Commit Graph
37186 Commits
Author SHA1 Message Date
Ondřej Surý a32d06dd42 Use custom isc_mem based allocator for libuv
The libuv library provides a way to replace the default allocator with
user supplied allocator (malloc, realloc, calloc and free).

Create a memory context specifically for libuv to allow tracking the
memory usage that has originated from within libuv.  This requires
libuv >= 1.38.0 which provides uv_library_shutdown() function that
assures no more allocations will be made.
2022-09-27 17:10:42 +02:00
Ondřej Surý a30e75db86 Check for working __builtin_mul_overflow() implementation
Instead of using generic HAVE_BUILTIN_OVERFLOW, we need to check whether
the overflow functions actually work as there was a bug in GCC that it
would not detect mul overflow when compiled with `-m32` option without
optimizations and the bug was fixed only for GCC 6.5+ and 7.3+/8+.

For further details see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82274
2022-09-27 17:10:42 +02:00
Ondřej Surý 2d2022a509 Make the debugging flags local to the memory context
Previously, the isc_mem_debugging would be single global variable that
would affect the behavior of the memory context whenever it would be
changed which could be after some allocation were already done.

Change the memory debugging options to be local to the memory context
and immutable, so all allocations within the same memory context are
treated the same.
2022-09-27 17:10:41 +02:00
Ondřej Surý 56f9c886aa Merge branch '3567-bump-the-minimal-libuv-version-to-1.34.0' into 'main'
Bump the libuv requirement to libuv >= 1.34.0

Closes #3567

See merge request isc-projects/bind9!6826
2022-09-27 15:09:53 +00:00
Ondřej Surý 178e0317a6 Add CHANGES and release note for [GL #3567] 2022-09-27 17:09:11 +02:00
Ondřej Surý 0086ebf3fc Bump the libuv requirement to libuv >= 1.34.0
By bumping the minimum libuv version to 1.34.0, it allows us to remove
all libuv shims we ever had and makes the code much cleaner.  The
up-to-date libuv is available in all distributions supported by BIND
9.19+ either natively or as a backport.
2022-09-27 17:09:10 +02:00
Ondřej Surý d5bead54c0 Drop Ubuntu 18.04 bionic from the CI
The Ubuntu 18.04 bionic will go EOL in April 2023 before the next stable
BIND 9 release, so we can drop this for the next stable BIND 9 release.
2022-09-27 17:09:10 +02:00
Ondřej Surý 7238c85c88 Drop Debian buster from the CI
The Debian buster is official EOL and in the LTS mode, so we can drop
this for the next stable BIND 9 release.
2022-09-27 17:09:10 +02:00
Matthijs Mekking 444461e9b1 Merge branch 'matthijs-dnssec-guide-dnssec-policy-requires-inline-signing' into 'main'
Add dnssec-policy inline-signing requirement to documentation

See merge request isc-projects/bind9!6823
2022-09-27 15:08:03 +00:00
Matthijs Mekking 18d230a584 Add inline-signing to config examples
Add 'inline-signing yes;' to configuration examples to have working
copy paste configurations.
2022-09-27 17:06:30 +02:00
Matthijs Mekking 5d454a7158 Update inline-signing requirement to ARM
This change was made in !6403, but the appropriate documentation
changes were not applied to the ARM.
2022-09-27 17:06:30 +02:00
Matthijs Mekking 09522c8d73 Add inline-signing requirement to DNSSEC Guide
This change was made in !6403, but the appropriate documentation
changes were not applied to the DNSSEC Guide.
2022-09-27 17:06:30 +02:00
Petr Špaček 489320e961 Merge branch '3541-have-named-v-report-supported-algorithms' into 'main'
Report supported crypto algorithms

Closes #3541

See merge request isc-projects/bind9!6771
2022-09-27 14:55:11 +00:00
Petr Špaček c138a8aa59 Add release note for new crypto algorithm logging 2022-09-27 16:54:39 +02:00
Petr Špaček c648e280e4 Document list of crypto algorithms in named -V output 2022-09-27 16:54:39 +02:00
Mark AndrewsandPetr Špaček d34ecdb366 Deduplicate string formating 2022-09-27 16:54:39 +02:00
Mark AndrewsandPetr Špaček e876de442e Add CHANGES entry for [GL #3541] 2022-09-27 16:54:39 +02:00
Mark AndrewsandPetr Špaček 3156d36495 silence scan-build false positive 2022-09-27 16:54:39 +02:00
Mark AndrewsandPetr Špaček cb1515e71f Report algorithms supported by named at startup 2022-09-27 16:54:39 +02:00
Mark AndrewsandPetr Špaček b308f866c0 Have 'named -V' report supported algorithms
These cover DNSSEC, DS, HMAC and TKEY algorithms.
2022-09-27 16:54:39 +02:00
Mark AndrewsandPetr Špaček 151cc2fff9 Replace alg_totext with dst_hmac_algorithm_totext
The new library function will be reused by subsequent commits.
2022-09-27 16:54:39 +02:00
Mark AndrewsandPetr Špaček 09f7e0607a Convert DST_ALG defines to enum and group HMAC algorithms
The HMACs and GSSAPI are just using unallocated values.
Moving them around shouldn't cause issues.
Only the dnssec system test knew the internal number in use for hmacmd5.
2022-09-27 16:54:36 +02:00
Arаm Sаrgsyаn a84c422fc8 Merge branch '3513-cid-356329-error-handling-in-dnssec-signzone.c' into 'main'
Resolve "CID 356329: Error handling issues in bin/dnssec/dnssec-signzone.c"

Closes #3513

See merge request isc-projects/bind9!6714
2022-09-27 14:34:23 +00:00
Aram Sargsyan 4509c4f1bd Use the return value of isc_task_create()
Improve the error handling by checking the isc_task_create()
function's return value.

CID 356329:

    /bin/dnssec/dnssec-signzone.c: 3732 in main()
    3726     	if (directory == NULL) {
    3727     		directory = ".";
    3728     	}
    3729
    3730     	isc_managers_create(&mctx, ntasks, &loopmgr, &netmgr, &taskmgr);
    3731
    >>>     CID 356329:  Error handling issues  (CHECKED_RETURN)
    >>>     Calling "isc__task_create" without checking return value (as is done elsewhere 16 out of 18 times).
    3732     	isc_task_create(taskmgr, &write_task, 0);
    3733
    3734     	result = dst_lib_init(mctx, engine);
    3735     	if (result != ISC_R_SUCCESS) {
    3736     		fatal("could not initialize dst: %s",
    3737
2022-09-27 12:22:34 +00:00
Mark Andrews eb7b068bf8 Merge branch '3557-catalog-zone-check-key-names' into 'main'
Resolve "Catalog zone processing failed to detect TSIG key changes for primaries"

Closes #3557

See merge request isc-projects/bind9!6806
2022-09-27 12:17:08 +00:00
Mark Andrews eacf41a20a Add release note for [GL #3557] 2022-09-27 21:54:02 +10:00
Mark Andrews 0774dacf2d Add CHANGES note for [GL #3557] 2022-09-27 21:54:02 +10:00
Mark Andrews 176e172210 Check that changing the TSIG key is successful
Switch the primary to require 'next_key' for zone transfers then
update the catalog zone to say to use 'next_key'.  Next update the
zones contents then check that those changes are seen on the
secondary.
2022-09-27 21:54:02 +10:00
Mark Andrews 9172bd9b5a Check that primary key names have not changed
When looking for changes in a catalog zone member zone we need to
also check if the TSIG key name associated with a primary server
has be added, removed or changed.
2022-09-27 21:54:02 +10:00
Petr Špaček 75424ec23a Merge branch 'pspacek/fix-dns_message_checksig-out-of-tree' into 'main'
Fix dns_message_checksig fuzzer

Closes #3565

See merge request isc-projects/bind9!6822
2022-09-27 11:22:56 +00:00
Ondřej SurýandPetr Špaček 16377100ae Fix stack-use-after-scope in dns_message_checksig test
Previously stack with buffer for test dns message went out of scope
before the message was processed. For fuzz testing its better to avoid
allocation, so let's avoid allocations completely and use simplest
possible static buffer.

Fixes: #3565
2022-09-27 13:06:01 +02:00
Petr Špaček 4108d79c9a Fix dns_message_checksig in out-of-tree setup
Hardcoded path was missing FUZZDIR prefix.

Related: !5923
2022-09-27 11:21:42 +02:00
Petr Špaček d102c59b96 Detect errors in fuzzer initialization
Incomplete initialization typically causes mysterious failures later on,
so let's err out early.
2022-09-27 11:21:38 +02:00
Michał Kępień 547f15ff11 Merge branch 'mnowak/add-fedora-36' into 'main'
Add Fedora 36

See merge request isc-projects/bind9!6297
2022-09-27 07:39:31 +00:00
Michal NowakandMichał Kępień a313c49a3b Add Fedora 36 2022-09-27 09:37:09 +02:00
Evan Hunt df51d22726 Merge branch '3553-static-buffer-functions' into 'main'
change ISC__BUFFER macros to inline functions

See merge request isc-projects/bind9!6801
2022-09-27 07:23:06 +00:00
Evan Hunt 1926ddc987 change ISC__BUFFER macros to inline functions
previously, when ISC_BUFFER_USEINLINE was defined, macros were
used to implement isc_buffer primitives (isc_buffer_init(),
isc_buffer_region(), etc). these macros were missing the DbC
assertions for those primitives, which made it possible for
coding errors to go undetected.

adding the assertions to the macros caused compiler warnings on
some platforms. therefore, this commit converts the ISC__BUFFER
macros to static inline functions instead, with assertions included,
and eliminates the non-inline implementation from buffer.c.

the --enable-buffer-useinline configure option has been removed.
2022-09-26 23:49:27 -07:00
Petr Špaček c42d980d4a Merge branch 'bug/main/doc-arm-rhel9' into 'main'
Compatibility for building ARM on older sphinx

See merge request isc-projects/bind9!6815
2022-09-26 15:15:27 +00:00
Petr MenšíkandPetr Špaček 3db7e241d2 Simplify allowing warnings during ARM build
RHEL8 Sphinx does not support all features used in ARM building. But
with few emitted warnings it can build the documentation fine. Simplify
warnings acceptance by allowing make doc SPHINX_W=''.
2022-09-26 17:09:56 +02:00
Petr MenšíkandPetr Špaček bc6c6b1184 Compatibility for building ARM on older sphinx
Make documentation building successful even on RHEL9 sphinx 3.4.3. It
does not like case-insensitive matching of terms, so provide lowercase
text description with Uppercase word reference.
2022-09-26 17:09:51 +02:00
Petr Špaček 12bce9e69b Merge branch 'ondrej-add-dns_message_checktsig-fuzzer' into 'main'
Add dns_message_checksig() fuzzer

See merge request isc-projects/bind9!5923
2022-09-26 14:30:16 +00:00
Petr Špaček 983822abcf Add seed to reproduce issue memory leak in dns_message_checktsig
Related: #3547
2022-09-26 16:29:36 +02:00
Mark AndrewsandPetr Špaček 6237273205 Add CHANGES notes for [GL !5923] 2022-09-26 16:29:35 +02:00
Mark AndrewsandPetr Špaček 805e2ba31d Add the ability to dig to specify the signing time 2022-09-26 16:28:23 +02:00
Mark AndrewsandPetr Špaček 4d248ee78e Allow dig to SIG(0) sign a message 2022-09-26 16:28:23 +02:00
Mark AndrewsandPetr Špaček c127a2aefc Add a SIG(0) request seed 2022-09-26 16:28:23 +02:00
Mark AndrewsandPetr Špaček 3c28608c9f Add TSIG reply seed 2022-09-26 16:28:23 +02:00
Mark AndrewsandPetr Špaček f3d47bc8e0 Add TSIG request seed 2022-09-26 16:28:23 +02:00
Ondřej SurýandPetr Špaček 4da0180ba2 Add dns_message_checksig() fuzzer
dns_message_checksig is called in a number of scenarios

	* on requests and responses
	* on multiple opcodes
	* with and without signatures
	* with TSIG signatures
	* with SIG(0) signatures
	* with and without configured TSIG keys
	* with and without KEY records being present
	* signing performed now, in the future and in the past

we use the first two octets of the seed to configure the calling
environment with the remainder of the seed being the rdata of the
TSIG/SIG(0) record.
2022-09-26 16:28:23 +02:00
Ondřej SurýandPetr Špaček 3e85d8c3d6 Add the ability specify the signing / verification time
When fuzzing it is useful for all signing operations to happen
at a specific time for reproducability.  Add two variables to
the message structure (fuzzing and fuzztime) to specify if a
fixed time should be used and the value of that time.
2022-09-26 16:28:12 +02:00