This commit contains fixes to unit tests to make them work well on
various platforms (in particular ones shipping old versions of
OpenSSL) and fo different configurations.
It also updates the generated manpage to include DoH configuration
options.
This commit completes the support for DNS-over-HTTP(S) built on top of
nghttp2 and plugs it into the BIND. Support for both GET and POST
requests is present, as required by RFC8484.
Both encrypted (via TLS) and unencrypted HTTP/2 connections are
supported. The latter are mostly there for debugging/troubleshooting
purposes and for the means of encryption offloading to third-party
software (as might be desirable in some environments to simplify TLS
certificates management).
This commit adds stub parser support and tests for:
- an "https-server" global option for HTTP/2 configuration.
- an "https-endpoint" view option for DoH configuration.
- add specific -p options to set dns, tls, or https port numbers by
specifying -p dns-PORT, -p tls=PORT, or -p https=PORT. NOTE: this
change only affects syntax; specifying the TLS port on the command
line DOES NOT CURRENTLY HAVE ANY EFFECT.
- change option names to tls-port and https-port for consistency.
- change variable names in system tests to TLSPORT and HTTPSPORT,
and report them when running tests.
Documentation for these options has also been added to the ARM, but
needs further work.
Add support for a "tls" key/value pair for zone primaries, referencing
either a "tls" configuration statement or "ephemeral". If set to use
TLS, zones will send SOA and AXFR/IXFR queries over a TLS channel.
The 'filter-aaaa', 'filter-aaaa-on-v4', and 'filter-aaaa-on-v6' options
are replaced by the filter-aaaa plugin. This plugin was introduced in
9.13.5 and so it is safe to remove the named.conf options.
These options were ancient or made obsolete a long time ago, it is
safe to remove them.
Also stop printing ancient options, they should be treated the same as
unknown options.
Removed options: lwres, geoip-use-ecs, sit-secret, use-ixfr,
acache-cleaning-interval, acache-enable, additional-from-auth,
additional-from-cache, allow-v6-synthesis, dnssec-enable,
max-acache-size, nosit-udp-size, queryport-pool-ports,
queryport-pool-updateinterval, request-sit, use-queryport-pool, and
support-ixfr.
Ondřej SurýandArtem Boldariev
Evan HuntandArtem Boldariev
Matthijs Mekking
Mark Andrews
Diego Fronza
Ondřej SurýandMichał Kępień
Michal NowakandMichał Kępień
JP Mens