00
Ondřej Surý
d5bead54c0 Drop Ubuntu 18.04 bionic from the CI
The Ubuntu 18.04 bionic will go EOL in April 2023 before the next stable
BIND 9 release, so we can drop this for the next stable BIND 9 release.
2022-09-27 17:09:10 +02:00
Ondřej Surý
7238c85c88 Drop Debian buster from the CI
The Debian buster is official EOL and in the LTS mode, so we can drop
this for the next stable BIND 9 release.
2022-09-27 17:09:10 +02:00
Matthijs Mekking
444461e9b1 Merge branch 'matthijs-dnssec-guide-dnssec-policy-requires-inline-signing' into 'main'
Add dnssec-policy inline-signing requirement to documentation

See merge request isc-projects/bind9!6823
2022-09-27 15:08:03 +00:00
Matthijs Mekking
18d230a584 Add inline-signing to config examples
Add 'inline-signing yes;' to configuration examples to have working
copy paste configurations.
2022-09-27 17:06:30 +02:00
Matthijs Mekking
5d454a7158 Update inline-signing requirement to ARM
This change was made in !6403, but the appropriate documentation
changes were not applied to the ARM.
2022-09-27 17:06:30 +02:00
Matthijs Mekking
09522c8d73 Add inline-signing requirement to DNSSEC Guide
This change was made in !6403, but the appropriate documentation
changes were not applied to the DNSSEC Guide.
2022-09-27 17:06:30 +02:00
Petr Špaček
489320e961 Merge branch '3541-have-named-v-report-supported-algorithms' into 'main'
Report supported crypto algorithms

Closes #3541

See merge request isc-projects/bind9!6771
2022-09-27 14:55:11 +00:00
Petr Špaček
c138a8aa59 Add release note for new crypto algorithm logging 2022-09-27 16:54:39 +02:00
Petr Špaček
c648e280e4 Document list of crypto algorithms in named -V output 2022-09-27 16:54:39 +02:00
Mark Andrews
d34ecdb366 Deduplicate string formating 2022-09-27 16:54:39 +02:00
Mark Andrews
e876de442e Add CHANGES entry for [GL #3541] 2022-09-27 16:54:39 +02:00
Mark Andrews
3156d36495 silence scan-build false positive 2022-09-27 16:54:39 +02:00
Mark Andrews
cb1515e71f Report algorithms supported by named at startup 2022-09-27 16:54:39 +02:00
Mark Andrews
b308f866c0 Have 'named -V' report supported algorithms
These cover DNSSEC, DS, HMAC and TKEY algorithms.
2022-09-27 16:54:39 +02:00
Mark Andrews
151cc2fff9 Replace alg_totext with dst_hmac_algorithm_totext
The new library function will be reused by subsequent commits.
2022-09-27 16:54:39 +02:00