Add support for the cd (checking disabled) bit. Setting the cd bit in a
query still doesn't completely work, since the resolver needs to be modified
also. Basically, if data is in the cache and trust == pending, it will now
be returned when the cd bit is set.
329. [func] omapi_auth_register() now takes a size_t argument for
the length of a key's secret data. Previously
OMAPI only stored secrets up to the first NUL byte.
299. [cleanup] Get the user and group information before changing the
root directory, so the administrator does not need to
keep a copy of the user and group databases in the
chroot'ed environment. Suggested by Hakan Olsson.
In query_find(), if we're looking up a key and dns_db_find() returns
DNS_R_DELEGATION, don't use the domain & ns set found by dns_db_find().
This means that a recursive server will not immediately ask the child zone
for a key set at the apex; the resolver will determine who to ask.
299. [cleanup] Get the user and group information before changing the
root directory, so the administrator does not need to
keep a copy of the user and group databases in the
chroot'ed environment. Suggested by Hakan Olsson.
(including multiple fixes to the original change)
309. [bug] When sending a referral, the server did not look
for name server addresses as glue in the zone
holding the NS RRset in the case where this zone
was not the same as the one where it looked for
name server addresses as authoritative data.
if getuid() == 0. Don't call ns_os_changeuser() more than once (it
could happen on Linux).
The code in its current form doesn't check for root before calling
setgid() or setuid(), since they'll fail and print reasonable error
messages (unless -u is supplied with the non-root user that ran named,
in which case it would succeed). The call to initgroups() would fail for
non root, so it shouldn't be tried.
The previous (as of a few days ago) code just ignored the -u parameter
when named was run as non-root. This was not good.
DNS_R_DELEGATION, don't use the domain & ns set found by dns_db_find().
This means that a recursive server will not immediately ask the child zone
for a key set at the apex; the resolver will determine who to ask.
algorithm to more closely follow RFC1035, so that root servers will
provide a more complete set of name server glue addresses in ccTLD
referral responses.
For non-referral responses, the server no longer uses glue as
additional data.
For referral responses, the servers now looks for glue A/AAAA/A6 RRs
in the zone where the NS RRs reside, even in the case where this is
different from the zone where the A/AAAA/A6 RRs would have resided had
they been authoritative data.
A6 chains included as additional info may not yet fully follow these
rules.
root directory, so the administrator does not need to
keep a copy of the user and group databases in the
chroot'ed environment. Suggested by Hakan Olsson.
Brian Wellington
Michael Graff