that is simpler, faster, and produces a much more even distribution,
particularly when the data to hash ends with a null byte like domain
names often do
"Store CNAMEs and their SIGs (if any) in their own name structure on
the name list. I.e. do not mix CNAMEs with non-CNAME data. Do the
same thing for DNAMEs."
because it caused DNSSEC validation of responses to ANY queries at
nodes with CNAME records to fail, and no one was able to figure out
why it was added in the first place. As a beneficial side effect,
findname() now finds names even if they have attribute bits set
differently from the one being searched for. This supersedes
the fix of revision 1.133.
the multiple answer RRsets by validating each one separately. Also,
eliminated the "done" variable in answer_response() because in the
rare situations where it got set to ISC_TRUE, it caused the function
to return prematurely by exiting a loop with a result of ISC_R_SUCCESS
and hitting a "if (result != ISC_R_NOMORE) return (result);" test
immediately following following the loop.
This should fix [RT #109], "ANY query in secure zone crashes server".
of dns_name_concatenate(NULL, NULL, name, NULL).
Define DNS_NAME_USELINE to get macroized name functions. Removed
older FAST_COUNTLABELS and FAST_ISABSOLUTE to use standard name
interface, which are covered by DNS_NAME_USEINLINE.
make the warning message say 'file does not end with newline' instead of
'unexpected end of file' to lead the user on the right tracks to fixing
the most likely cause. Also, don't include the function name in the message.
isc_socket_cancel() has been called. resquery_senddone() has been fixed
to account for this (there was a race condition because of the faulty
assumption that only ISC_R_CANCELED would be returned after
isc_socket_cancel()).
The interaction of resquery_response() with the dispatcher now has to be
closely reviewed to make sure it does not have a similar problem with
a canceled query. If the faulty assumption hadn't been faulty, it was
fine, but now I'm not so sure.
subtype only)
- support "keys" clause
controls {
inet * port 1024
allow { any; } keys { "foo"; }
}
- allow "port xxx" to be left out of statement,
in which case it defaults to omapi's default port
of 953.
validation should only consist of checking that each key in the key set
is also in the list of security root keys.
Strangeness occurs when the key set is signed, since the key set is marked
as secure, but the sig set is not, since it wasn't used in the validation
process. This means that a query for a key set at a security root will
have the AD bit set if the key set is unsigned and not if the key set is signed.
match does not have associated data and DNS_RBTFIND_EMPTYDATA is not set.
Return DNS_R_PARTIALMATCH instead if there is a superdomain with
data, or ISC_R_NOTFOUND if no superdomain has data.
Make dns_rbt_findname() honor DNS_RBTFIND_EMPTYDATA, per the rbt.h
documentation that has been saying it will. It didn't.
the DNS_DB_NOEXACT flag. This means that the resolver will start look for the
key at or above the parent zone, and will return the key set from the parent
zone if key sets are present in both the parent and child.
Andreas Gustafsson
Michael Graff
Mark Andrews