Commit Graph

28856 Commits

Author SHA1 Message Date
Matthijs Mekking
ae159914b0 Update copyrights 2019-02-22 15:24:16 +01:00
Matthijs Mekking
d6cb3022a3 Add test for rpz zone load fail 2019-02-22 15:24:08 +01:00
Matthijs Mekking
6594f7acb2 Remove rpz->db_registered
As pointed out in !813 db_registered is sort of redundant.  It is
set to `true` only in `dns_zone_rpz_enable_db()` right before the
`dns_rpz_dbupdate_callback()` callback is registered.  It is only
required in that callback and it is the only place that the callback
is registered.  Therefore there is no path that that `REQUIRE` can
fail.

The `db_registered` variable is only set to `false` in
`dns_rpz_new_zone`, so it is not like the variable is unset again
later.

The only other place where `db_registered` is checked is in
`rpz_detach()`.  If `true`, it will call
`dns_db_updatenotify_unregister()`.  However if that happens, the
`db_registered` is not set back to `false` thus this implies that
this may happen multiple times.  If called a second time, most
likely the unregister function will return `ISC_R_NOTFOUND`, but
the return value is not checked anyway.  So it can do without the
`db_registered` check.
2019-02-22 15:23:59 +01:00
Matthijs Mekking
a4cd74e71a Add curly brackets on if statements 2019-02-22 15:23:44 +01:00
Matthijs Mekking
48d7e4bb40 named crashes on shutdown after load rpz failed
This may happen when loading an RPZ failed and the code path skips
calling dns_db_endload().  The dns_rpz_zone_t object is still kept
marked as having registered db.  So when this object is finally
destroyed in rpz_detach(), this code will incorrectly call
`dns_db_updatenotify_unregister()`:

   if (rpz->db_registered)
     dns_db_updatenotify_unregister(rpz->db,
                                    dns_rpz_dbupdate_callback, rpz);

and trigger this assertion failure:

   REQUIRE(db != NULL);

To fix this, only call `dns_db_updatenotify_unregister()` when
`rpz->db` is not NULL.
2019-02-22 15:23:33 +01:00
Matthijs Mekking
e2def297b6 Make RPZ tests more readable 2019-02-22 15:18:20 +01:00
Matthijs Mekking
c01d63373c Add README to RPZ tests 2019-02-22 15:18:11 +01:00
Tinderbox User
6491691ac4 Merge branch 'prep-release' into security-v9_14 v9.13.7 2019-02-21 02:11:26 +00:00
Tinderbox User
453f5da790 doc rebuild 2019-02-21 02:11:15 +00:00
Tinderbox User
856c74700f prep 9.13.7 2019-02-21 01:57:08 +00:00
Evan Hunt
ce5857556b Merge branch 'security-dlz-axfr-deny-broken' into security-master
denied axfr requests were not effective for writable DLZ zones

See merge request isc-private/bind9!57
2019-02-20 17:45:50 -08:00
Mark Andrews
ed6c10d46b add CHANGES and release notes entries 2019-02-20 17:45:50 -08:00
Mark Andrews
bc01aadc02 denied axfr requests were not effective for writable DLZ zones 2019-02-20 17:45:50 -08:00
Evan Hunt
702e5dc21a Merge 'keytag-memleak' into security-master 2019-02-20 17:45:49 -08:00
Evan Hunt
a47d2850c0 fix test error 2019-02-20 17:45:49 -08:00
Mark Andrews
7d5b7192ec add CHANGES and release note entries 2019-02-20 17:45:49 -08:00
Mark Andrews
d68adfea9c check that multiple KEY-TAG trust-anchor-telemetry options don't leak memory 2019-02-20 17:45:49 -08:00
Mark Andrews
873c704de9 silently ignore additional keytag options 2019-02-20 17:45:49 -08:00
Evan Hunt
ff47556e26 Merge 'managed-key-assert' into security-master 2019-02-20 17:45:48 -08:00
Evan Hunt
f3fbbc20d2 Merge 'managed-key-assert' into security-master 2019-02-20 17:45:48 -08:00
Evan Hunt
8b8e492e48 use algorithm 255 for both unsupported keys 2019-02-20 17:45:48 -08:00
Matthijs Mekking
ea5a5b77f9 CHANGES, notes 2019-02-20 17:45:48 -08:00
Matthijs Mekking
98ef5c09d2 Update keyfetch_done compute_tag check
If in keyfetch_done the compute_tag fails (because for example the
algorithm is not supported), don't crash, but instead ignore the
key.
2019-02-20 17:45:47 -08:00
Matthijs Mekking
3516864ade Add tests for mkeys with unsupported algorithm
These tests check if a key with an unsupported algorithm in
managed-keys is ignored and when seeing an algorithm rollover to
an unsupported algorithm, the new key will be ignored too.
2019-02-20 17:45:47 -08:00
Matthijs Mekking
5aa41ae9f8 Don't free key in compute_tag in case of failure
If `dns_dnssec_keyfromrdata` failed we don't need to call
`dst_key_free` because no `dstkey` was created.  Doing so
nevertheless will result in an assertion failure.

This can happen if the key uses an unsupported algorithm.
2019-02-20 17:45:47 -08:00
Evan Hunt
566ad7021e Merge branch 'setup-v914' into v9_14 2019-02-20 17:44:43 -08:00
Evan Hunt
2579f31f54 begin setup of 9.14 branch 2019-02-20 17:44:32 -08:00
Evan Hunt
f4ade46f4a Merge branch '428-remove-contrib-sdb' into 'master'
remove contrib/sdb

Closes #428

See merge request isc-projects/bind9!1501
2019-02-19 20:47:55 -05:00
Evan Hunt
bcc2fd679b CHANGES 2019-02-19 17:19:40 -08:00
Evan Hunt
c79e2f12fe remove contrib/sdb
removed the SDB databases in contrib/sdb as they hadn't been
maintained in some time, and were no longer able to link to named
without modification.  also:

- cleaned up contrib/README, which still referred to contrib
  subdirectores that were removed already, and linked to an obsolete URL.
- removed references to sdb in doc/misc/roadmap and doc/misc/sdb.
2019-02-19 17:19:40 -08:00
Mark Andrews
d27f41cb7f Merge branch '884-patches-to-review' into 'master'
Correct errno to result translation

Closes #884

See merge request isc-projects/bind9!1519
2019-02-19 18:11:42 -05:00
Mark Andrews
a0c0d76029 add CHANGES 2019-02-20 09:44:56 +11:00
Mark Andrews
218ce34e7d correct errno to result translation 2019-02-20 09:43:16 +11:00
Mark Andrews
fa79f4b899 Merge branch '836-building-fails-in-build-subdirectory-when-dnstap-is-enabled' into 'master'
Resolve "Building fails in build subdirectory when dnstap is enabled"

Closes #836

See merge request isc-projects/bind9!1510
2019-02-19 17:40:59 -05:00
Mark Andrews
3a21fdf884 add CHANGES 2019-02-20 09:29:07 +11:00
Mark Andrews
c0d4ff5796 teach proto_c to look in the source directory for out of tree builds 2019-02-20 09:27:00 +11:00
Mark Andrews
d76e172480 Merge branch '877-clang-scan-build-redundant-assignments-detected' into 'master'
Remove redundant assignments

Closes #877

See merge request isc-projects/bind9!1513
2019-02-18 18:01:56 -05:00
Mark Andrews
f475dc75b1 remove redundant assignment 2019-02-18 17:40:56 -05:00
Mark Andrews
7b60f6832e silence clang 2019-02-18 17:40:56 -05:00
Mark Andrews
9a9dc4072f declarations before assertions 2019-02-18 17:40:56 -05:00
Mark Andrews
70fab477b1 don't overwrite result 2019-02-18 17:40:56 -05:00
Mark Andrews
63c03cdb2d remove seen_dname 2019-02-18 17:40:56 -05:00
Mark Andrews
a92d281e10 Merge branch '877-clang-scan-build-redundant-assignments-detected-3' into 'master'
Uninitialised reads in dns_tsig_sign after change 5148.

See merge request isc-projects/bind9!1528
2019-02-18 17:39:38 -05:00
Mark Andrews
4938f97c97 record when querytsig is valid 2019-02-18 17:39:08 -05:00
Mark Andrews
0de6a3835f Merge branch '877-clang-scan-build-redundant-assignments-detected-2' into 'master'
decode_NegTokenInit failed to cleanup allocated memory on error.

See merge request isc-projects/bind9!1527
2019-02-18 17:34:50 -05:00
Mark Andrews
7114d16098 fix memory leak 2019-02-19 09:17:03 +11:00
Mark Andrews
d2ca9e79e3 Merge branch '877-clang-scan-build-redundant-assignments-detected-2' into 'master'
Cleanup no longer necessary assignments post refactoring in socket.c

See merge request isc-projects/bind9!1526
2019-02-18 16:14:56 -05:00
Mark Andrews
f87b88e520 remove dead assignments 2019-02-19 08:12:09 +11:00
Mark Andrews
26c0eaf6e0 Merge branch '877-clang-scan-build-redundant-assignments-detected-2' into 'master'
Add missing asserts to socket_test.c and dnstest.c

See merge request isc-projects/bind9!1523
2019-02-18 15:57:46 -05:00
Mark Andrews
76a1c1531a assert result is ISC_R_SUCCESS 2019-02-19 07:57:14 +11:00