Use `nc` to check that multiple POST requests with non-empty HTTP
body are serviced normally by the statistics channel.
(cherry picked from commit bc32885ba981cab6308981936f49ab625af84bf2)
Update the "statschannel" system test to use the $((expression))
shell constucts instead of executing the `expr` program.
(cherry picked from commit 8034819b53789b52dd1c80b0256880b506a3f31b)
When the HTTP request has a body part after the HTTP headers, it is
not getting processed and is being prepended to the next request's data,
which results in an error when trying to parse it.
Improve the httpd.c:process_request() function with the following
additions:
1. Require that HTTP POST requests must have Content-Length header.
2. When Content-Length header is set, extract its value, and make sure
that it is valid and that the whole request's body is received before
processing the request.
3. Discard the request's body by consuming Content-Length worth of data
in the buffer.
(cherry picked from commit c2bbdc8a648c9630b2c9cea5227ad5c309c2ade5)
Add a new `const char **fvalue` parameter to the httpd.c:have_header()
function which, when set, will point to the found header's value.
(cherry picked from commit 376e698dc21f4117d6461101c4cfbaef2b724592)
It might be reused if /etc/bind.keys exists, but failed correct parsing.
Release traces of previous parsing attempt of different data.
(cherry picked from commit dc07394c4724c1e1235af85dd8c044af70da93ae)
This commit modifies the CHANGES file to mention that +http-plain-get
and +http-plain-post options support in dig was fixed.
(cherry picked from commit 0ab40c223b524b2d65a2b67a2eb76f4d63fbfb3e)
Before the commit some checks in the system test would try to verify
that different HTTP methods can be used and are functional. However,
until recently, it was not possible to tell from the output which
method was in fact used, so it turned out that +http-plain-get option
is broken.
This commit add the additional checks to prevent that from happening
in the future.
(cherry picked from commit 625991c810b4086a5fbfc48ecb54974f6b6e3f9a)
Support for parsing +http-plain-get and +http-plain-post options was
broken. This commit fixes that.
(cherry picked from commit fb135867644684a21d79bc3a5cebe3c83217a221)
The old code could incorrectly match "INSOA" in the RRSIG rdata
when looking for the SOA record.
(cherry picked from commit 2fc5f6fb2831697c79f75c50a769449ac561aad0)
When dumping an ADB address entry associated with a name,
the name bucket lock was held, but the entry bucket lock was
not; this could cause data races when other threads were updating
address entry info. (These races are probably not operationally
harmful, but they triggered TSAN error reports.)
Fedora 36 uses OpenSSL 3.0.2 by default, but the OpenSSL engine API
which we use for PKCS#11 is deprecated in OpenSSL 3.0.0. For the
keyfromlabel system test to work operating system with OpenSSL 1.1 needs
to be used.
(cherry picked from commit 2eecebdea91868be571e3c7a5fb3324505fbd2ff)
--without-cmocka and --without-gssapi ./configure options have been lost
when Debian 9 "stretch" was dropped from the CI. This reintroduces them,
albeit to a slightly different platform.
(cherry picked from commit a2c8703967e7b6ba2a0d02ab414172588a3cb17a)
Stop using a RSASHA1 fixed key in ns3's named.conf as the
trusted key and instead compute a broken digest from the
real digest to use in trusted-keys.
(cherry picked from commit be4cbe2b80)
Moves tests from being RSASHA1 based to RSASHA256 based where possible
and split out the remaining RSASHA1 based tests so that they are not
run on OS's that don't support RSASHA1.
(cherry picked from commit db028684e5)
migrate-nomatch-alglen: switched to RSASHA256 instead of RSASHA1
and the key size now changes from 2048 bits to 3072 bits instead
of 1024 bits to 2048 bits.
migrate-nomatch-algnum: switched to RSASHA256 instead of RSASHA1
as initial algorithm and adjusted mininum key size to 2048 bits.
rsasha256: adjusted minimum key size to 2048 bits.
(cherry picked from commit 048b015166)
The nsec-only.example zone was not converted as we use it to
test nsec-only DNSSEC algorithms to nsec3 conversion failure.
The subtest is skipped in fips mode.
Update "checking revoked key with duplicate key ID" test
to use FIPS compatible algorithm.
(cherry picked from commit 99ad09975e)
