ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity
38,028 Commits 589 Branches 805 Tags
42c42be9a997a30dcf83c8a77a2f57811757a72d
Commit Graph
38028 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mark AndrewsandMichał Kępień 42c42be9a9 Add release note for [GL #3622] 2023-01-12 12:22:58 +01:00
Mark AndrewsandMichał Kępień 8ca018b5ec Add CHANGES note for [GL #3622] 2023-01-12 12:22:58 +01:00
Mark AndrewsandMichał Kępień 56eae06418 Move the mapping of SIG and RRSIG to ANY 
dns_db_findext() asserts if RRSIG is passed to it and
query_lookup_stale() failed to map RRSIG to ANY to prevent this.  To
avoid cases like this in the future, move the mapping of SIG and RRSIG
to ANY for qctx->type to qctx_init().
 2023-01-12 12:22:58 +01:00
Michał Kępień c28ea3ce2b Merge branch '3523-confidential-update-quota' into 'security-main' 
[CVE-2022-3094] apply quotas to updates

See merge request isc-private/bind9!442
 2023-01-12 10:56:37 +00:00
Evan HuntandMichał Kępień 991de0aa76 CHANGES and release notes for [GL #3523] 2023-01-12 11:52:48 +01:00
Evan HuntandMichał Kępień b91339b80e test failure conditions 
verify that updates are refused when the client is disallowed by
allow-query, and update forwarding is refused when the client is
is disallowed by update-forwarding.

verify that "too many DNS UPDATEs" appears in the log file when too
many simultaneous updates are processing.
 2023-01-12 11:52:48 +01:00
Evan HuntandMichał Kępień 964f559edb move update ACL and update-policy checks before quota 
check allow-update, update-policy, and allow-update-forwarding before
consuming quota slots, so that unauthorized clients can't fill the
quota.

(this moves the access check before the prerequisite check, which
violates the precise wording of RFC 2136. however, RFC co-author Paul
Vixie has stated that the RFC is mistaken on this point; it should have
said that access checking must happen *no later than* the completion of
prerequisite checks, not that it must happen exactly then.)
 2023-01-12 11:52:48 +01:00
Evan HuntandMichał Kępień f57758a730 add a configuration option for the update quota 
add an "update-quota" option to configure the update quota.
 2023-01-12 11:52:48 +01:00
Evan HuntandMichał Kępień 7c47254a14 add an update quota 
limit the number of simultaneous DNS UPDATE events that can be
processed by adding a quota for update and update forwarding.
this quota currently, arbitrarily, defaults to 100.

also add a statistics counter to record when the update quota
has been exceeded.
 2023-01-12 11:52:48 +01:00
Michał Kępień 6ecc0a2693 Merge branch 'michal/add-placeholder-entries-to-CHANGES' into 'main' 
Add placeholder entries to CHANGES

See merge request isc-projects/bind9!7356
 2023-01-11 16:48:05 +00:00
Michał Kępień a2cc802060 Add placeholder entries to CHANGES 
Add placeholders for the following issues:

  - [GL #3523]
  - [GL #3599]
  - [GL #3619]
  - [GL #3622]
 2023-01-11 17:44:12 +01:00
Arаm Sаrgsyаn a5e23c3158 Merge branch 'aram/dns_fwdtable_addfwd-cleanup-bugfix' into 'main' 
Fix dns_fwdtable_addfwd() error path cleanup bug

See merge request isc-projects/bind9!7205
 2023-01-11 13:19:31 +00:00
Aram Sargsyan cf4003fa58 Use sizeof(*ptr) for allocating/freeing memory in forward.c 
As shown in the previous commit, using sizeof(type_t) is a little
bit more error-prone when copy-pasting code, so extracting the
size information from the pointer which is being dealt with seems
like a better alternative.
 2023-01-11 12:41:06 +00:00
Aram Sargsyan 0cc1b06d98 Fix dns_fwdtable_addfwd() error path cleanup bug 
Free 'sizeof(dns_forwarder_t)' bytes of memory instead of
'sizeof(dns_sockaddr_t)' bytes, because `fwd` is a pointer
to a 'dns_forwarder_t' type structure.
 2023-01-11 12:41:06 +00:00
Mark Andrews 40077f6f75 Merge branch '3764-adjust-descriptors-for-some-unit-tests' into 'main' 
Resolve "Adjust descriptor limit for some unit tests"

Closes #3764

See merge request isc-projects/bind9!7294
 2023-01-11 11:04:07 +00:00
Mark Andrews cdcd605ede Increase the number of available file descriptors 
notify_test and query_test run out of descriptors on some platforms.

    % ./notify_test
    [==========] Running 1 test(s).
    [ RUN      ] notify_start
    netmgr/tcp.c:369: REQUIRE(csock->fd >= 0) failed, back trace
    0   libisc-9.19.9-dev.dylib             0x00000001045c5080 default_callback + 72
    1   libisc-9.19.9-dev.dylib             0x00000001045c4ffc isc_assertion_failed + 56
    2   libisc-9.19.9-dev.dylib             0x00000001045b8bcc start_tcp_child + 304
    3   libisc-9.19.9-dev.dylib             0x00000001045b8710 isc_nm_listentcp + 636
    4   libisc-9.19.9-dev.dylib             0x00000001045b3e0c isc_nm_listenstreamdns + 344
    5   libns-9.19.9-dev.dylib              0x0000000104b90630 ns_interface_listentcp + 152
    6   libns-9.19.9-dev.dylib              0x0000000104b8f65c interface_setup + 488
    7   libns-9.19.9-dev.dylib              0x0000000104b8de98 do_scan + 2028
    8   libns-9.19.9-dev.dylib              0x0000000104b8d640 ns_interfacemgr_scan + 212
    9   notify_test                         0x000000010418ddd0 scan_interfaces + 44
    10  libisc-9.19.9-dev.dylib             0x00000001045d5fd8 isc__job_cb + 116
    11  libuv.1.dylib                       0x000000010545afe4 uv__run_idle + 152
    12  libuv.1.dylib                       0x0000000105455cd0 uv_run + 204
    13  libisc-9.19.9-dev.dylib             0x00000001045e1120 loop_run + 460
    14  libisc-9.19.9-dev.dylib             0x00000001045df824 loop_thread + 44
    15  libisc-9.19.9-dev.dylib             0x00000001045df6dc isc_loopmgr_run + 456
    16  notify_test                         0x000000010418b900 run_test_notify_start + 88
    17  libcmocka.0.dylib                   0x00000001054968c0 cmocka_run_one_test_or_fixture + 448
    18  libcmocka.0.dylib                   0x0000000105494ca4 _cmocka_run_group_tests + 848
    19  notify_test                         0x000000010418be60 main + 120
    20  libdyld.dylib                       0x0000000181509430 start + 4
    Abort
    % ./query_test
    [==========] Running 4 test(s).
    [ RUN      ] ns__query_sfcache
    netmgr/tcp.c:369: REQUIRE(csock->fd >= 0) failed, back trace
    0   libisc-9.19.9-dev.dylib             0x000000010294d080 default_callback + 72
    1   libisc-9.19.9-dev.dylib             0x000000010294cffc isc_assertion_failed + 56
    2   libisc-9.19.9-dev.dylib             0x0000000102940bcc start_tcp_child + 304
    3   libisc-9.19.9-dev.dylib             0x0000000102940710 isc_nm_listentcp + 636
    4   libisc-9.19.9-dev.dylib             0x000000010293be0c isc_nm_listenstreamdns + 344
    5   libns-9.19.9-dev.dylib              0x00000001026cc630 ns_interface_listentcp + 152
    6   libns-9.19.9-dev.dylib              0x00000001026cb65c interface_setup + 488
    7   libns-9.19.9-dev.dylib              0x00000001026c9e98 do_scan + 2028
    8   libns-9.19.9-dev.dylib              0x00000001026c9640 ns_interfacemgr_scan + 212
    9   query_test                          0x00000001026a1018 scan_interfaces + 44
    10  libisc-9.19.9-dev.dylib             0x000000010295dfd8 isc__job_cb + 116
    11  libuv.1.dylib                       0x0000000103996fe4 uv__run_idle + 152
    12  libuv.1.dylib                       0x0000000103991cd0 uv_run + 204
    13  libisc-9.19.9-dev.dylib             0x0000000102969120 loop_run + 460
    14  libisc-9.19.9-dev.dylib             0x0000000102967824 loop_thread + 44
    15  libisc-9.19.9-dev.dylib             0x00000001029676dc isc_loopmgr_run + 456
    16  query_test                          0x000000010269cf34 run_test_ns__query_sfcache + 88
    17  libcmocka.0.dylib                   0x00000001028068c0 cmocka_run_one_test_or_fixture + 448
    18  libcmocka.0.dylib                   0x0000000102804ca4 _cmocka_run_group_tests + 848
    19  query_test                          0x000000010269eab8 main + 116
    20  libdyld.dylib                       0x0000000181509430 start + 4
    Abort
    %

expected_creads can exceed the number of file descriptors on some
platforms.

    % ./udp_test
    [==========] Running 18 test(s).
    [ RUN      ] mock_listenudp_uv_udp_open
    [       OK ] mock_listenudp_uv_udp_open
    [ RUN      ] mock_listenudp_uv_udp_bind
    [       OK ] mock_listenudp_uv_udp_bind
    [ RUN      ] mock_listenudp_uv_udp_recv_start
    [       OK ] mock_listenudp_uv_udp_recv_start
    [ RUN      ] mock_udpconnect_uv_udp_open
    [       OK ] mock_udpconnect_uv_udp_open
    [ RUN      ] mock_udpconnect_uv_udp_bind
    [       OK ] mock_udpconnect_uv_udp_bind
    [ RUN      ] mock_udpconnect_uv_udp_connect
    [       OK ] mock_udpconnect_uv_udp_connect
    [ RUN      ] mock_udpconnect_uv_recv_buffer_size
    [       OK ] mock_udpconnect_uv_recv_buffer_size
    [ RUN      ] mock_udpconnect_uv_send_buffer_size
    [       OK ] mock_udpconnect_uv_send_buffer_size
    [ RUN      ] udp_noop
    [       OK ] udp_noop
    [ RUN      ] udp_noresponse
    [       OK ] udp_noresponse
    [ RUN      ] udp_shutdown_connect
    [       OK ] udp_shutdown_connect
    [ RUN      ] udp_shutdown_read
    [       OK ] udp_shutdown_read
    [ RUN      ] udp_cancel_read
    [       OK ] udp_cancel_read
    [ RUN      ] udp_timeout_recovery
    [       OK ] udp_timeout_recovery
    [ RUN      ] udp_double_read
    [       OK ] udp_double_read
    [ RUN      ] udp_recv_one
    [       OK ] udp_recv_one
    [ RUN      ] udp_recv_two
    [       OK ] udp_recv_two
    [ RUN      ] udp_recv_send
    udp__connect_cb(0x0, too many open files, 0x0)
    udp__connect_cb(0x0, too many open files, 0x0)
    udp__connect_cb(0x0, too many open files, 0x0)
    udp__connect_cb(0x0, too many open files, 0x0)
    udp__connect_cb(0x0, too many open files, 0x0)
    udp__connect_cb(0x0, too many open files, 0x0)
    %
 2023-01-11 10:44:07 +00:00
Ondřej Surý 5bcfd46523 Merge branch 'ondrej/use-pthread_barrier-if-available' into 'main' 
Prefer the pthread_barrier implementation over uv_barrier

See merge request isc-projects/bind9!7348
 2023-01-11 09:54:13 +00:00
Ondřej Surý d07c4a98da Prefer the pthread_barrier implementation over uv_barrier 
Prefer the pthread_barrier implementation on platforms where it is
available over uv_barrier implementation.  This also solves the problem
with thread sanitizer builds on macOS that doesn't have pthread barrier.
 2023-01-11 09:51:02 +01:00
Ondřej Surý 5139b04e27 Merge branch 'fanf-git-replay-merge-tags' into 'main' 
Auto-tag merge requests created by git-replay-merge

See merge request isc-projects/bind9!7254
 2023-01-11 08:02:46 +00:00
Tony FinchandOndřej Surý 434e25c098 Auto-tag merge requests created by git-replay-merge 
The target branch is added to the title of the MR, and a "Backport"
label is added. If the target branch starts with "v" a version label
is added too.

While I am here, clean up remnants of the old gitlab API (which has
been replaced by push options for our purposes) and improve the
command-line parsing.
 2023-01-11 08:02:29 +00:00
Ondřej Surý 2037b1d944 Merge branch 'ondrej/remove-udp-and-tcp-listen-lock' into 'main' 
Get rid of locking during UDP and TCP listen

See merge request isc-projects/bind9!7343
 2023-01-11 06:51:14 +00:00
Ondřej Surý d06602f036 Get rid of locking during UDP and TCP listen 
We already have a synchronization mechanism when starting the UDP and
TCP listener children - barriers.  Change how we start the first-born
child (tid == 0), so we don't have to race for sock->parent->result and
sock->parent->fd.
 2023-01-11 07:17:46 +01:00
Ondřej Surý 7900cbd9a9 Merge branch 'ondrej/cleanup-isc_astack-usage-in-netmgr' into 'main' 
Convert isc_astack usage in netmgr to mempool and ISC_LIST

See merge request isc-projects/bind9!7300
 2023-01-10 19:53:50 +00:00
Ondřej Surý 10f884a5b8 Remove unused isc_astack unit 
The isc_astack unit is now unused, so just remove it.
 2023-01-10 20:31:24 +01:00
Ondřej Surý 359faf2ff7 Convert isc_astack usage in netmgr to mempool and ISC_LIST 
Change the per-socket inactive uvreq cache (implemented as isc_astack)
to per-worker memory pool.

Change the per-socket inactive nmhandle cache (implemented as
isc_astack) to unlocked per-socket ISC_LIST.
 2023-01-10 20:31:24 +01:00
Ondřej Surý 8de2c73fd5 Merge branch 'ondrej/always-track-netmgr-sockets-and-handles' into 'main' 
Simplify tracing the reference counting in isc_netmgr

See merge request isc-projects/bind9!7292
 2023-01-10 19:30:37 +00:00
Ondřej Surý 5bbba0d1a1 Simplify tracing the reference counting in isc_netmgr 
Always track the per-worker sockets in the .active_sockets field in the
isc__networker_t struct and always track the per-socket handles in the
.active_handles field ian the isc_nmsocket_t struct.
 2023-01-10 19:57:39 +01:00
Ondřej Surý 56d7e01334 Merge branch '3785-openssl-refactoring-19' into 'main' 
Add CHANGES note for [GL #3785]

Closes #3785

See merge request isc-projects/bind9!7344
 2023-01-10 09:39:55 +00:00
Ondřej Surý 41870dccba Add CHANGES note for [GL #3785] 2023-01-10 10:07:06 +01:00
Mark Andrews 6734b0f063 Merge branch '3787-siphash-c-105-26-runtime-error-applying-zero-offset-to-null-pointer' into 'main' 
Resolve "siphash.c:105:26: runtime error: applying zero offset to null pointer"

Closes #3787

See merge request isc-projects/bind9!7339
 2023-01-10 07:22:37 +00:00
Mark Andrews 349c23dbb7 Accept 'in=NULL' with 'inlen=0' in isc_{half}siphash24 
Arthimetic on NULL pointers is undefined.  Avoid arithmetic operations
when 'in' is NULL and require 'in' to be non-NULL if 'inlen' is not zero.
 2023-01-10 17:52:56 +11:00
Ondřej Surý a14946817e Merge branch '3785-openssl-refactoring-18' into 'main' 
Resolve "OpenSSL 3 refactoring"

Closes #3785

See merge request isc-projects/bind9!7335
 2023-01-09 21:50:15 +00:00
Ondřej Surý 504f3282e3 Ignore the extra EVP_PKEY_get_bn_param() failures 
In opensslrsa_components_get(), ignore the extra EVP_PKEY_get_bn_param()
return codes as RSA key might not have all those components.
 2023-01-09 22:10:17 +01:00
Evan Hunt 51093a834b Merge branch '3773-remove-dscp' into 'main' 
remove nonfunctional DSCP implementation

Closes #3773

See merge request isc-projects/bind9!7305
 2023-01-09 21:04:55 +00:00
Evan Hunt 34a7166029 CHANGES and release note for [GL #3773] 2023-01-09 12:15:28 -08:00
Evan Hunt 916ea26ead remove nonfunctional DSCP implementation 
DSCP has not been fully working since the network manager was
introduced in 9.16, and has been completely broken since 9.18.
This seems to have caused very few difficulties for anyone,
so we have now marked it as obsolete and removed the
implementation.

To ensure that old config files don't fail, the code to parse
dscp key-value pairs is still present, but a warning is logged
that the feature is obsolete and should not be used. Nothing is
done with configured values, and there is no longer any
range checking.
 2023-01-09 12:15:21 -08:00
Ondřej Surý f362cc0bf3 Merge branch '3785-openssl-refactoring-17' into 'main' 
Refactor OpenSSL ECDSA public and private key export

Closes #3785

See merge request isc-projects/bind9!7334
 2023-01-09 19:32:28 +00:00
Timo TeräsandOndřej Surý 8b62e7ed99 Refactor OpenSSL ECDSA private key export 2023-01-09 19:56:31 +01:00
Ondřej Surý ddce412489 Merge branch '3785-openssl-refactoring-16' into 'main' 
Refactor OpenSSL ECDSA generation to helper functions

Closes #3785

See merge request isc-projects/bind9!7333
 2023-01-09 18:56:29 +00:00
Timo TeräsandOndřej Surý 83b2e45600 Refactor OpenSSL ECDSA public key export 2023-01-09 19:56:27 +01:00
Timo TeräsandOndřej Surý 560d21a8b3 Refactor OpenSSL ECDSA generation to helper functions 
Reduce the #ifdef cruft by having specific helper functions.
 2023-01-09 19:52:56 +01:00
Ondřej Surý a0d15e4e07 Merge branch '3785-openssl-refactoring-15' into 'main' 
Refactor OpenSSL ECDSA to use pkeypair

Closes #3785

See merge request isc-projects/bind9!7332
 2023-01-09 18:52:27 +00:00
Timo TeräsandOndřej Surý a3b6729a88 Refactor OpenSSL ECDSA to use pkeypair 
- Use separate EVP_PKEY for public and private keys
- On private key load, generate public key allowing better consistency
- Support OpenSSL3 providers
- Clean up key construction abstraction
- Various other clean ups
 2023-01-09 19:33:48 +01:00
Ondřej Surý f6f807319c Merge branch '3785-openssl-refactoring-14' into 'main' 
Make OpenSSL keypair comparation a generic helper function

Closes #3785

See merge request isc-projects/bind9!7331
 2023-01-09 18:33:24 +00:00
Ondřej Surý 326e85e08d Merge branch '3785-openssl-refactoring-13' into 'main' 
Refactor OpenSSL ECDSA type check to opensslecdsa_valid_key_alg helper

Closes #3785

See merge request isc-projects/bind9!7330
 2023-01-09 18:31:06 +00:00
Timo TeräsandOndřej Surý 02efa591ef Make OpenSSL keypair comparation a generic helper function 2023-01-09 19:30:49 +01:00
Ondřej Surý 608ca9b140 Merge branch '3785-openssl-refactoring-12' into 'main' 
Implement support for OpenSSL 3 Provider API stored RSA keys

Closes #3785

See merge request isc-projects/bind9!7329
 2023-01-09 18:29:56 +00:00
Timo TeräsandOndřej Surý 96b8ad21f6 Refactor OpenSSL ECDSA type check to opensslecdsa_valid_key_alg helper 2023-01-09 19:29:38 +01:00
Timo TeräsandOndřej Surý 5fd6cfc625 Implement support for OpenSSL 3 Provider API stored RSA keys 
Allows using pkcs11-provider module for PKCS#11 keys
 2023-01-09 19:22:40 +01:00
Michal Nowak 370acd1f0a Merge branch 'mnowak/abort-on-ubsan-errors' into 'main' 
Abort on UBSAN errors

See merge request isc-projects/bind9!6877
 2023-01-09 16:39:24 +00:00