Commit Graph
36547 Commits
Author SHA1 Message Date
Petr Špaček 7b4ad8a3ff Warn about experimental and deprecated options 2022-07-01 08:59:23 +02:00
Petr Špaček c6fe8970f6 Render statement's grammar
This is replacement for auto-generated *.rst files stored in the repo.
2022-07-01 08:59:23 +02:00
Petr Špaček eba3b1ad16 Render list of blocks accepting a given statement 2022-07-01 08:59:23 +02:00
Petr Špaček d61d998e3b Detect unsupported statement:: directives with multiple names 2022-07-01 08:59:23 +02:00
Petr Špaček ebe6ede2ec Warn about statements not found in the grammar 2022-07-01 08:59:23 +02:00
Petr Špaček cbad1803a5 Warn about statements in grammar not described in docs
Skip over obsolete options.
2022-07-01 08:59:22 +02:00
Petr Špaček 1c6f2c5ad1 Give Sphinx configuration domains access to grammar 2022-07-01 08:59:22 +02:00
Petr Špaček a691ebd0c9 Add helper to unify options and zone block grammars
A helper is needed to combine cfg_test output for generic options and
all the type-dependent zone block variants.
2022-07-01 08:59:22 +02:00
Petr Špaček 190004e46c Add pretty printer for JSON grammar
It produces the same format as cfg_test --grammar. The advantage is that
it allows to print any node in configuration the tree, not just whole
blocks.
2022-07-01 08:59:22 +02:00
Petr Špaček 8960d51aa3 Add utility to search for context-dependent configuration statements
The utility detects statements which use the same name (e.g.
max-zone-ttl) but use different grammar in different contexts. These
typically need special case in docs.
2022-07-01 08:59:22 +02:00
Petr Špaček df08982930 Add a new library to parse grammar format produced by cfg_test
It transforms named.conf/rndc.conf grammar from text format into Python
dictionary. This allows granular access to grammar elements.

Beware: It heavity depens on cfg_test output format!
2022-07-01 08:59:04 +02:00
Petr Špaček fb474de3ab Add rndc.conf grammar into doc/misc
It uses the same mechanism as all other grammars, but the file is named
differently to distinguish it from named.conf grammars.
2022-07-01 08:56:35 +02:00
Petr Špaček 699570cdec Un-format grammar files in doc/misc
The next commit is going to add parser for ISC configuration format.
To simplify the parser the grammar files in doc/misc are no longer
line-wrapped as handling it would make the grammar parser unnecessairly
complicated.

This affects visible output in the ARM, but in the end we are going to
replace the auto-generated .rst files with grammar pretty printed, so
formatting of these files does not matter in practical terms.
2022-07-01 08:56:33 +02:00
Petr Špaček af3683f436 Add missing comment markers to doc/misc/ grammar files
These files can be consumed by scripts, so obviously missing comment
markers wreak havoc.
2022-06-30 19:00:17 +02:00
Petr Špaček b18fa6c7b2 Merge branch 'sgoldlust/arm-tag-query-transfer' into 'main'
Add tags and short descriptions for query and transfer statements

See merge request isc-projects/bind9!6502
2022-06-30 16:11:30 +00:00
Petr Špaček 563eb8e1b9 Accept rst syntax in .. statement:: short: text
Nested rst syntax is now parsed and rendered. E.g.:

.. namedconf:statement:: example
   :short: Use ``this`` **cool** syntax!
2022-06-30 18:04:44 +02:00
Petr Špaček 0e7ca5b5e0 Disambiguate address_match_list link anchor
Let's keep just the :term: produced by grammar glossary.
2022-06-30 18:04:41 +02:00
Suzanne GoldlustandPetr Špaček 3cf976bd78 Add the :tags: and :short: descriptions for the category "transfer" 2022-06-30 18:04:40 +02:00
Suzanne GoldlustandPetr Špaček 7187a5cf77 Add the :tags: and :short: descriptions for the category "query" 2022-06-30 18:04:40 +02:00
Petr Špaček 2630cf8e76 Resurrect DNS NOTIFY chapter in the ARM
It was accidentally removed in the heat of
25eb91d23c.
2022-06-30 18:04:40 +02:00
Michał Kępień 692fb3eedd Merge branch '2147-obsolete-the-glue-cache-option' into 'main'
Obsolete the "glue-cache" option

Closes #2147

See merge request isc-projects/bind9!6500
2022-06-30 13:27:54 +00:00
Michał Kępień f0d2d3c03f Add CHANGES entry and release note for GL #2147 2022-06-30 15:24:08 +02:00
Michał Kępień 887c666caf Obsolete the "glue-cache" option
The "glue-cache" option was marked as deprecated by commit
5ae33351f2 (first released in BIND 9.17.6,
back in October 2020), so now obsolete that option, removing all code
and documentation related to it.

Note: this causes the glue cache feature to be permanently enabled, not
disabled.
2022-06-30 15:24:08 +02:00
Michal Nowak 3fb7ab8476 Merge branch '2371-add-stress-testing-with-rpz' into 'main'
Run the "stress" test in RPZ mode in GitLab CI

Closes #2371

See merge request isc-projects/bind9!4526
2022-06-28 18:36:30 +00:00
Michal Nowak d272574653 Add stress testing with RPZ 2022-06-28 20:32:37 +02:00
Petr Špaček accc2440ee Merge branch '3408-drop-debian-9-stretch' into 'main'
Drop support for Debian 9 (Stretch)

See merge request isc-projects/bind9!6486
2022-06-28 15:56:06 +00:00
Petr Špaček 4ce1f25210 Declare Debian 9 (Stretch) community-maintained 2022-06-28 17:54:48 +02:00
Petr Špaček aa86a8bcf0 Drop Debian 9 (Stretch) from CI 2022-06-28 17:54:44 +02:00
Artem Boldariev 7a90169fee Merge branch '3415-update-http-listeners-on-reconfig' into 'main'
Update HTTP listeners settings on reconfiguration

Closes #3415

See merge request isc-projects/bind9!6482
2022-06-28 13:10:20 +00:00
Artem Boldariev 7822670d0f doth test: extend with HTTP endpoints reconfiguration check
This commit add a check which verifies that HTTP endpoints are being
picked up properly by the BIND instance on a reconfiguration.
2022-06-28 15:43:19 +03:00
Artem Boldariev 502c78c339 Update CHANGES [GL #3415]
Mention that the settings are now applied properly on reconfiguration.
2022-06-28 15:43:18 +03:00
Artem Boldariev d2e13ddf22 Update the set of HTTP endpoints on reconfiguration
This commit ensures that on reconfiguration the set of HTTP
endpoints (=paths) is being updated within HTTP listeners.
2022-06-28 15:42:38 +03:00
Artem Boldariev e72962d5f1 Update max concurrent streams limit in HTTP listeners on reconfig
This commit ensures that HTTP listeners concurrent streams limit gets
updated properly on reconfiguration.
2022-06-28 15:42:38 +03:00
Artem Boldariev a2379135fa Update HTTP listeners quotas on reconfiguration
This commit ensures that on reconfiguration a proper value for HTTP
connections limit is picked up.

The commit also refactors how listeners settings are updated so that
there is less code duplication.
2022-06-28 15:42:38 +03:00
Artem Boldariev 3f0b310772 Store HTTP quota size inside a listenlist instead of the quota
This way only quota size is passed to the interface/listener
management code instead of a quota object. Thus, we can implement
updating the quota object size instead of recreating the object.
2022-06-28 15:42:38 +03:00
Matthijs Mekking 806b89abe1 Merge branch 'matthijs-dnssec-policy-defaults-in-config-dot-c' into 'main'
Move built-in dnssec-policies into defaultconf

See merge request isc-projects/bind9!6467
2022-06-28 12:35:46 +00:00
Matthijs Mekking d8dae61832 Add isccfg duration utility functions
Add function isccfg_duration_toseconds and isccfg_parse_duration to get
rid of code duplication.
2022-06-28 11:56:31 +02:00
Matthijs Mekking 8e18fa5874 Fix a bug in the duration_fromtext function
The function actually did not enforce that the duration string starts
with a P (or p), just that there is a P (or p) in the string.
2022-06-28 11:56:31 +02:00
Matthijs Mekking c2a7950417 Also inherit from "default" for "insecure" policy
Remove the duplication from the defaultconf and inherit the values
not set in the "insecure" policy from the "default" policy. Therefore,
we must insist that the first read built-in policy is the default one.
2022-06-28 11:56:31 +02:00
Matthijs Mekking 80b55f9cfa Add change entry for dnssec-policy in defaultconf 2022-06-28 11:56:31 +02:00
Matthijs Mekking 5d6f0de84b Nit changes in keymgr and kasp
Use the ISC_MAX define instead of "x = a > b ? a : b" paradigm.

Remove an unneeded include.
2022-06-28 11:56:31 +02:00
Matthijs Mekking 20acb8d3a3 When loading dnssec-policies, inherit from default
Most of the settings (durations) are already inheriting from the default
because they use the constants from lib/dns/kasp.h. We need them as
constants so we can use them in named-checkconf to verify the policy
parameters.

The NSEC(3) parameters and keys should come from the actual default
policy. Change the call to cfg_kasp_fromconfig() to include the default
kasp. We also no longer need to corner case where config is NULL we load
the built-in policy: the built-in policies are now loaded when config is
set to named_g_config.

Finally, add a debug log (it is useful to see which policies are being
loaded).
2022-06-28 11:56:31 +02:00
Matthijs Mekking 5ff414e986 Store built-in dnssec-policies in defaultconf
Update the defaultconf with the built-in policies. These will now be
printed with "named -C".

Change the defines in kasp.h to be strings, so they can be concatenated
in the defaultconf. This means when creating a kasp structure, we no
longer initialize the defaults (this is fine because only kaspconf.c
uses dns_kasp_create() and it inherits from the default policy).

In kaspconf.c, the default values now need to be parsed from string.

Introduce some variables so we don't need to do get_duration multiple
times on the same configuration option.

Finally, clang-format-14 decided to do some random formatting changes.
2022-06-28 11:56:31 +02:00
Matthijs Mekking a28d919503 Move duration structure to libisccfg/duration
Having the duration structure and parsing code here, it becomes
more accessible to be used in other places.
2022-06-28 11:56:31 +02:00
Michał Kępień 1854bd93ba Merge branch '3216-run-sslyze-in-gitlab-ci' into 'main'
[CVE-2022-1183] Run sslyze in GitLab CI

Closes #3216

See merge request isc-projects/bind9!6365
2022-06-27 21:08:40 +00:00
Michał Kępień 4f12892740 Also test DNS-over-TLS code using sslyze
Since sslyze can test any TLS-enabled server, also use it for exercising
DNS-over-TLS code rather than just DNS-over-HTTPS code.
2022-06-27 22:50:00 +02:00
Michał Kępień e97b4697cf Add regression test for CVE-2022-1183
If sslyze is available in PATH, run it in a loop as part of the "doth"
system test.
2022-06-27 22:50:00 +02:00
Matthijs Mekking c7146ce90a Merge branch '3422-dnssec-policy-clarifications' into 'main'
Add some clarifications wrt dynamic zones

Closes #3422

See merge request isc-projects/bind9!6487
2022-06-27 09:03:54 +00:00
Matthijs Mekking fb517eb52a Add some clarifications wrt dynamic zones
These were suggested by GitLab user @elmaimbo.
2022-06-27 11:01:33 +02:00
Petr Špaček 24908151a9 Merge branch '3169-named-conf-intro-and-links' into 'main'
Reworked named.conf introduction and link anchors

See merge request isc-projects/bind9!6459
2022-06-24 14:38:46 +00:00