ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity
29,349 Commits 589 Branches 805 Tags
3736bc9604ba945fcf5bfdd2500daa631f1e67f3
Commit Graph
29349 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michał Kępień 3736bc9604 Tweak and reword release notes 2021-05-12 09:09:43 +02:00
Michał Kępień ebe83bed9c Tweak and reword recent CHANGES entries 2021-05-12 09:09:43 +02:00
Michal Nowak c524142b74 Merge branch 'mnowak/use-sigabrt-from-start.pl-v9_11' into 'v9_11' 
[v9_11] Use SIGABRT instead of SIGKILL to produce cores on failed start

See merge request isc-projects/bind9!4992
 2021-05-04 15:54:20 +00:00
Ondřej SurýandMichal Nowak 401b3519eb Use SIGABRT instead of SIGKILL to produce cores on failed start 
When the `named` would hang on startup it would be killed with SIGKILL
leaving us with no information about the state the process was in.
This commit changes the start.pl script to send SIGABRT instead, so we
can properly collect and process the coredump from the hung named
process.

(cherry picked from commit 861a236937)
 2021-05-04 17:22:41 +02:00
Matthijs Mekking dfadbc9d7b Merge branch 'matthijs-nsupdate-update_test-v9_11' into 'v9_11' 
Update nsupdate test (9.11)

See merge request isc-projects/bind9!4979
 2021-04-30 12:57:46 +00:00
Matthijs Mekking 5d899d0d99 Update nsupdate test 
The nsupdate system test did not record failures from the
'update_test.pl' Perl script. This was because the 'ret' value was
not being saved outside the '{ $PERL ... || ret=1 } cat_i' scope.

Change this piece to store the output in a separate file and then
cat its contents. Now the 'ret' value is being saved.

Also record failures in 'update_test.pl' if sending the update
failed.

Add missing 'n' incrementals to 'nsupdate/test.sh' to keep track of
test numbers.

(cherry picked from commit 5b31811b5f)
 2021-04-30 14:30:51 +02:00
Matthijs Mekking f2ff6fcc47 Merge branch '2445-nsec3-iterations-resolver-v9_11' into 'v9_11' 
Mark DNSSEC responses with NSEC3 records that exceed 150 as insecure (9.11)

See merge request isc-projects/bind9!4974
 2021-04-30 09:35:20 +00:00
Mark AndrewsandMatthijs Mekking 83cbbf0ac8 Add release note for [GL #2445] 
(manually picked from commit ad236976fc)
 2021-04-30 11:13:37 +02:00
Mark AndrewsandMatthijs Mekking 523b9b02af Add CHANGES for [GL #2445] 
(cherry picked from commit fd1f7b6480)
 2021-04-30 11:13:37 +02:00
Mark AndrewsandMatthijs Mekking 02f4a9d6b3 Check insecure responses returned with too many NSEC3 iterations 
(cherry picked from commit e6e0e29fbb)
 2021-04-30 11:13:37 +02:00
Matthijs Mekking 2c81206984 Sync dns results 
Add missing DNS results from 9.16. We only care about
DNS_R_NSEC3ITERRANGE but better to sync and use the same numbers than
use a different number for this result code than what is used in 9.16.
 2021-04-30 09:58:44 +02:00
Mark AndrewsandMatthijs Mekking 1647bc7dc4 Mark DNSSEC responses with NSEC3 records that exceed 150 as insecure 
(cherry picked from commit af02bbcdd6)
 2021-04-30 09:36:45 +02:00
Mark Andrews 2ee92dd506 Merge branch '2668-handle-net-dns-versions-that-don-t-support-nsec3param-v9_11' into 'v9_11' 
NSEC3PARAM support was added to Net::DNS in 1.00_06

See merge request isc-projects/bind9!4973
 2021-04-30 06:56:14 +00:00
Mark Andrews eb3122cd38 NSEC3PARAM support was added to Net::DNS in 1.00_06 
Require 1.01 or later to when adding a NSEC3PARAM records.

(cherry picked from commit 044933756a)
 2021-04-30 16:29:57 +10:00
Mark Andrews e0fcb90b09 Merge branch '2658-update-zonemd-now-that-rfc-8976-has-been-issued-v9_11' into 'v9_11' 
Update ZONEMD to match RFC 8976

See merge request isc-projects/bind9!4970
 2021-04-30 02:30:23 +00:00
Mark Andrews e4e4ff0e10 Update ZONEMD to match RFC 8976 
* The location of the digest type field has changed to where the
  reserved field was.
* The reserved field is now called scheme and is where the digest
  type field was.
* Digest type 2 has been defined (SHA256).

(cherry picked from commit 8510ccaa54)
 2021-04-30 11:31:05 +10:00
Mark Andrews 4aaddec8d9 Merge branch '2642-reduce-the-maximum-nsec3-iterations-that-can-be-configured-v9_11' into 'v9_11' 
Reduce nsec3 max iterations to 150 (9.11)

See merge request isc-projects/bind9!4967
 2021-04-30 01:14:38 +00:00
Mark Andrews 00a5a54978 Add Release Note for [GL #2642] 
(manually picked from commit ca07b8e414)
 2021-04-30 10:49:00 +10:00
Mark Andrews d749ccc41a Add CHANGES for [GL #2642] 
5625.   [func]          Reduce the supported maximum number of iterations
                        that can be configured in an NSEC3 zones to 150.
                        [GL #2642]

(cherry picked from commit e04f06873f)
 2021-04-30 10:49:00 +10:00
Mark Andrews e0fbb10017 Check that excessive iterations in logged by named when 
loading an existing zone or transfering from the primary.

(manually picked from commit 46eb21c546)
 2021-04-30 10:49:00 +10:00
Mark Andrews aa6a2d3902 Check NSEC3 iterations with dnssec-signzone 
(cherry picked from commit 8ec16c378d)
 2021-04-30 10:49:00 +10:00
Mark Andrews 80e8f72500 Check that named rejects excessive iterations via UPDATE 
(cherry picked from commit 4ce8437a6e)
 2021-04-30 10:49:00 +10:00
Mark Andrews f5625719a0 nsupdate: reject attempts to add NSEC3PARAM with excessive iterations 
(manually picked from commit 3fe75d9809)
 2021-04-30 10:49:00 +10:00
Mark Andrews 6e729ce890 Warn if there is excessive NSEC3 iterations 
(cherry picked from commit c9f5f8a059)
 2021-04-30 10:49:00 +10:00
Mark Andrews 91a7f94a66 Reduce nsec3 max iterations to 150 
(manually picked from commit 29126500d2)
 2021-04-30 10:49:00 +10:00
Michal Nowak f727ba383f Merge branch 'mnowak/configure-with-enable-dnstap-by-default-v9_11' into 'v9_11' 
[v9_11] Configure with --enable-dnstap by default

See merge request isc-projects/bind9!4966
 2021-04-29 14:53:41 +00:00
Michal Nowak da97afefca Suppress TSAN errors from libfstrm.so 
dnstap_test produces TSAN errors which originate in libfstrm.so. Unless
libfstrm is TSAN clean or a workaround is placed in libfstrm sources,
suppressing TSAN coming from libfstrm is necessary to test DNSTAP under
TSAN.

(cherry picked from commit c97c6fbfea)
 2021-04-29 16:19:16 +02:00
Michal Nowak b6695749c3 Configure with --enable-dnstap by default 
All platforms but OpenBSD have dnstap dependencies readily in their
respective repositories, and dnstap thus can be tested there. Given that
majority of images have dnstap dependencies available, it seems fitting
to make dnstap enabled by default.

Also dnstap is disabled for TSAN jobs configured with --disable-atomic
as it's known to produce TSAN errors (#2664) and for the gcc:noatomics
job because it has threads disabled, which is a requirement for dnstap.

(cherry picked from commit deff0ae317)
 2021-04-29 16:12:13 +02:00
Michał Kępień 52e752f25d Merge branch 'v9_11_31-release' into 'v9_11' 
Merge 9.11.31 release branch

See merge request isc-projects/bind9!4956
 2021-04-29 10:08:00 +00:00
Michał Kępień 06a3b1858c Set up release notes for BIND 9.11.32 2021-04-29 11:56:03 +02:00
Michał Kępień c0d7b3bb1d Bump BIND_BASELINE_VERSION for ABI checks 2021-04-29 11:56:03 +02:00
Tinderbox UserandMichał Kępień c3c68c6451 Merge branch 'prep-release' into v9_11_31-release 2021-04-29 11:56:03 +02:00
Michał Kępień a35cf8bc65 Merge branch 'michal/prepare-documentation-for-bind-9.11.31' into 'v9_11_31-release' 
Prepare documentation for BIND 9.11.31

See merge request isc-private/bind9!289
 2021-04-29 11:56:03 +02:00
Tinderbox UserandMichał Kępień fa3ef955fe prep 9.11.31 2021-04-29 11:56:03 +02:00
Tinderbox UserandMichał Kępień 763e28ef90 Merge branch 'prep-release' into v9_11_30-release 2021-04-29 11:56:03 +02:00
Michał Kępień 83694be221 Prepare release notes for BIND 9.11.31 2021-04-29 11:56:03 +02:00
Michał Kępień 008a7ef2fb Merge branch 'michal/prepare-documentation-for-bind-9.11.30' into 'security-v9_11' 
Prepare documentation for BIND 9.11.30

See merge request isc-private/bind9!286
 2021-04-29 11:56:03 +02:00
Tinderbox UserandMichał Kępień ab7ca7759c prep 9.11.30 2021-04-29 11:56:03 +02:00
Michał Kępień 8736b29be8 Merge branch '2604-confidential-issue-spnego-v9_11' into 'security-v9_11' 
[CVE-2021-25216] [v9_11] Documentation for ZDI-CAN-13347: ISC BIND TKEY Query Integer Overflow Remote Code Execution Vulnerability

See merge request isc-private/bind9!284
 2021-04-29 11:56:03 +02:00
Michał Kępień 72995fb678 Prepare release notes for BIND 9.11.30 2021-04-29 11:56:03 +02:00
Michał Kępień 3c5c4bc2b4 Merge branch '2540-confidential-issue-existing-dname-v9_11' into 'security-v9_11' 
[CVE-2021-25215] [v9_11] Properly answer queries for DNAME records that require the DNAME to be processed to resolve itself

See merge request isc-private/bind9!282
 2021-04-29 11:56:03 +02:00
Michał Kępień 891db84e90 Add release note for [GL #2604] 2021-04-29 11:56:03 +02:00
Michał Kępień 614fc0e9d0 Tweak and reword release notes 2021-04-29 11:56:03 +02:00
Michał Kępień 44a7cc73b5 Merge branch '2467-confidential-issue-ixfr-checks-v9_11' into 'security-v9_11' 
[CVE-2021-25214] [v9_11] Prevent malformed incoming zone transfers from producing a zone without an SOA record

See merge request isc-private/bind9!263
 2021-04-29 11:56:03 +02:00
Mark AndrewsandMichał Kępień 14f5703516 Add Release Notes entry for [GL #2540] 2021-04-29 11:56:03 +02:00
Michał Kępień 948285ef15 Add CHANGES entry for [GL #2604] 2021-04-29 11:56:03 +02:00
Michał Kępień 1fd570e4a9 Tweak and reword recent CHANGES entries 2021-04-29 11:56:03 +02:00
Mark AndrewsandMichał Kępień abad891076 Add release note for [GL #2467] 2021-04-29 11:56:03 +02:00
Mark AndrewsandMichał Kępień df056d0b33 Add CHANGES entry for [GL #2540] 2021-04-29 11:56:03 +02:00
Mark AndrewsandMichał Kępień 4b307852eb Add CHANGES entry for [GL #2467] 2021-04-29 11:56:03 +02:00