Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Tony Finch
|
128a2c80a9 | ||
|
Tony Finch
|
e1c4e29b1b |
+4
-7
@@ -34,10 +34,6 @@ PointerAlignment: Right
|
||||
PointerBindsToType: false
|
||||
IncludeBlocks: Regroup
|
||||
IncludeCategories:
|
||||
- Regex: '^<(urcu\.h|urcu/urcu-|urcu-)'
|
||||
Priority: 2
|
||||
- Regex: '^<urcu/'
|
||||
Priority: 3
|
||||
- Regex: '^<isc/'
|
||||
Priority: 5
|
||||
- Regex: '^<(pk11|pkcs11)/'
|
||||
@@ -54,6 +50,8 @@ IncludeCategories:
|
||||
Priority: 35
|
||||
- Regex: '^<irs/'
|
||||
Priority: 40
|
||||
- Regex: '^<bind9/'
|
||||
Priority: 45
|
||||
- Regex: '^<(dig|named|rndc|confgen|dlz)/'
|
||||
Priority: 50
|
||||
- Regex: '^<dlz_'
|
||||
@@ -63,9 +61,9 @@ IncludeCategories:
|
||||
- Regex: '^<tests/'
|
||||
Priority: 100
|
||||
- Regex: '<openssl/'
|
||||
Priority: 4
|
||||
Priority: 1
|
||||
- Regex: '<(mysql|protobuf-c)/'
|
||||
Priority: 4
|
||||
Priority: 1
|
||||
- Regex: '.*'
|
||||
Priority: 0
|
||||
IndentExternBlock: NoIndent
|
||||
@@ -78,4 +76,3 @@ PenaltyBreakString: 80
|
||||
PenaltyExcessCharacter: 100
|
||||
Standard: Cpp11
|
||||
ContinuationIndentWidth: 8
|
||||
ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe', 'ISC_LIST_FOREACH', 'ISC_LIST_FOREACH_SAFE', 'ISC_LIST_FOREACH_REV', 'ISC_LIST_FOREACH_REV_SAFE' ]
|
||||
|
||||
+15
-29
@@ -34,40 +34,26 @@ PointerAlignment: Right
|
||||
PointerBindsToType: false
|
||||
IncludeBlocks: Regroup
|
||||
IncludeCategories:
|
||||
- Regex: '^<(urcu/urcu-|urcu-)'
|
||||
Priority: 2
|
||||
- Regex: '^<urcu/'
|
||||
Priority: 3
|
||||
- Regex: '^<isc/'
|
||||
Priority: 5
|
||||
- Regex: '^<(pk11|pkcs11)/'
|
||||
Priority: 10
|
||||
Priority: 2
|
||||
- Regex: '^<dns/'
|
||||
Priority: 15
|
||||
- Regex: '^<dst/'
|
||||
Priority: 20
|
||||
- Regex: '^<isccc/'
|
||||
Priority: 25
|
||||
Priority: 3
|
||||
- Regex: '^<iscccc/'
|
||||
Priority: 4
|
||||
- Regex: '^<isccfg/'
|
||||
Priority: 30
|
||||
Priority: 5
|
||||
- Regex: '^<ns/'
|
||||
Priority: 35
|
||||
- Regex: '^<irs/'
|
||||
Priority: 40
|
||||
- Regex: '^<(dig|named|rndc|confgen|dlz)/'
|
||||
Priority: 50
|
||||
- Regex: '^<dlz_'
|
||||
Priority: 55
|
||||
- Regex: '^".*"'
|
||||
Priority: 99
|
||||
Priority: 6
|
||||
- Regex: '^<bind9/)'
|
||||
Priority: 7
|
||||
- Regex: '^(<[^/]*)/)'
|
||||
Priority: 8
|
||||
- Regex: '^<tests/'
|
||||
Priority: 100
|
||||
- Regex: '<openssl/'
|
||||
Priority: 4
|
||||
- Regex: '<(mysql|protobuf-c)/'
|
||||
Priority: 4
|
||||
- Regex: '.*'
|
||||
Priority: 0
|
||||
Priority: 10
|
||||
- Regex: '<[[:alnum:].]+>'
|
||||
Priority: 1
|
||||
- Regex: '".*"'
|
||||
Priority: 9
|
||||
IndentExternBlock: NoIndent
|
||||
KeepEmptyLinesAtTheStartOfBlocks: false
|
||||
MaxEmptyLinesToKeep: 1
|
||||
|
||||
+3
-3
@@ -52,7 +52,7 @@
|
||||
;; libtest
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "tests/include"))
|
||||
|
||||
|
||||
;; bin
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "bin/check"))
|
||||
@@ -61,7 +61,7 @@
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "bin/confgen"))
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "bin/confgen/include"))
|
||||
(concat directory-of-current-dir-locals-file "bin/confgen/include"))
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "bin/dig/include"))
|
||||
(expand-file-name
|
||||
@@ -79,7 +79,7 @@
|
||||
|
||||
(expand-file-name "/usr/include/libxml2")
|
||||
(expand-file-name "/usr/include/json-c")
|
||||
|
||||
|
||||
(expand-file-name "/usr/local/opt/openssl@1.1/include")
|
||||
(expand-file-name "/usr/local/opt/libxml2/include/libxml2")
|
||||
(expand-file-name "/usr/local/opt/json-c/include/json-c/")
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
[*.sh{,.in}]
|
||||
indent_style = space
|
||||
indent_size = 2
|
||||
binary_next_line = true
|
||||
switch_case_indent = true
|
||||
@@ -1526,15 +1526,3 @@ ffaab41a01621c0e02196e225f9269daf8b2ec8f
|
||||
ffac31097d25039951063bbb9f864e223a46ad1b
|
||||
# update copyright notice / whitespace
|
||||
ffbe6b95371c99b7fb05e6de17a8d6b7bf4f629f
|
||||
# remove trailing whitespace
|
||||
5893debf46ce1b5fbe793114a59da28fac4cccb7
|
||||
# arithmetic expansion in system tests
|
||||
4d42bdc245a1db1654abb502a52a5a8a3a570881
|
||||
# arithmetic expansion in system tests
|
||||
1436025e20ae13cfe55df14d62f5812c0cea2ee9
|
||||
# subshell notation in system tests
|
||||
05baf7206b7baaf91cb8e049ad13e413c52cdf3f
|
||||
# reformat shell scripts with shfmt
|
||||
4cb8b13987b930952238cc88e84272b8cf911933
|
||||
# Reformat sources with up-to-date clang-format-17
|
||||
79d93600116faabd89798522817ad95a69684fff
|
||||
|
||||
@@ -2,7 +2,7 @@ name: "CodeQL"
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ "bind-9.16", "bind-9.18", "main" ]
|
||||
branches: [ "v9_16", "v9_18", "main" ]
|
||||
schedule:
|
||||
- cron: '39 8 * * 3'
|
||||
|
||||
@@ -27,7 +27,7 @@ jobs:
|
||||
- name: Install build dependencies
|
||||
uses: awalsh128/cache-apt-pkgs-action@latest
|
||||
with:
|
||||
packages: liburcu-dev libuv1-dev libssl-dev libnghttp2-dev libxml2-dev liblmdb-dev libjson-c-dev pkg-config autoconf automake autotools-dev libtool-bin libjemalloc-dev libedit-dev libcap-dev libidn2-dev libkrb5-dev libmaxminddb-dev zlib1g-dev python3-ply
|
||||
packages: libuv1-dev libssl-dev libnghttp2-dev libxml2-dev liblmdb-dev libjson-c-dev pkg-config autoconf automake autotools-dev libtool-bin libjemalloc-dev libedit-dev libcap-dev libidn2-dev libkrb5-dev libmaxminddb-dev zlib1g-dev python3-ply
|
||||
version: 1.0
|
||||
|
||||
# Initializes the CodeQL tools for scanning.
|
||||
|
||||
@@ -2,7 +2,7 @@ name: SonarCloud
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ "bind-9.16", "bind-9.18", "main" ]
|
||||
branches: [ "v9_16", "v9_18", "main" ]
|
||||
schedule:
|
||||
- cron: '39 8 * * 3'
|
||||
|
||||
@@ -30,7 +30,7 @@ jobs:
|
||||
- name: Install build dependencies
|
||||
uses: awalsh128/cache-apt-pkgs-action@latest
|
||||
with:
|
||||
packages: liburcu-dev libuv1-dev libssl-dev libnghttp2-dev libxml2-dev liblmdb-dev libjson-c-dev pkg-config autoconf automake autotools-dev libtool-bin libjemalloc-dev libedit-dev libcap-dev libidn2-dev libkrb5-dev libmaxminddb-dev zlib1g-dev python3-ply
|
||||
packages: libuv1-dev libssl-dev libnghttp2-dev libxml2-dev liblmdb-dev libjson-c-dev pkg-config autoconf automake autotools-dev libtool-bin libjemalloc-dev libedit-dev libcap-dev libidn2-dev libkrb5-dev libmaxminddb-dev zlib1g-dev python3-ply
|
||||
version: 1.0
|
||||
|
||||
- name: Install sonar-scanner and build-wrapper
|
||||
|
||||
@@ -5,7 +5,6 @@
|
||||
*.la
|
||||
*.lo
|
||||
*.log
|
||||
*.log.txt
|
||||
*.o
|
||||
*.orig
|
||||
*.plist/ # ccc-analyzer store its results in .plist directories
|
||||
|
||||
+269
-565
File diff suppressed because it is too large
Load Diff
@@ -2,62 +2,45 @@
|
||||
If the bug you are reporting is potentially security-related - for example,
|
||||
if it involves an assertion failure or other crash in `named` that can be
|
||||
triggered repeatedly - then please make sure that you make the new issue
|
||||
confidential by clicking the checkbox at the bottom!
|
||||
confidential!
|
||||
-->
|
||||
|
||||
### Summary
|
||||
|
||||
<!-- Concisely summarize the bug encountered. -->
|
||||
(Summarize the bug encountered concisely.)
|
||||
|
||||
### BIND version affected
|
||||
<!--
|
||||
Make sure you are testing with the **latest** supported version of BIND
|
||||
for a given branch. Many bugs have been fixed over time!
|
||||
### BIND version used
|
||||
|
||||
See https://kb.isc.org/docs/supported-platforms for the current list.
|
||||
The latest source is available from https://www.isc.org/download/#BIND
|
||||
|
||||
Paste the output of `named -V` here.
|
||||
-->
|
||||
(Paste the output of `named -V`.)
|
||||
|
||||
### Steps to reproduce
|
||||
|
||||
<!--
|
||||
This is extremely important! Be precise and use itemized lists, please.
|
||||
|
||||
Even if a default configuration is affected, please include the full configuration
|
||||
files _you were testing with_.
|
||||
|
||||
Example:
|
||||
1. Use _attached_ configuration file
|
||||
2. Start BIND server with command: `named -g -c named.conf ...`
|
||||
3. Simulate legitimate clients using command `dnsperf -S1 -d legit-queries ...`
|
||||
4. Simulate attack traffic using command `dnsperf -S1 -d attack-queries ...`
|
||||
-->
|
||||
|
||||
1.
|
||||
2.
|
||||
3.
|
||||
(How one can reproduce the issue - this is very important.)
|
||||
|
||||
### What is the current *bug* behavior?
|
||||
|
||||
<!-- What actually happens. -->
|
||||
(What actually happens.)
|
||||
|
||||
### What is the expected *correct* behavior?
|
||||
|
||||
<!-- What you should see instead. -->
|
||||
(What you should see instead.)
|
||||
|
||||
### Relevant configuration files
|
||||
|
||||
<!-- Paste any relevant configuration files here - please use code blocks (```)
|
||||
(Paste any relevant configuration files - please use code blocks (```)
|
||||
to format console output. If submitting the contents of your
|
||||
configuration file in a non-confidential issue, it is advisable to
|
||||
obscure key secrets; this can be done automatically by using
|
||||
`named-checkconf -px`. -->
|
||||
configuration file in a non-confidential Issue, it is advisable to
|
||||
obscure key secrets: this can be done automatically by using
|
||||
`named-checkconf -px`.)
|
||||
|
||||
### Relevant logs
|
||||
### Relevant logs and/or screenshots
|
||||
|
||||
<!-- Paste any relevant logs here - please use code blocks (```) to format console
|
||||
output, logs, and code, as it's very hard to read otherwise. -->
|
||||
(Paste any relevant logs - please use code blocks (```) to format console
|
||||
output, logs, and code, as it's very hard to read otherwise.)
|
||||
|
||||
/label ~Bug
|
||||
### Possible fixes
|
||||
|
||||
(If you can, link to the line of code that might be responsible for the
|
||||
problem.)
|
||||
|
||||
/label ~bug
|
||||
|
||||
@@ -16,9 +16,11 @@ confidential!
|
||||
| Mattermost Channel: | [CVE-YYYY-NNNN][mattermost_url] |
|
||||
| Support Ticket: | [URL] |
|
||||
| Release Checklist: | #NNNN |
|
||||
| Post-mortem Etherpad: | [postmortem-YYYY-MM][postmortem_url] |
|
||||
|
||||
[cvss_score]: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X&version=3.1
|
||||
[mattermost_url]:
|
||||
[postmortem_url]:
|
||||
|
||||
:bulb: **Click [here][checklist_explanations] (internal resource) for general information about the security incident handling process.**
|
||||
|
||||
@@ -28,14 +30,14 @@ confidential!
|
||||
|
||||
- [ ] [:link:][step_deputy] **(IM)** Pick a Deputy Incident Manager
|
||||
- [ ] [:link:][step_respond] **(IM)** Respond to the bug reporter
|
||||
- [ ] [:link:][step_etherpad] **(IM)** Create an Etherpad for post-mortem
|
||||
- [ ] [:link:][step_public_mrs] **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
|
||||
- [ ] [:link:][step_assign_cve_id] **(IM)** Assign a CVE identifier
|
||||
- [ ] [:link:][step_note_cve_info] **(SwEng)** Update this issue with the assigned CVE identifier and the CVSS score
|
||||
- [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
|
||||
- [ ] [:link:][step_workarounds] **(SwEng)** Determine whether workarounds for the problem exist
|
||||
- [ ] [:link:][step_coordinate] **(SwEng)** If necessary, coordinate with other parties
|
||||
- [ ] [:link:][step_earliest_prepare] **(Support)** Prepare "earliest" notification text and hand it off to Marketing
|
||||
- [ ] [:link:][step_earliest_send] **(Marketing)** Update "earliest" notification document in SF portal and send bulk email to earliest customers
|
||||
- [ ] [:link:][step_earliest] **(Support)** Prepare and send out "earliest" notifications
|
||||
- [ ] [:link:][step_advisory_mr] **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
|
||||
- [ ] [:link:][step_reproducer_mr] **(SwEng)** Prepare a private merge request containing a system test reproducing the problem
|
||||
- [ ] [:link:][step_notify_support] **(SwEng)** Notify Support when a reproducer is ready
|
||||
@@ -53,42 +55,46 @@ confidential!
|
||||
|
||||
### At T-5
|
||||
|
||||
- [ ] [:link:][step_asn_documents] **(Marketing)** Update the text on the T-5 (from the Printing Press project) and "earliest" ASN documents in the SF portal
|
||||
- [ ] [:link:][step_asn_links] **(Marketing)** (BIND 9 only) Update the BIND -S information document in SF with download links to the new versions
|
||||
- [ ] [:link:][step_asn_send] **(Marketing)** Bulk email eligible customers to check the SF portal
|
||||
- [ ] [:link:][step_preannouncement] **(Marketing)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes
|
||||
- [ ] [:link:][step_send_asn] **(Support)** Send ASN to eligible customers
|
||||
- [ ] [:link:][step_preannouncement] **(Support)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes
|
||||
|
||||
### At T-4
|
||||
|
||||
- [ ] [:link:][step_verify_asn] **(Support)** Verify that all ASN-eligible customers have received the notification email
|
||||
|
||||
### At T-1
|
||||
|
||||
- [ ] [:link:][step_check_customers] **(Support)** Verify that any new or reinstated customers have received the notification email
|
||||
- [ ] [:link:][step_packager_emails] **(First IM)** Send notifications to OS packagers
|
||||
|
||||
### On the Day of Public Disclosure
|
||||
|
||||
- [ ] [:link:][step_clearance] **(IM)** Grant QA & Marketing clearance to proceed with public release
|
||||
- [ ] [:link:][step_publish] **(QA/Marketing)** Publish the releases (as outlined in the release checklist)
|
||||
- [ ] [:link:][step_matrix] **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
|
||||
- [ ] [:link:][step_clearance] **(IM)** Grant Support clearance to proceed with public release
|
||||
- [ ] [:link:][step_publish] **(Support)** Publish the releases (as outlined in the release checklist)
|
||||
- [ ] [:link:][step_matrix] **(Support)** (BIND 9 only) Update vulnerability matrix in the Knowledge Base
|
||||
- [ ] [:link:][step_publish_advisory] **(Support)** Bump Document Version for the Security Advisory and publish it in the Knowledge Base
|
||||
- [ ] [:link:][step_notifications] **(First IM)** Send notification emails to third parties
|
||||
- [ ] [:link:][step_mitre] **(First IM)** Advise MITRE about the disclosed CVEs
|
||||
- [ ] [:link:][step_merge_advisory] **(First IM)** Merge the Security Advisory merge request
|
||||
- [ ] [:link:][step_embargo_end] **(IM)** Inform original reporter (if external) that the security disclosure process is complete
|
||||
- [ ] [:link:][step_asn_clear] **(Marketing)** Update the SF portal to clear the ASN
|
||||
- [ ] [:link:][step_customers] **(Marketing)** Email ASN recipients that the embargo is lifted
|
||||
- [ ] [:link:][step_customers] **(Support)** Inform customers a fix has been released
|
||||
|
||||
### After Public Disclosure
|
||||
|
||||
- [ ] [:link:][step_postmortem] **(First IM)** Organize post-mortem meeting and make sure it happens
|
||||
- [ ] [:link:][step_tickets] **(Support)** Close support tickets
|
||||
- [ ] [:link:][step_regression] **(QA)** Merge a regression test reproducing the bug into all affected (and still maintained) branches
|
||||
|
||||
[step_deputy]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#pick-a-deputy-incident-manager
|
||||
[step_respond]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
|
||||
[step_etherpad]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-an-etherpad-for-post-mortem
|
||||
[step_public_mrs]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
|
||||
[step_assign_cve_id]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
|
||||
[step_note_cve_info]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-and-the-cvss-score
|
||||
[step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
|
||||
[step_workarounds]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
|
||||
[step_coordinate]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
|
||||
[step_earliest_prepare]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-earliest-notification-text-and-hand-it-off-to-marketing
|
||||
[step_earliest_send]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-earliest-notification-document-in-sf-portal-and-send-bulk-email-to-earliest-customers
|
||||
[step_earliest]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-and-send-out-earliest-notifications
|
||||
[step_advisory_mr]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-a-merge-request-for-the-security-advisory-and-include-all-readily-available-information-in-it
|
||||
[step_reproducer_mr]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-containing-a-system-test-reproducing-the-problem
|
||||
[step_notify_support]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-support-when-a-reproducer-is-ready
|
||||
@@ -103,21 +109,20 @@ confidential!
|
||||
[step_merge_fixes]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-cve-fixes-in-cve-identifier-order
|
||||
[step_patches]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-standalone-patch-for-the-last-stable-release-of-each-affected-and-still-maintained-product-branch
|
||||
[step_asn_releases]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-asn-releases-as-outlined-in-the-release-checklist
|
||||
[step_asn_documents]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-text-on-the-t-5-from-the-printing-press-project-and-earliest-asn-documents-in-the-sf-portal
|
||||
[step_asn_links]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-the-bind-s-information-document-in-sf-with-download-links-to-the-new-versions
|
||||
[step_asn_send]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bulk-email-eligible-customers-to-check-the-sf-portal
|
||||
[step_send_asn]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-asn-to-eligible-customers
|
||||
[step_preannouncement]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-send-a-pre-announcement-email-to-the-bind-announce-mailing-list-to-alert-users-that-the-upcoming-release-will-include-security-fixes
|
||||
[step_verify_asn]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#verify-that-all-asn-eligible-customers-have-received-the-notification-email
|
||||
[step_check_customers]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#verify-that-any-new-or-reinstated-customers-have-received-the-notification-email
|
||||
[step_packager_emails]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notifications-to-os-packagers
|
||||
[step_clearance]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-qa-marketing-clearance-to-proceed-with-public-release
|
||||
[step_clearance]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-support-clearance-to-proceed-with-public-release
|
||||
[step_publish]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
|
||||
[step_matrix]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
|
||||
[step_matrix]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-vulnerability-matrix-in-the-knowledge-base
|
||||
[step_publish_advisory]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-and-publish-it-in-the-knowledge-base
|
||||
[step_notifications]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notification-emails-to-third-parties
|
||||
[step_mitre]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#advise-mitre-about-the-disclosed-cves
|
||||
[step_merge_advisory]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-security-advisory-merge-request
|
||||
[step_embargo_end]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-original-reporter-if-external-that-the-security-disclosure-process-is-complete
|
||||
[step_asn_clear]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-sf-portal-to-clear-the-asn
|
||||
[step_customers]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#email-asn-recipients-that-the-embargo-is-lifted
|
||||
[step_customers]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-customers-a-fix-has-been-released
|
||||
[step_postmortem]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#organize-post-mortem-meeting-and-make-sure-it-happens
|
||||
[step_tickets]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#close-support-tickets
|
||||
[step_regression]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-a-regression-test-reproducing-the-bug-into-all-affected-and-still-maintained-branches
|
||||
|
||||
/confidential
|
||||
@@ -1,8 +0,0 @@
|
||||
Hi and thanks for filing an issue! It will be read with care by human beings.
|
||||
|
||||
It would be a tremendous help if you could follow these steps first:
|
||||
- [ ] Search the existing issues in GitLab (both open and closed) to see if your report might be a duplicate. We have a large database here and many issues have already been fixed in the latest versions!
|
||||
- [ ] Make sure this is **not** a support question. If you have specific trouble configuring or debugging your setup, please use the bind-users mailing list: https://lists.isc.org/mailman/listinfo/bind-users
|
||||
- [ ] You have read and understood the "out in the open" support policy: https://blog.powerdns.com/2016/01/18/open-source-support-out-in-the-open/ . Even though it was written by the PowerDNS folks, we follow it as well!
|
||||
|
||||
Before continuing, **please select the appropriate issue template in the drop-down menu above, under the heading _Description_**.
|
||||
@@ -8,4 +8,4 @@
|
||||
|
||||
### Links / references
|
||||
|
||||
/label ~Feature
|
||||
/label ~"feature request"
|
||||
|
||||
@@ -0,0 +1,95 @@
|
||||
## Release Schedule
|
||||
|
||||
**Code Freeze:**
|
||||
|
||||
**Tagging Deadline:**
|
||||
|
||||
**Public Release:**
|
||||
|
||||
## Documentation Review Links
|
||||
|
||||
**Closed issues assigned to the milestone without a release note:**
|
||||
|
||||
- []()
|
||||
- []()
|
||||
- []()
|
||||
|
||||
**Merge requests merged into the milestone without a release note:**
|
||||
|
||||
- []()
|
||||
- []()
|
||||
- []()
|
||||
|
||||
**Merge requests merged into the milestone without a `CHANGES` entry:**
|
||||
|
||||
- []()
|
||||
- []()
|
||||
- []()
|
||||
|
||||
## Release Checklist
|
||||
|
||||
### Before the Code Freeze
|
||||
|
||||
- [ ] ***(QA)*** Inform Support and Marketing of impending release (and give estimated release dates).
|
||||
- [ ] ***(QA)*** Ensure there are no permanent test failures on any platform.
|
||||
- [ ] ***(QA)*** Check Perflab to ensure there has been no unexplained drop in performance for the versions being released.
|
||||
- [ ] ***(QA)*** Check whether all issues assigned to the release milestone are resolved[^1].
|
||||
- [ ] ***(QA)*** Ensure that there are no outstanding merge requests in the private repository[^1] (Subscription Edition only).
|
||||
- [ ] ***(QA)*** Ensure all merge requests marked for backporting have been indeed backported.
|
||||
- [ ] ***(QA)*** Update GitLab settings for all maintained branches to disallow merging to them.
|
||||
- [ ] ***(QA)*** Announce (on Mattermost) that the code freeze is in effect.
|
||||
|
||||
### Before the Tagging Deadline
|
||||
|
||||
- [ ] ***(QA)*** Ensure release notes are correct, ask Support and Marketing to check them as well.
|
||||
- [ ] ***(QA)*** Add a release marker to `CHANGES`.
|
||||
- [ ] ***(QA)*** Add a release marker to `CHANGES.SE` (Subscription Edition only).
|
||||
- [ ] ***(QA)*** Update BIND 9 version in `configure.ac` (9.18+) or `version` (9.16).
|
||||
- [ ] ***(QA)*** Rebuild `configure` using Autoconf on `docs.isc.org` (9.16).
|
||||
- [ ] ***(QA)*** Tag the releases in the private repository (`git tag -s -m "BIND 9.x.y" v9_x_y`).
|
||||
|
||||
### Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)
|
||||
|
||||
- [ ] ***(QA)*** Check that the formatting is correct for HTML and PDF versions of release notes.
|
||||
- [ ] ***(QA)*** Check that the formatting of the generated man pages is correct.
|
||||
- [ ] ***(QA)*** Verify GitLab CI results for the tags created and sign off on the releases to be published.
|
||||
- [ ] ***(QA)*** Update GitLab settings for all maintained branches to allow merging to them again.
|
||||
- [ ] ***(QA)*** Prepare and merge MRs resetting the release notes and updating the version string for each maintained branch.
|
||||
- [ ] ***(QA)*** Announce (on Mattermost) that the code freeze is over.
|
||||
- [ ] ***(QA)*** Request signatures for the tarballs, providing their location and checksums.
|
||||
- [ ] ***(Signers)*** Ensure that the contents of tarballs and tags are identical.
|
||||
- [ ] ***(Signers)*** Validate tarball checksums, sign tarballs, and upload signatures.
|
||||
- [ ] ***(QA)*** Verify tarball signatures and check tarball checksums again.
|
||||
- [ ] ***(Support)*** Pre-publish ASN and/or Subscription Edition tarballs so that packages can be built.
|
||||
- [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages.
|
||||
- [ ] ***(QA)*** Prepare the `patches/` subdirectory for each security release (if applicable).
|
||||
- [ ] ***(QA)*** Notify Support that the releases have been prepared.
|
||||
- [ ] ***(Support)*** Send out ASNs (if applicable).
|
||||
|
||||
### On the Day of Public Release
|
||||
|
||||
- [ ] ***(Support)*** Wait for clearance from Security Officer to proceed with the public release (if applicable).
|
||||
- [ ] ***(Support)*** Place tarballs in public location on FTP site.
|
||||
- [ ] ***(Support)*** Publish links to downloads on ISC website.
|
||||
- [ ] ***(Support)*** Write release email to *bind-announce*.
|
||||
- [ ] ***(Support)*** Write email to *bind-users* (if a major release).
|
||||
- [ ] ***(Support)*** Send eligible customers updated links to the Subscription Edition (update the -S edition delivery tickets, even if those links were provided earlier via an ASN ticket).
|
||||
- [ ] ***(Support)*** Update tickets in case of waiting support customers.
|
||||
- [ ] ***(QA)*** Build and test any outstanding private packages.
|
||||
- [ ] ***(QA)*** Build public RPMs.
|
||||
- [ ] ***(SwEng)*** Build Debian/Ubuntu packages.
|
||||
- [ ] ***(SwEng)*** Update Docker images.
|
||||
- [ ] ***(QA)*** Inform Marketing of the release.
|
||||
- [ ] ***(Marketing)*** Post short note to Twitter.
|
||||
- [ ] ***(Marketing)*** Update [Wikipedia entry for BIND](https://en.wikipedia.org/wiki/BIND).
|
||||
- [ ] ***(Marketing)*** Write blog article (if a major release).
|
||||
- [ ] ***(QA)*** Ensure all new tags are annotated and signed.
|
||||
- [ ] ***(QA)*** Push tags for the published releases to the public repository.
|
||||
- [ ] ***(QA)*** Merge published release tags (non-linearly) back into the their relevant development/maintenance branches.
|
||||
- [ ] ***(QA)*** Sanitize confidential issues which are assigned to the current release milestone and do not describe a security vulnerability, then make them public.
|
||||
- [ ] ***(QA)*** Sanitize confidential issues which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
|
||||
- [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Black, PyLint, Sphinx) by modifying the relevant `Dockerfile`.
|
||||
- [ ] ***(QA)*** Run a pipeline to rebuild all [images](https://gitlab.isc.org/isc-projects/images) used in GitLab CI.
|
||||
|
||||
[^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
|
||||
[^2]: As a rule of thumb, security vulnerabilities which have reproducers merged to the public repository are considered okay for full disclosure.
|
||||
@@ -1,139 +0,0 @@
|
||||
### Summary
|
||||
<!--
|
||||
Concisely summarize the bug encountered,
|
||||
preferably in one paragraph or less.
|
||||
-->
|
||||
|
||||
### BIND versions affected
|
||||
<!--
|
||||
Make sure you are testing with the **latest** supported version of BIND.
|
||||
See https://kb.isc.org/docs/supported-platforms for the current list.
|
||||
The latest source is available from https://www.isc.org/download/#BIND
|
||||
|
||||
Paste the output of `named -V` here.
|
||||
-->
|
||||
|
||||
### Preconditions and assumptions
|
||||
<!--
|
||||
Is a specific setup needed?
|
||||
|
||||
Please check the BIND Security Assumptions chapter in the ARM:
|
||||
https://bind9.readthedocs.io/en/latest/chapter7.html#security-assumptions
|
||||
|
||||
E.g. DNSSEC validation must be disabled, etc.
|
||||
E.g. Resolver must be configured to forward to attacker's server via DNS-over-TLS, etc.
|
||||
E.g. Authoritative server must be configured to transfer specific primary zone.
|
||||
E.g. Attacker must be in posession of a key authorized to modify at least one zone.
|
||||
E.g. Attacker can affect system clock on the server running BIND.
|
||||
-->
|
||||
|
||||
### Attacker's abilities
|
||||
<!--
|
||||
What resources does an attacker need to have under their control to mount this attack?
|
||||
|
||||
E.g. If attacking an authoritative server, does the attacked have to have prior
|
||||
relationship with it? "The authoritative server under attack needs to
|
||||
transfer a malicious zone from attacker's authoritative server via TLS."
|
||||
|
||||
E.g. If attacking a resolver, does the attacker need the ability to send
|
||||
arbitrary queries to the resolver under attack? Do they need to _also_ control
|
||||
an authoritative server at the same time?
|
||||
-->
|
||||
|
||||
|
||||
### Impact
|
||||
<!--
|
||||
Who or what is the victim of the attack and what is the impact?
|
||||
|
||||
Is a third party receiving many packets generated by a reflection attack?
|
||||
|
||||
If the affected party is the BIND server itself, please quantify the impact
|
||||
on legitimate clients:
|
||||
E.g. After launching the attack, the answers-per-second metric for legitimate
|
||||
traffic drops to 1/1000 within the first minute of the attack.
|
||||
-->
|
||||
|
||||
|
||||
### Steps to reproduce
|
||||
<!--
|
||||
This is extremely important! Be precise and use itemized lists, please.
|
||||
|
||||
Even if a default configuration is affected, please include the full configuration
|
||||
files _you were testing with_.
|
||||
|
||||
Example:
|
||||
1. Use the _attached_ configuration file
|
||||
2. Start the BIND server with command: `named -g -c named.conf ...`
|
||||
3. Simulate legitimate clients using the command `dnsperf -S1 -d legit-queries ...`
|
||||
4. Simulate attack traffic using the command `dnsperf -S1 -d attack-queries ...`
|
||||
-->
|
||||
|
||||
1.
|
||||
2.
|
||||
3.
|
||||
|
||||
### What is the current *bug* behavior?
|
||||
|
||||
<!--
|
||||
Examples:
|
||||
Legitimate QPS drops 1000x.
|
||||
Memory consumption increases out of bounds and the server crashes.
|
||||
The server crashes immediately.
|
||||
-->
|
||||
|
||||
### What is the expected *correct* behavior?
|
||||
|
||||
<!--
|
||||
If the attack causes resource exhaustion, what do you think the correct
|
||||
behavior should be? Should BIND refuse to process more requests?
|
||||
|
||||
What heuristic do you propose to distinguish legitimate and attack traffic?
|
||||
-->
|
||||
|
||||
### Relevant logs
|
||||
<!--
|
||||
Please provide log files from your testing. Include full named logs and also
|
||||
the output from any testing tools (e.g. dnsperf, DNS Shotgun, kxdpgun, etc.)
|
||||
|
||||
If multiple log files are needed, make sure all the files have matching timestamps
|
||||
so we can correlate log events across log files.
|
||||
|
||||
In the case of resource exhaustion attacks, please _also_ include system monitoring
|
||||
data. You can use https://gitlab.isc.org/isc-projects/resource-monitor/ to
|
||||
gather system-wide statistics.
|
||||
-->
|
||||
|
||||
### Coordination
|
||||
- Does this issue affect multiple implementations?
|
||||
<!--
|
||||
Issues affecting multiple implementations require very careful coordination. We
|
||||
have to make sure the information does not leak to the public until vendors are ready to
|
||||
release fixed versions. If it is a multi-vendor issue, we need to know about the situation
|
||||
as soon as possible to start the (confidential!) coordination process within
|
||||
DNS-OARC and other suitable fora.
|
||||
|
||||
Please list implementations you have tested.
|
||||
-->
|
||||
|
||||
- Have you shared the information with anyone else?
|
||||
<!--
|
||||
Have you informed other affected vendors? Or maybe submitted a paper for
|
||||
review?
|
||||
-->
|
||||
|
||||
- What is your plan to publicize this issue?
|
||||
<!--
|
||||
E.g. we plan to go public during conference XYZ on 20XX-XX-XX
|
||||
-->
|
||||
|
||||
### Acknowledgements
|
||||
<!--
|
||||
Please specify whether and how you would like to be publicly credited with
|
||||
discovering the issue. We normally use the format:
|
||||
First_name Last_name, Company_or_Team.
|
||||
-->
|
||||
|
||||
<!-- DO NOT modify the following two lines. -->
|
||||
|
||||
/label ~Bug ~Security
|
||||
/confidential
|
||||
@@ -7,4 +7,3 @@ disable=
|
||||
C0209, # consider-using-f-string
|
||||
C0415, # import-outside-toplevel
|
||||
R0801, # duplicate-code
|
||||
R0903, # too-few-public-methods
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
|
||||
|
||||
version: 2
|
||||
|
||||
build:
|
||||
os: ubuntu-22.04
|
||||
tools:
|
||||
python: "3.11"
|
||||
|
||||
# Build documentation in doc/arm/ with Sphinx
|
||||
sphinx:
|
||||
configuration: doc/arm/conf.py
|
||||
|
||||
# Build all formats
|
||||
formats: all
|
||||
|
||||
# Explicitly set the version of Python and its requirements
|
||||
python:
|
||||
install:
|
||||
- requirements: doc/arm/requirements.txt
|
||||
+1
-10
@@ -54,9 +54,6 @@ Files: **/*.after*
|
||||
bin/tests/system/keepalive/expected
|
||||
bin/tests/system/legacy/ns6/edns512.db.signed
|
||||
bin/tests/system/legacy/ns7/edns512-notcp.db.signed
|
||||
bin/tests/system/masterfile/knowngood.include
|
||||
bin/tests/system/masterfile/knowngood.ttl1
|
||||
bin/tests/system/masterfile/knowngood.ttl2
|
||||
bin/tests/system/nsupdate/CA/CA.cfg
|
||||
bin/tests/system/nsupdate/CA/README
|
||||
bin/tests/system/nsupdate/CA/index.txt
|
||||
@@ -84,10 +81,7 @@ Files: **/*.after*
|
||||
bin/tests/system/unknown/large.out
|
||||
bin/tests/system/xfer/ans5/badkeydata
|
||||
bin/tests/system/xfer/ans5/badmessageid
|
||||
bin/tests/system/xfer/ans5/ednsformerr
|
||||
bin/tests/system/xfer/ans5/ednsnotimp
|
||||
bin/tests/system/xfer/ans5/goodaxfr
|
||||
bin/tests/system/xfer/ans5/ixfrnotimp
|
||||
bin/tests/system/xfer/ans5/partial
|
||||
bin/tests/system/xfer/ans5/soamismatch
|
||||
bin/tests/system/xfer/ans5/unknownkey
|
||||
@@ -163,21 +157,18 @@ Files: **/.clang-format
|
||||
.clang-format
|
||||
.clang-format.headers
|
||||
.dir-locals.el
|
||||
.editorconfig
|
||||
.git-blame-ignore-revs
|
||||
.gitattributes
|
||||
.gitignore
|
||||
.gitlab-ci.yml
|
||||
.lgtm.yml
|
||||
.pylintrc
|
||||
.readthedocs.yaml
|
||||
.tsan-suppress
|
||||
.uncrustify.cfg
|
||||
doc/misc/*.zoneopt
|
||||
doc/misc/options
|
||||
doc/misc/rndc.grammar
|
||||
tsan-suppressions.txt
|
||||
sonar-project.properties
|
||||
tests/bench/names.csv
|
||||
Copyright: Internet Systems Consortium, Inc. ("ISC")
|
||||
License: CC0-1.0
|
||||
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
# Uninstrumented libraries
|
||||
called_from_lib:libfstrm.so
|
||||
race:dummyrpz
|
||||
@@ -1,984 +1,3 @@
|
||||
6369. [func] The 'fixed' value for the 'rrset-order' option has
|
||||
been marked and documented as deprecated. [GL #4446]
|
||||
|
||||
6368. [func] The 'sortlist' option has been marked and documented
|
||||
as deprecated. [GL #4593]
|
||||
|
||||
6367. [bug] Since the dns_validator_destroy() function doesn't
|
||||
guarantee that it destroys the validator, rename it to
|
||||
dns_validator_shutdown() and require explicit
|
||||
dns_validator_detach() to follow. Implement an expected
|
||||
behavior of the function to release a name associated
|
||||
with the validator. [GL #4654]
|
||||
|
||||
6366. [bug] An assertion could be triggered in the QPDB cache when
|
||||
encountering a delegation below a DNAME. [GL #4652]
|
||||
|
||||
6365. [placeholder]
|
||||
|
||||
6364. [protocol] Add RESOLVER.ARPA to the built in empty zones.
|
||||
[GL #4580]
|
||||
|
||||
6363. [bug] dig/mdig +ednsflags=<non-zero-value> did not re-enable
|
||||
EDNS if it had been disabled. [GL #4641]
|
||||
|
||||
6362. [bug] Reduce memory consumption of QP-trie based databases
|
||||
by dynamically allocating the nodenames. [GL #4614]
|
||||
|
||||
6361. [bug] Some invalid ISO 8601 durations were accepted
|
||||
erroneously. [GL #4624]
|
||||
|
||||
6360. [bug] Don't return static-stub synthesised NS RRset.
|
||||
[GL #4608]
|
||||
|
||||
6359. [bug] Fix bug in Depends (keymgr_dep) function. [GL #4552]
|
||||
|
||||
--- 9.19.22 released ---
|
||||
|
||||
6358. [bug] Fix validate_dnskey_dsset when KSK is not signing,
|
||||
do not skip remainder of DS RRset. [GL #4625]
|
||||
|
||||
6357. [func] The QP zone database implementation introduced in
|
||||
change #6355 has now been replaced with a version
|
||||
based on the multithreaded dns_qpmulti API, which
|
||||
is based on RCU and reduces the need for locking.
|
||||
The new implementation is called "qpzone". The
|
||||
previous "qp" implementation has been renamed
|
||||
"qpcache", and can only be used for the cache.
|
||||
[GL #4348]
|
||||
|
||||
6356. [bug] Attach the loop also in the dns_cache_flush(), so
|
||||
the cache pruning still works after the flush.
|
||||
[GL #4621]
|
||||
|
||||
6355. [func] The red-black tree data structure underlying the
|
||||
RBTDB has been replaced with QP-tries. This is
|
||||
expected to improve scalability and reduce
|
||||
CPU consumption under load. It is currently known to
|
||||
have higher memory consumption than the traditional
|
||||
RBTDB; this will be addressed in future releases.
|
||||
|
||||
Nodes in a QP-trie contain the full domain name,
|
||||
while nodes in a red-black tree only contain names
|
||||
relative to a parent. Because of this difference,
|
||||
zone files dumped with masterfile-style "relative"
|
||||
will no longer have multiple different $ORIGIN
|
||||
statements throughout the file.
|
||||
|
||||
This version is a minimal adaptation, keeping RBTDB
|
||||
code largely unchanged, except as needed to replace
|
||||
the underlying data structure. It uses the
|
||||
single-thread "dns_qp" interface with locks for
|
||||
synchronization. A future version will use the
|
||||
multithreaded "dns_qpmulti" interface instead,
|
||||
and will be renamed to QPDB.
|
||||
|
||||
The RBT-based version of RBTDB is still in place
|
||||
for now, and can be used by specifying "database rbt"
|
||||
in a "zone" statement, or by compiling with
|
||||
"configure --with-zonedb=rbt --with-cachedb=rbt".
|
||||
[GL #4411]
|
||||
|
||||
6354. [bug] Change 6035 introduced a regression when chasing DS
|
||||
records resulting in an assertion failure. [GL #4612]
|
||||
|
||||
6353. [bug] Improve the TTL-based cleaning by removing the expired
|
||||
headers from the heap, so they don't block the next
|
||||
cleaning round and clean more than a single item for
|
||||
each new addition to the RBTDB. [GL #4591]
|
||||
|
||||
6352. [bug] Revert change 6319 and decrease lock contention during
|
||||
RBTDB tree pruning by not cleaning up nodes recursively
|
||||
within a single prune_tree() call. [GL #4596]
|
||||
|
||||
6351. [protocol] Support for the RESINFO record type has been added.
|
||||
[GL #4413]
|
||||
|
||||
6350. [bug] Address use after free in expire_lru_headers. [GL #4495]
|
||||
|
||||
6349. [placeholder]
|
||||
|
||||
6348. [bug] BIND could previously abort when trying to
|
||||
establish a connection to a remote server using an
|
||||
incorrect 'tls' configuration. That has been
|
||||
fixed. Thanks to Tobias Wolter for bringing
|
||||
the issue to our attention. [GL #4572]
|
||||
|
||||
6347. [func] Disallow stale-answer-client-timeout non-zero values.
|
||||
[GL #4447]
|
||||
|
||||
6346. [bug] Cleaned up several minor bugs in the RBTDB dbiterator
|
||||
implementation. [GL !8741]
|
||||
|
||||
6345. [bug] Added missing dns_rdataset_disassociate calls in
|
||||
validator.c:findnsec3proofs. [GL #4571]
|
||||
|
||||
6344. [bug] Fix case insensitive setting for isc_ht hashtable.
|
||||
[GL #4568]
|
||||
|
||||
6343. [bug] Fix case insensitive setting for isc_ht hashtable.
|
||||
[GL #4568]
|
||||
|
||||
6342. [placeholder]
|
||||
|
||||
6341. [bug] Address use after free in ccmsg_senddone. [GL #4549]
|
||||
|
||||
6340. [test] Fix incorrectly reported errors when running tests
|
||||
with `make test` on platforms with older pytest.
|
||||
[GL #4560]
|
||||
|
||||
6339. [bug] The alignas() can't be used on types larger than
|
||||
max_align_t; instead add padding into the structures
|
||||
where we want avoid false memory sharing. [GL #4187]
|
||||
|
||||
6338. [func] Optimize slabheader placement, so the infrastructure
|
||||
records are put in the beginning of the slabheader
|
||||
linked list. [GL !8675]
|
||||
|
||||
6337. [bug] Nsupdate could assert while shutting down. [GL #4529]
|
||||
|
||||
6336. [func] Expose the zones with the 'first refresh' flag set in
|
||||
statistics channel's "Incoming Zone Transfers" section
|
||||
to indicate the zones that are not yet fully ready, and
|
||||
their first refresh is pending or is in-progress. Also
|
||||
expose the number of such zones in the output of the
|
||||
'rndc status' command. [GL #4241]
|
||||
|
||||
6335. [func] The 'dnssec-validation yes' option now requires an
|
||||
explicitly configured 'trust-anchors' statement (or
|
||||
'managed-keys' or 'trusted-keys' statements, both
|
||||
deprecated). [GL #4373]
|
||||
|
||||
6334. [doc] Improve ARM parental-agents definition. [GL #4531]
|
||||
|
||||
6333. [bug] Fix the DNS_GETDB_STALEFIRST flag, which was defined
|
||||
incorrectly in lib/ns/query.c. [GL !8683]
|
||||
|
||||
6332. [bug] Range-check the arguments to fetch-quota-param.
|
||||
[GL #362]
|
||||
|
||||
6331. [func] Add HSM support for dnssec-policy. You can now
|
||||
configure keys with a key-store that allows you to
|
||||
set the directory to store key files and to set a
|
||||
PKCS #11 URI string. [GL #1129]
|
||||
|
||||
6330. [doc] Update ZSK minimum lifetime documentation in ARM, also
|
||||
depends on signing delay. [GL #4510]
|
||||
|
||||
6329. [func] Nsupdate can now set the UL EDNS option when sending
|
||||
UPDATE requests. [GL #4419]
|
||||
|
||||
6328. [func] Add workaround to enforce dynamic linker to pull
|
||||
jemalloc earlier than libc to ensure all memory
|
||||
allocations are done via jemalloc. [GL #4404]
|
||||
|
||||
6327. [func] Expose the TCP client count in statistics channel.
|
||||
[GL #4425]
|
||||
|
||||
6326. [bug] Changes to "listen-on" statements were ignored on
|
||||
reconfiguration unless the port or interface address was
|
||||
changed, making it impossible to change a related
|
||||
listener transport type. Thanks to Thomas Amgarten.
|
||||
[GL #4518] [GL #4528]
|
||||
|
||||
6325. [func] The 'tls' block was extended with a new
|
||||
'cipher-suites' option that allows setting
|
||||
allowed cipher suites for TLSv1.3.
|
||||
[GL #3504]
|
||||
|
||||
6324. [bug] Fix a possible crash in 'dig +nssearch +nofail' and
|
||||
'host -C' commands when one of the name servers returns
|
||||
SERVFAIL. [GL #4508]
|
||||
|
||||
--- 9.19.21 released ---
|
||||
|
||||
6323. [placeholder]
|
||||
|
||||
6322. [security] Specific DNS answers could cause a denial-of-service
|
||||
condition due to DNS validation taking a long time.
|
||||
(CVE-2023-50387) [GL #4424]
|
||||
|
||||
The same code change also addresses another problem:
|
||||
preparing NSEC3 closest encloser proofs could exhaust
|
||||
available CPU resources. (CVE-2023-50868) [GL #4459]
|
||||
|
||||
6321. [security] Change 6315 inadvertently introduced regressions that
|
||||
could cause named to crash. [GL #4234]
|
||||
|
||||
6320. [placeholder]
|
||||
|
||||
--- 9.19.20 released ---
|
||||
|
||||
6319. [func] Limit isc_async_run() overhead for RBTDB tree pruning.
|
||||
[GL #4383]
|
||||
|
||||
6318. [placeholder]
|
||||
|
||||
6317. [security] Restore DNS64 state when handling a serve-stale timeout.
|
||||
(CVE-2023-5679) [GL #4334]
|
||||
|
||||
6316. [security] Specific queries could trigger an assertion check with
|
||||
nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281]
|
||||
|
||||
6315. [security] Speed up parsing of DNS messages with many different
|
||||
names. (CVE-2023-4408) [GL #4234]
|
||||
|
||||
6314. [bug] Address race conditions in dns_tsigkey_find().
|
||||
[GL #4182]
|
||||
|
||||
6313. [bug] When dnssec-policy is in effect the DNSKEY's TTLs in
|
||||
the zone where not being updated to match the policy.
|
||||
This lead to failures when DNSKEYs where updated as the
|
||||
TTLs mismatched. [GL #4466]
|
||||
|
||||
6312. [bug] Conversion from NSEC3 signed to NSEC signed could
|
||||
temporarily put the zone into a state where it was
|
||||
treated as unsigned until the NSEC chain was built.
|
||||
Additionally conversion from one set of NSEC3 parameters
|
||||
to another could also temporarily put the zone into a
|
||||
state where it was treated as unsigned until the new
|
||||
NSEC3 chain was built. [GL #1794] [GL #4495]
|
||||
|
||||
6311. [func] Zone content checks are now disabled by default
|
||||
when running named-compilezone. named-checkzone
|
||||
can still be used for checking zone integrity,
|
||||
or the former checks in named-compilezone can be
|
||||
re-enabled by using "named-compilezone -i full
|
||||
-k fail -n fail -r warn -m warn -M warn -S warn
|
||||
-T warn -W warn -C check-svcb:fail". [GL #4364]
|
||||
|
||||
6310. [bug] Memory leak in zone.c:sign_zone. When named signed a
|
||||
zone it could leak dst_keys due to a misplaced
|
||||
'continue'. [GL #4488]
|
||||
|
||||
6309. [bug] Changing a zone's primaries while a refresh was in
|
||||
progress could trigger an assertion. [GL #4310]
|
||||
|
||||
6308. [bug] Prevent crashes caused by the zone journal getting
|
||||
destroyed before all changes from an incoming IXFR are
|
||||
written to it. [GL #4496]
|
||||
|
||||
6307. [bug] Obtain a client->handle reference when calling
|
||||
async_restart. [GL #4439]
|
||||
|
||||
6306. [func] Log more details about the cause of "not exact" errors.
|
||||
[GL #4500]
|
||||
|
||||
6305. [placeholder]
|
||||
|
||||
6304. [bug] The wrong time was being used to determine what RRSIGs
|
||||
where to be generated when dnssec-policy was in use.
|
||||
[GL #4494]
|
||||
|
||||
6303. [bug] Dig failed to correctly process a SIGINT received while
|
||||
waiting for a TCP connection to complete. [GL #4138]
|
||||
|
||||
6302. [func] The "trust-anchor-telemetry" statement is no longer
|
||||
marked as experimental. This silences a relevant log
|
||||
message that was emitted even when the feature was
|
||||
explicitly disabled. [GL #4497]
|
||||
|
||||
6301. [bug] Fix data races with atomic members of the xfrin
|
||||
structure in xfrin_start() and xfrin_send_request()
|
||||
functions. [GL #4493]
|
||||
|
||||
6300. [bug] Fix statistics export to use full 64 bit signed numbers
|
||||
instead of truncating values to unsigned 32 bits.
|
||||
[GL #4467]
|
||||
|
||||
6299. [port] NetBSD has added 'hmac' to libc which collides with our
|
||||
use of 'hmac'. [GL #4478]
|
||||
|
||||
6298. [bug] Fix dns_qp_lookup bugs related to the iterator.
|
||||
[GL !8558]
|
||||
|
||||
--- 9.19.19 released ---
|
||||
|
||||
6297. [bug] Improve LRU cleaning behaviour. [GL #4448]
|
||||
|
||||
6296. [func] The "resolver-nonbackoff-tries" and
|
||||
"resolver-retry-interval" options have been removed;
|
||||
Using them is now a fatal error. [GL #4405]
|
||||
|
||||
6295. [bug] Fix an assertion failure which could occur during
|
||||
shutdown when DNSSEC validation was running. [GL #4462]
|
||||
|
||||
6294. [bug] BIND might sometimes crash after startup or
|
||||
re-configuration when one 'tls' entry is used multiple
|
||||
times to connect to remote servers due to initialisation
|
||||
attempts from contexts of multiple threads. That has
|
||||
been fixed. [GL #4464]
|
||||
|
||||
6293. [func] Initial support for accepting the PROXYv2 protocol in
|
||||
all currently implemented DNS transports in BIND and
|
||||
complementary support for sending it in dig are included
|
||||
into this release. [GL #4388]
|
||||
|
||||
6292. [func] Lower the maximum number of allowed NSEC3 iterations,
|
||||
from 150 to 50. DNSSEC responses with a higher
|
||||
iteration count are treated as insecure. For signing
|
||||
with dnssec-policy, iterations must be set to zero.
|
||||
[GL #4363]
|
||||
|
||||
6291. [bug] SIGTERM failed to properly stop multiple outstanding
|
||||
lookup in dig. [GL #4457]
|
||||
|
||||
6290. [bug] Dig +yaml will now report "no servers could be reached"
|
||||
also for UDP setup failure when no other servers or
|
||||
tries are left. [GL #1229]
|
||||
|
||||
6289. [test] Remove legacy system test runner in favor of pytest.
|
||||
[GL #4251]
|
||||
|
||||
6288. [func] Refactor the isc_mem overmem handling to always use
|
||||
isc_mem_isovermem and remove the water callback.
|
||||
[GL #4451]
|
||||
|
||||
6287. [bug] Recognize escapes when reading the public key from file.
|
||||
[GL !8502]
|
||||
|
||||
6286. [bug] Dig +yaml will now report "no servers could be reached"
|
||||
on TCP connection failure as well as for UDP timeouts.
|
||||
[GL #4396]
|
||||
|
||||
6285. [func] Remove AES-based DNS cookies. [GL #4421]
|
||||
|
||||
6284. [bug] Fix a catz db update notification callback registration
|
||||
logic error, which could cause an assertion failure when
|
||||
receiving an AXFR update for a catalog zone while the
|
||||
previous update process of the catalog zone was already
|
||||
running. [GL #4418]
|
||||
|
||||
6283. [bug] Fix a data race in isc_hashmap by using atomics for the
|
||||
iterators number. [GL !8474]
|
||||
|
||||
6282. [func] Deprecate AES-based DNS cookies. [GL #4421]
|
||||
|
||||
6281. [bug] Fix a data race in dns_tsigkeyring_dump(). [GL #4328]
|
||||
|
||||
--- 9.19.18 released ---
|
||||
|
||||
6280. [bug] Fix missing newlines in the output of "rndc nta -dump".
|
||||
[GL !8454]
|
||||
|
||||
6279. [func] Use QNAME minimization when fetching nameserver
|
||||
addresses. [GL #4209]
|
||||
|
||||
6278. [bug] The call to isc_mem_setwater() was incorrectly
|
||||
removed from dns_cache_setcachesize(), causing
|
||||
cache overmem conditions not to be detected. [GL #4340]
|
||||
|
||||
6277. [bug] Take into account local authoritative zones when
|
||||
falling back to serve-stale. [GL #4355]
|
||||
|
||||
6276. [cleanup] Remove both lock-file configuration option and the
|
||||
-X argument to named. [GL #4391]
|
||||
|
||||
6275. [bug] Fix assertion failure when using lock-file configuration
|
||||
option together -X argument to named. [GL #4386]
|
||||
|
||||
6274. [bug] The 'lock-file' file was being removed when it
|
||||
shouldn't have been making it ineffective if named was
|
||||
started 3 or more times. [GL #4387]
|
||||
|
||||
6273. [bug] Don't reuse the existing TCP streams in dns_xfrin, so
|
||||
parallel TCP transfers works again. [GL #4379]
|
||||
|
||||
6272. [func] Enable systemd units support with the 'notify-reload'
|
||||
service type by settng the MONOTONIC_USEC field when
|
||||
sending an sd_notify() message to the service manager
|
||||
to notify it about reloading the service. Note that the
|
||||
'NotifyAccess=all' option is required in the systemd
|
||||
unit file's '[Service]' section. [GL #4377]
|
||||
|
||||
6271. [bug] Fix a shutdown race in dns__catz_update_cb(). [GL #4381]
|
||||
|
||||
6270. [bug] Handle an assertion when the primary server returned
|
||||
NOTIMP to IXFR or FORMERR to EDNS to SOA/IXFR/AXFR
|
||||
request when transfering a zone. [GL #4372]
|
||||
|
||||
6269. [maint] B.ROOT-SERVERS.NET addresses are now 170.247.170.2 and
|
||||
2801:1b8:10::b. [GL #4101]
|
||||
|
||||
6268. [func] Offload the IXFR and AXFR processing to unblock
|
||||
the networking threads. [GL #4367]
|
||||
|
||||
6267. [func] The timeouts for resending zone refresh queries over UDP
|
||||
were lowered to enable named to more quickly determine
|
||||
that a primary is down. [GL #4260]
|
||||
|
||||
6266. [func] The zone option 'inline-signing' is ignored from now
|
||||
on iff there is no 'dnssec-policy' configured for the
|
||||
corresponding zone. [GL #4349]
|
||||
|
||||
6265. [bug] Don't schedule resign operations on the raw version
|
||||
of an inline-signing zone. [GL #4350]
|
||||
|
||||
6264. [func] Use atomics to handle some ADB entry members
|
||||
to reduce ADB locking contention. [GL #4326]
|
||||
|
||||
6263. [func] Convert the RPZ summary database to use a QP trie
|
||||
instead of an RBT. [GL !8352]
|
||||
|
||||
6262. [bug] Duplicate control sockets didn't generate a
|
||||
configuration failure leading to hard to diagnose
|
||||
rndc connection errors. These are now caught by
|
||||
named-checkconf and named. [GL #4253]
|
||||
|
||||
6261. [bug] Fix a possible assertion failure on an error path in
|
||||
resolver.c:fctx_query(), when using an uninitialized
|
||||
link. [GL #4331]
|
||||
|
||||
6260. [func] Added options to the QP trie that will be needed
|
||||
when it is used as a zone or cache database: backward
|
||||
iteration, and retrieval of DNSSEC predecessor
|
||||
nodes and node chains. [GL !8338]
|
||||
|
||||
6259. [placeholder]
|
||||
|
||||
6258. [func] Use explictly created external memory pools for
|
||||
dns_message in the ns_client and dns_resolver.
|
||||
[GL #4325]
|
||||
|
||||
6257. [func] Expose the "Refresh SOA" query state (before the XFR)
|
||||
in the incoming zone transfers section of the
|
||||
statistics channel and show the local and remote
|
||||
addresses for that query. Also Improve the
|
||||
"Duration (s)" field to show the duration of the
|
||||
"Pending" and "Refresh SOA" states too, before the
|
||||
actual transfer starts. [GL !8305]
|
||||
|
||||
6256. [func] Expose the SOA query transport type (used before/during
|
||||
XFR) in the incoming zone transfers section of the
|
||||
statistics channel. [GL !8240]
|
||||
|
||||
6255. [func] Expose data about incoming zone transfers in progress
|
||||
using statistics channel. [GL #3883]
|
||||
|
||||
6254. [cleanup] Add semantic patch to do an explicit cast from char
|
||||
to unsigned char in ctype.h class of functions.
|
||||
[GL #4327]
|
||||
|
||||
6253. [cleanup] Remove the support for control channel over Unix
|
||||
Domain Sockets. [GL #4311]
|
||||
|
||||
6252. [test] Python system tests have to be executed by invoking
|
||||
pytest directly. Executing them with the legacy test
|
||||
runner is no longer supported. [GL #4250]
|
||||
|
||||
6251. [bug] Interating a hashmap could return the same element
|
||||
twice. [GL #3422]
|
||||
|
||||
6250. [bug] The wrong covered value was being set by
|
||||
dns_ncache_current for RRSIG records in the returned
|
||||
rdataset structure. This resulted in TYPE0 being
|
||||
reported as the covered value of the RRSIG when dumping
|
||||
the cache contents. [GL #4314]
|
||||
|
||||
6249. [cleanup] Reduce the number of reserved UDP dispatches
|
||||
to the number of loops, replace the round-robin
|
||||
mechanism in dns_dispatchset_t with dispatches
|
||||
pinned to loops, and use lock-free hash tables
|
||||
for looking up query IDs and active TCP
|
||||
connections. [GL !8304]
|
||||
|
||||
6248. [func] Add an option "resolver-use-dns64", which enables
|
||||
application of DNS64 rules to server addresses
|
||||
when sending recursive queries. This allows
|
||||
resolution to be performed via NAT64. [GL #608]
|
||||
|
||||
6247. [func] Implement incremental hashing in both isc_siphash
|
||||
and isc_hash units. [GL #4306]
|
||||
|
||||
--- 9.19.17 released ---
|
||||
|
||||
6246. [placeholder]
|
||||
|
||||
6245. [security] Limit the amount of recursion that can be performed
|
||||
by isccc_cc_fromwire. (CVE-2023-3341) [GL #4152]
|
||||
|
||||
6244. [bug] Adjust log levels on malformed messages to NOTICE when
|
||||
transferring in a zone. [GL #4290]
|
||||
|
||||
6243. [bug] Restore the call order of dns_validator_destroy and
|
||||
fetchctx_detach to prevent use after free. [GL #4214]
|
||||
|
||||
6242. [func] Ignore jemalloc versions before 4.0.0 as we now
|
||||
need explicit memory arenas and tcache support.
|
||||
[GL #4296]
|
||||
|
||||
6241. [placeholder]
|
||||
|
||||
6240. [bug] Use dedicated per-worker thread jemalloc memory
|
||||
arenas for send buffers allocation to reduce memory
|
||||
consumption and avoid lock contention. [GL #4038]
|
||||
|
||||
6239. [func] Deprecate the 'dnssec-must-be-secure' option.
|
||||
[GL #3700]
|
||||
|
||||
6238. [cleanup] Refactor several objects relying on dns_rbt trees
|
||||
to instead of dns_nametree, a wrapper around dns_qp.
|
||||
[GL !8213]
|
||||
|
||||
6237. [bug] Address memory leaks due to not clearing OpenSSL error
|
||||
stack. [GL #4159]
|
||||
|
||||
6236. [func] Add isc_mem_cget() and isc_mem_cput() calloc-like
|
||||
functions that take nmemb and size, do checked
|
||||
multiplication and zero the memory before returning
|
||||
it to the user. Replace isc_mem_getx(..., ISC_MEM_ZERO)
|
||||
with isc_mem_cget(...) usage. [GL !8237]
|
||||
|
||||
6235. [doc] Clarify BIND 9 time formats. [GL #4266]
|
||||
|
||||
6234. [bug] Restore stale-refresh-time value after flushing the
|
||||
cache. [GL #4278]
|
||||
|
||||
6233. [func] Extend client side support for the EDNS EXPIRE option
|
||||
to IXFR and AXFR query types. [GL #4170]
|
||||
|
||||
6232. [bug] Following the introduction of krb5-subdomain-self-rhs
|
||||
and ms-subdomain-self-rhs update rules, removal of
|
||||
nonexistent PTR and SRV records via UPDATE could fail.
|
||||
[GL #4280]
|
||||
|
||||
6231. [func] Make nsupdate honor -v for SOA requests only if the
|
||||
server is specified. [GL #1181]
|
||||
|
||||
6230. [bug] Prevent an unnecessary query restart if a synthesized
|
||||
CNAME target points to the CNAME owner. [GL #3835]
|
||||
|
||||
6229. [func] Add basic USDT framework for adding static
|
||||
tracing points. [GL #4041]
|
||||
|
||||
6228. [func] Limit the number of inactive network manager handles
|
||||
and uvreq objects that we keep around for reusing
|
||||
later. [GL #4265]
|
||||
|
||||
6227. [bug] Check the statistics-channel HTTP Content-length
|
||||
to prevent negative or overflowing values from
|
||||
causing a crash. [GL #4125]
|
||||
|
||||
6226. [bug] Attach dispatchmgr in the dns_view object to prevent
|
||||
use-after-free when shutting down. [GL #4228]
|
||||
|
||||
6225. [func] Convert dns_nta, dns_forward and dns_keytable units
|
||||
to use QP trie instead of an RBT. [GL !7811]
|
||||
|
||||
6224. [bug] Check the If-Modified-Since value length to prevent
|
||||
out-of-bounds write. [GL #4124]
|
||||
|
||||
6223. [func] Make -E engine option for OpenSSL Engine API use only.
|
||||
OpenSSL Provider API will now require engine to not be
|
||||
set. [GL #8153]
|
||||
|
||||
6222. [func] Fixes to provider/engine based ECDSA key handling.
|
||||
[GL !8152]
|
||||
|
||||
--- 9.19.16 released ---
|
||||
|
||||
6221. [cleanup] Refactor dns_rdataset internals, move rdatasetheader
|
||||
declarations out of rbtdb.c so they can be used by other
|
||||
databases in the future, and split the zone and cache
|
||||
functions from rbtdb.c into separate modules. [GL !7873]
|
||||
|
||||
6220. [func] Deprecate the 'dialup' and 'heartbeat-interval'
|
||||
options. [GL #3700]
|
||||
|
||||
6219. [bug] Ignore 'max-zone-ttl' on 'dnssec-policy insecure'.
|
||||
[GL #4032]
|
||||
|
||||
6218. [func] Add inline-signing to dnssec-policy. [GL #3677]
|
||||
|
||||
6217. [func] The dns_badcache unit was refactored to use cds_lfht
|
||||
instead of hand-crafted locked hashtable. [GL #4223]
|
||||
|
||||
6216. [bug] Pin dns_request events to the originating loop
|
||||
to serialize access to the data. [GL #4086]
|
||||
|
||||
6215. [protocol] Return REFUSED to GSS-API TKEY requests if GSS-API
|
||||
support is not configured. [GL #4225]
|
||||
|
||||
6214. [bug] Fix the memory leak in for struct stub_glue_request
|
||||
allocated in stub_request_nameserver_address() but not
|
||||
freed in stub_glue_response(). [GL #4227]
|
||||
|
||||
6213. [bug] Mark a primary server as temporarily unreachable if the
|
||||
TCP connection attempt times out. [GL #4215]
|
||||
|
||||
6212. [placeholder]
|
||||
|
||||
6211. [func] Remove 'auto-dnssec'. This obsoletes the configuration
|
||||
options 'dnskey-sig-validity', 'dnssec-dnskey-kskonly',
|
||||
'dnssec-update-mode', 'sig-validity-interval', and
|
||||
'update-check-ksk'. [GL #3672]
|
||||
|
||||
6210. [func] Don't add signing records for DNSKEY added with dynamic
|
||||
update. The dynamic update DNSSEC management feature was
|
||||
removed with GL #3686. [GL !8070]
|
||||
|
||||
6209. [func] Reduce query-response latency by making recursive
|
||||
queries (CNAME, DNAME, NSEC) asynchronous instead
|
||||
of directly calling the respective functions. [GL #4185]
|
||||
|
||||
6208. [func] Return BADCOOKIE for out-of-date or otherwise bad, well
|
||||
formed DNS SERVER COOKIES. [GL #4194]
|
||||
|
||||
--- 9.19.15 released ---
|
||||
|
||||
6207. [cleanup] The code implementing TSIG/TKEY support has been cleaned
|
||||
up and refactored for improved robustness, readability,
|
||||
and consistency with other code modules. [GL !7828]
|
||||
|
||||
6206. [bug] Add shutdown checks in dns_catz_dbupdate_callback() to
|
||||
avoid a race with dns_catz_shutdown_catzs(). [GL #4171]
|
||||
|
||||
6205. [bug] Restore support to read legacy HMAC-MD5 K file pairs.
|
||||
[GL #4154]
|
||||
|
||||
6204. [bug] Use NS records for relaxed QNAME-minimization mode.
|
||||
This reduces the number of queries named makes when
|
||||
resolving, as it allows the non-existence of NS RRsets
|
||||
at non-referral nodes to be cached in addition to the
|
||||
referrals that are normally cached. [GL #3325]
|
||||
|
||||
6203. [cleanup] Ensure that the size calculation does not overflow
|
||||
when allocating memory for an array.
|
||||
[GL #4120] [GL #4121] [GL #4122]
|
||||
|
||||
6202. [func] Use per-loop memory contexts for dns_resolver
|
||||
objects. [GL !8015]
|
||||
|
||||
6201. [bug] The free_all_cpu_call_rcu_data() call at the end
|
||||
of isc_loopmgr_run() was causing ~200 ms extra
|
||||
latency. [GL #4163]
|
||||
|
||||
6200. [placeholder]
|
||||
|
||||
6199. [bug] Improve HTTP Connection: header protocol conformance
|
||||
in the statistics channel. [GL #4126]
|
||||
|
||||
6198. [func] Remove the holes in the isc_result_t enum to compact
|
||||
the isc_result tables. [GL #4149]
|
||||
|
||||
6197. [bug] Fix a data race between the dns_zone and dns_catz
|
||||
modules when registering/unregistering a database
|
||||
update notification callback for a catalog zone.
|
||||
[GL #4132]
|
||||
|
||||
6196. [cleanup] Report "permission denied" instead of "unexpected error"
|
||||
when trying to update a zone file on a read-only file
|
||||
system. Thanks to Midnight Veil. [GL #4134]
|
||||
|
||||
6195. [bug] Use rcu to reference view->adb. [GL #4021]
|
||||
|
||||
6194. [func] Change function 'find_zone_keys()' to look for signing
|
||||
keys by looking for key files instead of a DNSKEY
|
||||
RRset lookup. [GL #4141]
|
||||
|
||||
6193. [bug] Fix a catz db update notification callback registration
|
||||
logic error, which could crash named when receiving an
|
||||
AXFR update for a catalog zone while the previous update
|
||||
process of the catalog zone was already running.
|
||||
[GL #4136]
|
||||
|
||||
--- 9.19.14 released ---
|
||||
|
||||
6192. [placeholder]
|
||||
|
||||
6191. [placeholder]
|
||||
|
||||
6190. [security] Improve the overmem cleaning process to prevent the
|
||||
cache going over the configured limit. (CVE-2023-2828)
|
||||
[GL #4055]
|
||||
|
||||
6189. [bug] Fix an extra dns_validator deatch when encountering
|
||||
deadling which would lead to assertion failure.
|
||||
[GL #4115]
|
||||
|
||||
6188. [performance] Reduce memory consumption by allocating properly
|
||||
sized send buffers for stream-based transports.
|
||||
[GL #4038]
|
||||
|
||||
6187. [bug] Address view shutdown INSIST when accessing the
|
||||
zonetable. [GL #4093]
|
||||
|
||||
6186. [bug] Fix a 'clients-per-query' miscalculation bug. When the
|
||||
'stale-answer-enable' options was enabled and the
|
||||
'stale-answer-client-timeout' option was enabled and
|
||||
larger than 0, named was taking two places from the
|
||||
'clients-per-query' limit for each client and was
|
||||
failing to gradually auto-tune its value, as configured.
|
||||
[GL #4074]
|
||||
|
||||
6185. [func] Add "ClientQuota" statistics channel counter, which
|
||||
indicates the number of the resolver's spilled queries
|
||||
due to reaching the clients per query quota. [GL !7978]
|
||||
|
||||
6184. [func] Special-case code that was added to allow GSS-TSIG
|
||||
to work around bugs in the Windows 2000 version of
|
||||
Active Directory has been removed. The 'nsupdate -o'
|
||||
option and 'oldgsstsig' command have been
|
||||
deprecated, and are now treated as synonyms for
|
||||
'nsupdate -g' and 'gsstsig' respectively. [GL #4012]
|
||||
|
||||
6183. [bug] Fix a serve-stale bug where a delegation from cache
|
||||
could be returned to the client. [GL #3950]
|
||||
|
||||
6182. [cleanup] Remove configure checks for epoll, kqueue and
|
||||
/dev/poll. [GL #4098]
|
||||
|
||||
6181. [placeholder]
|
||||
|
||||
6180. [bug] The session key object could be incorrectly added
|
||||
to multiple different views' keyrings. [GL #4079]
|
||||
|
||||
6179. [bug] Fix an interfacemgr use-after-free error in
|
||||
zoneconf.c:isself(). [GL #3765]
|
||||
|
||||
6178. [func] Add support for the multi-signer model 2 (RFC 8901) when
|
||||
using inline-signing. [GL #2710]
|
||||
|
||||
6177. [placeholder]
|
||||
|
||||
6176. [test] Add support for using pytest & pytest-xdist to
|
||||
execute the system test suite. [GL #3978]
|
||||
|
||||
6175. [test] Fix the `upforwd` system test to be more reliable,
|
||||
|
||||
6174. [placeholder]
|
||||
|
||||
6173. [bug] Properly process extra "nameserver" lines in
|
||||
resolv.conf otherwise the next line is not properly
|
||||
processed. [GL #4066]
|
||||
|
||||
6172. [cleanup] Refactor the loop manager and qp-trie code to remove
|
||||
isc_qsbr and use liburcu instead. [GL #3936]
|
||||
|
||||
6171. [cleanup] Remove the stack implementation added in change 6108:
|
||||
we are using the liburcu concurrent data structures
|
||||
instead. [GL !7920]
|
||||
|
||||
6170. [func] The 'rndc -t' option allows a timeout to be set in
|
||||
seconds, so that commands that take a long time to
|
||||
complete (e.g., reloading a very large configuration)
|
||||
can be given time to do so. The default is 60
|
||||
seconds. [GL #4046]
|
||||
|
||||
6169. [bug] named could crash when deleting inline-signing zones
|
||||
with "rndc delzone". [GL #4054]
|
||||
|
||||
6168. [func] Refactor the glue cache to store list of the GLUE
|
||||
directly in the rdatasetheader instead of keeping
|
||||
it in the hashtable indexed by the node pointer.
|
||||
[GL #4045]
|
||||
|
||||
6167. [func] Add 'cdnskey' configuration option. [GL #4050]
|
||||
|
||||
6166. [func] Retry without DNS COOKIE on FORMERR if it appears that
|
||||
the FORMERR was due to the presence of a DNS COOKIE
|
||||
option. [GL #4049]
|
||||
|
||||
6165. [bug] Fix a logic error in dighost.c which could call the
|
||||
dighost_shutdown() callback twice and cause problems
|
||||
if the callback function was not idempotent. [GL #4039]
|
||||
|
||||
--- 9.19.13 released ---
|
||||
|
||||
6164. [bug] Set the rndc idle read timeout back to 60 seconds,
|
||||
from the netmgr default of 30 seconds, in order to
|
||||
match the behavior of 9.16 and earlier. [GL #4046]
|
||||
|
||||
6163. [func] Add option to dnstap-read to use timestamps in
|
||||
milliseconds (thanks to Oliver Ford). [GL #2360]
|
||||
|
||||
6162. [placeholder]
|
||||
|
||||
6161. [bug] Fix log file rotation when using absolute path as
|
||||
file. [GL #3991]
|
||||
|
||||
6160. [bug] 'delv +ns' could print duplicate output. [GL #4020]
|
||||
|
||||
6159. [bug] Fix use-after-free bug in TCP accept connection
|
||||
failure. [GL #4018]
|
||||
|
||||
6158. [func] Add ISC_LIST_FOREACH() and ISC_LIST_FOREACH_SAFE()
|
||||
to walk the ISC_LIST() in a unified manner and use
|
||||
the safe macro to fix the potential UAF when shutting
|
||||
down the isc_httpd. [GL #4031]
|
||||
|
||||
6157. [bug] When removing delegations in an OPTOUT range
|
||||
empty-non-terminal NSEC3 records generated by
|
||||
those delegations were not removed. [GL #4027]
|
||||
|
||||
6156. [bug] Reimplement the maximum and idle timeouts for incoming
|
||||
zone tranfers. [GL #4004]
|
||||
|
||||
6155. [bug] Treat ISC_R_INVALIDPROTO as a networking error
|
||||
in the dispatch code to avoid retrying with the
|
||||
same server. [GL #4005]
|
||||
|
||||
6154. [func] Add spinlock implementation. The spinlock is much
|
||||
smaller (8 bytes) than pthread_mutex (40 bytes), so
|
||||
it can be easily embedded into objects for more
|
||||
fine-grained locking (per-object vs per-bucket).
|
||||
|
||||
On the other hand, the spinlock is unsuitable for
|
||||
situations where the lock might be held for a long
|
||||
time as it keeps the waiting threads in a spinning
|
||||
busy loop. [GL #3977]
|
||||
|
||||
6153. [bug] Fix the streaming protocols (TCP, TLS) shutdown
|
||||
sequence. [GL #4011]
|
||||
|
||||
6152. [bug] In dispatch, honour the configured source-port
|
||||
selection when UDP connection fails with address
|
||||
in use error.
|
||||
|
||||
Also treat ISC_R_NOPERM same as ISC_R_ADDRINUSE.
|
||||
[GL #3986]
|
||||
|
||||
6151. [bug] When the same ``notify-source`` address and port number
|
||||
was configured for multiple destinations and zones, an
|
||||
unresponsive server could tie up the socket until it
|
||||
timed out; in the meantime, NOTIFY messages for other
|
||||
servers silently failed.``named`` will now retry these
|
||||
failing messages over TCP. NOTIFY failures are now
|
||||
logged at level INFO. [GL #4001] [GL #4002]
|
||||
|
||||
6150. [bug] If the zones have active upstream forwards, the
|
||||
shutting down the server might cause assertion
|
||||
failures as the forward were all canceled from
|
||||
the main loop instead from the loops associated
|
||||
with the zone. [GL #4015]
|
||||
|
||||
6149. [test] As a workaround, include an OpenSSL header file before
|
||||
including cmocka.h in the unit tests, because OpenSSL
|
||||
3.1.0 uses __attribute__(malloc), conflicting with a
|
||||
redefined malloc in cmocka.h. [GL #4000]
|
||||
|
||||
6148. [bug] Fix a use-after-free bug in dns_xfrin_create().
|
||||
[GL !7832]
|
||||
|
||||
6147. [performance] Fix the TCP server parent quota use. [GL #3985]
|
||||
|
||||
--- 9.19.12 released ---
|
||||
|
||||
6146. [performance] Replace the zone table red-black tree and associated
|
||||
locking with a lock-free qp-trie. [GL !7582]
|
||||
|
||||
6145. [bug] Fix a possible use-after-free bug in the
|
||||
dns__catz_done_cb() function. [GL #3997]
|
||||
|
||||
6144. [bug] A reference counting problem (double detach) might
|
||||
occur when shutting down zone transfer early after
|
||||
switching the dns_xfrin to use dns_dispatch API.
|
||||
[GL #3984]
|
||||
|
||||
6143. [bug] A reference counting problem on the error path in
|
||||
the xfrin_connect_done() might cause an assertion
|
||||
failure on shutdown. [GL #3989]
|
||||
|
||||
6142. [bug] Reduce the number of dns_dnssec_verify calls made
|
||||
determining if revoked keys needs to be removed from
|
||||
the trust anchors. [GL #3981]
|
||||
|
||||
6141. [bug] Fix several issues in nsupdate timeout handling and
|
||||
update the -t option's documentation. [GL #3674]
|
||||
|
||||
6140. [func] Implement automatic parental-agents ('checkds yes').
|
||||
[GL #3901]
|
||||
|
||||
6139. [func] Add isc_histo_t general-purpose log-linear histograms,
|
||||
and use them for message size statistics. [GL !7696]
|
||||
|
||||
6138. [doc] Fix the DF-flag documentation on the outgoing
|
||||
UDP packets. [GL #3710]
|
||||
|
||||
6137. [cleanup] Remove the trampoline jump when spawning threads.
|
||||
[GL !7293]
|
||||
|
||||
6136. [cleanup] Remove the isc_fsaccess API in favor of creating
|
||||
temporary file first and atomically replace the key
|
||||
with non-truncated content. [GL #3982]
|
||||
|
||||
6135. [cleanup] Change isc_stdtime_get(&t) to t = isc_stdtime_now().
|
||||
[GL !7757]
|
||||
|
||||
6134. [bug] Fix a crash when dig or host receive a signal.
|
||||
[GL #3970]
|
||||
|
||||
6133. [cleanup] Refactor the isc_job_run() to not make any allocations
|
||||
by embedding isc_job_t into callback argument, and
|
||||
running it directly. As a side-effect, isc_async_run
|
||||
and isc_job_run now executes jobs in the natural order.
|
||||
|
||||
Use the new improved API to execute connect, read and
|
||||
send callbacks from netmgr in more straightforward
|
||||
manner, speeding up the networking. [GL #3961]
|
||||
|
||||
6132. [doc] Remove a dead link in the DNSSEC guide. [GL #3967]
|
||||
|
||||
6131. [test] Add a minimal test-only library to allow testing
|
||||
of the DNSRPS API without FastRPZ installed.
|
||||
Thanks to Farsight Securty. [GL !7693]
|
||||
|
||||
6130. [func] The new "delv +ns" option activates name server mode,
|
||||
in which delv sets up an internal recursive
|
||||
resolver and uses that, rather than an external
|
||||
server, to look up the requested data. All messages
|
||||
sent and received during the resolution and
|
||||
validation process are logged. This can be used in
|
||||
place of "dig +trace"; it more accurately
|
||||
replicates the behavior of named when resolving
|
||||
a query. [GL #3842]
|
||||
|
||||
6129. [cleanup] Value stored to 'source' during its initialization is
|
||||
never read. [GL #3965]
|
||||
|
||||
6128. [bug] Fix an omission in an earlier commit to avoid a race
|
||||
between the 'dns__catz_update_cb()' and
|
||||
'dns_catz_dbupdate_callback()' functions. [GL #3968]
|
||||
|
||||
6127. [cleanup] Refactor network manager netievent callbacks to
|
||||
use isc_job_run()/isc_async_run(). [GL #3964]
|
||||
|
||||
6126. [func] Remove zone type "delegation-only" and the
|
||||
"delegation-only" and "root-delegation-only"
|
||||
options. [GL #3953]
|
||||
|
||||
6125. [bug] Hold a catz reference while the update process is
|
||||
running, so that the catalog zone is not destroyed
|
||||
during shutdown until the update process is finished or
|
||||
properly canceled by the activated 'shuttingdown' flag.
|
||||
[GL #3955]
|
||||
|
||||
6124. [bug] When changing from a NSEC3 capable DNSSEC algorithm to
|
||||
an NSEC3 incapable DNSSEC algorithm using KASP the zone
|
||||
could sometimes be incompletely signed. [GL #3937]
|
||||
|
||||
6123. [placeholder]
|
||||
|
||||
6122. [func] BIND now requires liburcu for lock-free data structures
|
||||
and concurrent safe memory reclamation. It replaces the
|
||||
home-grown lock-free linked list and QSBR machinery
|
||||
added in changes 6108 and 6109. [GL #3935]
|
||||
|
||||
6121. [cleanup] Remove support for TKEY Mode 2 (Diffie-Hellman Exchanged
|
||||
Keying). [GL #3905]
|
||||
|
||||
--- 9.19.11 released ---
|
||||
|
||||
6120. [bug] Use two pairs of dns_db_t and dns_dbversion_t in a
|
||||
catalog zone structure to avoid a race between the
|
||||
dns__catz_update_cb() and dns_catz_dbupdate_callback()
|
||||
functions. [GL #3907]
|
||||
|
||||
6119. [bug] Make sure to revert the reconfigured zones to the
|
||||
previous version of the view, when the new view
|
||||
reconfiguration fails during the configuration of
|
||||
one of the configured zones. [GL #3911]
|
||||
|
||||
6118. [func] Add 'cds-digest-types' configuration option. Also allow
|
||||
dnssec-signzone to create multple CDS records.
|
||||
[GL #3837]
|
||||
@@ -992,7 +11,8 @@
|
||||
|
||||
6115. [bug] Unregister db update notify callback before detaching
|
||||
from the previous db inside the catz update notify
|
||||
callback. [GL #3777]
|
||||
callback. Also, call the db notify callbacks only after
|
||||
zone_postload() returns successfully. [GL #3777]
|
||||
|
||||
6114. [func] Run the catalog zone update process on the offload
|
||||
threads. [GL #3881]
|
||||
|
||||
+21
-6
@@ -71,14 +71,14 @@ To clone the repository, use:
|
||||
|
||||
> $ git clone https://gitlab.isc.org/isc-projects/bind9.git
|
||||
|
||||
Release branch names are of the form `bind-9.X`, where X represents the second
|
||||
number in the BIND 9 version number. So, to check out the BIND 9.18
|
||||
Release branch names are of the form `v9_X`, where X represents the second
|
||||
number in the BIND 9 version number. So, to check out the BIND 9.12
|
||||
branch, use:
|
||||
|
||||
> $ git checkout bind-9.18
|
||||
> $ git checkout v9_12
|
||||
|
||||
Whenever a branch is ready for publication, a tag is placed of the
|
||||
form `v9.X.Y`. The 9.18.0 release, for instance, is tagged as `v9.18.0`.
|
||||
form `v9_X_Y`. The 9.12.0 release, for instance, is tagged as `v9_12_0`.
|
||||
|
||||
The branch in which the next major release is being developed is called
|
||||
`main`.
|
||||
@@ -102,7 +102,22 @@ Twitter, or Facebook.
|
||||
|
||||
### Reporting possible security issues
|
||||
|
||||
See `SECURITY.md`.
|
||||
If you think you may be seeing a potential security vulnerability in BIND
|
||||
(for example, a crash with REQUIRE, INSIST, or ASSERT failure), please
|
||||
report it immediately by emailing to security-officer@isc.org. Plain-text
|
||||
e-mail is not a secure choice for communications concerning undisclosed
|
||||
security issues so please encrypt your communications to us if possible,
|
||||
using the [ISC Security Officer public key](https://www.isc.org/pgpkey/).
|
||||
|
||||
Do not discuss undisclosed security vulnerabilities on any public mailing list.
|
||||
ISC has a long history of handling reported vulnerabilities promptly and
|
||||
effectively and we respect and acknowledge responsible reporters.
|
||||
|
||||
ISC's Security Vulnerability Disclosure Policy is documented at
|
||||
[https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
|
||||
|
||||
If you have a crash, you may want to consult
|
||||
["What to do if your BIND or DHCP server has crashed."](https://kb.isc.org/docs/aa-00340)
|
||||
|
||||
### <a name="contrib"></a>Contributing code
|
||||
|
||||
@@ -173,7 +188,7 @@ of documentation in the BIND source tree:
|
||||
they document, in files ending in `.rst`: for example, the
|
||||
`named` man page is `bin/named/named.rst`.
|
||||
* The *BIND 9 Administrator Reference Manual* is in the .rst files in
|
||||
`doc/arm/`; the HTML version is automatically generated from
|
||||
`doc/arm/`; the PDF and HTML versions are automatically generated from
|
||||
the `.rst` files.
|
||||
* API documentation is in the header file describing the API, in
|
||||
Doxygen-formatted comments.
|
||||
|
||||
@@ -133,7 +133,7 @@ modification, are permitted provided that the following conditions are met:
|
||||
3. Neither the name of the University nor the names of its contributors may
|
||||
be used to endorse or promote products derived from this software
|
||||
without specific prior written permission.
|
||||
|
||||
|
||||
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
||||
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
@@ -149,35 +149,35 @@ POSSIBILITY OF SUCH DAMAGE.
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
|
||||
(Royal Institute of Technology, Stockholm, Sweden).
|
||||
All rights reserved.
|
||||
(Royal Institute of Technology, Stockholm, Sweden).
|
||||
All rights reserved.
|
||||
|
||||
Redistribution and use in source and binary forms, with or without
|
||||
modification, are permitted provided that the following conditions
|
||||
are met:
|
||||
Redistribution and use in source and binary forms, with or without
|
||||
modification, are permitted provided that the following conditions
|
||||
are met:
|
||||
|
||||
1. Redistributions of source code must retain the above copyright
|
||||
notice, this list of conditions and the following disclaimer.
|
||||
1. Redistributions of source code must retain the above copyright
|
||||
notice, this list of conditions and the following disclaimer.
|
||||
|
||||
2. Redistributions in binary form must reproduce the above copyright
|
||||
notice, this list of conditions and the following disclaimer in the
|
||||
documentation and/or other materials provided with the distribution.
|
||||
2. Redistributions in binary form must reproduce the above copyright
|
||||
notice, this list of conditions and the following disclaimer in the
|
||||
documentation and/or other materials provided with the distribution.
|
||||
|
||||
3. Neither the name of the Institute nor the names of its contributors
|
||||
may be used to endorse or promote products derived from this software
|
||||
without specific prior written permission.
|
||||
3. Neither the name of the Institute nor the names of its contributors
|
||||
may be used to endorse or promote products derived from this software
|
||||
without specific prior written permission.
|
||||
|
||||
THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGE.
|
||||
THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGE.
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
|
||||
+4
-3
@@ -3,13 +3,15 @@ include $(top_srcdir)/Makefile.top
|
||||
SUBDIRS = . lib doc
|
||||
|
||||
# build libtest before fuzz/* and bin/tests
|
||||
if HAVE_CMOCKA
|
||||
SUBDIRS += tests
|
||||
endif HAVE_CMOCKA
|
||||
|
||||
# run fuzz tests before system tests
|
||||
SUBDIRS += fuzz bin
|
||||
|
||||
BUILT_SOURCES += bind.keys.h
|
||||
CLEANFILES += bind.keys.h
|
||||
BUILT_SOURCES = bind.keys.h
|
||||
CLEANFILES = bind.keys.h
|
||||
|
||||
bind.keys.h: bind.keys Makefile
|
||||
${PERL} ${top_srcdir}/util/bindkeys.pl ${top_srcdir}/bind.keys > $@
|
||||
@@ -19,7 +21,6 @@ bind.keys.h: bind.keys Makefile
|
||||
EXTRA_DIST = \
|
||||
bind.keys \
|
||||
util/bindkeys.pl \
|
||||
util/dtrace.sh \
|
||||
contrib \
|
||||
CHANGES \
|
||||
COPYRIGHT \
|
||||
|
||||
@@ -25,8 +25,11 @@ common_SPHINXOPTS = \
|
||||
-a \
|
||||
$(SPHINX_V)
|
||||
|
||||
# The "today" variable set below is not directly used in the ARM, but its value
|
||||
# is implicitly inserted on the title page of the PDF file produced by Sphinx.
|
||||
ALLSPHINXOPTS = \
|
||||
$(common_SPHINXOPTS) \
|
||||
-D today="$(RELEASE_DATE)" \
|
||||
-D rst_epilog="$$(printf "$${RST_EPILOG}")" \
|
||||
$(SPHINXOPTS) \
|
||||
$(srcdir)
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
# Hey Emacs, this is -*- makefile-automake -*- file!
|
||||
# vim: filetype=automake
|
||||
|
||||
AM_V_DTRACE = $(AM_V_DTRACE_@AM_V@)
|
||||
AM_V_DTRACE_ = $(AM_V_DTRACE_@AM_DEFAULT_V@)
|
||||
AM_V_DTRACE_0 = @echo " DTRACE $@";
|
||||
|
||||
BUILT_SOURCES += probes.h
|
||||
CLEANFILES += probes.h probes.o
|
||||
|
||||
probes.h: Makefile probes.d
|
||||
$(AM_V_DTRACE)$(DTRACE) -s $(srcdir)/probes.d -h -o $@
|
||||
probes.lo: Makefile probes.d $(DTRACE_DEPS)
|
||||
$(AM_V_DTRACE)$(LIBTOOL) --mode=compile --tag=CC $(DTRACE) -s $(srcdir)/probes.d -G -o $@ $(DTRACE_OBJS)
|
||||
|
||||
if HAVE_DTRACE
|
||||
if !HOST_MACOS
|
||||
DTRACE_LIBADD = probes.lo
|
||||
endif
|
||||
endif
|
||||
@@ -21,8 +21,3 @@ AM_CPPFLAGS += \
|
||||
LDADD += \
|
||||
$(top_builddir)/tests/libtest/libtest.la \
|
||||
$(CMOCKA_LIBS)
|
||||
|
||||
if HAVE_JEMALLOC
|
||||
AM_CFLAGS += $(JEMALLOC_CFLAGS)
|
||||
LDADD += $(JEMALLOC_LIBS)
|
||||
endif
|
||||
|
||||
+2
-22
@@ -15,31 +15,17 @@ AM_LDFLAGS = \
|
||||
$(STD_LDFLAGS)
|
||||
LDADD =
|
||||
|
||||
BUILT_SOURCES =
|
||||
CLEANFILES =
|
||||
|
||||
if HOST_MACOS
|
||||
AM_LDFLAGS += \
|
||||
-Wl,-flat_namespace
|
||||
endif HOST_MACOS
|
||||
|
||||
if HAVE_JEMALLOC
|
||||
LIBISC_CFLAGS = $(JEMALLOC_CFLAGS)
|
||||
LIBISC_LIBS = $(JEMALLOC_LIBS)
|
||||
else
|
||||
LIBISC_CFLAGS =
|
||||
LIBISC_LIBS =
|
||||
endif
|
||||
|
||||
LIBISC_CFLAGS += \
|
||||
LIBISC_CFLAGS = \
|
||||
-I$(top_srcdir)/include \
|
||||
-I$(top_srcdir)/lib/isc/include \
|
||||
-I$(top_builddir)/lib/isc/include
|
||||
|
||||
LIBISC_LIBS += $(top_builddir)/lib/isc/libisc.la
|
||||
if HAVE_DTRACE
|
||||
LIBISC_DTRACE = $(top_builddir)/lib/isc/probes.lo
|
||||
endif
|
||||
LIBISC_LIBS = $(top_builddir)/lib/isc/libisc.la
|
||||
|
||||
LIBDNS_CFLAGS = \
|
||||
-I$(top_srcdir)/lib/dns/include \
|
||||
@@ -47,18 +33,12 @@ LIBDNS_CFLAGS = \
|
||||
|
||||
LIBDNS_LIBS = \
|
||||
$(top_builddir)/lib/dns/libdns.la
|
||||
if HAVE_DTRACE
|
||||
LIBDNS_DTRACE = $(top_builddir)/lib/dns/probes.lo
|
||||
endif
|
||||
|
||||
LIBNS_CFLAGS = \
|
||||
-I$(top_srcdir)/lib/ns/include
|
||||
|
||||
LIBNS_LIBS = \
|
||||
$(top_builddir)/lib/ns/libns.la
|
||||
if HAVE_DTRACE
|
||||
LIBNS_DTRACE = $(top_builddir)/lib/ns/probes.lo
|
||||
endif
|
||||
|
||||
LIBISCCFG_CFLAGS = \
|
||||
-I$(top_srcdir)/lib/isccfg/include
|
||||
|
||||
@@ -74,9 +74,17 @@ contents of your configuration file in a non-confidential issue, it is
|
||||
advisable to obscure key secrets; this can be done automatically by
|
||||
using `named-checkconf -px`.
|
||||
|
||||
For information about ISC's Security Vulnerability Disclosure Policy and
|
||||
information about reporting potential security issues, please see
|
||||
`SECURITY.md`.
|
||||
If you are reporting a bug that is a potential security issue, such as an
|
||||
assertion failure or other crash in `named`, please do *NOT* use GitLab to
|
||||
report it. Instead, send mail to
|
||||
[security-officer@isc.org](mailto:security-officer@isc.org) using our
|
||||
OpenPGP key to secure your message. (Information about OpenPGP and links
|
||||
to our key can be found at
|
||||
[https://www.isc.org/pgpkey](https://www.isc.org/pgpkey).) Please do not
|
||||
discuss the bug on any public mailing list.
|
||||
|
||||
For a general overview of ISC security policies, read the Knowledgebase
|
||||
article at [https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
|
||||
|
||||
Professional support and training for BIND are available from
|
||||
ISC. Contact us at [https://www.isc.org/contact](https://www.isc.org/contact)
|
||||
@@ -128,7 +136,7 @@ multiple servers to run locally and communicate with each other). These
|
||||
IP addresses can be configured by running the command
|
||||
`bin/tests/system/ifconfig.sh up` as root.
|
||||
|
||||
Some tests require Perl and the `Net::DNS` and/or `IO::Socket::IP` modules,
|
||||
Some tests require Perl and the `Net::DNS` and/or `IO::Socket::INET6` modules,
|
||||
and are skipped if these are not available. Some tests require Python
|
||||
and the `dnspython` module and are skipped if these are not available.
|
||||
See bin/tests/system/README for further details.
|
||||
@@ -141,18 +149,9 @@ parallel test driver; unit tests are also run by `make check`.
|
||||
|
||||
The *BIND 9 Administrator Reference Manual* (ARM) is included with the source
|
||||
distribution, and in .rst format, in the `doc/arm`
|
||||
directory. The HTML version is automatically generated and can
|
||||
directory. HTML and PDF versions are automatically generated and can
|
||||
be viewed at [https://bind9.readthedocs.io/en/latest/index.html](https://bind9.readthedocs.io/en/latest/index.html).
|
||||
|
||||
The PDF version can be built by running:
|
||||
|
||||
cd doc/arm/
|
||||
sphinx-build -b latex . pdf/
|
||||
make -C pdf/ all-pdf
|
||||
|
||||
The above requires TeX Live in order to work. The PDF will be written to
|
||||
`doc/arm/pdf/Bv9ARM.pdf`.
|
||||
|
||||
Man pages for some of the programs in the BIND 9 distribution
|
||||
are also included in the BIND ARM.
|
||||
|
||||
|
||||
-35
@@ -1,35 +0,0 @@
|
||||
<!--
|
||||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
|
||||
SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
-->
|
||||
# Security Policy
|
||||
|
||||
ISC's Security Vulnerability Disclosure Policy is documented in the
|
||||
relevant [ISC Knowledgebase article][1].
|
||||
|
||||
## Reporting possible security issues
|
||||
|
||||
If you think you may be seeing a potential security vulnerability in
|
||||
BIND (for example, a crash with a REQUIRE, INSIST, or ASSERT failure),
|
||||
please report it immediately by [opening a confidential GitLab issue][2]
|
||||
(preferred) or emailing bind-security@isc.org.
|
||||
|
||||
Please do not discuss undisclosed security vulnerabilities on any public
|
||||
mailing list. ISC has a long history of handling reported
|
||||
vulnerabilities promptly and effectively and we respect and acknowledge
|
||||
responsible reporters.
|
||||
|
||||
If you have a crash, you may want to consult the Knowledgebase article
|
||||
entitled ["What to do if your BIND or DHCP server has crashed"][3].
|
||||
|
||||
[1]: https://kb.isc.org/docs/aa-00861
|
||||
[2]: https://gitlab.isc.org/isc-projects/bind9/-/issues/new?issue[confidential]=true&issuable_template=Bug
|
||||
[3]: https://kb.isc.org/docs/aa-00340
|
||||
@@ -73,7 +73,7 @@
|
||||
#define ERR_IS_MXCNAME 6
|
||||
#define ERR_IS_SRVCNAME 7
|
||||
|
||||
static const char *dbtype[] = { ZONEDB_DEFAULT };
|
||||
static const char *dbtype[] = { "rbt" };
|
||||
|
||||
int debug = 0;
|
||||
const char *journal = NULL;
|
||||
@@ -88,7 +88,6 @@ bool dochecksrv = false;
|
||||
bool docheckns = false;
|
||||
#endif /* if CHECK_LOCAL */
|
||||
dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
|
||||
DNS_ZONEOPT_CHECKDUPRR | DNS_ZONEOPT_CHECKSPF |
|
||||
DNS_ZONEOPT_MANYERRORS | DNS_ZONEOPT_CHECKNAMES |
|
||||
DNS_ZONEOPT_CHECKINTEGRITY |
|
||||
#if CHECK_SIBLING
|
||||
@@ -596,7 +595,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
|
||||
zonename, filename, classname);
|
||||
}
|
||||
|
||||
dns_zone_create(&zone, mctx, 0);
|
||||
CHECK(dns_zone_create(&zone, mctx, 0));
|
||||
|
||||
dns_zone_settype(zone, dns_zone_primary);
|
||||
|
||||
@@ -617,7 +616,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
|
||||
CHECK(dns_zone_setjournal(zone, journal));
|
||||
}
|
||||
|
||||
region.base = UNCONST(classname);
|
||||
DE_CONST(classname, region.base);
|
||||
region.length = strlen(classname);
|
||||
CHECK(dns_rdataclass_fromtext(&rdclass, ®ion));
|
||||
|
||||
|
||||
+39
-52
@@ -44,6 +44,8 @@
|
||||
|
||||
static const char *program = "named-checkconf";
|
||||
|
||||
static bool loadplugins = true;
|
||||
|
||||
isc_log_t *logc = NULL;
|
||||
|
||||
#define CHECK(r) \
|
||||
@@ -60,10 +62,10 @@ usage(void);
|
||||
static void
|
||||
usage(void) {
|
||||
fprintf(stderr,
|
||||
"usage: %s [-achijlvz] [-p [-x]] [-t directory] "
|
||||
"usage: %s [-chijlvz] [-p [-x]] [-t directory] "
|
||||
"[named.conf]\n",
|
||||
program);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/*% directory callback */
|
||||
@@ -155,7 +157,7 @@ configure_hint(const char *zfile, const char *zclass, isc_mem_t *mctx) {
|
||||
return (ISC_R_FAILURE);
|
||||
}
|
||||
|
||||
r.base = UNCONST(zclass);
|
||||
DE_CONST(zclass, r.base);
|
||||
r.length = strlen(zclass);
|
||||
result = dns_rdataclass_fromtext(&rdclass, &r);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
@@ -242,9 +244,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
|
||||
* Skip checks when using an alternate data source.
|
||||
*/
|
||||
cfg_map_get(zoptions, "database", &dbobj);
|
||||
if (dbobj != NULL &&
|
||||
strcmp(ZONEDB_DEFAULT, cfg_obj_asstring(dbobj)) != 0)
|
||||
{
|
||||
if (dbobj != NULL && strcmp("rbt", cfg_obj_asstring(dbobj)) != 0) {
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
@@ -512,7 +512,7 @@ config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
|
||||
*classp = defclass;
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
r.base = UNCONST(cfg_obj_asstring(classobj));
|
||||
DE_CONST(cfg_obj_asstring(classobj), r.base);
|
||||
r.length = strlen(r.base);
|
||||
return (dns_rdataclass_fromtext(classp, &r));
|
||||
}
|
||||
@@ -577,10 +577,10 @@ cleanup:
|
||||
|
||||
static void
|
||||
output(void *closure, const char *text, int textlen) {
|
||||
UNUSED(closure);
|
||||
if (fwrite(text, 1, textlen, stdout) != (size_t)textlen) {
|
||||
isc_result_t *result = closure;
|
||||
perror("fwrite");
|
||||
*result = ISC_R_FAILURE;
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -592,21 +592,20 @@ main(int argc, char **argv) {
|
||||
cfg_obj_t *config = NULL;
|
||||
const char *conffile = NULL;
|
||||
isc_mem_t *mctx = NULL;
|
||||
isc_result_t result = ISC_R_SUCCESS;
|
||||
bool cleanup_dst = true;
|
||||
isc_result_t result;
|
||||
int exit_status = 0;
|
||||
bool load_zones = false;
|
||||
bool list_zones = false;
|
||||
bool print = false;
|
||||
bool nodeprecate = false;
|
||||
unsigned int flags = 0;
|
||||
unsigned int checkflags = BIND_CHECK_PLUGINS | BIND_CHECK_ALGORITHMS;
|
||||
|
||||
isc_commandline_errprint = false;
|
||||
|
||||
/*
|
||||
* Process memory debugging argument first.
|
||||
*/
|
||||
#define CMDLINE_FLAGS "acdhijlm:t:pvxz"
|
||||
#define CMDLINE_FLAGS "cdhijlm:t:pvxz"
|
||||
while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
|
||||
switch (c) {
|
||||
case 'm':
|
||||
@@ -633,12 +632,8 @@ main(int argc, char **argv) {
|
||||
|
||||
while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != EOF) {
|
||||
switch (c) {
|
||||
case 'a':
|
||||
checkflags &= ~BIND_CHECK_ALGORITHMS;
|
||||
break;
|
||||
|
||||
case 'c':
|
||||
checkflags &= ~BIND_CHECK_PLUGINS;
|
||||
loadplugins = false;
|
||||
break;
|
||||
|
||||
case 'd':
|
||||
@@ -665,7 +660,7 @@ main(int argc, char **argv) {
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "isc_dir_chroot: %s\n",
|
||||
isc_result_totext(result));
|
||||
CHECK(result);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -675,8 +670,7 @@ main(int argc, char **argv) {
|
||||
|
||||
case 'v':
|
||||
printf("%s\n", PACKAGE_VERSION);
|
||||
result = ISC_R_SUCCESS;
|
||||
goto cleanup;
|
||||
exit(0);
|
||||
|
||||
case 'x':
|
||||
flags |= CFG_PRINTER_XKEY;
|
||||
@@ -696,27 +690,25 @@ main(int argc, char **argv) {
|
||||
}
|
||||
FALLTHROUGH;
|
||||
case 'h':
|
||||
isc_mem_detach(&mctx);
|
||||
usage();
|
||||
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
CHECK(ISC_R_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
if (((flags & CFG_PRINTER_XKEY) != 0) && !print) {
|
||||
fprintf(stderr, "%s: -x cannot be used without -p\n", program);
|
||||
CHECK(ISC_R_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
if (print && list_zones) {
|
||||
fprintf(stderr, "%s: -l cannot be used with -p\n", program);
|
||||
CHECK(ISC_R_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
if (isc_commandline_index + 1 < argc) {
|
||||
isc_mem_detach(&mctx);
|
||||
usage();
|
||||
}
|
||||
if (argv[isc_commandline_index] != NULL) {
|
||||
@@ -726,48 +718,43 @@ main(int argc, char **argv) {
|
||||
conffile = NAMED_CONFFILE;
|
||||
}
|
||||
|
||||
CHECK(setup_logging(mctx, stdout, &logc));
|
||||
RUNTIME_CHECK(setup_logging(mctx, stdout, &logc) == ISC_R_SUCCESS);
|
||||
|
||||
CHECK(dst_lib_init(mctx, NULL));
|
||||
cleanup_dst = true;
|
||||
|
||||
CHECK(cfg_parser_create(mctx, logc, &parser));
|
||||
RUNTIME_CHECK(cfg_parser_create(mctx, logc, &parser) == ISC_R_SUCCESS);
|
||||
|
||||
if (nodeprecate) {
|
||||
cfg_parser_setflags(parser, CFG_PCTX_NODEPRECATED, true);
|
||||
}
|
||||
cfg_parser_setcallback(parser, directory_callback, NULL);
|
||||
|
||||
CHECK(cfg_parse_file(parser, conffile, &cfg_type_namedconf, &config));
|
||||
CHECK(isccfg_check_namedconf(config, checkflags, logc, mctx));
|
||||
if (load_zones || list_zones) {
|
||||
CHECK(load_zones_fromconfig(config, mctx, list_zones));
|
||||
if (cfg_parse_file(parser, conffile, &cfg_type_namedconf, &config) !=
|
||||
ISC_R_SUCCESS)
|
||||
{
|
||||
exit(1);
|
||||
}
|
||||
|
||||
if (print) {
|
||||
cfg_printx(config, flags, output, &result);
|
||||
result = isccfg_check_namedconf(config, loadplugins, logc, mctx);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
exit_status = 1;
|
||||
}
|
||||
|
||||
cleanup:
|
||||
if (config != NULL) {
|
||||
cfg_obj_destroy(parser, &config);
|
||||
if (result == ISC_R_SUCCESS && (load_zones || list_zones)) {
|
||||
result = load_zones_fromconfig(config, mctx, list_zones);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
exit_status = 1;
|
||||
}
|
||||
}
|
||||
|
||||
if (parser != NULL) {
|
||||
cfg_parser_destroy(&parser);
|
||||
if (print && exit_status == 0) {
|
||||
cfg_printx(config, flags, output, NULL);
|
||||
}
|
||||
cfg_obj_destroy(parser, &config);
|
||||
|
||||
if (cleanup_dst) {
|
||||
dst_lib_destroy();
|
||||
}
|
||||
cfg_parser_destroy(&parser);
|
||||
|
||||
if (logc != NULL) {
|
||||
isc_log_destroy(&logc);
|
||||
}
|
||||
isc_log_destroy(&logc);
|
||||
|
||||
if (mctx != NULL) {
|
||||
isc_mem_destroy(&mctx);
|
||||
}
|
||||
isc_mem_destroy(&mctx);
|
||||
|
||||
return (result == ISC_R_SUCCESS ? 0 : 1);
|
||||
return (exit_status);
|
||||
}
|
||||
|
||||
@@ -21,7 +21,7 @@ named-checkconf - named configuration file syntax checking tool
|
||||
Synopsis
|
||||
~~~~~~~~
|
||||
|
||||
:program:`named-checkconf` [**-achjlvz**] [**-p** [**-x** ]] [**-t** directory] {filename}
|
||||
:program:`named-checkconf` [**-chjlvz**] [**-p** [**-x** ]] [**-t** directory] {filename}
|
||||
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
@@ -41,13 +41,6 @@ explicitly.
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
.. option:: -a
|
||||
|
||||
Don't check the `dnssec-policy`'s DNSSEC key algorithms against
|
||||
those supported by the crypto provider. This is useful when checking
|
||||
a `named.conf` intended to be run on another machine with possibly a
|
||||
different set of supported DNSSEC key algorithms.
|
||||
|
||||
.. option:: -h
|
||||
|
||||
This option prints the usage summary and exits.
|
||||
|
||||
+28
-25
@@ -79,7 +79,7 @@ usage(void) {
|
||||
"%s zonename [ (filename|-) ]\n",
|
||||
prog_name,
|
||||
progmode == progmode_check ? "[-o filename]" : "-o filename");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -147,12 +147,15 @@ main(int argc, char **argv) {
|
||||
UNREACHABLE();
|
||||
}
|
||||
|
||||
/* When compiling, disable checks by default */
|
||||
/* Compilation specific defaults */
|
||||
if (progmode == progmode_compile) {
|
||||
zone_options = 0;
|
||||
docheckmx = false;
|
||||
docheckns = false;
|
||||
dochecksrv = false;
|
||||
zone_options |= (DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_FATALNS |
|
||||
DNS_ZONEOPT_CHECKSPF | DNS_ZONEOPT_CHECKDUPRR |
|
||||
DNS_ZONEOPT_CHECKNAMES |
|
||||
DNS_ZONEOPT_CHECKNAMESFAIL |
|
||||
DNS_ZONEOPT_CHECKWILDCARD);
|
||||
} else {
|
||||
zone_options |= (DNS_ZONEOPT_CHECKDUPRR | DNS_ZONEOPT_CHECKSPF);
|
||||
}
|
||||
|
||||
#define ARGCMP(X) (strcmp(isc_commandline_argument, X) == 0)
|
||||
@@ -206,7 +209,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -i: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -240,7 +243,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -k: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -251,7 +254,7 @@ main(int argc, char **argv) {
|
||||
if (*endp != '\0') {
|
||||
fprintf(stderr, "source serial number "
|
||||
"must be numeric");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -262,7 +265,7 @@ main(int argc, char **argv) {
|
||||
if (*endp != '\0') {
|
||||
fprintf(stderr, "maximum TTL "
|
||||
"must be numeric");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -279,7 +282,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -n: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -296,7 +299,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -m: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -321,7 +324,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -r: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -334,7 +337,7 @@ main(int argc, char **argv) {
|
||||
fprintf(stderr,
|
||||
"unknown or unsupported style: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -344,13 +347,13 @@ main(int argc, char **argv) {
|
||||
fprintf(stderr, "isc_dir_chroot: %s: %s\n",
|
||||
isc_commandline_argument,
|
||||
isc_result_totext(result));
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
case 'v':
|
||||
printf("%s\n", PACKAGE_VERSION);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
|
||||
case 'w':
|
||||
workdir = isc_commandline_argument;
|
||||
@@ -364,7 +367,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -C: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -385,7 +388,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -M: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -402,7 +405,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -S: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -414,7 +417,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -T: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -438,7 +441,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", prog_name,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -447,7 +450,7 @@ main(int argc, char **argv) {
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "isc_dir_chdir: %s: %s\n", workdir,
|
||||
isc_result_totext(result));
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -463,7 +466,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "unknown file format: %s\n",
|
||||
inputformatstr);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -481,12 +484,12 @@ main(int argc, char **argv) {
|
||||
rawversion > 1U)
|
||||
{
|
||||
fprintf(stderr, "unknown raw format version\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
} else {
|
||||
fprintf(stderr, "unknown file format: %s\n",
|
||||
outputformatstr);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -30,16 +30,10 @@ Description
|
||||
|
||||
:program:`named-compilezone` checks the syntax and integrity of a zone file,
|
||||
and dumps the zone contents to a specified file in a specified format.
|
||||
|
||||
Unlike :program:`named-checkzone`, zone contents are not strictly checked
|
||||
by default. If the output is to be used as an actual zone file to be loaded
|
||||
by :iscman:`named`, then the check levels should be manually configured to
|
||||
be at least as strict as those specified in the :iscman:`named` configuration
|
||||
file.
|
||||
|
||||
Running :program:`named-checkzone` on the input prior to compiling will
|
||||
ensure that the zone compiles with the default requirements of
|
||||
:iscman:`named`.
|
||||
It applies strict check levels by default, since the
|
||||
dump output is used as an actual zone file loaded by :iscman:`named`.
|
||||
When manually specified otherwise, the check levels must at least be as
|
||||
strict as those specified in the :iscman:`named` configuration file.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
@@ -83,13 +77,13 @@ Options
|
||||
|
||||
``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
|
||||
records and ``check-svcb:ignore`` disables these checks. The
|
||||
default is ``check-svcb:ignore``.
|
||||
default is ``check-svcb:fail``.
|
||||
|
||||
.. option:: -i mode
|
||||
|
||||
This option performs post-load zone integrity checks. Possible modes are
|
||||
``full``, ``full-sibling``, ``local``,
|
||||
``local-sibling``, and ``none`` (the default).
|
||||
``full`` (the default), ``full-sibling``, ``local``,
|
||||
``local-sibling``, and ``none``.
|
||||
|
||||
Mode ``full`` checks that MX records refer to A or AAAA records
|
||||
(both in-zone and out-of-zone hostnames). Mode ``local`` only
|
||||
@@ -133,7 +127,7 @@ Options
|
||||
.. option:: -k mode
|
||||
|
||||
This option performs ``check-names`` checks with the specified failure mode.
|
||||
Possible modes are ``fail``, ``warn``, and ``ignore`` (the default).
|
||||
Possible modes are ``fail`` (the default), ``warn``, and ``ignore``.
|
||||
|
||||
.. option:: -l ttl
|
||||
|
||||
@@ -150,19 +144,19 @@ Options
|
||||
.. option:: -m mode
|
||||
|
||||
This option specifies whether MX records should be checked to see if they are
|
||||
addresses. Possible modes are ``fail``, ``warn``, and
|
||||
``ignore`` (the default).
|
||||
addresses. Possible modes are ``fail``, ``warn`` (the default), and
|
||||
``ignore``.
|
||||
|
||||
.. option:: -M mode
|
||||
|
||||
This option checks whether a MX record refers to a CNAME. Possible modes are
|
||||
``fail``, ``warn``, and ``ignore`` (the default).
|
||||
``fail``, ``warn`` (the default), and ``ignore``.
|
||||
|
||||
.. option:: -n mode
|
||||
|
||||
This option specifies whether NS records should be checked to see if they are
|
||||
addresses. Possible modes are ``fail``, ``warn``, and
|
||||
``ignore`` (the default).
|
||||
addresses. Possible modes are ``fail`` (the default), ``warn``, and
|
||||
``ignore``.
|
||||
|
||||
.. option:: -o filename
|
||||
|
||||
@@ -173,7 +167,7 @@ Options
|
||||
|
||||
This option checks for records that are treated as different by DNSSEC but are
|
||||
semantically equal in plain DNS. Possible modes are ``fail``,
|
||||
``warn``, and ``ignore`` (the default).
|
||||
``warn`` (the default), and ``ignore``.
|
||||
|
||||
.. option:: -s style
|
||||
|
||||
@@ -186,7 +180,7 @@ Options
|
||||
.. option:: -S mode
|
||||
|
||||
This option checks whether an SRV record refers to a CNAME. Possible modes are
|
||||
``fail``, ``warn``, and ``ignore`` (the default).
|
||||
``fail``, ``warn`` (the default), and ``ignore``.
|
||||
|
||||
.. option:: -t directory
|
||||
|
||||
@@ -198,7 +192,7 @@ Options
|
||||
|
||||
This option checks whether Sender Policy Framework (SPF) records exist and issues a
|
||||
warning if an SPF-formatted TXT record is not also present. Possible
|
||||
modes are ``warn`` and ``ignore`` (the default).
|
||||
modes are ``warn`` (the default) and ``ignore``.
|
||||
|
||||
.. option:: -w directory
|
||||
|
||||
@@ -216,7 +210,7 @@ Options
|
||||
This option specifies whether to check for non-terminal wildcards. Non-terminal
|
||||
wildcards are almost always the result of a failure to understand the
|
||||
wildcard matching algorithm (:rfc:`4592`). Possible modes are ``warn``
|
||||
and ``ignore`` (the default).
|
||||
(the default) and ``ignore``.
|
||||
|
||||
.. option:: zonename
|
||||
|
||||
|
||||
@@ -124,7 +124,7 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
|
||||
|
||||
DO("generate key",
|
||||
dst_key_generate(dns_rootname, alg, keysize, 0, 0, DNS_KEYPROTO_ANY,
|
||||
dns_rdataclass_in, NULL, mctx, &key, NULL));
|
||||
dns_rdataclass_in, mctx, &key, NULL));
|
||||
|
||||
isc_buffer_init(&key_rawbuffer, &key_rawsecret, sizeof(key_rawsecret));
|
||||
|
||||
|
||||
@@ -146,8 +146,7 @@ main(int argc, char **argv) {
|
||||
keyfile = isc_commandline_argument;
|
||||
break;
|
||||
case 'h':
|
||||
usage(EXIT_SUCCESS);
|
||||
break;
|
||||
usage(0);
|
||||
case 'k':
|
||||
case 'y': /* Compatible with rndc -y. */
|
||||
keyname = isc_commandline_argument;
|
||||
@@ -193,15 +192,15 @@ main(int argc, char **argv) {
|
||||
if (isc_commandline_option != '?') {
|
||||
fprintf(stderr, "%s: invalid argument -%c\n",
|
||||
program, isc_commandline_option);
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
} else {
|
||||
usage(EXIT_SUCCESS);
|
||||
usage(0);
|
||||
}
|
||||
break;
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -210,7 +209,7 @@ main(int argc, char **argv) {
|
||||
POST(argv);
|
||||
|
||||
if (argc > 0) {
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
}
|
||||
|
||||
if (alg == DST_ALG_HMACMD5) {
|
||||
|
||||
+10
-10
@@ -138,13 +138,13 @@ main(int argc, char **argv) {
|
||||
keysize = alg_bits(alg);
|
||||
break;
|
||||
case 'h':
|
||||
usage(EXIT_SUCCESS);
|
||||
usage(0);
|
||||
case 'k':
|
||||
case 'y':
|
||||
if (progmode == progmode_confgen) {
|
||||
keyname = isc_commandline_argument;
|
||||
} else {
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
}
|
||||
break;
|
||||
case 'M':
|
||||
@@ -157,7 +157,7 @@ main(int argc, char **argv) {
|
||||
if (progmode == progmode_confgen) {
|
||||
quiet = true;
|
||||
} else {
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
}
|
||||
break;
|
||||
case 'r':
|
||||
@@ -167,29 +167,29 @@ main(int argc, char **argv) {
|
||||
if (progmode == progmode_confgen) {
|
||||
self_domain = isc_commandline_argument;
|
||||
} else {
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
}
|
||||
break;
|
||||
case 'z':
|
||||
if (progmode == progmode_confgen) {
|
||||
zone = isc_commandline_argument;
|
||||
} else {
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
}
|
||||
break;
|
||||
case '?':
|
||||
if (isc_commandline_option != '?') {
|
||||
fprintf(stderr, "%s: invalid argument -%c\n",
|
||||
program, isc_commandline_option);
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
} else {
|
||||
usage(EXIT_SUCCESS);
|
||||
usage(0);
|
||||
}
|
||||
break;
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -200,11 +200,11 @@ main(int argc, char **argv) {
|
||||
POST(argv);
|
||||
|
||||
if (self_domain != NULL && zone != NULL) {
|
||||
usage(EXIT_FAILURE); /* -s and -z cannot coexist */
|
||||
usage(1); /* -s and -z cannot coexist */
|
||||
}
|
||||
|
||||
if (argc > isc_commandline_index) {
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
}
|
||||
|
||||
/* Use canonical algorithm name */
|
||||
|
||||
@@ -27,10 +27,9 @@ Synopsis
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
:program:`tsig-keygen` is an utility that generates keys for use with TSIG
|
||||
(Transaction Signatures) as defined in :rfc:`2845`. The resulting keys can be used,
|
||||
for example, to secure dynamic DNS updates to a zone, or for the :iscman:`rndc`
|
||||
command channel.
|
||||
:program:`tsig-keygen` is an utility that generates keys for use in TSIG signing.
|
||||
The resulting keys can be used, for example, to secure dynamic DNS updates
|
||||
to a zone, or for the :iscman:`rndc` command channel.
|
||||
|
||||
A domain name can be specified on the command line to be used as the name
|
||||
of the generated key. If no name is specified, the default is ``tsig-key``.
|
||||
|
||||
+2
-6
@@ -13,15 +13,11 @@
|
||||
|
||||
/*! \file */
|
||||
|
||||
#include "util.h"
|
||||
#include <stdarg.h>
|
||||
#include <stdbool.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include <isc/tls.h>
|
||||
|
||||
#include "util.h"
|
||||
|
||||
extern bool verbose;
|
||||
extern const char *progname;
|
||||
@@ -47,5 +43,5 @@ fatal(const char *format, ...) {
|
||||
vfprintf(stderr, format, args);
|
||||
va_end(args);
|
||||
fprintf(stderr, "\n");
|
||||
_exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
@@ -4,7 +4,6 @@ AM_CPPFLAGS += \
|
||||
-I$(top_builddir)/include \
|
||||
$(LIBISC_CFLAGS) \
|
||||
$(LIBDNS_CFLAGS) \
|
||||
$(LIBNS_CFLAGS) \
|
||||
$(LIBISCCFG_CFLAGS)
|
||||
|
||||
AM_CPPFLAGS += \
|
||||
@@ -18,5 +17,4 @@ delv_SOURCES = \
|
||||
delv_LDADD = \
|
||||
$(LIBISC_LIBS) \
|
||||
$(LIBDNS_LIBS) \
|
||||
$(LIBNS_LIBS) \
|
||||
$(LIBISCCFG_LIBS)
|
||||
|
||||
+89
-482
@@ -25,7 +25,6 @@
|
||||
#include <sys/types.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include <isc/async.h>
|
||||
#include <isc/attributes.h>
|
||||
#include <isc/base64.h>
|
||||
#include <isc/buffer.h>
|
||||
@@ -36,7 +35,6 @@
|
||||
#include <isc/mem.h>
|
||||
#include <isc/netmgr.h>
|
||||
#include <isc/parseint.h>
|
||||
#include <isc/random.h>
|
||||
#include <isc/result.h>
|
||||
#include <isc/sockaddr.h>
|
||||
#include <isc/string.h>
|
||||
@@ -44,28 +42,20 @@
|
||||
#include <isc/tls.h>
|
||||
#include <isc/util.h>
|
||||
|
||||
#include <dns/acl.h>
|
||||
#include <dns/byaddr.h>
|
||||
#include <dns/cache.h>
|
||||
#include <dns/client.h>
|
||||
#include <dns/dispatch.h>
|
||||
#include <dns/fixedname.h>
|
||||
#include <dns/keytable.h>
|
||||
#include <dns/keyvalues.h>
|
||||
#include <dns/log.h>
|
||||
#include <dns/masterdump.h>
|
||||
#include <dns/message.h>
|
||||
#include <dns/name.h>
|
||||
#include <dns/rdata.h>
|
||||
#include <dns/rdataclass.h>
|
||||
#include <dns/rdataset.h>
|
||||
#include <dns/rdatastruct.h>
|
||||
#include <dns/rdatatype.h>
|
||||
#include <dns/request.h>
|
||||
#include <dns/result.h>
|
||||
#include <dns/rootns.h>
|
||||
#include <dns/secalg.h>
|
||||
#include <dns/stats.h>
|
||||
#include <dns/view.h>
|
||||
|
||||
#include <dst/dst.h>
|
||||
@@ -73,10 +63,6 @@
|
||||
#include <isccfg/log.h>
|
||||
#include <isccfg/namedconf.h>
|
||||
|
||||
#include <ns/client.h>
|
||||
#include <ns/interfacemgr.h>
|
||||
#include <ns/server.h>
|
||||
|
||||
#include <irs/resconf.h>
|
||||
|
||||
#define CHECK(r) \
|
||||
@@ -89,24 +75,13 @@
|
||||
#define MAXNAME (DNS_NAME_MAXTEXT + 1)
|
||||
|
||||
/* Variables used internally by delv. */
|
||||
char *progname = NULL;
|
||||
char *progname;
|
||||
static isc_mem_t *mctx = NULL;
|
||||
static isc_log_t *lctx = NULL;
|
||||
static dns_view_t *view = NULL;
|
||||
static ns_server_t *sctx = NULL;
|
||||
static ns_interface_t *ifp = NULL;
|
||||
static dns_dispatch_t *dispatch = NULL;
|
||||
static dns_db_t *roothints = NULL;
|
||||
static isc_stats_t *resstats = NULL;
|
||||
static dns_stats_t *resquerystats = NULL;
|
||||
static FILE *logfp = NULL;
|
||||
|
||||
/* Managers */
|
||||
static isc_nm_t *netmgr = NULL;
|
||||
static isc_loopmgr_t *loopmgr = NULL;
|
||||
static dns_dispatchmgr_t *dispatchmgr = NULL;
|
||||
static dns_requestmgr_t *requestmgr = NULL;
|
||||
static ns_interfacemgr_t *interfacemgr = NULL;
|
||||
|
||||
/* TLS */
|
||||
static isc_tlsctx_cache_t *tlsctx_client_cache = NULL;
|
||||
@@ -114,29 +89,26 @@ static isc_tlsctx_cache_t *tlsctx_client_cache = NULL;
|
||||
/* Configurables */
|
||||
static char *server = NULL;
|
||||
static const char *port = "53";
|
||||
static uint32_t destport = 53;
|
||||
static isc_sockaddr_t *srcaddr4 = NULL, *srcaddr6 = NULL;
|
||||
static isc_sockaddr_t a4, a6;
|
||||
static char *curqname = NULL, *qname = NULL;
|
||||
static bool classset = false;
|
||||
static dns_rdatatype_t qtype = dns_rdatatype_none;
|
||||
static bool typeset = false;
|
||||
static const char *hintfile = NULL;
|
||||
|
||||
static unsigned int styleflags = 0;
|
||||
static uint32_t splitwidth = 0xffffffff;
|
||||
static bool showcomments = true, showdnssec = true, showtrust = true,
|
||||
rrcomments = true, noclass = false, nocrypto = false, nottl = false,
|
||||
multiline = false, short_form = false, print_unknown_format = false,
|
||||
yaml = false, fulltrace = false;
|
||||
yaml = false;
|
||||
|
||||
static bool resolve_trace = false, validator_trace = false,
|
||||
message_trace = false, send_trace = false;
|
||||
message_trace = false;
|
||||
|
||||
static bool use_ipv4 = true, use_ipv6 = true;
|
||||
|
||||
static bool cdflag = false, no_sigs = false, root_validation = true;
|
||||
static bool qmin = false, qmin_strict = false;
|
||||
|
||||
static bool use_tcp = false;
|
||||
|
||||
@@ -217,12 +189,8 @@ usage(void) {
|
||||
"records)\n"
|
||||
" +[no]mtrace (Trace messages "
|
||||
"received)\n"
|
||||
" +[no]ns (Run internal name "
|
||||
"server)\n"
|
||||
" +[no]multiline (Print records in an "
|
||||
"expanded format)\n"
|
||||
" +[no]qmin[=mode] (QNAME minimization: "
|
||||
"relaxed or strict)\n"
|
||||
" +[no]root (DNSSEC validation trust "
|
||||
"anchor)\n"
|
||||
" +[no]rrcomments (Control display of "
|
||||
@@ -233,8 +201,6 @@ usage(void) {
|
||||
" +[no]short (Short form answer)\n"
|
||||
" +[no]split=## (Split hex/base64 fields "
|
||||
"into chunks)\n"
|
||||
" +[no]strace (Trace messages "
|
||||
"sent)\n"
|
||||
" +[no]tcp (TCP mode)\n"
|
||||
" +[no]ttl (Control display of ttls "
|
||||
"in records)\n"
|
||||
@@ -247,7 +213,7 @@ usage(void) {
|
||||
"process)\n"
|
||||
" +[no]yaml (Present the results as "
|
||||
"YAML)\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
noreturn static void
|
||||
@@ -263,7 +229,7 @@ fatal(const char *format, ...) {
|
||||
vfprintf(stderr, format, args);
|
||||
va_end(args);
|
||||
fprintf(stderr, "\n");
|
||||
_exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -314,7 +280,6 @@ setup_logging(FILE *errout) {
|
||||
isc_result_t result;
|
||||
isc_logdestination_t destination;
|
||||
isc_logconfig_t *logconfig = NULL;
|
||||
int packetlevel = 10;
|
||||
|
||||
isc_log_create(mctx, &lctx, &logconfig);
|
||||
isc_log_registercategories(lctx, categories);
|
||||
@@ -367,12 +332,9 @@ setup_logging(FILE *errout) {
|
||||
}
|
||||
}
|
||||
|
||||
if (send_trace) {
|
||||
packetlevel = 11;
|
||||
}
|
||||
if ((message_trace || send_trace) && loglevel < packetlevel) {
|
||||
if (message_trace && loglevel < 10) {
|
||||
isc_log_createchannel(logconfig, "messages", ISC_LOG_TOFILEDESC,
|
||||
ISC_LOG_DEBUG(packetlevel), &destination,
|
||||
ISC_LOG_DEBUG(10), &destination,
|
||||
ISC_LOG_PRINTPREFIX);
|
||||
|
||||
result = isc_log_usechannel(logconfig, "messages",
|
||||
@@ -462,7 +424,7 @@ print_status(dns_rdataset_t *rdataset) {
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
static isc_result_t
|
||||
printdata(dns_rdataset_t *rdataset, dns_name_t *owner) {
|
||||
isc_result_t result = ISC_R_SUCCESS;
|
||||
static dns_trust_t trust;
|
||||
@@ -475,13 +437,12 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner) {
|
||||
if (!dns_rdataset_isassociated(rdataset)) {
|
||||
char namebuf[DNS_NAME_FORMATSIZE];
|
||||
dns_name_format(owner, namebuf, sizeof(namebuf));
|
||||
delv_log(ISC_LOG_DEBUG(4), "warning: empty rdataset %s",
|
||||
namebuf);
|
||||
return;
|
||||
delv_log(ISC_LOG_DEBUG(4), "WARN: empty rdataset %s", namebuf);
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
if (!showdnssec && rdataset->type == dns_rdatatype_rrsig) {
|
||||
return;
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
if (first || rdataset->trust != trust) {
|
||||
@@ -555,6 +516,8 @@ cleanup:
|
||||
if (t != NULL) {
|
||||
isc_mem_put(mctx, t, len);
|
||||
}
|
||||
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
@@ -607,7 +570,7 @@ static isc_result_t
|
||||
convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
|
||||
isc_result_t result;
|
||||
isc_buffer_t b;
|
||||
dns_name_t *n = NULL;
|
||||
dns_name_t *n;
|
||||
unsigned int len;
|
||||
|
||||
REQUIRE(fn != NULL && name != NULL && text != NULL);
|
||||
@@ -619,7 +582,7 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
|
||||
|
||||
result = dns_name_fromtext(n, &b, dns_rootname, 0, NULL);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
delv_log(ISC_LOG_ERROR, "failed to convert name %s: %s", text,
|
||||
delv_log(ISC_LOG_ERROR, "failed to convert QNAME %s: %s", text,
|
||||
isc_result_totext(result));
|
||||
return (result);
|
||||
}
|
||||
@@ -629,7 +592,7 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
|
||||
key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
|
||||
dns_rdata_dnskey_t dnskey;
|
||||
dns_rdata_ds_t ds;
|
||||
uint32_t rdata1, rdata2, rdata3;
|
||||
@@ -652,8 +615,6 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
|
||||
} anchortype;
|
||||
const cfg_obj_t *obj;
|
||||
|
||||
REQUIRE(client != NULL || toview != NULL);
|
||||
|
||||
keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
|
||||
CHECK(convert_name(&fkeyname, &keyname, keynamestr));
|
||||
|
||||
@@ -747,15 +708,9 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
|
||||
CHECK(dns_rdata_fromstruct(NULL, dnskey.common.rdclass,
|
||||
dnskey.common.rdtype, &dnskey,
|
||||
&rrdatabuf));
|
||||
if (client != NULL) {
|
||||
CHECK(dns_client_addtrustedkey(
|
||||
client, dns_rdataclass_in, dns_rdatatype_dnskey,
|
||||
keyname, &rrdatabuf));
|
||||
} else if (toview != NULL) {
|
||||
CHECK(dns_view_addtrustedkey(toview,
|
||||
dns_rdatatype_dnskey,
|
||||
keyname, &rrdatabuf));
|
||||
}
|
||||
CHECK(dns_client_addtrustedkey(client, dns_rdataclass_in,
|
||||
dns_rdatatype_dnskey, keyname,
|
||||
&rrdatabuf));
|
||||
break;
|
||||
case INITIAL_DS:
|
||||
case STATIC_DS:
|
||||
@@ -796,14 +751,9 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
|
||||
|
||||
CHECK(dns_rdata_fromstruct(NULL, ds.common.rdclass,
|
||||
ds.common.rdtype, &ds, &rrdatabuf));
|
||||
if (client != NULL) {
|
||||
CHECK(dns_client_addtrustedkey(
|
||||
client, dns_rdataclass_in, dns_rdatatype_ds,
|
||||
keyname, &rrdatabuf));
|
||||
} else if (toview != NULL) {
|
||||
CHECK(dns_view_addtrustedkey(toview, dns_rdatatype_ds,
|
||||
keyname, &rrdatabuf));
|
||||
}
|
||||
CHECK(dns_client_addtrustedkey(client, dns_rdataclass_in,
|
||||
dns_rdatatype_ds, keyname,
|
||||
&rrdatabuf));
|
||||
}
|
||||
|
||||
num_keys++;
|
||||
@@ -827,7 +777,7 @@ cleanup:
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
load_keys(const cfg_obj_t *keys, dns_client_t *client, dns_view_t *toview) {
|
||||
load_keys(const cfg_obj_t *keys, dns_client_t *client) {
|
||||
const cfg_listelt_t *elt, *elt2;
|
||||
const cfg_obj_t *key, *keylist;
|
||||
isc_result_t result = ISC_R_SUCCESS;
|
||||
@@ -840,7 +790,7 @@ load_keys(const cfg_obj_t *keys, dns_client_t *client, dns_view_t *toview) {
|
||||
elt2 = cfg_list_next(elt2))
|
||||
{
|
||||
key = cfg_listelt_value(elt2);
|
||||
CHECK(key_fromconfig(key, client, toview));
|
||||
CHECK(key_fromconfig(key, client));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -852,7 +802,7 @@ cleanup:
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
|
||||
setup_dnsseckeys(dns_client_t *client) {
|
||||
isc_result_t result;
|
||||
cfg_parser_t *parser = NULL;
|
||||
const cfg_obj_t *trusted_keys = NULL;
|
||||
@@ -903,13 +853,13 @@ setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
|
||||
cfg_map_get(bindkeys, "trust-anchors", &trust_anchors);
|
||||
|
||||
if (trusted_keys != NULL) {
|
||||
CHECK(load_keys(trusted_keys, client, toview));
|
||||
CHECK(load_keys(trusted_keys, client));
|
||||
}
|
||||
if (managed_keys != NULL) {
|
||||
CHECK(load_keys(managed_keys, client, toview));
|
||||
CHECK(load_keys(managed_keys, client));
|
||||
}
|
||||
if (trust_anchors != NULL) {
|
||||
CHECK(load_keys(trust_anchors, client, toview));
|
||||
CHECK(load_keys(trust_anchors, client));
|
||||
}
|
||||
result = ISC_R_SUCCESS;
|
||||
|
||||
@@ -933,15 +883,21 @@ cleanup:
|
||||
|
||||
static isc_result_t
|
||||
addserver(dns_client_t *client) {
|
||||
struct addrinfo hints, *res = NULL, *cur = NULL;
|
||||
struct addrinfo hints, *res, *cur;
|
||||
int gaierror;
|
||||
struct in_addr in4;
|
||||
struct in6_addr in6;
|
||||
isc_sockaddr_t *sa = NULL;
|
||||
isc_sockaddr_t *sa;
|
||||
isc_sockaddrlist_t servers;
|
||||
uint32_t destport;
|
||||
isc_result_t result;
|
||||
dns_name_t *name = NULL;
|
||||
|
||||
result = parse_uint(&destport, port, 0xffff, "port");
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("Couldn't parse port number");
|
||||
}
|
||||
|
||||
ISC_LIST_INIT(servers);
|
||||
|
||||
if (inet_pton(AF_INET, server, &in4) == 1) {
|
||||
@@ -1019,7 +975,13 @@ findserver(dns_client_t *client) {
|
||||
isc_result_t result;
|
||||
irs_resconf_t *resconf = NULL;
|
||||
isc_sockaddrlist_t *nameservers;
|
||||
isc_sockaddr_t *sa = NULL, *next = NULL;
|
||||
isc_sockaddr_t *sa, *next;
|
||||
uint32_t destport;
|
||||
|
||||
result = parse_uint(&destport, port, 0xffff, "port");
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("Couldn't parse port number");
|
||||
}
|
||||
|
||||
result = irs_resconf_load(mctx, "/etc/resolv.conf", &resconf);
|
||||
if (result != ISC_R_SUCCESS && result != ISC_R_FILENOTFOUND) {
|
||||
@@ -1162,7 +1124,7 @@ plus_option(char *option) {
|
||||
if (state) {
|
||||
fprintf(stderr, "Invalid option: "
|
||||
"+dlv is obsolete\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
case 'n': /* dnssec */
|
||||
@@ -1173,26 +1135,9 @@ plus_option(char *option) {
|
||||
goto invalid_option;
|
||||
}
|
||||
break;
|
||||
case 'h':
|
||||
switch (cmd[1]) {
|
||||
case 'i': /* hint */
|
||||
if (state) {
|
||||
if (value == NULL) {
|
||||
fatal("+hint: must specify hint file");
|
||||
}
|
||||
hintfile = value;
|
||||
} else {
|
||||
hintfile = NULL;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
break;
|
||||
case 'm':
|
||||
switch (cmd[1]) {
|
||||
case 't': /* mtrace */
|
||||
FULLCHECK("mtrace");
|
||||
message_trace = state;
|
||||
if (state) {
|
||||
resolve_trace = state;
|
||||
@@ -1206,41 +1151,6 @@ plus_option(char *option) {
|
||||
goto invalid_option;
|
||||
}
|
||||
break;
|
||||
case 'n':
|
||||
switch (cmd[1]) {
|
||||
case 's': /* ns */
|
||||
FULLCHECK("ns");
|
||||
fulltrace = state;
|
||||
if (state) {
|
||||
message_trace = state;
|
||||
send_trace = state;
|
||||
resolve_trace = state;
|
||||
logfp = stdout;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
break;
|
||||
case 'q': /* qmin */
|
||||
FULLCHECK("qmin");
|
||||
if (state) {
|
||||
if (value == NULL || strcasecmp(value, "relaxed") == 0)
|
||||
{
|
||||
qmin = true;
|
||||
} else if (strcasecmp(value, "strict") == 0) {
|
||||
qmin = true;
|
||||
qmin_strict = true;
|
||||
} else {
|
||||
fatal("Invalid qmin option '%s': "
|
||||
"use 'relaxed' or 'strict'\n",
|
||||
value);
|
||||
}
|
||||
} else {
|
||||
qmin = false;
|
||||
qmin_strict = false;
|
||||
}
|
||||
break;
|
||||
case 'r':
|
||||
switch (cmd[1]) {
|
||||
case 'o': /* root */
|
||||
@@ -1310,13 +1220,6 @@ plus_option(char *option) {
|
||||
fatal("Couldn't parse split");
|
||||
}
|
||||
break;
|
||||
case 't': /* strace */
|
||||
FULLCHECK("strace");
|
||||
send_trace = state;
|
||||
if (state) {
|
||||
message_trace = state;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
@@ -1331,20 +1234,9 @@ plus_option(char *option) {
|
||||
FULLCHECK("tcp");
|
||||
use_tcp = state;
|
||||
break;
|
||||
case 'r':
|
||||
switch (cmd[2]) {
|
||||
case 'a': /* trace */
|
||||
FULLCHECK("trace");
|
||||
fatal("Invalid argument +trace. For "
|
||||
"delegation path tracing, use +ns.");
|
||||
break;
|
||||
case 'u': /* trust */
|
||||
FULLCHECK("trust");
|
||||
showtrust = state;
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
case 'r': /* trust */
|
||||
FULLCHECK("trust");
|
||||
showtrust = state;
|
||||
break;
|
||||
case 't': /* ttl */
|
||||
FULLCHECK("ttl");
|
||||
@@ -1429,7 +1321,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
|
||||
break;
|
||||
case 'h':
|
||||
usage();
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
case 'i':
|
||||
no_sigs = true;
|
||||
root_validation = false;
|
||||
@@ -1439,7 +1331,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
|
||||
break;
|
||||
case 'v':
|
||||
printf("delv %s\n", PACKAGE_VERSION);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
default:
|
||||
UNREACHABLE();
|
||||
}
|
||||
@@ -1528,10 +1420,6 @@ dash_option(char *option, char *next, bool *open_type_class) {
|
||||
return (value_from_next);
|
||||
case 'p':
|
||||
port = value;
|
||||
result = parse_uint(&destport, port, 0xffff, "port");
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("Couldn't parse port number");
|
||||
}
|
||||
return (value_from_next);
|
||||
case 'q':
|
||||
if (curqname != NULL) {
|
||||
@@ -1576,7 +1464,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
|
||||
typeset = true;
|
||||
} else {
|
||||
fprintf(stderr, "Invalid IP address %s\n", value);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
return (value_from_next);
|
||||
invalid_option:
|
||||
@@ -1725,11 +1613,6 @@ parse_args(int argc, char **argv) {
|
||||
}
|
||||
}
|
||||
|
||||
/* check consistency */
|
||||
if (qmin && !fulltrace) {
|
||||
fatal("'+qmin' cannot be used without '+ns'");
|
||||
}
|
||||
|
||||
/*
|
||||
* If no qname or qtype specified, search for root/NS
|
||||
* If no qtype specified, use A
|
||||
@@ -1852,7 +1735,10 @@ resolve_cb(dns_client_t *client, const dns_name_t *query_name,
|
||||
for (rdataset = ISC_LIST_HEAD(response_name->list);
|
||||
rdataset != NULL; rdataset = ISC_LIST_NEXT(rdataset, link))
|
||||
{
|
||||
printdata(rdataset, response_name);
|
||||
result = printdata(rdataset, response_name);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
delv_log(ISC_LOG_ERROR, "print data failed");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1865,14 +1751,12 @@ resolve_cb(dns_client_t *client, const dns_name_t *query_name,
|
||||
}
|
||||
|
||||
static void
|
||||
run_resolve(void *arg) {
|
||||
dns_client_t *client = NULL;
|
||||
dns_namelist_t *namelist = NULL;
|
||||
resolve(void *arg) {
|
||||
dns_client_t *client = arg;
|
||||
dns_namelist_t *namelist;
|
||||
unsigned int resopt;
|
||||
isc_result_t result;
|
||||
dns_name_t *query_name = NULL;
|
||||
|
||||
UNUSED(arg);
|
||||
dns_name_t *query_name;
|
||||
|
||||
namelist = isc_mem_get(mctx, sizeof(*namelist));
|
||||
ISC_LIST_INIT(*namelist);
|
||||
@@ -1895,22 +1779,14 @@ run_resolve(void *arg) {
|
||||
resopt |= DNS_CLIENTRESOPT_TCP;
|
||||
}
|
||||
|
||||
/* Create client */
|
||||
CHECK(dns_client_create(mctx, loopmgr, netmgr, 0, tlsctx_client_cache,
|
||||
&client, srcaddr4, srcaddr6));
|
||||
/* Perform resolution */
|
||||
result = dns_client_resolve(client, query_name, dns_rdataclass_in,
|
||||
qtype, resopt, namelist, resolve_cb);
|
||||
|
||||
/* Set the nameserver */
|
||||
if (server != NULL) {
|
||||
addserver(client);
|
||||
} else {
|
||||
findserver(client);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
CHECK(setup_dnsseckeys(client, NULL));
|
||||
|
||||
/* Perform resolution */
|
||||
CHECK(dns_client_resolve(client, query_name, dns_rdataclass_in, qtype,
|
||||
resopt, namelist, resolve_cb));
|
||||
return;
|
||||
cleanup:
|
||||
if (!yaml) {
|
||||
@@ -1924,294 +1800,18 @@ cleanup:
|
||||
dns_client_detach(&client);
|
||||
}
|
||||
|
||||
static void
|
||||
shutdown_server(void) {
|
||||
if (requestmgr != NULL) {
|
||||
dns_requestmgr_shutdown(requestmgr);
|
||||
dns_requestmgr_detach(&requestmgr);
|
||||
}
|
||||
if (interfacemgr != NULL) {
|
||||
ns_interfacemgr_shutdown(interfacemgr);
|
||||
ns_interfacemgr_detach(&interfacemgr);
|
||||
}
|
||||
if (dispatch != NULL) {
|
||||
dns_dispatch_detach(&dispatch);
|
||||
}
|
||||
if (dispatchmgr != NULL) {
|
||||
dns_dispatchmgr_detach(&dispatchmgr);
|
||||
}
|
||||
if (sctx != NULL) {
|
||||
ns_server_detach(&sctx);
|
||||
}
|
||||
|
||||
isc_loopmgr_shutdown(loopmgr);
|
||||
}
|
||||
|
||||
static void
|
||||
recvresponse(void *arg) {
|
||||
dns_request_t *request = (dns_request_t *)arg;
|
||||
dns_message_t *query = dns_request_getarg(request);
|
||||
isc_result_t result = dns_request_getresult(request);
|
||||
dns_message_t *response = NULL;
|
||||
dns_name_t *prev = NULL;
|
||||
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("request event result: %s", isc_result_totext(result));
|
||||
}
|
||||
|
||||
dns_message_create(mctx, NULL, NULL, DNS_MESSAGE_INTENTPARSE,
|
||||
&response);
|
||||
|
||||
result = dns_request_getresponse(request, response,
|
||||
DNS_MESSAGEPARSE_PRESERVEORDER);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("request response failed: %s", isc_result_totext(result));
|
||||
}
|
||||
if (response->rcode != dns_rcode_noerror) {
|
||||
result = dns_result_fromrcode(response->rcode);
|
||||
delv_log(ISC_LOG_INFO, "response code: %s",
|
||||
isc_result_totext(result));
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
for (result = dns_message_firstname(response, DNS_SECTION_ANSWER);
|
||||
result == ISC_R_SUCCESS;
|
||||
result = dns_message_nextname(response, DNS_SECTION_ANSWER))
|
||||
{
|
||||
dns_name_t *name = NULL;
|
||||
dns_rdataset_t *rdataset = NULL;
|
||||
dns_rdatatype_t prevtype = 0;
|
||||
|
||||
dns_message_currentname(response, DNS_SECTION_ANSWER, &name);
|
||||
|
||||
for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
|
||||
rdataset = ISC_LIST_NEXT(rdataset, link))
|
||||
{
|
||||
dns_rdataset_t rds, sigs;
|
||||
int options = 0;
|
||||
|
||||
/*
|
||||
* The response message contains the answer the
|
||||
* resolver found, but it doesn't contain the
|
||||
* trust status. if we're not displaying that,
|
||||
* fine, we can just print that version.
|
||||
*/
|
||||
if (!showtrust) {
|
||||
printdata(rdataset, name);
|
||||
continue;
|
||||
}
|
||||
|
||||
/*
|
||||
* ... but if we are printing the trust status
|
||||
* (which is the default behavior)), we'll need
|
||||
* to retrieve a copy of the rdataset from the cache.
|
||||
* if we do that for ever record, it will produce
|
||||
* duplicate output, so we check here whether we've
|
||||
* already printed this name and type.
|
||||
*/
|
||||
if (prev != NULL && dns_name_equal(prev, name)) {
|
||||
continue;
|
||||
}
|
||||
prev = name;
|
||||
|
||||
if (prevtype == rdataset->type) {
|
||||
continue;
|
||||
}
|
||||
prevtype = rdataset->type;
|
||||
|
||||
/* do the cache lookup */
|
||||
if (rdataset->type == dns_rdatatype_rrsig) {
|
||||
continue;
|
||||
}
|
||||
|
||||
dns_rdataset_init(&rds);
|
||||
dns_rdataset_init(&sigs);
|
||||
|
||||
if (cdflag) {
|
||||
options |= DNS_DBFIND_PENDINGOK;
|
||||
}
|
||||
result = dns_view_simplefind(view, name, rdataset->type,
|
||||
0, options, false, &rds,
|
||||
&sigs);
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
printdata(&rds, name);
|
||||
dns_rdataset_disassociate(&rds);
|
||||
if (dns_rdataset_isassociated(&sigs)) {
|
||||
printdata(&sigs, name);
|
||||
dns_rdataset_disassociate(&sigs);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
cleanup:
|
||||
dns_message_detach(&query);
|
||||
dns_message_detach(&response);
|
||||
dns_request_destroy(&request);
|
||||
|
||||
dns_view_detach(&view);
|
||||
shutdown_server();
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
accept_cb(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
|
||||
UNUSED(handle);
|
||||
UNUSED(arg);
|
||||
|
||||
return (result);
|
||||
}
|
||||
|
||||
static void
|
||||
sendquery(void *arg) {
|
||||
isc_nmsocket_t *sock = (isc_nmsocket_t *)arg;
|
||||
isc_sockaddr_t peer = isc_nmsocket_getaddr(sock);
|
||||
isc_result_t result;
|
||||
dns_message_t *message = NULL;
|
||||
dns_name_t *query_name = NULL, *mname = NULL;
|
||||
dns_rdataset_t *mrdataset = NULL;
|
||||
dns_rdataset_t *opt = NULL;
|
||||
dns_request_t *request = NULL;
|
||||
|
||||
/* Construct query message */
|
||||
CHECK(convert_name(&qfn, &query_name, qname));
|
||||
|
||||
dns_message_create(mctx, NULL, NULL, DNS_MESSAGE_INTENTRENDER,
|
||||
&message);
|
||||
message->opcode = dns_opcode_query;
|
||||
message->flags = DNS_MESSAGEFLAG_RD | DNS_MESSAGEFLAG_AD;
|
||||
if (cdflag) {
|
||||
message->flags |= DNS_MESSAGEFLAG_CD;
|
||||
}
|
||||
message->rdclass = dns_rdataclass_in;
|
||||
message->id = (dns_messageid_t)isc_random16();
|
||||
|
||||
dns_message_gettempname(message, &mname);
|
||||
dns_message_gettemprdataset(message, &mrdataset);
|
||||
dns_name_clone(query_name, mname);
|
||||
dns_rdataset_makequestion(mrdataset, dns_rdataclass_in, qtype);
|
||||
ISC_LIST_APPEND(mname->list, mrdataset, link);
|
||||
dns_message_addname(message, mname, DNS_SECTION_QUESTION);
|
||||
mrdataset = NULL;
|
||||
mname = NULL;
|
||||
|
||||
CHECK(dns_message_buildopt(message, &opt, 0, 0, DNS_MESSAGEEXTFLAG_DO,
|
||||
NULL, 0));
|
||||
CHECK(dns_message_setopt(message, opt));
|
||||
|
||||
CHECK(dns_requestmgr_create(mctx, loopmgr, dispatchmgr, NULL, NULL,
|
||||
&requestmgr));
|
||||
|
||||
dns_view_attach(view, &(dns_view_t *){ NULL });
|
||||
CHECK(dns_request_create(requestmgr, message, NULL, &peer, NULL, NULL,
|
||||
DNS_REQUESTOPT_TCP, NULL, 1, 0, 0, isc_loop(),
|
||||
recvresponse, message, &request));
|
||||
return;
|
||||
|
||||
cleanup:
|
||||
if (message != NULL) {
|
||||
dns_message_detach(&message);
|
||||
}
|
||||
|
||||
shutdown_server();
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
matchview(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
|
||||
dns_message_t *message, dns_aclenv_t *env, isc_result_t *sigresultp,
|
||||
dns_view_t **viewp) {
|
||||
UNUSED(srcaddr);
|
||||
UNUSED(destaddr);
|
||||
UNUSED(message);
|
||||
UNUSED(env);
|
||||
UNUSED(sigresultp);
|
||||
|
||||
*viewp = view;
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
static void
|
||||
run_server(void *arg) {
|
||||
isc_result_t result;
|
||||
dns_cache_t *cache = NULL;
|
||||
isc_sockaddr_t addr, any;
|
||||
struct in_addr in;
|
||||
|
||||
UNUSED(arg);
|
||||
|
||||
RUNTIME_CHECK(inet_pton(AF_INET, "127.0.0.1", &in));
|
||||
isc_sockaddr_fromin(&addr, &in, 0);
|
||||
|
||||
ns_server_create(mctx, matchview, &sctx);
|
||||
|
||||
CHECK(dns_dispatchmgr_create(mctx, loopmgr, netmgr, &dispatchmgr));
|
||||
isc_sockaddr_any(&any);
|
||||
CHECK(dns_dispatch_createudp(dispatchmgr, &any, &dispatch));
|
||||
CHECK(ns_interfacemgr_create(mctx, sctx, loopmgr, netmgr, dispatchmgr,
|
||||
NULL, false, &interfacemgr));
|
||||
|
||||
CHECK(dns_view_create(mctx, dispatchmgr, dns_rdataclass_in, "_default",
|
||||
&view));
|
||||
CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", &cache));
|
||||
dns_view_setcache(view, cache, false);
|
||||
dns_cache_detach(&cache);
|
||||
dns_view_setdstport(view, destport);
|
||||
|
||||
CHECK(dns_rootns_create(mctx, dns_rdataclass_in, hintfile, &roothints));
|
||||
dns_view_sethints(view, roothints);
|
||||
dns_db_detach(&roothints);
|
||||
|
||||
view->qminimization = qmin;
|
||||
view->qmin_strict = qmin_strict;
|
||||
|
||||
dns_view_initsecroots(view);
|
||||
CHECK(setup_dnsseckeys(NULL, view));
|
||||
|
||||
CHECK(dns_view_createresolver(view, netmgr, 0, tlsctx_client_cache,
|
||||
dispatch, NULL));
|
||||
|
||||
isc_stats_create(mctx, &resstats, dns_resstatscounter_max);
|
||||
dns_resolver_setstats(view->resolver, resstats);
|
||||
isc_stats_detach(&resstats);
|
||||
|
||||
dns_rdatatypestats_create(mctx, &resquerystats);
|
||||
dns_resolver_setquerystats(view->resolver, resquerystats);
|
||||
dns_stats_detach(&resquerystats);
|
||||
|
||||
dns_view_freeze(view);
|
||||
|
||||
ns_interface_create(interfacemgr, &addr, NULL, &ifp);
|
||||
|
||||
CHECK(isc_nm_listenstreamdns(netmgr, ISC_NM_LISTEN_ONE, &addr,
|
||||
ns_client_request, ifp, accept_cb, ifp, 10,
|
||||
NULL, NULL, ISC_NM_PROXY_NONE,
|
||||
&ifp->tcplistensocket));
|
||||
ifp->flags |= NS_INTERFACEFLAG_LISTENING;
|
||||
isc_async_current(sendquery, ifp->tcplistensocket);
|
||||
|
||||
return;
|
||||
|
||||
cleanup:
|
||||
if (view != NULL) {
|
||||
dns_view_detach(&view);
|
||||
}
|
||||
shutdown_server();
|
||||
}
|
||||
|
||||
int
|
||||
main(int argc, char *argv[]) {
|
||||
dns_client_t *client = NULL;
|
||||
isc_result_t result;
|
||||
isc_loop_t *loop = NULL;
|
||||
|
||||
progname = argv[0];
|
||||
logfp = stderr;
|
||||
|
||||
preparse_args(argc, argv);
|
||||
|
||||
argc--;
|
||||
argv++;
|
||||
|
||||
isc_managers_create(&mctx, 1, &loopmgr, &netmgr);
|
||||
loop = isc_loop_main(loopmgr);
|
||||
|
||||
result = dst_lib_init(mctx, NULL);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
@@ -2222,30 +1822,33 @@ main(int argc, char *argv[]) {
|
||||
|
||||
CHECK(setup_style());
|
||||
|
||||
setup_logging(logfp);
|
||||
|
||||
if (!fulltrace && hintfile != NULL) {
|
||||
delv_log(ISC_LOG_WARNING,
|
||||
"WARNING: not using internal name server mode, "
|
||||
"hint file will be ignored");
|
||||
}
|
||||
|
||||
if (fulltrace && server != NULL) {
|
||||
delv_log(ISC_LOG_WARNING,
|
||||
"WARNING: using internal name server mode: "
|
||||
"'@%s' will be ignored",
|
||||
server);
|
||||
}
|
||||
setup_logging(stderr);
|
||||
|
||||
/* Create client */
|
||||
isc_tlsctx_cache_create(mctx, &tlsctx_client_cache);
|
||||
result = dns_client_create(mctx, loopmgr, netmgr, 0,
|
||||
tlsctx_client_cache, &client, srcaddr4,
|
||||
srcaddr6);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
|
||||
isc_result_totext(result));
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
/* Set the nameserver */
|
||||
if (server != NULL) {
|
||||
addserver(client);
|
||||
} else {
|
||||
findserver(client);
|
||||
}
|
||||
|
||||
CHECK(setup_dnsseckeys(client));
|
||||
|
||||
isc_loop_setup(isc_loop_main(loopmgr), resolve, client);
|
||||
|
||||
isc_loop_setup(loop, fulltrace ? run_server : run_resolve, NULL);
|
||||
isc_loopmgr_run(loopmgr);
|
||||
|
||||
cleanup:
|
||||
if (tlsctx_client_cache != NULL) {
|
||||
isc_tlsctx_cache_detach(&tlsctx_client_cache);
|
||||
}
|
||||
if (trust_anchor != NULL) {
|
||||
isc_mem_free(mctx, trust_anchor);
|
||||
}
|
||||
@@ -2258,8 +1861,12 @@ cleanup:
|
||||
if (style != NULL) {
|
||||
dns_master_styledestroy(&style, mctx);
|
||||
}
|
||||
if (tlsctx_client_cache != NULL) {
|
||||
isc_tlsctx_cache_detach(&tlsctx_client_cache);
|
||||
}
|
||||
|
||||
isc_log_destroy(&lctx);
|
||||
|
||||
dst_lib_destroy();
|
||||
|
||||
isc_managers_destroy(&mctx, &loopmgr, &netmgr);
|
||||
|
||||
+8
-50
@@ -230,36 +230,6 @@ assign values to options like the timeout interval. They have the form
|
||||
This option controls whether to display the CLASS when printing a record. The
|
||||
default is to display the CLASS.
|
||||
|
||||
.. option:: +hint=FILE, +nohint
|
||||
|
||||
This option specifies a filename from which to load root hints;
|
||||
this will be used to find the root name servers when name server
|
||||
mode (``delv +ns``) is in use. If the option is not specified,
|
||||
built-in root hints will be used.
|
||||
|
||||
.. option:: +ns, +nons
|
||||
|
||||
This option toggles name server mode. When this option is in use,
|
||||
the ``delv`` process instantiates a full recursive resolver, and uses
|
||||
that to look up the requested query name and type. Turning on this
|
||||
option also activates ``+mtrace``, ``+strace`` and ``+rtrace``, so that
|
||||
every iterative query will be logged, including the full response messages
|
||||
from each authoritatve server. These logged messages will be written
|
||||
to ``stdout`` rather than ``stderr`` as usual, so that the full trace
|
||||
can be captured more easily.
|
||||
|
||||
This is intended to be similar to the behavior of ``dig +trace``, but
|
||||
because it uses the same code as ``named``, it much more accurately
|
||||
replicates the behavior of a recursive name server with a cold cache
|
||||
that is processing a recursive query.
|
||||
|
||||
.. option:: +qmin[=MODE], +noqmin
|
||||
|
||||
When used with ``+ns``, this option enables QNAME minimization mode.
|
||||
Valid options of MODE are ``relaxed`` and ``strict``. By default,
|
||||
QNAME minimization is disabled. If ``+qmin`` is specified but MODE
|
||||
is omitted, then ``relaxed`` mode will be used.
|
||||
|
||||
.. option:: +ttl, +nottl
|
||||
|
||||
This option controls whether to display the TTL when printing a record. The
|
||||
@@ -267,11 +237,11 @@ assign values to options like the timeout interval. They have the form
|
||||
|
||||
.. option:: +rtrace, +nortrace
|
||||
|
||||
This option toggles resolver fetch logging. This reports the name and
|
||||
type of each query sent by :program:`delv` in the process of carrying
|
||||
out the resolution and validation process, including the original query
|
||||
and all subsequent queries to follow CNAMEs and to establish a chain of
|
||||
trust for DNSSEC validation.
|
||||
This option toggles resolver fetch logging. This reports the name and type of each
|
||||
query sent by :program:`delv` in the process of carrying out the resolution
|
||||
and validation process, including the original query
|
||||
and all subsequent queries to follow CNAMEs and to establish a chain
|
||||
of trust for DNSSEC validation.
|
||||
|
||||
This is equivalent to setting the debug level to 1 in the "resolver"
|
||||
logging category. Setting the systemwide debug level to 1 using the
|
||||
@@ -280,27 +250,15 @@ assign values to options like the timeout interval. They have the form
|
||||
|
||||
.. option:: +mtrace, +nomtrace
|
||||
|
||||
This option toggles logging of messages received. This produces
|
||||
a detailed dump of the responses received by :program:`delv` in the
|
||||
process of carrying out the resolution and validation process.
|
||||
This option toggles message logging. This produces a detailed dump of the
|
||||
responses received by :program:`delv` in the process of carrying out the
|
||||
resolution and validation process.
|
||||
|
||||
This is equivalent to setting the debug level to 10 for the "packets"
|
||||
module of the "resolver" logging category. Setting the systemwide
|
||||
debug level to 10 using the :option:`-d` option produces the same
|
||||
output, but affects other logging categories as well.
|
||||
|
||||
.. option:: +strace, +nostrace
|
||||
|
||||
This option toggles logging of messages sent. This produces a detailed
|
||||
dump of the queries sent by :program:`delv` in the process of carrying
|
||||
out the resolution and validation process. Turning on this option
|
||||
also activates ``+mtrace``.
|
||||
|
||||
This is equivalent to setting the debug level to 11 for the "packets"
|
||||
module of the "resolver" logging category. Setting the systemwide
|
||||
debug level to 11 using the :option:`-d` option produces the same
|
||||
output, but affects other logging categories as well.
|
||||
|
||||
.. option:: +vtrace, +novtrace
|
||||
|
||||
This option toggles validation logging. This shows the internal process of the
|
||||
|
||||
+42
-406
@@ -119,7 +119,7 @@ usage(void) {
|
||||
print_usage(stderr);
|
||||
fprintf(stderr, "\nUse \"dig -h\" (or \"dig -h | more\") "
|
||||
"for complete list of options\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
#endif /* if TARGET_OS_IPHONE */
|
||||
|
||||
@@ -225,7 +225,7 @@ help(void) {
|
||||
" +[no]http-plain[=###] (DNS over plain HTTP "
|
||||
"mode) "
|
||||
"[/]\n"
|
||||
" +[no]http-plain-get (Use GET instead of "
|
||||
" +[no]https-plain-get (Use GET instead of "
|
||||
"default POST method while using plain HTTP)\n"
|
||||
" +[no]identify (ID responders in short "
|
||||
"answers)\n"
|
||||
@@ -252,14 +252,6 @@ help(void) {
|
||||
"request)\n"
|
||||
" +padding=### (Set padding block size "
|
||||
"[0])\n"
|
||||
" "
|
||||
"+[no]proxy[=src_addr[#src_port]-dst_addr[#dst_port]] "
|
||||
"(Add PROXYv2 headers to the queries. If addresses are omitted, "
|
||||
"LOCAL PROXYv2 headers are added)\n"
|
||||
" "
|
||||
"+[no]proxy-plain[=src_addr[#src_port]-dst_addr[#dst_port]] "
|
||||
"(The same as '+[no]proxy', but send PROXYv2 headers ahead of "
|
||||
"any encryption if an encrypted transport is used)\n"
|
||||
" +qid=### (Specify the query ID to "
|
||||
"use when sending queries)\n"
|
||||
" +[no]qr (Print question before "
|
||||
@@ -306,7 +298,8 @@ help(void) {
|
||||
" +[no]tls-keyfile=file (Load client TLS "
|
||||
"private key from file)\n"
|
||||
" +[no]trace (Trace delegation down "
|
||||
"from root [implies +dnssec])\n"
|
||||
"from root "
|
||||
"[+dnssec])\n"
|
||||
" +tries=### (Set number of UDP "
|
||||
"attempts) [3]\n"
|
||||
" +[no]ttlid (Control display of ttls "
|
||||
@@ -372,39 +365,6 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
|
||||
}
|
||||
printf(";; SERVER: %s(%s) (%s)\n", fromtext, query->userarg,
|
||||
proto);
|
||||
|
||||
if (query->lookup->proxy_mode) {
|
||||
printf(";; CLIENT PROXY HEADER");
|
||||
|
||||
if ((dig_lookup_is_tls(query->lookup) ||
|
||||
(query->lookup->https_mode &&
|
||||
!query->lookup->http_plain)) &&
|
||||
query->lookup->proxy_plain)
|
||||
{
|
||||
printf(" (plain)");
|
||||
}
|
||||
|
||||
printf(": ");
|
||||
|
||||
if (!query->lookup->proxy_local) {
|
||||
char src_buf[ISC_SOCKADDR_FORMATSIZE] = { 0 };
|
||||
char dst_buf[ISC_SOCKADDR_FORMATSIZE] = { 0 };
|
||||
|
||||
isc_sockaddr_format(
|
||||
&query->lookup->proxy_src_addr, src_buf,
|
||||
sizeof(src_buf));
|
||||
|
||||
isc_sockaddr_format(
|
||||
&query->lookup->proxy_dst_addr, dst_buf,
|
||||
sizeof(dst_buf));
|
||||
printf("source: %s, destination: %s", src_buf,
|
||||
dst_buf);
|
||||
} else {
|
||||
printf("LOCAL");
|
||||
}
|
||||
|
||||
printf("\n");
|
||||
}
|
||||
time(&tnow);
|
||||
(void)localtime_r(&tnow, &tmnow);
|
||||
|
||||
@@ -527,8 +487,7 @@ dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
|
||||
size_t i, count = 10;
|
||||
|
||||
name = dns_fixedname_initname(&fixed);
|
||||
result = dns_name_fromstring(name, "ipv4only.arpa", dns_rootname, 0,
|
||||
NULL);
|
||||
result = dns_name_fromstring(name, "ipv4only.arpa", 0, NULL);
|
||||
check_result(result, "dns_name_fromstring");
|
||||
|
||||
result = dns_message_findname(msg, DNS_SECTION_ANSWER, name,
|
||||
@@ -1092,323 +1051,6 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
|
||||
goto invalid_option; \
|
||||
} while (0)
|
||||
|
||||
/*
|
||||
* Parse source and destination addresses in the same format as used by "kdig":
|
||||
*
|
||||
* SRC_ADDR[#SRC_PORT]-DST_ADDR[#DST_PORT]
|
||||
*
|
||||
* This can be described (pretty closely for our purpose) using the
|
||||
* following EBNF grammar:
|
||||
*
|
||||
* S = proxy-addrs. (* start rule *)
|
||||
* proxy-addrs = addr "-" addr EOF.
|
||||
* addr = addr-char { addr-char } ["#" port ].
|
||||
* port = digit { digit }.
|
||||
* addr-char = <aby but "#", "-", EOF >.
|
||||
* EOF = '\0'.
|
||||
*/
|
||||
#define MATCH(ch) (st->str[0] == (ch))
|
||||
#define MATCH_DIGIT() isdigit((unsigned char)(st->str[0]))
|
||||
#define ADVANCE() st->str++
|
||||
#define GETP() (st->str)
|
||||
|
||||
typedef struct isc_proxy_addrs_parser_state {
|
||||
const char *str;
|
||||
|
||||
const char *last_addr_start;
|
||||
size_t last_addr_len;
|
||||
|
||||
const char *last_port_start;
|
||||
size_t last_port_len;
|
||||
|
||||
const char *src_addr_start;
|
||||
size_t src_addr_len;
|
||||
|
||||
const char *src_port_start;
|
||||
size_t src_port_len;
|
||||
|
||||
const char *dst_addr_start;
|
||||
size_t dst_addr_len;
|
||||
|
||||
const char *dst_port_start;
|
||||
size_t dst_port_len;
|
||||
} isc_proxy_addrs_parser_state_t;
|
||||
|
||||
static bool
|
||||
rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st);
|
||||
|
||||
static bool
|
||||
rule_addr(isc_proxy_addrs_parser_state_t *st);
|
||||
|
||||
static bool
|
||||
rule_port(isc_proxy_addrs_parser_state_t *st);
|
||||
|
||||
static bool
|
||||
rule_addr_char(isc_proxy_addrs_parser_state_t *st);
|
||||
|
||||
static void
|
||||
proxy_handle_port_string(const char *port_start, const size_t port_len,
|
||||
in_port_t *pport) {
|
||||
char buf[512] = { 0 }; /* max */
|
||||
size_t string_size = 0, max_string_bytes = 0;
|
||||
unsigned int tmp;
|
||||
isc_result_t result;
|
||||
|
||||
string_size = port_len + 1;
|
||||
max_string_bytes = string_size > sizeof(buf) ? sizeof(buf)
|
||||
: string_size;
|
||||
|
||||
(void)strlcpy(buf, port_start, max_string_bytes);
|
||||
result = parse_uint(&tmp, buf, MAXPORT, "port number");
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("Couldn't parse port number");
|
||||
}
|
||||
*pport = tmp;
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
proxy_handle_addr_string(const char *addr_start, const size_t addr_len,
|
||||
const in_port_t addr_port, isc_sockaddr_t *addr) {
|
||||
isc_result_t result = ISC_R_FAILURE;
|
||||
char buf[512] = { 0 }; /* max */
|
||||
size_t string_size = 0, max_string_bytes = 0;
|
||||
struct in_addr ipv4 = { 0 };
|
||||
struct in6_addr ipv6 = { 0 };
|
||||
int ret = 0;
|
||||
|
||||
string_size = addr_len + 1;
|
||||
max_string_bytes = string_size > sizeof(buf) ? sizeof(buf)
|
||||
: string_size;
|
||||
|
||||
(void)strlcpy(buf, addr_start, max_string_bytes);
|
||||
|
||||
ret = inet_pton(AF_INET, buf, &ipv4);
|
||||
if (ret == 1) {
|
||||
isc_sockaddr_fromin(addr, &ipv4, addr_port);
|
||||
result = ISC_R_SUCCESS;
|
||||
} else {
|
||||
ret = inet_pton(AF_INET6, buf, &ipv6);
|
||||
if (ret == 1) {
|
||||
isc_sockaddr_fromin6(addr, &ipv6, addr_port);
|
||||
result = ISC_R_SUCCESS;
|
||||
}
|
||||
}
|
||||
|
||||
return (result);
|
||||
}
|
||||
|
||||
static bool
|
||||
parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
|
||||
isc_sockaddr_t *pdst) {
|
||||
isc_result_t result = ISC_R_FAILURE;
|
||||
isc_sockaddr_t src = { 0 }, dst = { 0 };
|
||||
isc_proxy_addrs_parser_state_t st = { 0 };
|
||||
in_port_t src_port = 0, dst_port = 53; /* Follow kdig footsteps */
|
||||
|
||||
REQUIRE(addrs != NULL && *addrs != '\0');
|
||||
REQUIRE(psrc != NULL);
|
||||
REQUIRE(pdst != NULL);
|
||||
|
||||
st.str = addrs;
|
||||
|
||||
/* start syntax analysis and verification */
|
||||
if (!rule_proxy_addrs(&st)) {
|
||||
warn("PROXY source and destination addresses cannot be parsed");
|
||||
return (false);
|
||||
}
|
||||
|
||||
/* get port numeric values */
|
||||
if (st.src_port_len > 0) {
|
||||
INSIST(st.src_port_start != NULL);
|
||||
proxy_handle_port_string(st.src_port_start, st.src_port_len,
|
||||
&src_port);
|
||||
}
|
||||
|
||||
if (st.dst_port_len > 0) {
|
||||
INSIST(st.dst_port_start != NULL);
|
||||
proxy_handle_port_string(st.dst_port_start, st.dst_port_len,
|
||||
&dst_port);
|
||||
}
|
||||
|
||||
/* get addresses */
|
||||
INSIST(st.src_addr_len > 0);
|
||||
INSIST(st.src_addr_start != NULL);
|
||||
INSIST(st.dst_addr_len > 0);
|
||||
INSIST(st.dst_addr_start != NULL);
|
||||
|
||||
result = proxy_handle_addr_string(st.src_addr_start, st.src_addr_len,
|
||||
src_port, &src);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
warn("Cannot get PROXY source address: %s",
|
||||
isc_result_totext(result));
|
||||
return (false);
|
||||
}
|
||||
|
||||
result = proxy_handle_addr_string(st.dst_addr_start, st.dst_addr_len,
|
||||
dst_port, &dst);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
warn("Cannot get PROXY destination address: %s",
|
||||
isc_result_totext(result));
|
||||
return (false);
|
||||
}
|
||||
|
||||
/* addresses should be of the same type */
|
||||
if (isc_sockaddr_pf(&src) != isc_sockaddr_pf(&dst)) {
|
||||
warn("PROXY source and destination addresses must be of the "
|
||||
"same type");
|
||||
return (false);
|
||||
}
|
||||
|
||||
*psrc = src;
|
||||
*pdst = dst;
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
static bool
|
||||
rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
|
||||
if (!rule_addr(st)) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
st->src_addr_start = st->last_addr_start;
|
||||
st->src_addr_len = st->last_addr_len;
|
||||
st->src_port_start = st->last_port_start;
|
||||
st->src_port_len = st->last_port_len;
|
||||
|
||||
if (!MATCH('-')) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
ADVANCE();
|
||||
|
||||
if (!rule_addr(st)) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
st->dst_addr_start = st->last_addr_start;
|
||||
st->dst_addr_len = st->last_addr_len;
|
||||
st->dst_port_start = st->last_port_start;
|
||||
st->dst_port_len = st->last_port_len;
|
||||
|
||||
if (!MATCH('\0')) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
static bool
|
||||
rule_addr(isc_proxy_addrs_parser_state_t *st) {
|
||||
const char *start = GETP();
|
||||
if (!rule_addr_char(st)) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
while (rule_addr_char(st)) {
|
||||
/* skip */
|
||||
}
|
||||
|
||||
st->last_addr_start = start;
|
||||
st->last_addr_len = GETP() - start;
|
||||
|
||||
if (MATCH('#')) {
|
||||
ADVANCE();
|
||||
|
||||
if (!rule_port(st)) {
|
||||
return (false);
|
||||
}
|
||||
}
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
static bool
|
||||
rule_port(isc_proxy_addrs_parser_state_t *st) {
|
||||
const char *start = GETP();
|
||||
if (!MATCH_DIGIT()) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
ADVANCE();
|
||||
|
||||
while (MATCH_DIGIT()) {
|
||||
ADVANCE();
|
||||
}
|
||||
|
||||
st->last_port_start = start;
|
||||
st->last_port_len = GETP() - start;
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
static bool
|
||||
rule_addr_char(isc_proxy_addrs_parser_state_t *st) {
|
||||
if (MATCH('#') || MATCH('-') || MATCH('\0')) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
ADVANCE();
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
#undef GETP
|
||||
#undef ADVANCE
|
||||
#undef MATCH_DIGIT
|
||||
#undef MATCH
|
||||
|
||||
static bool
|
||||
plus_proxy_handle_addresses(const char *value, const bool state,
|
||||
dig_lookup_t *lookup) {
|
||||
lookup->proxy_mode = state;
|
||||
if (!state) {
|
||||
/*
|
||||
* We are not interested in the option value in that
|
||||
* case
|
||||
*/
|
||||
return (true);
|
||||
}
|
||||
|
||||
if (value == NULL || *value == '\0') {
|
||||
lookup->proxy_local = true;
|
||||
return (true);
|
||||
}
|
||||
|
||||
if (!parse_proxy_addresses(value, &lookup->proxy_src_addr,
|
||||
&lookup->proxy_dst_addr))
|
||||
{
|
||||
return (false);
|
||||
}
|
||||
return (true);
|
||||
}
|
||||
|
||||
static bool
|
||||
plus_proxy_options(const char *cmd, const char *value, const bool state,
|
||||
dig_lookup_t *lookup) {
|
||||
switch (cmd[5]) {
|
||||
case '-':
|
||||
FULLCHECK("proxy-plain");
|
||||
lookup->proxy_plain = state;
|
||||
if (!plus_proxy_handle_addresses(value, state, lookup)) {
|
||||
goto invalid_option;
|
||||
}
|
||||
break;
|
||||
case '\0':
|
||||
FULLCHECK("proxy");
|
||||
if (!plus_proxy_handle_addresses(value, state, lookup)) {
|
||||
goto invalid_option;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
return (true);
|
||||
|
||||
invalid_option:
|
||||
return (false);
|
||||
}
|
||||
|
||||
static bool
|
||||
plus_tls_options(const char *cmd, const char *value, const bool state,
|
||||
dig_lookup_t *lookup) {
|
||||
@@ -1675,8 +1317,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
switch (cmd[1]) {
|
||||
case 'e': /* defname */
|
||||
FULLCHECK("defname");
|
||||
fprintf(stderr, ";; +[no]defname option is "
|
||||
"deprecated; use +[no]search\n");
|
||||
if (!lookup->trace) {
|
||||
usesearch = state;
|
||||
}
|
||||
@@ -1797,10 +1437,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
"ednsflags");
|
||||
goto exit_or_usage;
|
||||
}
|
||||
if (lookup->edns == -1) {
|
||||
lookup->edns =
|
||||
DEFAULT_EDNS_VERSION;
|
||||
}
|
||||
lookup->ednsflags = num;
|
||||
break;
|
||||
case 'n':
|
||||
@@ -2055,11 +1691,12 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
goto invalid_option;
|
||||
}
|
||||
break;
|
||||
case 'm':
|
||||
case 'm': /* multiline */
|
||||
switch (cmd[1]) {
|
||||
case 'a':
|
||||
FULLCHECK("mapped");
|
||||
fatal("+mapped option no longer supported");
|
||||
fprintf(stderr, ";; +mapped option is deprecated");
|
||||
break;
|
||||
case 'u':
|
||||
FULLCHECK("multiline");
|
||||
lookup->multiline = state;
|
||||
@@ -2159,30 +1796,19 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
}
|
||||
break;
|
||||
case 'p':
|
||||
switch (cmd[1]) {
|
||||
case 'a':
|
||||
FULLCHECK("padding");
|
||||
if (state && lookup->edns == -1) {
|
||||
lookup->edns = DEFAULT_EDNS_VERSION;
|
||||
}
|
||||
if (value == NULL) {
|
||||
goto need_value;
|
||||
}
|
||||
result = parse_uint(&num, value, 512, "padding");
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
warn("Couldn't parse padding");
|
||||
goto exit_or_usage;
|
||||
}
|
||||
lookup->padding = (uint16_t)num;
|
||||
break;
|
||||
case 'r':
|
||||
if (!plus_proxy_options(cmd, value, state, lookup)) {
|
||||
goto invalid_option;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
FULLCHECK("padding");
|
||||
if (state && lookup->edns == -1) {
|
||||
lookup->edns = DEFAULT_EDNS_VERSION;
|
||||
}
|
||||
if (value == NULL) {
|
||||
goto need_value;
|
||||
}
|
||||
result = parse_uint(&num, value, 512, "padding");
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
warn("Couldn't parse padding");
|
||||
goto exit_or_usage;
|
||||
}
|
||||
lookup->padding = (uint16_t)num;
|
||||
break;
|
||||
case 'q':
|
||||
switch (cmd[1]) {
|
||||
@@ -2313,7 +1939,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
break;
|
||||
case 'i': /* sigchase */
|
||||
FULLCHECK("sigchase");
|
||||
fatal("+sigchase option no longer supported");
|
||||
fprintf(stderr, ";; +sigchase option is deprecated");
|
||||
break;
|
||||
case 'p': /* split */
|
||||
FULLCHECK("split");
|
||||
if (value != NULL && !state) {
|
||||
@@ -2437,7 +2064,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
break;
|
||||
case 'o':
|
||||
FULLCHECK("topdown");
|
||||
fatal("+topdown option no longer supported");
|
||||
fprintf(stderr, ";; +topdown option is deprecated");
|
||||
break;
|
||||
case 'r':
|
||||
switch (cmd[2]) {
|
||||
case 'a': /* trace */
|
||||
@@ -2478,8 +2106,9 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
break;
|
||||
case 'u': /* trusted-key */
|
||||
FULLCHECK("trusted-key");
|
||||
fatal("+trusted-key option "
|
||||
"no longer supported");
|
||||
fprintf(stderr, ";; +trusted-key option is "
|
||||
"deprecated");
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
@@ -2516,8 +2145,9 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
switch (cmd[2]) {
|
||||
case 'e':
|
||||
FULLCHECK("unexpected");
|
||||
fatal("+unexpected option "
|
||||
"no longer supported");
|
||||
fprintf(stderr, ";; +unexpected option "
|
||||
"is deprecated");
|
||||
break;
|
||||
case 'k':
|
||||
FULLCHECK("unknownformat");
|
||||
lookup->print_unknown_format = state;
|
||||
@@ -2525,7 +2155,11 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
|
||||
break;
|
||||
case 'v':
|
||||
FULLCHECK("vc");
|
||||
@@ -2628,15 +2262,17 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
|
||||
break;
|
||||
case 'h':
|
||||
help();
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
break;
|
||||
case 'i':
|
||||
fatal("-%c removed", option[0]);
|
||||
/* deprecated */
|
||||
break;
|
||||
case 'm': /* memdebug */
|
||||
/* memdebug is handled in preparse_args() */
|
||||
break;
|
||||
case 'n':
|
||||
fatal("-%c removed", option[0]);
|
||||
/* deprecated */
|
||||
break;
|
||||
case 'r':
|
||||
debug("digrc (late)");
|
||||
digrc = false;
|
||||
@@ -2646,7 +2282,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
|
||||
break;
|
||||
case 'v':
|
||||
printf("DiG %s\n", PACKAGE_VERSION);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
break;
|
||||
}
|
||||
if (strlen(option) > 1U) {
|
||||
@@ -2821,7 +2457,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
|
||||
ptr = ptr2;
|
||||
ptr2 = ptr3;
|
||||
} else {
|
||||
hmac_alg = DST_ALG_HMACMD5;
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
digestbits = 0;
|
||||
}
|
||||
/* XXXONDREJ: FIXME */
|
||||
@@ -2855,7 +2491,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
|
||||
ISC_LIST_APPEND(lookup_list, *lookup, link);
|
||||
} else {
|
||||
fprintf(stderr, "Invalid IP address %s\n", value);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
return (value_from_next);
|
||||
invalid_option:
|
||||
|
||||
+23
-49
@@ -507,44 +507,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
|
||||
mandatory. Responses to padded queries may also be padded, but only
|
||||
if the query uses TCP or DNS COOKIE.
|
||||
|
||||
.. option:: +proxy[=src_addr[#src_port]-dst_addr[#dst_port]], +noproxy
|
||||
|
||||
When this option is set, :program:`dig` adds PROXYv2 headers to the
|
||||
queries. When source and destination addresses are specified, the
|
||||
headers contain them and use the ``PROXY`` command. It means for
|
||||
the remote peer that the queries were sent on behalf of another
|
||||
node and that the PROXYv2 header reflects the original connection
|
||||
endpoints. The default source port is ``0`` and destination port is
|
||||
`53`.
|
||||
|
||||
For encrypted DNS transports, to prevent accidental information
|
||||
leakage, encryption is applied to the PROXYv2 headers: the headers
|
||||
are sent right after the handshake process has been completed.
|
||||
|
||||
For plain DNS transports, no encryption is applied to the PROXYv2
|
||||
headers.
|
||||
|
||||
If the addressees are omitted, PROXYv2 headers, that use the
|
||||
``LOCAL`` command set, are added instead. For the remote peer, that
|
||||
means that the queries were sent on purpose without being relayed,
|
||||
so the real connection endpoint addresses must be used.
|
||||
|
||||
.. option:: +proxy-plain[=src_addr[#src_port]-dst_addr[#dst_port], +noproxy-plain
|
||||
|
||||
The same as ``+[no]proxy``, but instructs ``dig`` to send PROXYv2
|
||||
headers ahead of any encryption, before any handshake messages are
|
||||
sent. That makes :program:`dig` behave exactly how it is described
|
||||
in the PROXY protocol specification, but not all software expects
|
||||
such behaviour.
|
||||
|
||||
Please consult the software documentation to find out if you need
|
||||
this option. (for example, ``dnsdist`` expects encrypted PROXYv2
|
||||
headers sent over TLS when encryption is used, while ``HAProxy``
|
||||
and many other software packages expect plain ones).
|
||||
|
||||
For plain DNS transports the option is effectively an alias for the
|
||||
``+[no]proxy`` described above.
|
||||
|
||||
.. option:: +qid=value
|
||||
|
||||
This option specifies the query ID to use when sending queries.
|
||||
@@ -614,6 +576,11 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
|
||||
|
||||
This option performs [or does not perform] a search showing intermediate results.
|
||||
|
||||
.. option:: +sigchase, +nosigchase
|
||||
|
||||
This feature is now obsolete and has been removed; use :iscman:`delv`
|
||||
instead.
|
||||
|
||||
.. option:: +split=W
|
||||
|
||||
This option splits long hex- or base64-formatted fields in resource records into
|
||||
@@ -683,23 +650,25 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
|
||||
server TLS certificate verification. Otherwise, the DNS server name
|
||||
is used. This option has no effect if :option:`+tls-ca` is not specified.
|
||||
|
||||
.. option:: +topdown, +notopdown
|
||||
|
||||
This feature is related to :option:`dig +sigchase`, which is obsolete and
|
||||
has been removed. Use :iscman:`delv` instead.
|
||||
|
||||
.. option:: +trace, +notrace
|
||||
|
||||
This option toggles tracing of the delegation path from the root name
|
||||
servers for the name being looked up. Tracing is disabled by default.
|
||||
When tracing is enabled, :program:`dig` makes iterative queries to
|
||||
resolve the name being looked up. It follows referrals from the root
|
||||
servers, showing the answer from each server that was used to resolve
|
||||
the lookup.
|
||||
This option toggles tracing of the delegation path from the root name servers for
|
||||
the name being looked up. Tracing is disabled by default. When
|
||||
tracing is enabled, :program:`dig` makes iterative queries to resolve the
|
||||
name being looked up. It follows referrals from the root servers,
|
||||
showing the answer from each server that was used to resolve the
|
||||
lookup.
|
||||
|
||||
If ``@server`` is also specified, it affects only the initial query for
|
||||
the root zone name servers.
|
||||
|
||||
:option:`+dnssec` is set when :option:`+trace` is set, to better
|
||||
emulate the default queries from a name server.
|
||||
|
||||
Note that the ``delv +ns`` option can also be used for tracing the
|
||||
resolution of a name from the root (see :iscman:`delv`).
|
||||
:option:`+dnssec` is also set when :option:`+trace` is set, to better emulate the
|
||||
default queries from a name server.
|
||||
|
||||
.. option:: +tries=T
|
||||
|
||||
@@ -707,6 +676,11 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
|
||||
instead of the default, 3. If ``T`` is less than or equal to zero,
|
||||
the number of tries is silently rounded up to 1.
|
||||
|
||||
.. option:: +trusted-key=####
|
||||
|
||||
This option formerly specified trusted keys for use with :option:`dig +sigchase`. This
|
||||
feature is now obsolete and has been removed; use :iscman:`delv` instead.
|
||||
|
||||
.. option:: +ttlid, +nottlid
|
||||
|
||||
This option displays [or does not display] the TTL when printing the record.
|
||||
|
||||
+77
-123
@@ -138,7 +138,7 @@ char keyfile[MXNAME] = "";
|
||||
char keysecret[MXNAME] = "";
|
||||
unsigned char cookie_secret[33];
|
||||
unsigned char cookie[8];
|
||||
dst_algorithm_t hmac_alg = DST_ALG_UNKNOWN;
|
||||
const dns_name_t *hmacname = NULL;
|
||||
unsigned int digestbits = 0;
|
||||
isc_buffer_t *namebuf = NULL;
|
||||
dns_tsigkey_t *tsigkey = NULL;
|
||||
@@ -359,6 +359,8 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
|
||||
}
|
||||
}
|
||||
|
||||
void (*dighost_pre_exit_hook)(void) = NULL;
|
||||
|
||||
#if TARGET_OS_IPHONE
|
||||
void
|
||||
warn(const char *format, ...) {
|
||||
@@ -391,7 +393,10 @@ digexit(void) {
|
||||
exitcode = 10;
|
||||
}
|
||||
if (fatalexit != 0) {
|
||||
_exit(fatalexit);
|
||||
exitcode = fatalexit;
|
||||
}
|
||||
if (dighost_pre_exit_hook != NULL) {
|
||||
dighost_pre_exit_hook();
|
||||
}
|
||||
exit(exitcode);
|
||||
}
|
||||
@@ -406,11 +411,6 @@ fatal(const char *format, ...) {
|
||||
vfprintf(stderr, format, args);
|
||||
va_end(args);
|
||||
fprintf(stderr, "\n");
|
||||
if (fatalexit == 0 && exitcode != 0) {
|
||||
fatalexit = exitcode;
|
||||
} else if (fatalexit == 0) {
|
||||
fatalexit = EXIT_FAILURE;
|
||||
}
|
||||
digexit();
|
||||
}
|
||||
|
||||
@@ -422,7 +422,7 @@ debug(const char *format, ...) {
|
||||
if (debugging) {
|
||||
fflush(stdout);
|
||||
if (debugtiming) {
|
||||
t = isc_time_now();
|
||||
TIME_NOW(&t);
|
||||
fprintf(stderr, "%u.%06u: ", isc_time_seconds(&t),
|
||||
isc_time_nanoseconds(&t) / 1000);
|
||||
}
|
||||
@@ -793,11 +793,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
|
||||
looknew->rrcomments = lookold->rrcomments;
|
||||
looknew->fuzzing = lookold->fuzzing;
|
||||
looknew->fuzztime = lookold->fuzztime;
|
||||
looknew->proxy_mode = lookold->proxy_mode;
|
||||
looknew->proxy_plain = lookold->proxy_plain;
|
||||
looknew->proxy_local = lookold->proxy_local;
|
||||
looknew->proxy_src_addr = lookold->proxy_src_addr;
|
||||
looknew->proxy_dst_addr = lookold->proxy_dst_addr;
|
||||
|
||||
if (lookold->ecs_addr != NULL) {
|
||||
looknew->ecs_addr = isc_mem_get(mctx,
|
||||
@@ -878,7 +873,7 @@ setup_text_key(void) {
|
||||
|
||||
secretsize = isc_buffer_usedlength(&secretbuf);
|
||||
|
||||
if (hmac_alg == DST_ALG_UNKNOWN) {
|
||||
if (hmacname == NULL) {
|
||||
result = DST_R_UNSUPPORTEDALG;
|
||||
goto failure;
|
||||
}
|
||||
@@ -888,8 +883,9 @@ setup_text_key(void) {
|
||||
goto failure;
|
||||
}
|
||||
|
||||
result = dns_tsigkey_create(&keyname, hmac_alg, secretstore,
|
||||
(int)secretsize, mctx, &tsigkey);
|
||||
result = dns_tsigkey_create(&keyname, hmacname, secretstore,
|
||||
(int)secretsize, false, NULL, 0, 0, mctx,
|
||||
NULL, &tsigkey);
|
||||
failure:
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
printf(";; Couldn't create key %s: %s\n", keynametext,
|
||||
@@ -1025,50 +1021,50 @@ done:
|
||||
* Parse HMAC algorithm specification
|
||||
*/
|
||||
void
|
||||
parse_hmac(const char *algname) {
|
||||
parse_hmac(const char *hmac) {
|
||||
char buf[20];
|
||||
size_t len;
|
||||
|
||||
REQUIRE(algname != NULL);
|
||||
REQUIRE(hmac != NULL);
|
||||
|
||||
len = strlen(algname);
|
||||
len = strlen(hmac);
|
||||
if (len >= sizeof(buf)) {
|
||||
fatal("unknown key type '%.*s'", (int)len, algname);
|
||||
fatal("unknown key type '%.*s'", (int)len, hmac);
|
||||
}
|
||||
strlcpy(buf, algname, sizeof(buf));
|
||||
strlcpy(buf, hmac, sizeof(buf));
|
||||
|
||||
digestbits = 0;
|
||||
|
||||
if (strcasecmp(buf, "hmac-md5") == 0) {
|
||||
hmac_alg = DST_ALG_HMACMD5;
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
|
||||
hmac_alg = DST_ALG_HMACMD5;
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
digestbits = parse_bits(&buf[9], "digest-bits [0..128]", 128);
|
||||
} else if (strcasecmp(buf, "hmac-sha1") == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA1;
|
||||
hmacname = DNS_TSIG_HMACSHA1_NAME;
|
||||
digestbits = 0;
|
||||
} else if (strncasecmp(buf, "hmac-sha1-", 10) == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA1;
|
||||
hmacname = DNS_TSIG_HMACSHA1_NAME;
|
||||
digestbits = parse_bits(&buf[10], "digest-bits [0..160]", 160);
|
||||
} else if (strcasecmp(buf, "hmac-sha224") == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA224;
|
||||
hmacname = DNS_TSIG_HMACSHA224_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha224-", 12) == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA224;
|
||||
hmacname = DNS_TSIG_HMACSHA224_NAME;
|
||||
digestbits = parse_bits(&buf[12], "digest-bits [0..224]", 224);
|
||||
} else if (strcasecmp(buf, "hmac-sha256") == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA256;
|
||||
hmacname = DNS_TSIG_HMACSHA256_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha256-", 12) == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA256;
|
||||
hmacname = DNS_TSIG_HMACSHA256_NAME;
|
||||
digestbits = parse_bits(&buf[12], "digest-bits [0..256]", 256);
|
||||
} else if (strcasecmp(buf, "hmac-sha384") == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA384;
|
||||
hmacname = DNS_TSIG_HMACSHA384_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha384-", 12) == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA384;
|
||||
hmacname = DNS_TSIG_HMACSHA384_NAME;
|
||||
digestbits = parse_bits(&buf[12], "digest-bits [0..384]", 384);
|
||||
} else if (strcasecmp(buf, "hmac-sha512") == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA512;
|
||||
hmacname = DNS_TSIG_HMACSHA512_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha512-", 12) == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA512;
|
||||
hmacname = DNS_TSIG_HMACSHA512_NAME;
|
||||
digestbits = parse_bits(&buf[12], "digest-bits [0..512]", 512);
|
||||
} else {
|
||||
fprintf(stderr,
|
||||
@@ -1169,29 +1165,38 @@ setup_file_key(void) {
|
||||
|
||||
switch (dst_key_alg(dstkey)) {
|
||||
case DST_ALG_HMACMD5:
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA1:
|
||||
hmacname = DNS_TSIG_HMACSHA1_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA224:
|
||||
hmacname = DNS_TSIG_HMACSHA224_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA256:
|
||||
hmacname = DNS_TSIG_HMACSHA256_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA384:
|
||||
hmacname = DNS_TSIG_HMACSHA384_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA512:
|
||||
hmac_alg = dst_key_alg(dstkey);
|
||||
hmacname = DNS_TSIG_HMACSHA512_NAME;
|
||||
break;
|
||||
default:
|
||||
dst_key_attach(dstkey, &sig0key);
|
||||
dst_key_free(&dstkey);
|
||||
return;
|
||||
}
|
||||
|
||||
if (dstkey != NULL) {
|
||||
if (hmacname != NULL) {
|
||||
result = dns_tsigkey_createfromkey(
|
||||
dst_key_name(dstkey), hmac_alg, dstkey, false, false,
|
||||
NULL, 0, 0, mctx, &tsigkey);
|
||||
dst_key_name(dstkey), hmacname, dstkey, false, NULL, 0,
|
||||
0, mctx, NULL, &tsigkey);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
printf(";; Couldn't create key %s: %s\n", keynametext,
|
||||
isc_result_totext(result));
|
||||
goto failure;
|
||||
}
|
||||
} else {
|
||||
dst_key_attach(dstkey, &sig0key);
|
||||
dst_key_free(&dstkey);
|
||||
}
|
||||
|
||||
failure:
|
||||
if (dstkey != NULL) {
|
||||
dst_key_free(&dstkey);
|
||||
@@ -1387,7 +1392,6 @@ typedef struct dig_ednsoptname {
|
||||
|
||||
dig_ednsoptname_t optnames[] = {
|
||||
{ 1, "LLQ" }, /* draft-sekar-dns-llq */
|
||||
{ 2, "UL" }, /* draft-ietf-dnssd-update-lease */
|
||||
{ 3, "NSID" }, /* RFC 5001 */
|
||||
{ 5, "DAU" }, /* RFC 6975 */
|
||||
{ 6, "DHU" }, /* RFC 6975 */
|
||||
@@ -2034,7 +2038,7 @@ next_origin(dig_lookup_t *oldlookup) {
|
||||
* Check for a absolute name or ndots being met.
|
||||
*/
|
||||
name = dns_fixedname_initname(&fixed);
|
||||
result = dns_name_fromstring(name, oldlookup->textname, NULL, 0, NULL);
|
||||
result = dns_name_fromstring2(name, oldlookup->textname, NULL, 0, NULL);
|
||||
if (result == ISC_R_SUCCESS &&
|
||||
(dns_name_isabsolute(name) ||
|
||||
(int)dns_name_countlabels(name) > ndots))
|
||||
@@ -2197,8 +2201,7 @@ setup_lookup(dig_lookup_t *lookup) {
|
||||
|
||||
debug("setup_lookup(%p)", lookup);
|
||||
|
||||
dns_message_create(mctx, NULL, NULL, DNS_MESSAGE_INTENTRENDER,
|
||||
&lookup->sendmsg);
|
||||
dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &lookup->sendmsg);
|
||||
|
||||
if (lookup->new_search) {
|
||||
debug("resetting lookup counter.");
|
||||
@@ -2926,9 +2929,6 @@ start_tcp(dig_query_t *query) {
|
||||
bool tls_mode = false;
|
||||
isc_tlsctx_client_session_cache_t *sess_cache = NULL;
|
||||
int local_timeout;
|
||||
isc_nm_proxy_type_t proxy_type = ISC_NM_PROXY_NONE;
|
||||
isc_nm_proxyheader_info_t proxy_info = { 0 };
|
||||
isc_nm_proxyheader_info_t *ppi = NULL;
|
||||
|
||||
REQUIRE(DIG_VALID_QUERY(query));
|
||||
|
||||
@@ -3020,22 +3020,6 @@ start_tcp(dig_query_t *query) {
|
||||
}
|
||||
}
|
||||
|
||||
if (query->lookup->proxy_mode) {
|
||||
proxy_type = ISC_NM_PROXY_PLAIN;
|
||||
if ((tls_mode || (query->lookup->https_mode &&
|
||||
!query->lookup->http_plain)) &&
|
||||
!query->lookup->proxy_plain)
|
||||
{
|
||||
proxy_type = ISC_NM_PROXY_ENCRYPTED;
|
||||
}
|
||||
if (!query->lookup->proxy_local) {
|
||||
isc_nm_proxyheader_info_init(
|
||||
&proxy_info, &query->lookup->proxy_src_addr,
|
||||
&query->lookup->proxy_dst_addr, NULL);
|
||||
ppi = &proxy_info;
|
||||
}
|
||||
}
|
||||
|
||||
REQUIRE(query != NULL);
|
||||
|
||||
query_attach(query, &connectquery);
|
||||
@@ -3048,8 +3032,7 @@ start_tcp(dig_query_t *query) {
|
||||
}
|
||||
isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
|
||||
tcp_connected, connectquery,
|
||||
local_timeout, tlsctx, sess_cache,
|
||||
proxy_type, ppi);
|
||||
local_timeout, tlsctx, sess_cache);
|
||||
#if HAVE_LIBNGHTTP2
|
||||
} else if (query->lookup->https_mode) {
|
||||
char uri[4096] = { 0 };
|
||||
@@ -3069,13 +3052,12 @@ start_tcp(dig_query_t *query) {
|
||||
isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr, uri,
|
||||
!query->lookup->https_get, tcp_connected,
|
||||
connectquery, tlsctx, sess_cache,
|
||||
local_timeout, proxy_type, ppi);
|
||||
local_timeout);
|
||||
#endif
|
||||
} else {
|
||||
isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
|
||||
tcp_connected, connectquery,
|
||||
local_timeout, NULL, NULL, proxy_type,
|
||||
ppi);
|
||||
local_timeout, NULL, NULL);
|
||||
}
|
||||
|
||||
return;
|
||||
@@ -3122,9 +3104,9 @@ send_udp(dig_query_t *query) {
|
||||
isc_buffer_usedregion(&query->sendbuf, &r);
|
||||
debug("sending a request");
|
||||
if (query->lookup->use_usec) {
|
||||
query->time_sent = isc_time_now_hires();
|
||||
TIME_NOW_HIRES(&query->time_sent);
|
||||
} else {
|
||||
query->time_sent = isc_time_now();
|
||||
TIME_NOW(&query->time_sent);
|
||||
}
|
||||
|
||||
isc_nmhandle_attach(query->handle, &query->sendhandle);
|
||||
@@ -3229,12 +3211,11 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
|
||||
|
||||
if (next != NULL) {
|
||||
start_udp(next);
|
||||
check_if_done();
|
||||
} else {
|
||||
dighost_error("no servers could be reached\n");
|
||||
clear_current_lookup();
|
||||
}
|
||||
|
||||
check_if_done();
|
||||
return;
|
||||
}
|
||||
|
||||
@@ -3325,24 +3306,9 @@ start_udp(dig_query_t *query) {
|
||||
}
|
||||
|
||||
query_attach(query, &connectquery);
|
||||
if (query->lookup->proxy_mode) {
|
||||
isc_nm_proxyheader_info_t proxy_info = { 0 };
|
||||
isc_nm_proxyheader_info_t *ppi = NULL;
|
||||
if (!query->lookup->proxy_local) {
|
||||
isc_nm_proxyheader_info_init(
|
||||
&proxy_info, &query->lookup->proxy_src_addr,
|
||||
&query->lookup->proxy_dst_addr, NULL);
|
||||
ppi = &proxy_info;
|
||||
}
|
||||
isc_nm_proxyudpconnect(netmgr, &localaddr, &query->sockaddr,
|
||||
udp_ready, connectquery,
|
||||
(timeout ? timeout : UDP_TIMEOUT) * 1000,
|
||||
ppi);
|
||||
} else {
|
||||
isc_nm_udpconnect(netmgr, &localaddr, &query->sockaddr,
|
||||
udp_ready, connectquery,
|
||||
(timeout ? timeout : UDP_TIMEOUT) * 1000);
|
||||
}
|
||||
isc_nm_udpconnect(netmgr, &localaddr, &query->sockaddr, udp_ready,
|
||||
connectquery,
|
||||
(timeout ? timeout : UDP_TIMEOUT) * 1000);
|
||||
}
|
||||
|
||||
/*%
|
||||
@@ -3505,9 +3471,9 @@ launch_next_query(dig_query_t *query) {
|
||||
dig_query_t *sendquery = NULL;
|
||||
debug("sending a request in launch_next_query");
|
||||
if (query->lookup->use_usec) {
|
||||
query->time_sent = isc_time_now_hires();
|
||||
TIME_NOW_HIRES(&query->time_sent);
|
||||
} else {
|
||||
query->time_sent = isc_time_now();
|
||||
TIME_NOW(&query->time_sent);
|
||||
}
|
||||
|
||||
query_attach(query, &sendquery);
|
||||
@@ -3566,12 +3532,6 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
|
||||
debug("tcp_connected(%p, %s, %p)", handle, isc_result_totext(eresult),
|
||||
query);
|
||||
|
||||
if (eresult == ISC_R_SHUTTINGDOWN) {
|
||||
query_detach(&query);
|
||||
cancel_all();
|
||||
return;
|
||||
}
|
||||
|
||||
lookup_attach(query->lookup, &l);
|
||||
|
||||
if (eresult == ISC_R_CANCELED || eresult == ISC_R_TLSBADPEERCERT ||
|
||||
@@ -3648,12 +3608,11 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
|
||||
|
||||
if (next != NULL) {
|
||||
start_tcp(next);
|
||||
check_if_done();
|
||||
} else {
|
||||
dighost_error("no servers could be reached\n");
|
||||
clear_current_lookup();
|
||||
}
|
||||
|
||||
check_if_done();
|
||||
return;
|
||||
}
|
||||
|
||||
@@ -3952,14 +3911,10 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
|
||||
|
||||
lookup_attach(query->lookup, &l);
|
||||
|
||||
if (eresult == ISC_R_CANCELED || eresult == ISC_R_SHUTTINGDOWN ||
|
||||
query->canceled)
|
||||
{
|
||||
if (eresult == ISC_R_CANCELED || query->canceled) {
|
||||
debug("recv_done: cancel");
|
||||
isc_nmhandle_detach(&query->readhandle);
|
||||
if (eresult == ISC_R_SHUTTINGDOWN) {
|
||||
cancel_all();
|
||||
} else if (!query->canceled) {
|
||||
if (!query->canceled) {
|
||||
cancel_lookup(l);
|
||||
}
|
||||
query_detach(&query);
|
||||
@@ -3969,9 +3924,9 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
|
||||
}
|
||||
|
||||
if (query->lookup->use_usec) {
|
||||
query->time_recv = isc_time_now_hires();
|
||||
TIME_NOW_HIRES(&query->time_recv);
|
||||
} else {
|
||||
query->time_recv = isc_time_now();
|
||||
TIME_NOW(&query->time_recv);
|
||||
}
|
||||
|
||||
if ((!l->pending && !l->ns_search_only) || cancel_now) {
|
||||
@@ -4176,7 +4131,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
|
||||
goto keep_query;
|
||||
}
|
||||
|
||||
dns_message_create(mctx, NULL, NULL, DNS_MESSAGE_INTENTPARSE, &msg);
|
||||
dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &msg);
|
||||
|
||||
if (tsigkey != NULL) {
|
||||
if (l->querysig == NULL) {
|
||||
@@ -4354,32 +4309,29 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
|
||||
if ((msg->rcode == dns_rcode_servfail && !l->servfail_stops) ||
|
||||
(check_ra && (msg->flags & DNS_MESSAGEFLAG_RA) == 0 && l->recurse))
|
||||
{
|
||||
const char *err = (msg->rcode == dns_rcode_servfail &&
|
||||
!l->servfail_stops)
|
||||
? "SERVFAIL reply"
|
||||
: "recursion not available";
|
||||
dig_query_t *next = ISC_LIST_NEXT(query, link);
|
||||
if (l->current_query == query) {
|
||||
query_detach(&l->current_query);
|
||||
}
|
||||
if (next != NULL && (!l->ns_search_only || l->trace_root)) {
|
||||
dighost_comments(l,
|
||||
"Got %s from %s, trying next server",
|
||||
err, query->servname);
|
||||
if (next != NULL) {
|
||||
debug("sending query %p", next);
|
||||
if (l->tcp_mode) {
|
||||
start_tcp(next);
|
||||
} else {
|
||||
start_udp(next);
|
||||
}
|
||||
dighost_comments(l,
|
||||
"Got %s from %s, trying next "
|
||||
"server",
|
||||
msg->rcode == dns_rcode_servfail
|
||||
? "SERVFAIL reply"
|
||||
: "recursion not available",
|
||||
query->servname);
|
||||
if (check_if_queries_done(l, query)) {
|
||||
goto cancel_lookup;
|
||||
}
|
||||
|
||||
goto detach_query;
|
||||
} else {
|
||||
dighost_comments(l, "Got %s from %s", err,
|
||||
query->servname);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -4598,7 +4550,9 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
|
||||
result = isc_getaddresses(host, 0, sockaddrs, DIG_MAX_ADDRESSES,
|
||||
&count);
|
||||
isc_loopmgr_nonblocking(loopmgr);
|
||||
SET_IF_NOT_NULL(resultp, result);
|
||||
if (resultp != NULL) {
|
||||
*resultp = result;
|
||||
}
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
if (resultp == NULL) {
|
||||
fatal("couldn't get address for '%s': %s", host,
|
||||
|
||||
+2
-9
@@ -187,13 +187,6 @@ struct dig_lookup {
|
||||
char *tls_key_file;
|
||||
isc_tlsctx_cache_t *tls_ctx_cache;
|
||||
};
|
||||
struct {
|
||||
bool proxy_mode;
|
||||
bool proxy_plain;
|
||||
bool proxy_local;
|
||||
isc_sockaddr_t proxy_src_addr;
|
||||
isc_sockaddr_t proxy_dst_addr;
|
||||
};
|
||||
isc_stdtime_t fuzztime;
|
||||
};
|
||||
|
||||
@@ -266,7 +259,7 @@ extern isc_sockaddr_t localaddr;
|
||||
extern char keynametext[MXNAME];
|
||||
extern char keyfile[MXNAME];
|
||||
extern char keysecret[MXNAME];
|
||||
extern dst_algorithm_t hmac_alg;
|
||||
extern const dns_name_t *hmacname;
|
||||
extern unsigned int digestbits;
|
||||
extern dns_tsigkey_t *tsigkey;
|
||||
extern bool validated;
|
||||
@@ -348,7 +341,7 @@ isc_result_t
|
||||
parse_netprefix(isc_sockaddr_t **sap, const char *value);
|
||||
|
||||
void
|
||||
parse_hmac(const char *algname);
|
||||
parse_hmac(const char *hmacstr);
|
||||
|
||||
dig_lookup_t *
|
||||
requeue_lookup(dig_lookup_t *lookold, bool servers);
|
||||
|
||||
+4
-4
@@ -132,7 +132,7 @@ show_usage(void) {
|
||||
" -W specifies how long to wait for a reply\n"
|
||||
" -4 use IPv4 query transport only\n"
|
||||
" -6 use IPv6 query transport only\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -149,9 +149,9 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
|
||||
char fromtext[ISC_SOCKADDR_FORMATSIZE];
|
||||
isc_sockaddr_format(from, fromtext, sizeof(fromtext));
|
||||
if (query->lookup->use_usec) {
|
||||
now = isc_time_now_hires();
|
||||
TIME_NOW_HIRES(&now);
|
||||
} else {
|
||||
now = isc_time_now();
|
||||
TIME_NOW(&now);
|
||||
}
|
||||
diff = (int)isc_time_microdiff(&now, &query->time_sent);
|
||||
printf("Received %u bytes from %s in %d ms\n", bytes, fromtext,
|
||||
@@ -654,7 +654,7 @@ pre_parse_args(int argc, char **argv) {
|
||||
break;
|
||||
case 'V':
|
||||
printf("host %s\n", PACKAGE_VERSION);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
break;
|
||||
case 'w':
|
||||
break;
|
||||
|
||||
+5
-6
@@ -16,11 +16,11 @@
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include <isc/async.h>
|
||||
#include <isc/attributes.h>
|
||||
#include <isc/buffer.h>
|
||||
#include <isc/commandline.h>
|
||||
#include <isc/condition.h>
|
||||
#include <isc/job.h>
|
||||
#include <isc/loop.h>
|
||||
#include <isc/netaddr.h>
|
||||
#include <isc/parseint.h>
|
||||
@@ -849,7 +849,7 @@ usage(void) {
|
||||
"'host' using default server\n");
|
||||
fprintf(stderr, " nslookup [-opt ...] host server # just look up "
|
||||
"'host' using 'server'\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -862,7 +862,7 @@ parse_args(int argc, char **argv) {
|
||||
if (argv[0][0] == '-') {
|
||||
if (strncasecmp(argv[0], "-ver", 4) == 0) {
|
||||
printf("nslookup %s\n", PACKAGE_VERSION);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
} else if (argv[0][1] != 0) {
|
||||
setoption(&argv[0][1]);
|
||||
} else {
|
||||
@@ -888,14 +888,13 @@ static void
|
||||
start_next_command(void);
|
||||
|
||||
static void
|
||||
process_next_command(void *arg ISC_ATTR_UNUSED) {
|
||||
isc_loop_t *loop = isc_loop_main(loopmgr);
|
||||
process_next_command(void *arg __attribute__((__unused__))) {
|
||||
if (cmdline == NULL) {
|
||||
in_use = false;
|
||||
} else {
|
||||
do_next_command(cmdline);
|
||||
if (ISC_LIST_HEAD(lookup_list) != NULL) {
|
||||
isc_async_run(loop, run_loop, NULL);
|
||||
isc_job_run(loopmgr, run_loop, NULL);
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
+3
-16
@@ -12,8 +12,7 @@ noinst_LTLIBRARIES = libdnssectool.la
|
||||
LDADD += \
|
||||
libdnssectool.la \
|
||||
$(LIBISC_LIBS) \
|
||||
$(LIBDNS_LIBS) \
|
||||
$(OPENSSL_LIBS)
|
||||
$(LIBDNS_LIBS)
|
||||
|
||||
bin_PROGRAMS = \
|
||||
dnssec-cds \
|
||||
@@ -32,20 +31,8 @@ libdnssectool_la_SOURCES = \
|
||||
|
||||
dnssec_keygen_CPPFLAGS = \
|
||||
$(AM_CPPFLAGS) \
|
||||
$(LIBISCCFG_CFLAGS) \
|
||||
$(OPENSSL_CFLAGS)
|
||||
$(LIBISCCFG_CFLAGS)
|
||||
|
||||
dnssec_keygen_LDADD = \
|
||||
$(LDADD) \
|
||||
$(LIBISCCFG_LIBS) \
|
||||
$(OPENSSL_LIBS)
|
||||
|
||||
dnssec_signzone_CPPFLAGS = \
|
||||
$(AM_CPPFLAGS) \
|
||||
$(LIBISCCFG_CFLAGS) \
|
||||
$(OPENSSL_CFLAGS)
|
||||
|
||||
dnssec_signzone_LDADD = \
|
||||
$(LDADD) \
|
||||
$(LIBISCCFG_LIBS) \
|
||||
$(OPENSSL_LIBS)
|
||||
$(LIBISCCFG_LIBS)
|
||||
|
||||
+17
-17
@@ -247,8 +247,8 @@ static void
|
||||
load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
|
||||
isc_result_t result;
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
|
||||
rdclass, 0, NULL, dbp);
|
||||
result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
|
||||
NULL, dbp);
|
||||
check_result(result, "dns_db_create()");
|
||||
|
||||
result = dns_db_load(*dbp, filename, dns_masterformat_text,
|
||||
@@ -345,7 +345,8 @@ load_parent_set(const char *path) {
|
||||
}
|
||||
notbefore = isc_time_seconds(&modtime);
|
||||
if (startstr != NULL) {
|
||||
isc_stdtime_t now = isc_stdtime_now();
|
||||
isc_stdtime_t now;
|
||||
isc_stdtime_get(&now);
|
||||
notbefore = strtotime(startstr, now, notbefore, NULL);
|
||||
}
|
||||
verbose_time(1, "child records must not be signed before", notbefore);
|
||||
@@ -537,7 +538,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
|
||||
|
||||
nkey = dns_rdataset_count(keyset);
|
||||
|
||||
keytable = isc_mem_cget(mctx, nkey, sizeof(keytable[0]));
|
||||
keytable = isc_mem_getx(mctx, sizeof(keytable[0]) * nkey, ISC_MEM_ZERO);
|
||||
|
||||
for (result = dns_rdataset_first(keyset), i = 0, ki = keytable;
|
||||
result == ISC_R_SUCCESS;
|
||||
@@ -593,7 +594,7 @@ free_keytable(keyinfo_t **keytable_p) {
|
||||
}
|
||||
}
|
||||
|
||||
isc_mem_cput(mctx, keytable, nkey, sizeof(keytable[0]));
|
||||
isc_mem_put(mctx, keytable, sizeof(keytable[0]) * nkey);
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -614,7 +615,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
|
||||
|
||||
REQUIRE(keytbl != NULL);
|
||||
|
||||
algo = isc_mem_cget(mctx, nkey, sizeof(algo[0]));
|
||||
algo = isc_mem_getx(mctx, nkey * sizeof(algo[0]), ISC_MEM_ZERO);
|
||||
|
||||
for (result = dns_rdataset_first(sigset); result == ISC_R_SUCCESS;
|
||||
result = dns_rdataset_next(sigset))
|
||||
@@ -697,7 +698,7 @@ signed_loose(dns_secalg_t *algo) {
|
||||
ok = true;
|
||||
}
|
||||
}
|
||||
isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
|
||||
isc_mem_put(mctx, algo, nkey * sizeof(algo[0]));
|
||||
return (ok);
|
||||
}
|
||||
|
||||
@@ -739,7 +740,7 @@ signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
|
||||
}
|
||||
}
|
||||
|
||||
isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
|
||||
isc_mem_put(mctx, algo, nkey);
|
||||
return (all_ok);
|
||||
}
|
||||
|
||||
@@ -894,7 +895,7 @@ consistent_digests(dns_rdataset_t *dsset) {
|
||||
|
||||
n = dns_rdataset_count(dsset);
|
||||
|
||||
arrdata = isc_mem_cget(mctx, n, sizeof(dns_rdata_t));
|
||||
arrdata = isc_mem_get(mctx, n * sizeof(dns_rdata_t));
|
||||
|
||||
for (result = dns_rdataset_first(dsset), i = 0; result == ISC_R_SUCCESS;
|
||||
result = dns_rdataset_next(dsset), i++)
|
||||
@@ -908,7 +909,7 @@ consistent_digests(dns_rdataset_t *dsset) {
|
||||
/*
|
||||
* Convert sorted arrdata to more accessible format
|
||||
*/
|
||||
ds = isc_mem_cget(mctx, n, sizeof(dns_rdata_ds_t));
|
||||
ds = isc_mem_get(mctx, n * sizeof(dns_rdata_ds_t));
|
||||
|
||||
for (i = 0; i < n; i++) {
|
||||
result = dns_rdata_tostruct(&arrdata[i], &ds[i], NULL);
|
||||
@@ -947,8 +948,8 @@ consistent_digests(dns_rdataset_t *dsset) {
|
||||
/*
|
||||
* Done!
|
||||
*/
|
||||
isc_mem_cput(mctx, ds, n, sizeof(dns_rdata_ds_t));
|
||||
isc_mem_cput(mctx, arrdata, n, sizeof(dns_rdata_t));
|
||||
isc_mem_put(mctx, ds, n * sizeof(dns_rdata_ds_t));
|
||||
isc_mem_put(mctx, arrdata, n * sizeof(dns_rdata_t));
|
||||
|
||||
return (match);
|
||||
}
|
||||
@@ -979,8 +980,8 @@ update_diff(const char *cmd, uint32_t ttl, dns_rdataset_t *addset,
|
||||
dns_rdataset_t diffset;
|
||||
uint32_t save;
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
|
||||
rdclass, 0, NULL, &update_db);
|
||||
result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
|
||||
NULL, &update_db);
|
||||
check_result(result, "dns_db_create()");
|
||||
|
||||
result = dns_db_newversion(update_db, &update_version);
|
||||
@@ -1056,7 +1057,7 @@ usage(void) {
|
||||
" -T <ttl> TTL of DS records\n"
|
||||
" -V print version\n"
|
||||
" -v <verbosity>\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -1354,6 +1355,5 @@ main(int argc, char *argv[]) {
|
||||
cleanup:
|
||||
print_mem_stats = true;
|
||||
cleanup();
|
||||
|
||||
return (0);
|
||||
exit(0);
|
||||
}
|
||||
|
||||
@@ -100,8 +100,8 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
|
||||
|
||||
dns_name_format(name, setname, sizeof(setname));
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
|
||||
rdclass, 0, NULL, &db);
|
||||
result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
|
||||
NULL, &db);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("can't create database");
|
||||
}
|
||||
@@ -274,7 +274,7 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
|
||||
fatal("can't build record");
|
||||
}
|
||||
|
||||
result = dns_name_totext(name, 0, &nameb);
|
||||
result = dns_name_totext(name, false, &nameb);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("can't print name");
|
||||
}
|
||||
@@ -353,7 +353,7 @@ usage(void) {
|
||||
" -V: print version information\n");
|
||||
fprintf(stderr, "Output: DS or CDS RRs\n");
|
||||
|
||||
exit(EXIT_FAILURE);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
int
|
||||
@@ -452,7 +452,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -103,8 +103,8 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
|
||||
|
||||
dns_name_format(name, setname, sizeof(setname));
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
|
||||
rdclass, 0, NULL, &db);
|
||||
result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
|
||||
NULL, &db);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("can't create database");
|
||||
}
|
||||
@@ -289,7 +289,7 @@ usage(void) {
|
||||
fprintf(stderr, " -D sync date/[+-]offset/none: set/unset "
|
||||
"CDS and CDNSKEY deletion date\n");
|
||||
|
||||
exit(EXIT_FAILURE);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
int
|
||||
@@ -302,9 +302,10 @@ main(int argc, char **argv) {
|
||||
isc_log_t *log = NULL;
|
||||
dns_rdataset_t rdataset;
|
||||
dns_rdata_t rdata;
|
||||
isc_stdtime_t now = isc_stdtime_now();
|
||||
isc_stdtime_t now;
|
||||
|
||||
dns_rdata_init(&rdata);
|
||||
isc_stdtime_get(&now);
|
||||
|
||||
if (argc == 1) {
|
||||
usage();
|
||||
@@ -395,7 +396,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -56,7 +56,7 @@ usage(void) {
|
||||
fprintf(stderr, " name: owner of the key\n");
|
||||
fprintf(stderr, "Other options:\n");
|
||||
fprintf(stderr, " -a algorithm: \n"
|
||||
" RSASHA1 |\n"
|
||||
" DH | RSASHA1 |\n"
|
||||
" NSEC3RSASHA1 |\n"
|
||||
" RSASHA256 | RSASHA512 |\n"
|
||||
" ECDSAP256SHA256 | ECDSAP384SHA384 |\n"
|
||||
@@ -102,7 +102,7 @@ usage(void) {
|
||||
fprintf(stderr, " K<name>+<alg>+<id>.key, "
|
||||
"K<name>+<alg>+<id>.private\n");
|
||||
|
||||
exit(EXIT_FAILURE);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
int
|
||||
@@ -135,6 +135,7 @@ main(int argc, char **argv) {
|
||||
dns_ttl_t ttl = 0;
|
||||
isc_stdtime_t publish = 0, activate = 0, revoke = 0;
|
||||
isc_stdtime_t inactive = 0, deltime = 0;
|
||||
isc_stdtime_t now;
|
||||
int prepub = -1;
|
||||
bool setpub = false, setact = false;
|
||||
bool setrev = false, setinact = false;
|
||||
@@ -150,7 +151,6 @@ main(int argc, char **argv) {
|
||||
isc_stdtime_t syncadd = 0, syncdel = 0;
|
||||
bool unsetsyncadd = false, setsyncadd = false;
|
||||
bool unsetsyncdel = false, setsyncdel = false;
|
||||
isc_stdtime_t now = isc_stdtime_now();
|
||||
|
||||
if (argc == 1) {
|
||||
usage();
|
||||
@@ -160,6 +160,8 @@ main(int argc, char **argv) {
|
||||
|
||||
isc_commandline_errprint = false;
|
||||
|
||||
isc_stdtime_get(&now);
|
||||
|
||||
#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:n:P:p:R:S:t:v:Vy"
|
||||
while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
|
||||
switch (ch) {
|
||||
@@ -331,7 +333,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -385,6 +387,9 @@ main(int argc, char **argv) {
|
||||
if (ret != ISC_R_SUCCESS) {
|
||||
fatal("unknown algorithm %s", algname);
|
||||
}
|
||||
if (alg == DST_ALG_DH) {
|
||||
options |= DST_TYPE_KEY;
|
||||
}
|
||||
|
||||
if (use_nsec3) {
|
||||
switch (alg) {
|
||||
@@ -592,6 +597,13 @@ main(int argc, char **argv) {
|
||||
}
|
||||
}
|
||||
|
||||
if ((flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
|
||||
alg == DNS_KEYALG_DH)
|
||||
{
|
||||
fatal("a key with algorithm '%s' cannot be a zone key",
|
||||
algname);
|
||||
}
|
||||
|
||||
isc_buffer_init(&buf, filename, sizeof(filename) - 1);
|
||||
|
||||
/* associate the key */
|
||||
@@ -606,7 +618,7 @@ main(int argc, char **argv) {
|
||||
fatal("failed to get key %s/%s: %s", namestr, algstr,
|
||||
isc_result_totext(ret));
|
||||
UNREACHABLE();
|
||||
exit(EXIT_FAILURE);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
/*
|
||||
|
||||
+66
-172
@@ -33,12 +33,9 @@
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include <openssl/opensslv.h>
|
||||
|
||||
#include <isc/attributes.h>
|
||||
#include <isc/buffer.h>
|
||||
#include <isc/commandline.h>
|
||||
#include <isc/fips.h>
|
||||
#include <isc/mem.h>
|
||||
#include <isc/region.h>
|
||||
#include <isc/result.h>
|
||||
@@ -60,25 +57,13 @@
|
||||
#include <isccfg/grammar.h>
|
||||
#include <isccfg/kaspconf.h>
|
||||
#include <isccfg/namedconf.h>
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/provider.h>
|
||||
#endif
|
||||
|
||||
#include "dnssectool.h"
|
||||
|
||||
#define MAX_RSA 4096 /* should be long enough... */
|
||||
#define MAX_DH 4096 /* should be long enough... */
|
||||
|
||||
const char *program = "dnssec-keygen";
|
||||
|
||||
/*
|
||||
* These are are set here for backwards compatibility. They are
|
||||
* raised to 2048 in FIPS mode.
|
||||
*/
|
||||
static int min_rsa = 1024;
|
||||
static int min_dh = 128;
|
||||
|
||||
isc_log_t *lctx = NULL;
|
||||
|
||||
noreturn static void
|
||||
@@ -92,10 +77,10 @@ struct keygen_ctx {
|
||||
const char *policy;
|
||||
const char *configfile;
|
||||
const char *directory;
|
||||
dns_keystore_t *keystore;
|
||||
char *algname;
|
||||
char *nametype;
|
||||
char *type;
|
||||
int generator;
|
||||
int protocol;
|
||||
int size;
|
||||
int signatory;
|
||||
@@ -155,22 +140,17 @@ usage(void) {
|
||||
fprintf(stderr, " -l <file>: configuration file with dnssec-policy "
|
||||
"statement\n");
|
||||
fprintf(stderr, " -a <algorithm>:\n");
|
||||
if (!isc_fips_mode()) {
|
||||
fprintf(stderr, " RSASHA1 | NSEC3RSASHA1 |\n");
|
||||
}
|
||||
fprintf(stderr, " RSASHA1 | NSEC3RSASHA1 |\n");
|
||||
fprintf(stderr, " RSASHA256 | RSASHA512 |\n");
|
||||
fprintf(stderr, " ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
|
||||
fprintf(stderr, " ED25519 | ED448\n");
|
||||
fprintf(stderr, " ED25519 | ED448 | DH\n");
|
||||
fprintf(stderr, " -3: use NSEC3-capable algorithm\n");
|
||||
fprintf(stderr, " -b <key size in bits>:\n");
|
||||
if (!isc_fips_mode()) {
|
||||
fprintf(stderr, " RSASHA1:\t[%d..%d]\n", min_rsa,
|
||||
MAX_RSA);
|
||||
fprintf(stderr, " NSEC3RSASHA1:\t[%d..%d]\n", min_rsa,
|
||||
MAX_RSA);
|
||||
}
|
||||
fprintf(stderr, " RSASHA256:\t[%d..%d]\n", min_rsa, MAX_RSA);
|
||||
fprintf(stderr, " RSASHA512:\t[%d..%d]\n", min_rsa, MAX_RSA);
|
||||
fprintf(stderr, " RSASHA1:\t[1024..%d]\n", MAX_RSA);
|
||||
fprintf(stderr, " NSEC3RSASHA1:\t[1024..%d]\n", MAX_RSA);
|
||||
fprintf(stderr, " RSASHA256:\t[1024..%d]\n", MAX_RSA);
|
||||
fprintf(stderr, " RSASHA512:\t[1024..%d]\n", MAX_RSA);
|
||||
fprintf(stderr, " DH:\t\t[128..4096]\n");
|
||||
fprintf(stderr, " ECDSAP256SHA256:\tignored\n");
|
||||
fprintf(stderr, " ECDSAP384SHA384:\tignored\n");
|
||||
fprintf(stderr, " ED25519:\tignored\n");
|
||||
@@ -185,7 +165,8 @@ usage(void) {
|
||||
fprintf(stderr, " -E <engine>:\n");
|
||||
fprintf(stderr, " name of an OpenSSL engine to use\n");
|
||||
fprintf(stderr, " -f <keyflag>: KSK | REVOKE\n");
|
||||
fprintf(stderr, " -F: FIPS mode\n");
|
||||
fprintf(stderr, " -g <generator>: use specified generator "
|
||||
"(DH only)\n");
|
||||
fprintf(stderr, " -L <ttl>: default key TTL\n");
|
||||
fprintf(stderr, " -p <protocol>: (default: 3 [dnssec])\n");
|
||||
fprintf(stderr, " -s <strength>: strength value this key signs DNS "
|
||||
@@ -227,7 +208,7 @@ usage(void) {
|
||||
fprintf(stderr, " K<name>+<alg>+<id>.key, "
|
||||
"K<name>+<alg>+<id>.private\n");
|
||||
|
||||
exit(EXIT_FAILURE);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -256,42 +237,14 @@ progress(int p) {
|
||||
|
||||
static void
|
||||
kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
|
||||
const char *keydir, const char *engine, dns_kasp_t **kaspp) {
|
||||
isc_result_t result = ISC_R_NOTFOUND;
|
||||
dns_kasp_t **kaspp) {
|
||||
const cfg_listelt_t *element;
|
||||
const cfg_obj_t *kasps = NULL;
|
||||
dns_kasp_t *kasp = NULL, *kasp_next;
|
||||
isc_result_t result = ISC_R_NOTFOUND;
|
||||
dns_kasplist_t kasplist;
|
||||
const cfg_obj_t *keystores = NULL;
|
||||
dns_keystore_t *ks = NULL, *ks_next;
|
||||
dns_keystorelist_t kslist;
|
||||
|
||||
ISC_LIST_INIT(kasplist);
|
||||
ISC_LIST_INIT(kslist);
|
||||
|
||||
(void)cfg_map_get(config, "key-store", &keystores);
|
||||
for (element = cfg_list_first(keystores); element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
cfg_obj_t *kconfig = cfg_listelt_value(element);
|
||||
ks = NULL;
|
||||
result = cfg_keystore_fromconfig(kconfig, mctx, lctx, engine,
|
||||
&kslist, NULL);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("failed to configure key-store '%s': %s",
|
||||
cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
|
||||
isc_result_totext(result));
|
||||
}
|
||||
}
|
||||
/* Default key-directory key store. */
|
||||
ks = NULL;
|
||||
(void)cfg_keystore_fromconfig(NULL, mctx, lctx, engine, &kslist, &ks);
|
||||
INSIST(ks != NULL);
|
||||
if (keydir != NULL) {
|
||||
/* '-K keydir' takes priority */
|
||||
dns_keystore_setdirectory(ks, keydir);
|
||||
}
|
||||
dns_keystore_detach(&ks);
|
||||
|
||||
(void)cfg_map_get(config, "dnssec-policy", &kasps);
|
||||
for (element = cfg_list_first(kasps); element != NULL;
|
||||
@@ -305,8 +258,8 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
|
||||
continue;
|
||||
}
|
||||
|
||||
result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, lctx,
|
||||
&kslist, &kasplist, &kasp);
|
||||
result = cfg_kasp_fromconfig(kconfig, NULL, mctx, lctx,
|
||||
&kasplist, &kasp);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("failed to configure dnssec-policy '%s': %s",
|
||||
cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
|
||||
@@ -327,15 +280,6 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
|
||||
ISC_LIST_UNLINK(kasplist, kasp, link);
|
||||
dns_kasp_detach(&kasp);
|
||||
}
|
||||
|
||||
/*
|
||||
* Cleanup keystore list.
|
||||
*/
|
||||
for (ks = ISC_LIST_HEAD(kslist); ks != NULL; ks = ks_next) {
|
||||
ks_next = ISC_LIST_NEXT(ks, link);
|
||||
ISC_LIST_UNLINK(kslist, ks, link);
|
||||
dns_keystore_detach(&ks);
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -378,15 +322,8 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
|
||||
fatal("unsupported algorithm: %s", algstr);
|
||||
}
|
||||
|
||||
if (isc_fips_mode()) {
|
||||
/* verify only in FIPS mode */
|
||||
switch (ctx->alg) {
|
||||
case DST_ALG_RSASHA1:
|
||||
case DST_ALG_NSEC3RSASHA1:
|
||||
fatal("unsupported algorithm: %s", algstr);
|
||||
default:
|
||||
break;
|
||||
}
|
||||
if (ctx->alg == DST_ALG_DH) {
|
||||
ctx->options |= DST_TYPE_KEY;
|
||||
}
|
||||
|
||||
if (ctx->use_nsec3) {
|
||||
@@ -431,11 +368,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
|
||||
switch (ctx->alg) {
|
||||
case DST_ALG_RSASHA1:
|
||||
case DST_ALG_NSEC3RSASHA1:
|
||||
if (isc_fips_mode()) {
|
||||
fatal("key size not specified (-b "
|
||||
"option)");
|
||||
}
|
||||
FALLTHROUGH;
|
||||
case DST_ALG_RSASHA256:
|
||||
case DST_ALG_RSASHA512:
|
||||
ctx->size = 2048;
|
||||
@@ -591,18 +523,23 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
|
||||
switch (ctx->alg) {
|
||||
case DNS_KEYALG_RSASHA1:
|
||||
case DNS_KEYALG_NSEC3RSASHA1:
|
||||
if (isc_fips_mode()) {
|
||||
fatal("SHA1 based keys not supported in FIPS mode");
|
||||
}
|
||||
FALLTHROUGH;
|
||||
case DNS_KEYALG_RSASHA256:
|
||||
case DNS_KEYALG_RSASHA512:
|
||||
if (ctx->size != 0 &&
|
||||
(ctx->size < min_rsa || ctx->size > MAX_RSA))
|
||||
if (ctx->size != 0 && (ctx->size < 1024 || ctx->size > MAX_RSA))
|
||||
{
|
||||
fatal("RSA key size %d out of range", ctx->size);
|
||||
}
|
||||
break;
|
||||
case DNS_KEYALG_RSASHA512:
|
||||
if (ctx->size != 0 && (ctx->size < 1024 || ctx->size > MAX_RSA))
|
||||
{
|
||||
fatal("RSA key size %d out of range", ctx->size);
|
||||
}
|
||||
break;
|
||||
case DNS_KEYALG_DH:
|
||||
if (ctx->size != 0 && (ctx->size < 128 || ctx->size > 4096)) {
|
||||
fatal("DH key size %d out of range", ctx->size);
|
||||
}
|
||||
break;
|
||||
case DST_ALG_ECDSA256:
|
||||
ctx->size = 256;
|
||||
break;
|
||||
@@ -617,6 +554,10 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
|
||||
break;
|
||||
}
|
||||
|
||||
if (ctx->alg != DNS_KEYALG_DH && ctx->generator != 0) {
|
||||
fatal("specified DH generator for a non-DH key");
|
||||
}
|
||||
|
||||
if (ctx->nametype == NULL) {
|
||||
if ((ctx->options & DST_TYPE_KEY) != 0) { /* KEY */
|
||||
fatal("no nametype specified");
|
||||
@@ -666,6 +607,12 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
|
||||
}
|
||||
}
|
||||
|
||||
if ((flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
|
||||
ctx->alg == DNS_KEYALG_DH)
|
||||
{
|
||||
fatal("a key with algorithm %s cannot be a zone key", algstr);
|
||||
}
|
||||
|
||||
switch (ctx->alg) {
|
||||
case DNS_KEYALG_RSASHA1:
|
||||
case DNS_KEYALG_NSEC3RSASHA1:
|
||||
@@ -674,6 +621,10 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
|
||||
show_progress = true;
|
||||
break;
|
||||
|
||||
case DNS_KEYALG_DH:
|
||||
param = ctx->generator;
|
||||
break;
|
||||
|
||||
case DST_ALG_ECDSA256:
|
||||
case DST_ALG_ECDSA384:
|
||||
case DST_ALG_ED25519:
|
||||
@@ -693,27 +644,16 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
|
||||
|
||||
if (!ctx->quiet && show_progress) {
|
||||
fprintf(stderr, "Generating key pair.");
|
||||
}
|
||||
|
||||
if (ctx->keystore != NULL && ctx->policy != NULL) {
|
||||
ret = dns_keystore_keygen(
|
||||
ctx->keystore, name, ctx->policy, ctx->rdclass,
|
||||
mctx, ctx->alg, ctx->size, flags, &key);
|
||||
} else if (!ctx->quiet && show_progress) {
|
||||
ret = dst_key_generate(name, ctx->alg, ctx->size, param,
|
||||
flags, ctx->protocol,
|
||||
ctx->rdclass, NULL, mctx, &key,
|
||||
ctx->rdclass, mctx, &key,
|
||||
&progress);
|
||||
putc('\n', stderr);
|
||||
fflush(stderr);
|
||||
} else {
|
||||
ret = dst_key_generate(name, ctx->alg, ctx->size, param,
|
||||
flags, ctx->protocol,
|
||||
ctx->rdclass, NULL, mctx, &key,
|
||||
NULL);
|
||||
}
|
||||
|
||||
if (!ctx->quiet && show_progress) {
|
||||
putc('\n', stderr);
|
||||
fflush(stderr);
|
||||
ctx->rdclass, mctx, &key, NULL);
|
||||
}
|
||||
|
||||
if (ret != ISC_R_SUCCESS) {
|
||||
@@ -909,18 +849,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
check_keystore_options(keygen_ctx_t *ctx) {
|
||||
ctx->directory = dns_keystore_directory(ctx->keystore, NULL);
|
||||
if (ctx->directory != NULL) {
|
||||
isc_result_t ret = try_dir(ctx->directory);
|
||||
if (ret != ISC_R_SUCCESS) {
|
||||
fatal("cannot open directory %s: %s", ctx->directory,
|
||||
isc_result_totext(ret));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
int
|
||||
main(int argc, char **argv) {
|
||||
char *algname = NULL, *freeit = NULL;
|
||||
@@ -932,17 +860,12 @@ main(int argc, char **argv) {
|
||||
const char *engine = NULL;
|
||||
unsigned char c;
|
||||
int ch;
|
||||
bool set_fips_mode = false;
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
OSSL_PROVIDER *fips = NULL, *base = NULL;
|
||||
#endif
|
||||
|
||||
keygen_ctx_t ctx = {
|
||||
.options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC,
|
||||
.prepub = -1,
|
||||
.protocol = -1,
|
||||
.size = -1,
|
||||
.now = isc_stdtime_now(),
|
||||
};
|
||||
|
||||
if (argc == 1) {
|
||||
@@ -954,8 +877,8 @@ main(int argc, char **argv) {
|
||||
/*
|
||||
* Process memory debugging argument first.
|
||||
*/
|
||||
#define CMDLINE_FLAGS \
|
||||
"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:m:n:P:p:qR:r:S:s:" \
|
||||
#define CMDLINE_FLAGS \
|
||||
"3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:k:L:l:m:n:P:p:qR:r:S:s:" \
|
||||
"T:t:v:V"
|
||||
while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
|
||||
switch (ch) {
|
||||
@@ -980,6 +903,7 @@ main(int argc, char **argv) {
|
||||
isc_commandline_reset = true;
|
||||
|
||||
isc_mem_create(&mctx);
|
||||
isc_stdtime_get(&ctx.now);
|
||||
|
||||
while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
|
||||
switch (ch) {
|
||||
@@ -1010,6 +934,10 @@ main(int argc, char **argv) {
|
||||
case 'E':
|
||||
engine = isc_commandline_argument;
|
||||
break;
|
||||
case 'e':
|
||||
fprintf(stderr, "phased-out option -e "
|
||||
"(was 'use (RSA) large exponent')\n");
|
||||
break;
|
||||
case 'f':
|
||||
c = (unsigned char)(isc_commandline_argument[0]);
|
||||
if (toupper(c) == 'K') {
|
||||
@@ -1021,6 +949,13 @@ main(int argc, char **argv) {
|
||||
isc_commandline_argument);
|
||||
}
|
||||
break;
|
||||
case 'g':
|
||||
ctx.generator = strtol(isc_commandline_argument, &endp,
|
||||
10);
|
||||
if (*endp != '\0' || ctx.generator <= 0) {
|
||||
fatal("-g requires a positive number");
|
||||
}
|
||||
break;
|
||||
case 'K':
|
||||
ctx.directory = isc_commandline_argument;
|
||||
ret = try_dir(ctx.directory);
|
||||
@@ -1177,8 +1112,8 @@ main(int argc, char **argv) {
|
||||
ctx.prepub = strtottl(isc_commandline_argument);
|
||||
break;
|
||||
case 'F':
|
||||
set_fips_mode = true;
|
||||
break;
|
||||
/* Reserved for FIPS mode */
|
||||
FALLTHROUGH;
|
||||
case '?':
|
||||
if (isc_commandline_option != '?') {
|
||||
fprintf(stderr, "%s: invalid argument -%c\n",
|
||||
@@ -1196,7 +1131,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1204,40 +1139,11 @@ main(int argc, char **argv) {
|
||||
ctx.quiet = true;
|
||||
}
|
||||
|
||||
if (set_fips_mode) {
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
fips = OSSL_PROVIDER_load(NULL, "fips");
|
||||
if (fips == NULL) {
|
||||
ERR_clear_error();
|
||||
fatal("Failed to load FIPS provider");
|
||||
}
|
||||
base = OSSL_PROVIDER_load(NULL, "base");
|
||||
if (base == NULL) {
|
||||
OSSL_PROVIDER_unload(fips);
|
||||
ERR_clear_error();
|
||||
fatal("Failed to load base provider");
|
||||
}
|
||||
#endif
|
||||
if (!isc_fips_mode()) {
|
||||
if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
|
||||
fatal("setting FIPS mode failed");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
ret = dst_lib_init(mctx, engine);
|
||||
if (ret != ISC_R_SUCCESS) {
|
||||
fatal("could not initialize dst: %s", isc_result_totext(ret));
|
||||
}
|
||||
|
||||
/*
|
||||
* After dst_lib_init which will set FIPS mode if requested
|
||||
* at build time. The minumums are both raised to 2048.
|
||||
*/
|
||||
if (isc_fips_mode()) {
|
||||
min_rsa = min_dh = 2048;
|
||||
}
|
||||
|
||||
setup_logging(mctx, &lctx);
|
||||
|
||||
ctx.rdclass = strtoclass(classname);
|
||||
@@ -1330,8 +1236,7 @@ main(int argc, char **argv) {
|
||||
ctx.policy, ctx.configfile);
|
||||
}
|
||||
|
||||
kasp_from_conf(config, mctx, ctx.policy, ctx.directory,
|
||||
engine, &kasp);
|
||||
kasp_from_conf(config, mctx, ctx.policy, &kasp);
|
||||
if (kasp == NULL) {
|
||||
fatal("failed to load dnssec-policy '%s'",
|
||||
ctx.policy);
|
||||
@@ -1357,10 +1262,7 @@ main(int argc, char **argv) {
|
||||
ctx.ksk = dns_kasp_key_ksk(kaspkey);
|
||||
ctx.zsk = dns_kasp_key_zsk(kaspkey);
|
||||
ctx.lifetime = dns_kasp_key_lifetime(kaspkey);
|
||||
ctx.keystore = dns_kasp_key_keystore(kaspkey);
|
||||
if (ctx.keystore != NULL) {
|
||||
check_keystore_options(&ctx);
|
||||
}
|
||||
|
||||
keygen(&ctx, mctx, argc, argv);
|
||||
|
||||
kaspkey = ISC_LIST_NEXT(kaspkey, link);
|
||||
@@ -1381,14 +1283,6 @@ main(int argc, char **argv) {
|
||||
}
|
||||
isc_mem_destroy(&mctx);
|
||||
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
if (base != NULL) {
|
||||
OSSL_PROVIDER_unload(base);
|
||||
}
|
||||
if (fips != NULL) {
|
||||
OSSL_PROVIDER_unload(fips);
|
||||
}
|
||||
#endif
|
||||
if (freeit != NULL) {
|
||||
free(freeit);
|
||||
}
|
||||
|
||||
@@ -21,13 +21,15 @@ dnssec-keygen: DNSSEC key generation tool
|
||||
Synopsis
|
||||
~~~~~~~~
|
||||
|
||||
:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}
|
||||
:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-G**] [**-g** generator] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}
|
||||
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
:program:`dnssec-keygen` generates keys for DNSSEC (Secure DNS), as defined in
|
||||
:rfc:`2535` and :rfc:`4034`.
|
||||
:rfc:`2535` and :rfc:`4034`. It can also generate keys for use with TSIG
|
||||
(Transaction Signatures) as defined in :rfc:`2845`, or TKEY (Transaction
|
||||
Key) as defined in :rfc:`2930`.
|
||||
|
||||
The ``name`` of the key is specified on the command line. For DNSSEC
|
||||
keys, this must match the name of the zone for which the key is being
|
||||
@@ -47,7 +49,9 @@ Options
|
||||
|
||||
This option selects the cryptographic algorithm. For DNSSEC keys, the value of
|
||||
``algorithm`` must be one of RSASHA1, NSEC3RSASHA1, RSASHA256,
|
||||
RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.
|
||||
RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448. For
|
||||
TKEY, the value must be DH (Diffie-Hellman); specifying this value
|
||||
automatically sets the :option:`-T KEY <-T>` option as well.
|
||||
|
||||
These values are case-insensitive. In some cases, abbreviations are
|
||||
supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
|
||||
@@ -107,17 +111,17 @@ Options
|
||||
This option sets the specified flag in the flag field of the KEY/DNSKEY record.
|
||||
The only recognized flags are KSK (Key-Signing Key) and REVOKE.
|
||||
|
||||
.. option:: -F
|
||||
|
||||
This options turns on FIPS (US Federal Information Processing Standards)
|
||||
mode if the underlying crytographic library supports running in FIPS
|
||||
mode.
|
||||
|
||||
.. option:: -G
|
||||
|
||||
This option generates a key, but does not publish it or sign with it. This option is
|
||||
incompatible with :option:`-P` and :option:`-A`.
|
||||
|
||||
.. option:: -g generator
|
||||
|
||||
This option indicates the generator to use if generating a Diffie-Hellman key. Allowed
|
||||
values are 2 and 5. If no generator is specified, a known prime from
|
||||
:rfc:`2539` is used if possible; otherwise the default is 2.
|
||||
|
||||
.. option:: -h
|
||||
|
||||
This option prints a short summary of the options and arguments to
|
||||
|
||||
@@ -58,7 +58,7 @@ usage(void) {
|
||||
fprintf(stderr, " K<name>+<alg>+<new id>.key, "
|
||||
"K<name>+<alg>+<new id>.private\n");
|
||||
|
||||
exit(EXIT_FAILURE);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
int
|
||||
@@ -130,7 +130,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -190,7 +190,7 @@ main(int argc, char **argv) {
|
||||
|
||||
flags = dst_key_flags(key);
|
||||
if ((flags & DNS_KEYFLAG_REVOKE) == 0) {
|
||||
isc_stdtime_t now = isc_stdtime_now();
|
||||
isc_stdtime_t now;
|
||||
|
||||
if ((flags & DNS_KEYFLAG_KSK) == 0) {
|
||||
fprintf(stderr,
|
||||
@@ -200,6 +200,7 @@ main(int argc, char **argv) {
|
||||
program);
|
||||
}
|
||||
|
||||
isc_stdtime_get(&now);
|
||||
dst_key_settime(key, DST_TIME_REVOKE, now);
|
||||
|
||||
dst_key_setflags(key, flags | DNS_KEYFLAG_REVOKE);
|
||||
|
||||
@@ -101,7 +101,7 @@ usage(void) {
|
||||
fprintf(stderr, " K<name>+<alg>+<new id>.key, "
|
||||
"K<name>+<alg>+<new id>.private\n");
|
||||
|
||||
exit(EXIT_FAILURE);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -202,6 +202,7 @@ main(int argc, char **argv) {
|
||||
int prepub = -1;
|
||||
int options;
|
||||
dns_ttl_t ttl = 0;
|
||||
isc_stdtime_t now;
|
||||
isc_stdtime_t dstime = 0, dnskeytime = 0;
|
||||
isc_stdtime_t krrsigtime = 0, zrrsigtime = 0;
|
||||
isc_stdtime_t pub = 0, act = 0, rev = 0, inact = 0, del = 0;
|
||||
@@ -237,7 +238,6 @@ main(int argc, char **argv) {
|
||||
bool unsetdsadd = false, setdsadd = false;
|
||||
bool unsetdsdel = false, setdsdel = false;
|
||||
bool printdsadd = false, printdsdel = false;
|
||||
isc_stdtime_t now = isc_stdtime_now();
|
||||
|
||||
options = DST_TYPE_PUBLIC | DST_TYPE_PRIVATE | DST_TYPE_STATE;
|
||||
|
||||
@@ -251,6 +251,8 @@ main(int argc, char **argv) {
|
||||
|
||||
isc_commandline_errprint = false;
|
||||
|
||||
isc_stdtime_get(&now);
|
||||
|
||||
#define CMDLINE_FLAGS "A:D:d:E:fg:hI:i:K:k:L:P:p:R:r:S:suv:Vz:"
|
||||
while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
|
||||
switch (ch) {
|
||||
@@ -536,7 +538,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -148,7 +148,7 @@ All these formats are case-insensitive.
|
||||
.. option:: -A date/offset
|
||||
|
||||
This option sets the date on which the key is to be activated. After that date,
|
||||
the key is included in the zone and used to sign it.
|
||||
the key is included in the zone and used to sign it.
|
||||
|
||||
.. option:: -R date/offset
|
||||
|
||||
|
||||
@@ -33,18 +33,15 @@
|
||||
#include <time.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include <openssl/opensslv.h>
|
||||
|
||||
#include <isc/async.h>
|
||||
#include <isc/atomic.h>
|
||||
#include <isc/attributes.h>
|
||||
#include <isc/base32.h>
|
||||
#include <isc/commandline.h>
|
||||
#include <isc/dir.h>
|
||||
#include <isc/file.h>
|
||||
#include <isc/fips.h>
|
||||
#include <isc/hash.h>
|
||||
#include <isc/hex.h>
|
||||
#include <isc/job.h>
|
||||
#include <isc/loop.h>
|
||||
#include <isc/managers.h>
|
||||
#include <isc/md.h>
|
||||
@@ -88,10 +85,6 @@
|
||||
#include <dns/zoneverify.h>
|
||||
|
||||
#include <dst/dst.h>
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/provider.h>
|
||||
#endif
|
||||
|
||||
#include "dnssectool.h"
|
||||
|
||||
@@ -106,7 +99,7 @@ static int nsec_datatype = dns_rdatatype_nsec;
|
||||
"dns_dbiterator_current()")
|
||||
|
||||
#define IS_NSEC3 (nsec_datatype == dns_rdatatype_nsec3)
|
||||
#define OPTOUT(x) (((x) & DNS_NSEC3FLAG_OPTOUT) != 0)
|
||||
#define OPTOUT(x) (((x)&DNS_NSEC3FLAG_OPTOUT) != 0)
|
||||
|
||||
#define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) != 0)
|
||||
|
||||
@@ -529,8 +522,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
|
||||
if (!nosigs) {
|
||||
arraysize += dns_rdataset_count(&sigset);
|
||||
}
|
||||
wassignedby = isc_mem_cget(mctx, arraysize, sizeof(bool));
|
||||
nowsignedby = isc_mem_cget(mctx, arraysize, sizeof(bool));
|
||||
wassignedby = isc_mem_get(mctx, arraysize * sizeof(bool));
|
||||
nowsignedby = isc_mem_get(mctx, arraysize * sizeof(bool));
|
||||
|
||||
for (i = 0; i < arraysize; i++) {
|
||||
wassignedby[i] = nowsignedby[i] = false;
|
||||
@@ -782,8 +775,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
|
||||
}
|
||||
}
|
||||
|
||||
isc_mem_cput(mctx, wassignedby, arraysize, sizeof(bool));
|
||||
isc_mem_cput(mctx, nowsignedby, arraysize, sizeof(bool));
|
||||
isc_mem_put(mctx, wassignedby, arraysize * sizeof(bool));
|
||||
isc_mem_put(mctx, nowsignedby, arraysize * sizeof(bool));
|
||||
}
|
||||
|
||||
struct hashlist {
|
||||
@@ -998,8 +991,8 @@ opendb(const char *prefix, dns_name_t *name, dns_rdataclass_t rdclass,
|
||||
}
|
||||
isc_buffer_putuint8(&b, 0);
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, dns_rootname,
|
||||
dns_dbtype_zone, rdclass, 0, NULL, dbp);
|
||||
result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
|
||||
rdclass, 0, NULL, dbp);
|
||||
check_result(result, "dns_db_create()");
|
||||
|
||||
result = dns_db_load(*dbp, filename, inputformat, DNS_MASTER_HINT);
|
||||
@@ -1674,7 +1667,7 @@ assignwork(void *arg) {
|
||||
lock_and_dumpnode(dns_fixedname_name(&fname), node);
|
||||
dns_db_detachnode(gdb, &node);
|
||||
|
||||
isc_async_current(assignwork, NULL);
|
||||
isc_job_run(loopmgr, assignwork, NULL);
|
||||
}
|
||||
|
||||
/*%
|
||||
@@ -1963,7 +1956,7 @@ addnsec3param(const unsigned char *salt, size_t salt_len,
|
||||
nsec3param.hash = unknownalg ? DNS_NSEC3_UNKNOWNALG : dns_hash_sha1;
|
||||
nsec3param.iterations = iterations;
|
||||
nsec3param.salt_length = (unsigned char)salt_len;
|
||||
nsec3param.salt = UNCONST(salt);
|
||||
DE_CONST(salt, nsec3param.salt);
|
||||
|
||||
isc_buffer_init(&b, nsec3parambuf, sizeof(nsec3parambuf));
|
||||
result = dns_rdata_fromstruct(&rdata, gclass, dns_rdatatype_nsec3param,
|
||||
@@ -2572,8 +2565,8 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
|
||||
isc_result_totext(result));
|
||||
}
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
|
||||
rdclass, 0, NULL, db);
|
||||
result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
|
||||
NULL, db);
|
||||
check_result(result, "dns_db_create()");
|
||||
|
||||
result = dns_db_load(*db, file, inputformat, 0);
|
||||
@@ -2639,7 +2632,7 @@ loadzonekeys(bool preserve_keys, bool load_public) {
|
||||
|
||||
/* Load keys corresponding to the existing DNSKEY RRset. */
|
||||
result = dns_dnssec_keylistfromrdataset(
|
||||
gorigin, NULL, directory, mctx, &rdataset, &keysigs, &soasigs,
|
||||
gorigin, directory, mctx, &rdataset, &keysigs, &soasigs,
|
||||
preserve_keys, load_public, &keylist);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("failed to load the zone keys: %s",
|
||||
@@ -2812,7 +2805,7 @@ build_final_keylist(void) {
|
||||
char *s;
|
||||
size_t dlen;
|
||||
|
||||
digest = UNCONST(sync_records);
|
||||
DE_CONST(sync_records, digest);
|
||||
next_digest:
|
||||
s = strchr(digest, delim);
|
||||
if (s == NULL) {
|
||||
@@ -2830,8 +2823,8 @@ findkeys:
|
||||
/*
|
||||
* Find keys that match this zone in the key repository.
|
||||
*/
|
||||
result = dns_dnssec_findmatchingkeys(gorigin, NULL, directory, NULL,
|
||||
now, mctx, &matchkeys);
|
||||
result = dns_dnssec_findmatchingkeys(gorigin, directory, now, mctx,
|
||||
&matchkeys);
|
||||
if (result == ISC_R_NOTFOUND) {
|
||||
result = ISC_R_SUCCESS;
|
||||
}
|
||||
@@ -3162,8 +3155,8 @@ writeset(const char *prefix, dns_rdatatype_t type) {
|
||||
dns_diff_append(&diff, &tuple);
|
||||
}
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, dns_rootname,
|
||||
dns_dbtype_zone, gclass, 0, NULL, &db);
|
||||
result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
|
||||
gclass, 0, NULL, &db);
|
||||
check_result(result, "dns_db_create");
|
||||
|
||||
result = dns_db_newversion(db, &dbversion);
|
||||
@@ -3228,7 +3221,6 @@ usage(void) {
|
||||
fprintf(stderr, "\t\tdirectory to find key files (.)\n");
|
||||
fprintf(stderr, "\t-d directory:\n");
|
||||
fprintf(stderr, "\t\tdirectory to find dsset-* files (.)\n");
|
||||
fprintf(stderr, "\t-F:\tFIPS mode\n");
|
||||
fprintf(stderr, "\t-g:\t");
|
||||
fprintf(stderr, "update DS records based on child zones' "
|
||||
"dsset-* files\n");
|
||||
@@ -3300,7 +3292,7 @@ usage(void) {
|
||||
fprintf(stderr, "(default: all zone keys that have private keys)\n");
|
||||
fprintf(stderr, "\tkeyfile (Kname+alg+tag)\n");
|
||||
|
||||
exit(EXIT_FAILURE);
|
||||
exit(0);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -3370,10 +3362,6 @@ main(int argc, char *argv[]) {
|
||||
bool set_optout = false;
|
||||
bool set_iter = false;
|
||||
bool nonsecify = false;
|
||||
bool set_fips_mode = false;
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
OSSL_PROVIDER *fips = NULL, *base = NULL;
|
||||
#endif
|
||||
|
||||
atomic_init(&shuttingdown, false);
|
||||
atomic_init(&finished, false);
|
||||
@@ -3494,7 +3482,7 @@ main(int argc, char *argv[]) {
|
||||
set_iter = true;
|
||||
/* too-many is NOT DOCUMENTED */
|
||||
if (strcmp(isc_commandline_argument, "too-many") == 0) {
|
||||
nsec3iter = 51;
|
||||
nsec3iter = 151;
|
||||
no_max_check = true;
|
||||
break;
|
||||
}
|
||||
@@ -3550,7 +3538,7 @@ main(int argc, char *argv[]) {
|
||||
if (*endp != '\0') {
|
||||
fprintf(stderr, "source serial number "
|
||||
"must be numeric");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -3565,7 +3553,7 @@ main(int argc, char *argv[]) {
|
||||
if (*endp != '\0') {
|
||||
fprintf(stderr, "maximum TTL "
|
||||
"must be numeric");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -3663,9 +3651,8 @@ main(int argc, char *argv[]) {
|
||||
break;
|
||||
|
||||
case 'F':
|
||||
set_fips_mode = true;
|
||||
break;
|
||||
|
||||
/* Reserved for FIPS mode */
|
||||
FALLTHROUGH;
|
||||
case '?':
|
||||
if (isc_commandline_option != '?') {
|
||||
fprintf(stderr, "%s: invalid argument -%c\n",
|
||||
@@ -3689,11 +3676,11 @@ main(int argc, char *argv[]) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
now = isc_stdtime_now();
|
||||
isc_stdtime_get(&now);
|
||||
|
||||
if (startstr != NULL) {
|
||||
starttime = strtotime(startstr, now, now, NULL);
|
||||
@@ -3734,27 +3721,6 @@ main(int argc, char *argv[]) {
|
||||
|
||||
isc_managers_create(&mctx, nloops, &loopmgr, &netmgr);
|
||||
|
||||
if (set_fips_mode) {
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
fips = OSSL_PROVIDER_load(NULL, "fips");
|
||||
if (fips == NULL) {
|
||||
ERR_clear_error();
|
||||
fatal("Failed to load FIPS provider");
|
||||
}
|
||||
base = OSSL_PROVIDER_load(NULL, "base");
|
||||
if (base == NULL) {
|
||||
OSSL_PROVIDER_unload(fips);
|
||||
ERR_clear_error();
|
||||
fatal("Failed to load base provider");
|
||||
}
|
||||
#endif
|
||||
if (!isc_fips_mode()) {
|
||||
if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
|
||||
fatal("setting FIPS mode failed");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
result = dst_lib_init(mctx, engine);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("could not initialize dst: %s",
|
||||
@@ -3818,7 +3784,7 @@ main(int argc, char *argv[]) {
|
||||
rawversion > 1U)
|
||||
{
|
||||
fprintf(stderr, "unknown raw format version\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
} else {
|
||||
fatal("unknown file format: %s", outputformatstr);
|
||||
@@ -3858,7 +3824,7 @@ main(int argc, char *argv[]) {
|
||||
check_result(result, "dns_master_stylecreate");
|
||||
|
||||
gdb = NULL;
|
||||
timer_start = isc_time_now();
|
||||
TIME_NOW(&timer_start);
|
||||
loadzone(file, origin, rdclass, &gdb);
|
||||
if (journal != NULL) {
|
||||
loadjournal(mctx, gdb, journal);
|
||||
@@ -4048,7 +4014,7 @@ main(int argc, char *argv[]) {
|
||||
}
|
||||
|
||||
presign();
|
||||
sign_start = isc_time_now();
|
||||
TIME_NOW(&sign_start);
|
||||
signapex();
|
||||
if (!atomic_load(&finished)) {
|
||||
/*
|
||||
@@ -4064,7 +4030,7 @@ main(int argc, char *argv[]) {
|
||||
}
|
||||
}
|
||||
postsign();
|
||||
sign_finish = isc_time_now();
|
||||
TIME_NOW(&sign_finish);
|
||||
|
||||
if (disable_zone_check) {
|
||||
vresult = ISC_R_SUCCESS;
|
||||
@@ -4138,19 +4104,10 @@ main(int argc, char *argv[]) {
|
||||
isc_mem_stats(mctx, stdout);
|
||||
}
|
||||
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
if (base != NULL) {
|
||||
OSSL_PROVIDER_unload(base);
|
||||
}
|
||||
if (fips != NULL) {
|
||||
OSSL_PROVIDER_unload(fips);
|
||||
}
|
||||
#endif
|
||||
|
||||
isc_managers_destroy(&mctx, &loopmgr, &netmgr);
|
||||
|
||||
if (printstats) {
|
||||
timer_finish = isc_time_now();
|
||||
TIME_NOW(&timer_finish);
|
||||
print_stats(&timer_start, &timer_finish, &sign_start,
|
||||
&sign_finish);
|
||||
isc_mutex_destroy(&statslock);
|
||||
|
||||
@@ -21,7 +21,7 @@ dnssec-signzone - DNSSEC zone signing tool
|
||||
Synopsis
|
||||
~~~~~~~~
|
||||
|
||||
:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
|
||||
:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
|
||||
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
@@ -71,12 +71,6 @@ Options
|
||||
engine identifier that drives the cryptographic accelerator or
|
||||
hardware service module (usually ``pkcs11``).
|
||||
|
||||
.. option:: -F
|
||||
|
||||
This options turns on FIPS (US Federal Information Processing Standards)
|
||||
mode if the underlying crytographic library supports running in FIPS
|
||||
mode.
|
||||
|
||||
.. option:: -g
|
||||
|
||||
This option indicates that DS records for child zones should be generated from a ``dsset-`` or ``keyset-``
|
||||
@@ -359,12 +353,15 @@ Options
|
||||
.. option:: -x
|
||||
|
||||
This option indicates that BIND 9 should only sign the DNSKEY, CDNSKEY, and CDS RRsets with key-signing keys,
|
||||
and should omit signatures from zone-signing keys.
|
||||
and should omit signatures from zone-signing keys. (This is similar to the
|
||||
``dnssec-dnskey-kskonly yes;`` zone option in :iscman:`named`.)
|
||||
|
||||
.. option:: -z
|
||||
|
||||
This option indicates that BIND 9 should ignore the KSK flag on keys when determining what to sign. This causes
|
||||
KSK-flagged keys to sign all records, not just the DNSKEY RRset.
|
||||
(This is similar to the ``update-check-ksk no;`` zone option in
|
||||
:iscman:`named`.)
|
||||
|
||||
.. option:: -3 salt
|
||||
|
||||
|
||||
@@ -109,8 +109,8 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
|
||||
isc_result_totext(result));
|
||||
}
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
|
||||
rdclass, 0, NULL, db);
|
||||
result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
|
||||
NULL, db);
|
||||
check_result(result, "dns_db_create()");
|
||||
|
||||
result = dns_db_load(*db, file, inputformat, 0);
|
||||
@@ -162,7 +162,7 @@ usage(void) {
|
||||
fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
|
||||
"not ZSKs\n");
|
||||
fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
}
|
||||
|
||||
int
|
||||
@@ -271,7 +271,7 @@ main(int argc, char *argv[]) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -281,7 +281,7 @@ main(int argc, char *argv[]) {
|
||||
isc_result_totext(result));
|
||||
}
|
||||
|
||||
now = isc_stdtime_now();
|
||||
isc_stdtime_get(&now);
|
||||
|
||||
rdclass = strtoclass(classname);
|
||||
|
||||
|
||||
+32
-12
@@ -20,7 +20,6 @@
|
||||
#include <inttypes.h>
|
||||
#include <stdbool.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include <isc/base32.h>
|
||||
#include <isc/buffer.h>
|
||||
@@ -33,7 +32,6 @@
|
||||
#include <isc/result.h>
|
||||
#include <isc/string.h>
|
||||
#include <isc/time.h>
|
||||
#include <isc/tls.h>
|
||||
#include <isc/tm.h>
|
||||
#include <isc/util.h>
|
||||
|
||||
@@ -84,7 +82,7 @@ fatal(const char *format, ...) {
|
||||
if (fatalcallback != NULL) {
|
||||
(*fatalcallback)();
|
||||
}
|
||||
_exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
void
|
||||
@@ -114,7 +112,7 @@ vbprintf(int level, const char *fmt, ...) {
|
||||
void
|
||||
version(const char *name) {
|
||||
printf("%s %s\n", name, PACKAGE_VERSION);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
}
|
||||
|
||||
void
|
||||
@@ -291,11 +289,15 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
|
||||
struct tm tm;
|
||||
|
||||
if (isnone(str)) {
|
||||
SET_IF_NOT_NULL(setp, false);
|
||||
if (setp != NULL) {
|
||||
*setp = false;
|
||||
}
|
||||
return ((isc_stdtime_t)0);
|
||||
}
|
||||
|
||||
SET_IF_NOT_NULL(setp, true);
|
||||
if (setp != NULL) {
|
||||
*setp = true;
|
||||
}
|
||||
|
||||
if ((str[0] == '0' || str[0] == '-') && str[1] == '\0') {
|
||||
return ((isc_stdtime_t)0);
|
||||
@@ -372,7 +374,7 @@ strtoclass(const char *str) {
|
||||
if (str == NULL) {
|
||||
return (dns_rdataclass_in);
|
||||
}
|
||||
r.base = UNCONST(str);
|
||||
DE_CONST(str, r.base);
|
||||
r.length = strlen(str);
|
||||
result = dns_rdataclass_fromtext(&rdclass, &r);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
@@ -387,7 +389,7 @@ strtodsdigest(const char *str) {
|
||||
dns_dsdigest_t alg;
|
||||
isc_result_t result;
|
||||
|
||||
r.base = UNCONST(str);
|
||||
DE_CONST(str, r.base);
|
||||
r.length = strlen(str);
|
||||
result = dns_dsdigest_fromtext(&alg, &r);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
@@ -472,7 +474,8 @@ set_keyversion(dst_key_t *key) {
|
||||
* set the creation date
|
||||
*/
|
||||
if (major < 1 || (major == 1 && minor <= 2)) {
|
||||
isc_stdtime_t now = isc_stdtime_now();
|
||||
isc_stdtime_t now;
|
||||
isc_stdtime_get(&now);
|
||||
dst_key_settime(key, DST_TIME_CREATED, now);
|
||||
}
|
||||
}
|
||||
@@ -487,7 +490,9 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
|
||||
uint16_t id, oldid;
|
||||
uint32_t rid, roldid;
|
||||
dns_secalg_t alg;
|
||||
isc_stdtime_t now = isc_stdtime_now();
|
||||
char filename[NAME_MAX];
|
||||
isc_buffer_t fileb;
|
||||
isc_stdtime_t now;
|
||||
|
||||
if (exact != NULL) {
|
||||
*exact = false;
|
||||
@@ -497,9 +502,24 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
|
||||
rid = dst_key_rid(dstkey);
|
||||
alg = dst_key_alg(dstkey);
|
||||
|
||||
/*
|
||||
* For Diffie Hellman just check if there is a direct collision as
|
||||
* they can't be revoked. Additionally dns_dnssec_findmatchingkeys
|
||||
* only handles DNSKEY which is not used for HMAC.
|
||||
*/
|
||||
if (alg == DST_ALG_DH) {
|
||||
isc_buffer_init(&fileb, filename, sizeof(filename));
|
||||
result = dst_key_buildfilename(dstkey, DST_TYPE_PRIVATE, dir,
|
||||
&fileb);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (true);
|
||||
}
|
||||
return (isc_file_exists(filename));
|
||||
}
|
||||
|
||||
ISC_LIST_INIT(matchkeys);
|
||||
result = dns_dnssec_findmatchingkeys(name, NULL, dir, NULL, now, mctx,
|
||||
&matchkeys);
|
||||
isc_stdtime_get(&now);
|
||||
result = dns_dnssec_findmatchingkeys(name, dir, now, mctx, &matchkeys);
|
||||
if (result == ISC_R_NOTFOUND) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
@@ -38,8 +38,8 @@ AM_CPPFLAGS += \
|
||||
sbin_PROGRAMS = named
|
||||
|
||||
nodist_named_SOURCES = xsl.c
|
||||
BUILT_SOURCES += xsl.c
|
||||
CLEANFILES += xsl.c
|
||||
BUILT_SOURCES = xsl.c
|
||||
CLEANFILES = xsl.c
|
||||
|
||||
EXTRA_DIST = bind9.xsl
|
||||
|
||||
|
||||
@@ -303,7 +303,6 @@
|
||||
<a href="/xml/v3/status">Status</a>,
|
||||
<a href="/xml/v3/server">Server</a>,
|
||||
<a href="/xml/v3/zones">Zones</a>,
|
||||
<a href="/xml/v3/xfrins">Incoming Zone Transfers</a>,
|
||||
<a href="/xml/v3/net">Network</a>,
|
||||
<a href="/xml/v3/mem">Memory</a> and
|
||||
<a href="/xml/v3/traffic">Traffic Size</a></p>
|
||||
@@ -908,63 +907,6 @@
|
||||
</xsl:for-each>
|
||||
</xsl:for-each>
|
||||
</xsl:if>
|
||||
<xsl:if test="views/view/xfrins/xfrin">
|
||||
<xsl:for-each select="views/view">
|
||||
<h3>Incoming Zone Transfers for View <xsl:value-of select="@name"/></h3>
|
||||
<table class="xfrins">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Zone Name</th>
|
||||
<th>Zone Type</th>
|
||||
<th>Local Serial</th>
|
||||
<th>Remote Serial</th>
|
||||
<th>IXFR</th>
|
||||
<th>First Refresh</th>
|
||||
<th>State</th>
|
||||
<th>Additional Refresh Queued</th>
|
||||
<th>Local Address</th>
|
||||
<th>Remote Address</th>
|
||||
<th>SOA Transport</th>
|
||||
<th>Transport</th>
|
||||
<th>TSIG Key Name</th>
|
||||
<th>Duration (s)</th>
|
||||
<th>Messages Received</th>
|
||||
<th>Records Received</th>
|
||||
<th>Bytes Received</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<xsl:for-each select="xfrins/xfrin">
|
||||
<xsl:variable name="css-class16">
|
||||
<xsl:choose>
|
||||
<xsl:when test="position() mod 2 = 0">even</xsl:when>
|
||||
<xsl:otherwise>odd</xsl:otherwise>
|
||||
</xsl:choose>
|
||||
</xsl:variable>
|
||||
<tr class="{$css-class16}">
|
||||
<td><xsl:value-of select="@name"/></td>
|
||||
<td><xsl:value-of select="type"/></td>
|
||||
<td><xsl:value-of select="serial"/></td>
|
||||
<td><xsl:value-of select="remoteserial"/></td>
|
||||
<td><xsl:value-of select="ixfr"/></td>
|
||||
<td><xsl:value-of select="firstrefresh"/></td>
|
||||
<td><xsl:value-of select="state"/></td>
|
||||
<td><xsl:value-of select="refreshqueued"/></td>
|
||||
<td><xsl:value-of select="localaddr"/></td>
|
||||
<td><xsl:value-of select="remoteaddr"/></td>
|
||||
<td><xsl:value-of select="soatransport"/></td>
|
||||
<td><xsl:value-of select="transport"/></td>
|
||||
<td><xsl:value-of select="tsigkeyname"/></td>
|
||||
<td><xsl:value-of select="duration"/></td>
|
||||
<td><xsl:value-of select="nmsg"/></td>
|
||||
<td><xsl:value-of select="nrecs"/></td>
|
||||
<td><xsl:value-of select="nbytes"/></td>
|
||||
</tr>
|
||||
</xsl:for-each>
|
||||
</tbody>
|
||||
</table>
|
||||
</xsl:for-each>
|
||||
</xsl:if>
|
||||
<xsl:if test="memory/summary">
|
||||
<h2>Memory Usage Summary</h2>
|
||||
<table class="counters">
|
||||
|
||||
+6
-5
@@ -126,7 +126,7 @@ putrdata(bdbnode_t *node, dns_rdatatype_t typeval, dns_ttl_t ttl,
|
||||
rdata = isc_mem_get(mctx, sizeof(dns_rdata_t));
|
||||
|
||||
isc_buffer_allocate(mctx, &rdatabuf, rdlen);
|
||||
region.base = UNCONST(rdatap);
|
||||
DE_CONST(rdatap, region.base);
|
||||
region.length = rdlen;
|
||||
isc_buffer_copyregion(rdatabuf, ®ion);
|
||||
isc_buffer_usedregion(rdatabuf, ®ion);
|
||||
@@ -608,7 +608,7 @@ ipv4reverse_lookup(bdbnode_t *node) {
|
||||
*/
|
||||
static void
|
||||
disassociate(dns_rdataset_t *rdataset DNS__DB_FLARG) {
|
||||
dns_dbnode_t *node = rdataset->rdlist.node;
|
||||
dns_dbnode_t *node = rdataset->private5;
|
||||
bdbnode_t *bdbnode = (bdbnode_t *)node;
|
||||
dns_db_t *db = (dns_db_t *)bdbnode->bdb;
|
||||
|
||||
@@ -618,12 +618,13 @@ disassociate(dns_rdataset_t *rdataset DNS__DB_FLARG) {
|
||||
|
||||
static void
|
||||
rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target DNS__DB_FLARG) {
|
||||
dns_dbnode_t *node = source->rdlist.node;
|
||||
dns_dbnode_t *node = source->private5;
|
||||
bdbnode_t *bdbnode = (bdbnode_t *)node;
|
||||
dns_db_t *db = (dns_db_t *)bdbnode->bdb;
|
||||
|
||||
dns_rdatalist_clone(source, target DNS__DB_FLARG_PASS);
|
||||
attachnode(db, node, &target->rdlist.node DNS__DB_FLARG_PASS);
|
||||
attachnode(db, node,
|
||||
(dns_dbnode_t **)&target->private5 DNS__DB_FLARG_PASS);
|
||||
}
|
||||
|
||||
static dns_rdatasetmethods_t bdb_rdataset_methods = {
|
||||
@@ -643,7 +644,7 @@ new_rdataset(dns_rdatalist_t *rdatalist, dns_db_t *db, dns_dbnode_t *node,
|
||||
dns_rdatalist_tordataset(rdatalist, rdataset);
|
||||
|
||||
rdataset->methods = &bdb_rdataset_methods;
|
||||
dns_db_attachnode(db, node, &rdataset->rdlist.node);
|
||||
dns_db_attachnode(db, node, &rdataset->private5);
|
||||
}
|
||||
|
||||
/*
|
||||
|
||||
+73
-35
@@ -67,6 +67,7 @@ options {\n\
|
||||
interface-interval 60;\n\
|
||||
listen-on {any;};\n\
|
||||
listen-on-v6 {any;};\n\
|
||||
# lock-file \"" NAMED_LOCALSTATEDIR "/run/named/named.lock\";\n\
|
||||
match-mapped-addresses no;\n\
|
||||
max-ixfr-ratio 100%;\n\
|
||||
max-rsa-exponent-size 0; /* no limit */\n\
|
||||
@@ -118,6 +119,7 @@ options {\n\
|
||||
tcp-listen-queue 10;\n\
|
||||
tcp-receive-buffer 0;\n\
|
||||
tcp-send-buffer 0;\n\
|
||||
# tkey-dhkey <none>\n\
|
||||
# tkey-domain <none>\n\
|
||||
# tkey-gssapi-credential <none>\n\
|
||||
transfer-message-size 20480;\n\
|
||||
@@ -132,8 +134,6 @@ options {\n\
|
||||
/* view */\n\
|
||||
allow-new-zones no;\n\
|
||||
allow-notify {none;};\n\
|
||||
allow-proxy {none;};\n\
|
||||
allow-proxy-on {any;};\n\
|
||||
allow-query-cache { localnets; localhost; };\n\
|
||||
allow-query-cache-on { any; };\n\
|
||||
allow-recursion { localnets; localhost; };\n\
|
||||
@@ -150,9 +150,6 @@ options {\n\
|
||||
clients-per-query 10;\n\
|
||||
dnssec-accept-expired no;\n\
|
||||
dnssec-validation " VALIDATION_DEFAULT "; \n"
|
||||
#ifdef USE_DNSRPS
|
||||
" dnsrps-library \"" DNSRPS_LIBRPZ_PATH "\";\n"
|
||||
#endif /* ifdef USE_DNSRPS */
|
||||
#ifdef HAVE_DNSTAP
|
||||
" dnstap-identity hostname;\n"
|
||||
#endif /* ifdef HAVE_DNSTAP */
|
||||
@@ -189,6 +186,8 @@ options {\n\
|
||||
request-expire true;\n\
|
||||
request-ixfr true;\n\
|
||||
require-server-cookie no;\n\
|
||||
resolver-nonbackoff-tries 3;\n\
|
||||
resolver-retry-interval 800; /* in milliseconds */\n\
|
||||
root-key-sentinel yes;\n\
|
||||
servfail-ttl 1;\n\
|
||||
# sortlist <none>\n\
|
||||
@@ -200,7 +199,6 @@ options {\n\
|
||||
synth-from-dnssec yes;\n\
|
||||
# topology <none>\n\
|
||||
transfer-format many-answers;\n\
|
||||
resolver-use-dns64 false;\n\
|
||||
v6-bias 50;\n\
|
||||
zero-no-soa-ttl-cache no;\n\
|
||||
\n\
|
||||
@@ -215,7 +213,9 @@ options {\n\
|
||||
check-srv-cname warn;\n\
|
||||
check-wildcard yes;\n\
|
||||
dialup no;\n\
|
||||
dnssec-dnskey-kskonly yes;\n\
|
||||
dnssec-loadkeys-interval 60;\n\
|
||||
dnssec-update-mode maintain;\n\
|
||||
# forward <none>\n\
|
||||
# forwarders <none>\n\
|
||||
# inline-signing no;\n\
|
||||
@@ -238,9 +238,12 @@ options {\n\
|
||||
sig-signing-nodes 100;\n\
|
||||
sig-signing-signatures 10;\n\
|
||||
sig-signing-type 65534;\n\
|
||||
sig-validity-interval 30; /* days */\n\
|
||||
dnskey-sig-validity 0; /* default: sig-validity-interval */\n\
|
||||
transfer-source *;\n\
|
||||
transfer-source-v6 *;\n\
|
||||
try-tcp-refresh yes; /* BIND 8 compat */\n\
|
||||
update-check-ksk yes;\n\
|
||||
zero-no-soa-ttl yes;\n\
|
||||
zone-statistics terse;\n\
|
||||
};\n\
|
||||
@@ -291,10 +294,8 @@ dnssec-policy \"default\" {\n\
|
||||
csk key-directory lifetime unlimited algorithm 13;\n\
|
||||
};\n\
|
||||
\n\
|
||||
cdnskey yes;\n\
|
||||
cds-digest-types { 2; };\n\
|
||||
dnskey-ttl " DNS_KASP_KEY_TTL ";\n\
|
||||
inline-signing yes;\n\
|
||||
publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\
|
||||
retire-safety " DNS_KASP_RETIRE_SAFETY "; \n\
|
||||
purge-keys " DNS_KASP_PURGE_KEYS "; \n\
|
||||
@@ -308,9 +309,7 @@ dnssec-policy \"default\" {\n\
|
||||
};\n\
|
||||
\n\
|
||||
dnssec-policy \"insecure\" {\n\
|
||||
max-zone-ttl 0; \n\
|
||||
keys { };\n\
|
||||
inline-signing yes;\n\
|
||||
};\n\
|
||||
\n\
|
||||
"
|
||||
@@ -327,14 +326,14 @@ dnssec-policy \"insecure\" {\n\
|
||||
"# END TRUST ANCHORS\n\
|
||||
\n\
|
||||
primaries " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
|
||||
2801:1b8:10::b; # b.root-servers.net\n\
|
||||
2001:500:200::b; # b.root-servers.net\n\
|
||||
2001:500:2::c; # c.root-servers.net\n\
|
||||
2001:500:2f::f; # f.root-servers.net\n\
|
||||
2001:500:12::d0d; # g.root-servers.net\n\
|
||||
2001:7fd::1; # k.root-servers.net\n\
|
||||
2620:0:2830:202::132; # xfr.cjr.dns.icann.org\n\
|
||||
2620:0:2d0:202::132; # xfr.lax.dns.icann.org\n\
|
||||
170.247.170.2; # b.root-servers.net\n\
|
||||
199.9.14.201; # b.root-servers.net\n\
|
||||
192.33.4.12; # c.root-servers.net\n\
|
||||
192.5.5.241; # f.root-servers.net\n\
|
||||
192.112.36.4; # g.root-servers.net\n\
|
||||
@@ -440,7 +439,7 @@ named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
|
||||
*classp = defclass;
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
r.base = UNCONST(cfg_obj_asstring(classobj));
|
||||
DE_CONST(cfg_obj_asstring(classobj), r.base);
|
||||
r.length = strlen(r.base);
|
||||
result = dns_rdataclass_fromtext(classp, &r);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
@@ -460,7 +459,7 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
|
||||
*typep = deftype;
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
r.base = UNCONST(cfg_obj_asstring(typeobj));
|
||||
DE_CONST(cfg_obj_asstring(typeobj), r.base);
|
||||
r.length = strlen(r.base);
|
||||
result = dns_rdatatype_fromtext(typep, &r);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
@@ -576,18 +575,22 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
#define grow_array(mctx, array, newlen, oldlen) \
|
||||
if (newlen >= oldlen) { \
|
||||
array = isc_mem_creget(mctx, array, oldlen, newlen + 16, \
|
||||
sizeof(array[0])); \
|
||||
oldlen = newlen + 16; \
|
||||
#define grow_array(mctx, array, newlen, oldlen) \
|
||||
if (newlen >= oldlen) { \
|
||||
size_t newsize = (newlen + 16) * sizeof(array[0]); \
|
||||
size_t oldsize = oldlen * sizeof(array[0]); \
|
||||
array = isc_mem_regetx(mctx, array, oldsize, newsize, \
|
||||
ISC_MEM_ZERO); \
|
||||
oldlen = newlen + 16; \
|
||||
}
|
||||
|
||||
#define shrink_array(mctx, array, newlen, oldlen) \
|
||||
if (newlen < oldlen) { \
|
||||
array = isc_mem_creget(mctx, array, oldlen, newlen, \
|
||||
sizeof(array[0])); \
|
||||
oldlen = newlen; \
|
||||
#define shrink_array(mctx, array, newlen, oldlen) \
|
||||
if (newlen < oldlen) { \
|
||||
size_t newsize = newlen * sizeof(array[0]); \
|
||||
size_t oldsize = oldlen * sizeof(array[0]); \
|
||||
array = isc_mem_regetx(mctx, array, oldsize, newsize, \
|
||||
ISC_MEM_ZERO); \
|
||||
oldlen = newlen; \
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
@@ -804,10 +807,10 @@ resume:
|
||||
shrink_array(mctx, sources, i, srccount);
|
||||
|
||||
if (lists != NULL) {
|
||||
isc_mem_cput(mctx, lists, listcount, sizeof(lists[0]));
|
||||
isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
|
||||
}
|
||||
if (stack != NULL) {
|
||||
isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
|
||||
isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
|
||||
}
|
||||
|
||||
INSIST(keycount == addrcount);
|
||||
@@ -825,7 +828,7 @@ resume:
|
||||
|
||||
cleanup:
|
||||
if (addrs != NULL) {
|
||||
isc_mem_cput(mctx, addrs, addrcount, sizeof(addrs[0]));
|
||||
isc_mem_put(mctx, addrs, addrcount * sizeof(addrs[0]));
|
||||
}
|
||||
if (keys != NULL) {
|
||||
for (size_t j = 0; j < i; j++) {
|
||||
@@ -837,7 +840,7 @@ cleanup:
|
||||
}
|
||||
isc_mem_put(mctx, keys[j], sizeof(*keys[j]));
|
||||
}
|
||||
isc_mem_cput(mctx, keys, keycount, sizeof(keys[0]));
|
||||
isc_mem_put(mctx, keys, keycount * sizeof(keys[0]));
|
||||
}
|
||||
if (tlss != NULL) {
|
||||
for (size_t j = 0; j < i; j++) {
|
||||
@@ -849,16 +852,16 @@ cleanup:
|
||||
}
|
||||
isc_mem_put(mctx, tlss[j], sizeof(*tlss[j]));
|
||||
}
|
||||
isc_mem_cput(mctx, tlss, tlscount, sizeof(tlss[0]));
|
||||
isc_mem_put(mctx, tlss, tlscount * sizeof(tlss[0]));
|
||||
}
|
||||
if (sources != NULL) {
|
||||
isc_mem_cput(mctx, sources, srccount, sizeof(sources[0]));
|
||||
isc_mem_put(mctx, sources, srccount * sizeof(sources[0]));
|
||||
}
|
||||
if (lists != NULL) {
|
||||
isc_mem_cput(mctx, lists, listcount, sizeof(lists[0]));
|
||||
isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
|
||||
}
|
||||
if (stack != NULL) {
|
||||
isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
|
||||
isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
|
||||
}
|
||||
return (result);
|
||||
}
|
||||
@@ -916,8 +919,14 @@ struct keyalgorithms {
|
||||
{ NULL, hmacnone, DST_ALG_UNKNOWN, 0 } };
|
||||
|
||||
isc_result_t
|
||||
named_config_getkeyalgorithm(const char *str, unsigned int *typep,
|
||||
named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
|
||||
uint16_t *digestbits) {
|
||||
return (named_config_getkeyalgorithm2(str, name, NULL, digestbits));
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
|
||||
unsigned int *typep, uint16_t *digestbits) {
|
||||
int i;
|
||||
size_t len = 0;
|
||||
uint16_t bits;
|
||||
@@ -948,7 +957,36 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
|
||||
} else {
|
||||
bits = algorithms[i].size;
|
||||
}
|
||||
SET_IF_NOT_NULL(typep, algorithms[i].type);
|
||||
SET_IF_NOT_NULL(digestbits, bits);
|
||||
|
||||
if (name != NULL) {
|
||||
switch (algorithms[i].hmac) {
|
||||
case hmacmd5:
|
||||
*name = dns_tsig_hmacmd5_name;
|
||||
break;
|
||||
case hmacsha1:
|
||||
*name = dns_tsig_hmacsha1_name;
|
||||
break;
|
||||
case hmacsha224:
|
||||
*name = dns_tsig_hmacsha224_name;
|
||||
break;
|
||||
case hmacsha256:
|
||||
*name = dns_tsig_hmacsha256_name;
|
||||
break;
|
||||
case hmacsha384:
|
||||
*name = dns_tsig_hmacsha384_name;
|
||||
break;
|
||||
case hmacsha512:
|
||||
*name = dns_tsig_hmacsha512_name;
|
||||
break;
|
||||
default:
|
||||
UNREACHABLE();
|
||||
}
|
||||
}
|
||||
if (typep != NULL) {
|
||||
*typep = algorithms[i].type;
|
||||
}
|
||||
if (digestbits != NULL) {
|
||||
*digestbits = bits;
|
||||
}
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
+4
-2
@@ -177,7 +177,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
|
||||
/* Do not flush master files */
|
||||
named_server_flushonshutdown(named_g_server, false);
|
||||
named_os_shutdownmsg(cmdline, *text);
|
||||
isc_loopmgr_shutdown(named_g_loopmgr);
|
||||
result = ISC_R_SHUTTINGDOWN;
|
||||
} else if (command_compare(command, NAMED_COMMAND_STOP)) {
|
||||
/*
|
||||
@@ -195,7 +194,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
|
||||
#endif /* ifdef HAVE_LIBSCF */
|
||||
named_server_flushonshutdown(named_g_server, true);
|
||||
named_os_shutdownmsg(cmdline, *text);
|
||||
isc_loopmgr_shutdown(named_g_loopmgr);
|
||||
result = ISC_R_SHUTTINGDOWN;
|
||||
} else if (command_compare(command, NAMED_COMMAND_ADDZONE) ||
|
||||
command_compare(command, NAMED_COMMAND_MODZONE))
|
||||
@@ -278,6 +276,10 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
|
||||
result = named_server_freeze(named_g_server, false, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_TRACE)) {
|
||||
result = named_server_setdebuglevel(named_g_server, lex);
|
||||
} else if (command_compare(command, NAMED_COMMAND_TSIGDELETE)) {
|
||||
result = named_server_tsigdelete(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_TSIGLIST)) {
|
||||
result = named_server_tsiglist(named_g_server, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_VALIDATION)) {
|
||||
result = named_server_validation(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_ZONESTATUS)) {
|
||||
|
||||
+320
-221
@@ -27,7 +27,6 @@
|
||||
#include <isc/netmgr.h>
|
||||
#include <isc/nonce.h>
|
||||
#include <isc/random.h>
|
||||
#include <isc/refcount.h>
|
||||
#include <isc/result.h>
|
||||
#include <isc/stdtime.h>
|
||||
#include <isc/string.h>
|
||||
@@ -49,8 +48,6 @@
|
||||
#include <named/main.h>
|
||||
#include <named/server.h>
|
||||
|
||||
/* Add -DNAMED_CONTROLCONF_TRACE=1 to CFLAGS for detailed reference tracing */
|
||||
|
||||
typedef struct controlkey controlkey_t;
|
||||
typedef ISC_LIST(controlkey_t) controlkeylist_t;
|
||||
|
||||
@@ -68,8 +65,12 @@ struct controlkey {
|
||||
};
|
||||
|
||||
struct controlconnection {
|
||||
isc_refcount_t references;
|
||||
isc_nmhandle_t *readhandle;
|
||||
isc_nmhandle_t *sendhandle;
|
||||
isc_nmhandle_t *cmdhandle;
|
||||
isccc_ccmsg_t ccmsg;
|
||||
bool reading;
|
||||
bool sending;
|
||||
controllistener_t *listener;
|
||||
isccc_sexpr_t *ctrl;
|
||||
isc_buffer_t *buffer;
|
||||
@@ -82,7 +83,6 @@ struct controlconnection {
|
||||
isc_stdtime_t now;
|
||||
isc_result_t result;
|
||||
ISC_LINK(controlconnection_t) link;
|
||||
bool shuttingdown;
|
||||
};
|
||||
|
||||
struct controllistener {
|
||||
@@ -91,9 +91,10 @@ struct controllistener {
|
||||
isc_sockaddr_t address;
|
||||
isc_nmsocket_t *sock;
|
||||
dns_acl_t *acl;
|
||||
bool shuttingdown;
|
||||
isc_refcount_t references;
|
||||
bool exiting;
|
||||
isc_refcount_t refs;
|
||||
controlkeylist_t keys;
|
||||
isc_mutex_t connections_lock;
|
||||
controlconnectionlist_t connections;
|
||||
isc_socktype_t type;
|
||||
uint32_t perm;
|
||||
@@ -106,7 +107,7 @@ struct controllistener {
|
||||
struct named_controls {
|
||||
named_server_t *server;
|
||||
controllistenerlist_t listeners;
|
||||
bool shuttingdown;
|
||||
atomic_bool shuttingdown;
|
||||
isc_mutex_t symtab_lock;
|
||||
isccc_symtab_t *symtab;
|
||||
};
|
||||
@@ -115,48 +116,9 @@ static isc_result_t
|
||||
control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg);
|
||||
static void
|
||||
control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg);
|
||||
static void
|
||||
conn_cleanup(controlconnection_t *conn);
|
||||
static void
|
||||
conn_free(controlconnection_t *conn);
|
||||
static void
|
||||
conn_shutdown(controlconnection_t *conn);
|
||||
|
||||
#if NAMED_CONTROLCONF_TRACE
|
||||
#define controllistener_ref(ptr) \
|
||||
controllistener__ref(ptr, __func__, __FILE__, __LINE__)
|
||||
#define controllistener_unref(ptr) \
|
||||
controllistener__unref(ptr, __func__, __FILE__, __LINE__)
|
||||
#define controllistener_attach(ptr, ptrp) \
|
||||
controllistener__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
|
||||
#define controllistener_detach(ptrp) \
|
||||
controllistener__detach(ptrp, __func__, __FILE__, __LINE__)
|
||||
ISC_REFCOUNT_TRACE_DECL(controllistener);
|
||||
|
||||
#define controlconnection_ref(ptr) \
|
||||
controlconnection__ref(ptr, __func__, __FILE__, __LINE__)
|
||||
#define controlconnection_unref(ptr) \
|
||||
controlconnection__unref(ptr, __func__, __FILE__, __LINE__)
|
||||
#define controlconnection_attach(ptr, ptrp) \
|
||||
controlconnection__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
|
||||
#define controlconnection_detach(ptrp) \
|
||||
controlconnection__detach(ptrp, __func__, __FILE__, __LINE__)
|
||||
ISC_REFCOUNT_TRACE_DECL(controlconnection);
|
||||
#else
|
||||
ISC_REFCOUNT_DECL(controllistener);
|
||||
ISC_REFCOUNT_DECL(controlconnection);
|
||||
#endif
|
||||
|
||||
#define CLOCKSKEW 300
|
||||
|
||||
#define CHECK(x) \
|
||||
{ \
|
||||
result = (x); \
|
||||
if (result != ISC_R_SUCCESS) { \
|
||||
goto cleanup; \
|
||||
} \
|
||||
}
|
||||
|
||||
static void
|
||||
free_controlkey(controlkey_t *key, isc_mem_t *mctx) {
|
||||
if (key->keyname != NULL) {
|
||||
@@ -179,8 +141,11 @@ free_controlkeylist(controlkeylist_t *keylist, isc_mem_t *mctx) {
|
||||
|
||||
static void
|
||||
free_listener(controllistener_t *listener) {
|
||||
REQUIRE(listener->shuttingdown);
|
||||
REQUIRE(ISC_LIST_EMPTY(listener->connections));
|
||||
INSIST(listener->exiting);
|
||||
INSIST(ISC_LIST_EMPTY(listener->connections));
|
||||
|
||||
isc_refcount_destroy(&listener->refs);
|
||||
|
||||
REQUIRE(listener->sock == NULL);
|
||||
|
||||
free_controlkeylist(&listener->keys, listener->mctx);
|
||||
@@ -188,50 +153,42 @@ free_listener(controllistener_t *listener) {
|
||||
if (listener->acl != NULL) {
|
||||
dns_acl_detach(&listener->acl);
|
||||
}
|
||||
isc_mutex_destroy(&listener->connections_lock);
|
||||
|
||||
isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
|
||||
}
|
||||
|
||||
#if NAMED_CONTROLCONF_TRACE
|
||||
ISC_REFCOUNT_TRACE_IMPL(controllistener, free_listener);
|
||||
ISC_REFCOUNT_TRACE_IMPL(controlconnection, conn_free);
|
||||
#else
|
||||
ISC_REFCOUNT_IMPL(controllistener, free_listener);
|
||||
ISC_REFCOUNT_IMPL(controlconnection, conn_free);
|
||||
#endif
|
||||
static void
|
||||
maybe_free_listener(controllistener_t *listener) {
|
||||
if (isc_refcount_decrement(&listener->refs) == 1) {
|
||||
free_listener(listener);
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
shutdown_listener(controllistener_t *listener) {
|
||||
controlconnection_t *conn = NULL;
|
||||
controlconnection_t *next = NULL;
|
||||
if (!listener->exiting) {
|
||||
char socktext[ISC_SOCKADDR_FORMATSIZE];
|
||||
|
||||
/* Don't shutdown the same listener twice */
|
||||
if (listener->shuttingdown) {
|
||||
return;
|
||||
ISC_LIST_UNLINK(listener->controls->listeners, listener, link);
|
||||
|
||||
isc_sockaddr_format(&listener->address, socktext,
|
||||
sizeof(socktext));
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
|
||||
"stopping command channel on %s", socktext);
|
||||
#if 0
|
||||
/* XXX: no unix domain socket support */
|
||||
if (listener->type == isc_socktype_unix) {
|
||||
isc_socket_cleanunix(&listener->address, true);
|
||||
}
|
||||
#endif
|
||||
listener->exiting = true;
|
||||
}
|
||||
listener->shuttingdown = true;
|
||||
|
||||
for (conn = ISC_LIST_HEAD(listener->connections); conn != NULL;
|
||||
conn = next)
|
||||
{
|
||||
/*
|
||||
* 'conn' is likely to be freed by the conn_shutdown() call.
|
||||
*/
|
||||
next = ISC_LIST_NEXT(conn, link);
|
||||
conn_shutdown(conn);
|
||||
}
|
||||
|
||||
ISC_LIST_UNLINK(listener->controls->listeners, listener, link);
|
||||
|
||||
char socktext[ISC_SOCKADDR_FORMATSIZE];
|
||||
isc_sockaddr_format(&listener->address, socktext, sizeof(socktext));
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
|
||||
"stopping command channel on %s", socktext);
|
||||
|
||||
isc_nm_stoplistening(listener->sock);
|
||||
isc_nmsocket_close(&listener->sock);
|
||||
controllistener_detach(&listener);
|
||||
maybe_free_listener(listener);
|
||||
}
|
||||
|
||||
static bool
|
||||
@@ -242,6 +199,11 @@ address_ok(isc_sockaddr_t *sockaddr, controllistener_t *listener) {
|
||||
isc_result_t result;
|
||||
int match;
|
||||
|
||||
/* ACL doesn't apply to unix domain sockets */
|
||||
if (listener->type != isc_socktype_tcp) {
|
||||
return (true);
|
||||
}
|
||||
|
||||
isc_netaddr_fromsockaddr(&netaddr, sockaddr);
|
||||
|
||||
result = dns_acl_match(&netaddr, NULL, listener->acl, env, &match,
|
||||
@@ -252,37 +214,43 @@ address_ok(isc_sockaddr_t *sockaddr, controllistener_t *listener) {
|
||||
static void
|
||||
control_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
|
||||
controlconnection_t *conn = (controlconnection_t *)arg;
|
||||
controllistener_t *listener = conn->listener;
|
||||
isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);
|
||||
|
||||
if (conn->shuttingdown) {
|
||||
/* The connection is shuttingdown */
|
||||
result = ISC_R_SHUTTINGDOWN;
|
||||
REQUIRE(conn->sending);
|
||||
|
||||
conn->sending = false;
|
||||
|
||||
if (conn->result == ISC_R_SHUTTINGDOWN) {
|
||||
isc_loopmgr_shutdown(named_g_loopmgr);
|
||||
goto cleanup_sendhandle;
|
||||
}
|
||||
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
/* Everything is peachy, continue reading from the socket */
|
||||
isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage,
|
||||
conn);
|
||||
/* Detach the sending reference */
|
||||
controlconnection_detach(&conn);
|
||||
return;
|
||||
}
|
||||
|
||||
if (result != ISC_R_SHUTTINGDOWN) {
|
||||
if (atomic_load_acquire(&listener->controls->shuttingdown) ||
|
||||
result == ISC_R_SHUTTINGDOWN)
|
||||
{
|
||||
goto cleanup_sendhandle;
|
||||
} else if (result != ISC_R_SUCCESS) {
|
||||
char socktext[ISC_SOCKADDR_FORMATSIZE];
|
||||
isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);
|
||||
|
||||
isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
|
||||
"error sending command response to %s: %s",
|
||||
socktext, isc_result_totext(result));
|
||||
goto cleanup_sendhandle;
|
||||
}
|
||||
|
||||
/* Shutdown the reading */
|
||||
conn_shutdown(conn);
|
||||
isc_nmhandle_attach(handle, &conn->readhandle);
|
||||
conn->reading = true;
|
||||
|
||||
/* Detach the sending reference */
|
||||
controlconnection_detach(&conn);
|
||||
isc_nmhandle_detach(&conn->sendhandle);
|
||||
|
||||
isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);
|
||||
return;
|
||||
|
||||
cleanup_sendhandle:
|
||||
isc_nmhandle_detach(&conn->sendhandle);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -317,7 +285,7 @@ conn_cleanup(controlconnection_t *conn) {
|
||||
}
|
||||
|
||||
static void
|
||||
control_respond(controlconnection_t *conn) {
|
||||
control_respond(isc_nmhandle_t *handle, controlconnection_t *conn) {
|
||||
controllistener_t *listener = conn->listener;
|
||||
isccc_sexpr_t *data = NULL;
|
||||
isc_buffer_t b;
|
||||
@@ -379,7 +347,7 @@ control_respond(controlconnection_t *conn) {
|
||||
result = isccc_cc_towire(conn->response, &conn->buffer, conn->alg,
|
||||
&conn->secret);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
isc_buffer_init(&b, conn->buffer->base, 4);
|
||||
@@ -388,50 +356,39 @@ control_respond(controlconnection_t *conn) {
|
||||
r.base = conn->buffer->base;
|
||||
r.length = conn->buffer->used;
|
||||
|
||||
/* Attach the sending reference */
|
||||
controlconnection_ref(conn);
|
||||
isccc_ccmsg_sendmessage(&conn->ccmsg, &r, control_senddone, conn);
|
||||
isc_nmhandle_attach(handle, &conn->sendhandle);
|
||||
conn->sending = true;
|
||||
conn_cleanup(conn);
|
||||
|
||||
isc_nmhandle_detach(&conn->cmdhandle);
|
||||
|
||||
isc_nm_send(conn->sendhandle, &r, control_senddone, conn);
|
||||
|
||||
return;
|
||||
|
||||
cleanup:
|
||||
conn_cleanup(conn);
|
||||
isc_nmhandle_detach(&conn->cmdhandle);
|
||||
}
|
||||
|
||||
static void
|
||||
control_command(void *arg) {
|
||||
controlconnection_t *conn = (controlconnection_t *)arg;
|
||||
controllistener_t *listener = conn->listener;
|
||||
|
||||
/* Don't run the command if we already started the shutdown */
|
||||
if (!conn->shuttingdown) {
|
||||
conn->result = named_control_docommand(
|
||||
conn->request, conn->listener->readonly, &conn->text);
|
||||
control_respond(conn);
|
||||
}
|
||||
|
||||
/* Detach the control command reference */
|
||||
controlconnection_detach(&conn);
|
||||
}
|
||||
|
||||
static void
|
||||
conn_shutdown(controlconnection_t *conn) {
|
||||
/* Don't shutdown the same controlconnection twice */
|
||||
if (conn->shuttingdown) {
|
||||
if (atomic_load_acquire(&listener->controls->shuttingdown)) {
|
||||
conn_cleanup(conn);
|
||||
isc_nmhandle_detach(&conn->cmdhandle);
|
||||
return;
|
||||
}
|
||||
conn->shuttingdown = true;
|
||||
|
||||
/*
|
||||
* Close the TCP connection to make sure that no read callback will be
|
||||
* called for it ever again.
|
||||
*/
|
||||
isccc_ccmsg_disconnect(&conn->ccmsg);
|
||||
|
||||
/* Detach the reading reference */
|
||||
controlconnection_detach(&conn);
|
||||
conn->result = named_control_docommand(conn->request,
|
||||
listener->readonly, &conn->text);
|
||||
control_respond(conn->cmdhandle, conn);
|
||||
}
|
||||
|
||||
static void
|
||||
control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
void *arg) {
|
||||
control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
|
||||
controlconnection_t *conn = (controlconnection_t *)arg;
|
||||
controllistener_t *listener = conn->listener;
|
||||
controlkey_t *key = NULL;
|
||||
@@ -439,8 +396,22 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
isccc_time_t exp;
|
||||
uint32_t nonce;
|
||||
|
||||
conn->reading = false;
|
||||
|
||||
/* Is the server shutting down? */
|
||||
if (atomic_load_acquire(&listener->controls->shuttingdown)) {
|
||||
goto cleanup_readhandle;
|
||||
}
|
||||
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
goto cleanup;
|
||||
if (result == ISC_R_SHUTTINGDOWN) {
|
||||
atomic_store_release(&listener->controls->shuttingdown,
|
||||
true);
|
||||
} else if (result != ISC_R_EOF) {
|
||||
log_invalid(&conn->ccmsg, result);
|
||||
}
|
||||
|
||||
goto cleanup_readhandle;
|
||||
}
|
||||
|
||||
for (key = ISC_LIST_HEAD(listener->keys); key != NULL;
|
||||
@@ -448,7 +419,8 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
{
|
||||
isccc_region_t ccregion;
|
||||
|
||||
isccc_ccmsg_toregion(&conn->ccmsg, &ccregion);
|
||||
ccregion.rstart = isc_buffer_base(conn->ccmsg.buffer);
|
||||
ccregion.rend = isc_buffer_used(conn->ccmsg.buffer);
|
||||
conn->secret.rstart = isc_mem_get(listener->mctx,
|
||||
key->secret.length);
|
||||
memmove(conn->secret.rstart, key->secret.base,
|
||||
@@ -465,24 +437,24 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
}
|
||||
|
||||
if (key == NULL) {
|
||||
result = ISCCC_R_BADAUTH;
|
||||
log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
/* We shouldn't be getting a reply. */
|
||||
if (isccc_cc_isreply(conn->request)) {
|
||||
result = ISC_R_FAILURE;
|
||||
log_invalid(&conn->ccmsg, ISC_R_FAILURE);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
conn->now = isc_stdtime_now();
|
||||
isc_stdtime_get(&conn->now);
|
||||
|
||||
/*
|
||||
* Limit exposure to replay attacks.
|
||||
*/
|
||||
conn->ctrl = isccc_alist_lookup(conn->request, "_ctrl");
|
||||
if (!isccc_alist_alistp(conn->ctrl)) {
|
||||
result = ISC_R_FAILURE;
|
||||
log_invalid(&conn->ccmsg, ISC_R_FAILURE);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
@@ -490,11 +462,11 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
if ((sent + CLOCKSKEW) < conn->now ||
|
||||
(sent - CLOCKSKEW) > conn->now)
|
||||
{
|
||||
result = ISCCC_R_CLOCKSKEW;
|
||||
log_invalid(&conn->ccmsg, ISCCC_R_CLOCKSKEW);
|
||||
goto cleanup;
|
||||
}
|
||||
} else {
|
||||
result = ISC_R_FAILURE;
|
||||
log_invalid(&conn->ccmsg, ISC_R_FAILURE);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
@@ -504,7 +476,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
if (isccc_cc_lookupuint32(conn->ctrl, "_exp", &exp) == ISC_R_SUCCESS &&
|
||||
conn->now > exp)
|
||||
{
|
||||
result = ISCCC_R_EXPIRED;
|
||||
log_invalid(&conn->ccmsg, ISCCC_R_EXPIRED);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
@@ -520,6 +492,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
if (result == ISC_R_EXISTS) {
|
||||
result = ISCCC_R_DUPLICATE;
|
||||
}
|
||||
log_invalid(&conn->ccmsg, result);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
@@ -528,12 +501,15 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
ISC_R_SUCCESS ||
|
||||
conn->nonce != nonce))
|
||||
{
|
||||
result = ISCCC_R_BADAUTH;
|
||||
log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
isc_buffer_allocate(listener->mctx, &conn->text, 2 * 2048);
|
||||
|
||||
isc_nmhandle_attach(handle, &conn->cmdhandle);
|
||||
isc_nmhandle_detach(&conn->readhandle);
|
||||
|
||||
if (conn->nonce == 0) {
|
||||
/*
|
||||
* Establish nonce.
|
||||
@@ -542,93 +518,101 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
isc_nonce_buf(&conn->nonce, sizeof(conn->nonce));
|
||||
}
|
||||
conn->result = ISC_R_SUCCESS;
|
||||
control_respond(conn);
|
||||
control_respond(handle, conn);
|
||||
return;
|
||||
}
|
||||
|
||||
/* Attach the command reference */
|
||||
controlconnection_ref(conn);
|
||||
/*
|
||||
* Trigger the command.
|
||||
*/
|
||||
|
||||
/* Trigger the command asynchronously. */
|
||||
isc_async_run(named_g_mainloop, control_command, conn);
|
||||
|
||||
return;
|
||||
|
||||
cleanup:
|
||||
switch (result) {
|
||||
case ISC_R_SHUTTINGDOWN:
|
||||
case ISC_R_EOF:
|
||||
break;
|
||||
default:
|
||||
log_invalid(&conn->ccmsg, result);
|
||||
}
|
||||
conn_cleanup(conn);
|
||||
|
||||
conn_shutdown(conn);
|
||||
cleanup_readhandle:
|
||||
/*
|
||||
* readhandle could be NULL if we're shutting down,
|
||||
* but if not we need to detach it.
|
||||
*/
|
||||
if (conn->readhandle != NULL) {
|
||||
isc_nmhandle_detach(&conn->readhandle);
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
conn_free(controlconnection_t *conn) {
|
||||
/* Make sure that the connection was shutdown first */
|
||||
REQUIRE(conn->shuttingdown);
|
||||
|
||||
conn_reset(void *arg) {
|
||||
controlconnection_t *conn = (controlconnection_t *)arg;
|
||||
controllistener_t *listener = conn->listener;
|
||||
|
||||
isccc_ccmsg_invalidate(&conn->ccmsg);
|
||||
|
||||
conn_cleanup(conn);
|
||||
|
||||
if (conn->buffer != NULL) {
|
||||
isc_buffer_free(&conn->buffer);
|
||||
}
|
||||
|
||||
if (conn->reading) {
|
||||
isccc_ccmsg_cancelread(&conn->ccmsg);
|
||||
return;
|
||||
}
|
||||
|
||||
LOCK(&listener->connections_lock);
|
||||
ISC_LIST_UNLINK(listener->connections, conn, link);
|
||||
UNLOCK(&listener->connections_lock);
|
||||
#ifdef ENABLE_AFL
|
||||
if (named_g_fuzz_type == isc_fuzz_rndc) {
|
||||
named_fuzz_notify();
|
||||
}
|
||||
#endif /* ifdef ENABLE_AFL */
|
||||
|
||||
isccc_ccmsg_invalidate(&conn->ccmsg);
|
||||
}
|
||||
|
||||
static void
|
||||
conn_put(void *arg) {
|
||||
controlconnection_t *conn = (controlconnection_t *)arg;
|
||||
controllistener_t *listener = conn->listener;
|
||||
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
|
||||
"freeing control connection");
|
||||
|
||||
isc_mem_put(listener->mctx, conn, sizeof(*conn));
|
||||
|
||||
controllistener_detach(&listener);
|
||||
maybe_free_listener(listener);
|
||||
}
|
||||
|
||||
static void
|
||||
newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
|
||||
/* Don't create new connection if we are shutting down */
|
||||
if (listener->shuttingdown) {
|
||||
controlconnection_t *conn = NULL;
|
||||
|
||||
conn = isc_nmhandle_getdata(handle);
|
||||
if (conn == NULL) {
|
||||
conn = isc_mem_get(listener->mctx, sizeof(*conn));
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
|
||||
"rejected new control connection: %s",
|
||||
isc_result_totext(ISC_R_SHUTTINGDOWN));
|
||||
return;
|
||||
"allocate new control connection");
|
||||
isc_nmhandle_setdata(handle, conn, conn_reset, conn_put);
|
||||
isc_refcount_increment(&listener->refs);
|
||||
}
|
||||
|
||||
controlconnection_t *conn = isc_mem_get(listener->mctx, sizeof(*conn));
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
|
||||
"allocate new control connection");
|
||||
*conn = (controlconnection_t){ .listener = listener,
|
||||
.reading = false,
|
||||
.alg = DST_ALG_UNKNOWN };
|
||||
|
||||
*conn = (controlconnection_t){
|
||||
.alg = DST_ALG_UNKNOWN,
|
||||
.references = ISC_REFCOUNT_INITIALIZER(1),
|
||||
.listener = controllistener_ref(listener),
|
||||
.link = ISC_LINK_INITIALIZER,
|
||||
};
|
||||
|
||||
/* isccc_ccmsg_init() attaches to the handle */
|
||||
isccc_ccmsg_init(listener->mctx, handle, &conn->ccmsg);
|
||||
|
||||
/* Set a 32 KiB upper limit on incoming message. */
|
||||
isccc_ccmsg_setmaxsize(&conn->ccmsg, 32768);
|
||||
|
||||
ISC_LIST_APPEND(listener->connections, conn, link);
|
||||
LOCK(&listener->connections_lock);
|
||||
ISC_LIST_INITANDAPPEND(listener->connections, conn, link);
|
||||
UNLOCK(&listener->connections_lock);
|
||||
|
||||
isc_nmhandle_attach(handle, &conn->readhandle);
|
||||
conn->reading = true;
|
||||
|
||||
/* The reading reference has been initialized in the initializer */
|
||||
isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);
|
||||
}
|
||||
|
||||
@@ -668,7 +652,8 @@ controls_shutdown(named_controls_t *controls) {
|
||||
listener = next)
|
||||
{
|
||||
/*
|
||||
* As listeners shut down, they will call their callbacks.
|
||||
* This is asynchronous. As listeners shut down, they will
|
||||
* call their callbacks.
|
||||
*/
|
||||
next = ISC_LIST_NEXT(listener, link);
|
||||
shutdown_listener(listener);
|
||||
@@ -677,20 +662,8 @@ controls_shutdown(named_controls_t *controls) {
|
||||
|
||||
void
|
||||
named_controls_shutdown(named_controls_t *controls) {
|
||||
/*
|
||||
* Don't ever shutdown the controls twice.
|
||||
*
|
||||
* NOTE: This functions is called when the server is shutting down, but
|
||||
* controls_shutdown() can and will be called multiple times - on each
|
||||
* reconfiguration, the listeners will be torn down and recreated again,
|
||||
* see named_controls_configure() for details.
|
||||
*/
|
||||
if (controls->shuttingdown) {
|
||||
return;
|
||||
}
|
||||
controls->shuttingdown = true;
|
||||
|
||||
controls_shutdown(controls);
|
||||
atomic_store_release(&controls->shuttingdown, true);
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
@@ -780,8 +753,8 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
|
||||
algstr = cfg_obj_asstring(algobj);
|
||||
secretstr = cfg_obj_asstring(secretobj);
|
||||
|
||||
result = named_config_getkeyalgorithm(algstr, &algtype,
|
||||
NULL);
|
||||
result = named_config_getkeyalgorithm2(algstr, NULL,
|
||||
&algtype, NULL);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
cfg_obj_log(control, named_g_lctx,
|
||||
ISC_LOG_WARNING,
|
||||
@@ -819,6 +792,14 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
|
||||
}
|
||||
}
|
||||
|
||||
#define CHECK(x) \
|
||||
do { \
|
||||
result = (x); \
|
||||
if (result != ISC_R_SUCCESS) { \
|
||||
goto cleanup; \
|
||||
} \
|
||||
} while (0)
|
||||
|
||||
static isc_result_t
|
||||
get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
|
||||
isc_result_t result;
|
||||
@@ -866,7 +847,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
|
||||
algstr = cfg_obj_asstring(algobj);
|
||||
secretstr = cfg_obj_asstring(secretobj);
|
||||
|
||||
result = named_config_getkeyalgorithm(algstr, &algtype, NULL);
|
||||
result = named_config_getkeyalgorithm2(algstr, NULL, &algtype, NULL);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
|
||||
"unsupported algorithm '%s' in "
|
||||
@@ -1061,6 +1042,33 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
|
||||
socktext, isc_result_totext(result));
|
||||
}
|
||||
|
||||
#if 0
|
||||
/* XXX: no unix socket support yet */
|
||||
if (result == ISC_R_SUCCESS && type == isc_socktype_unix) {
|
||||
uint32_t perm, owner, group;
|
||||
perm = cfg_obj_asuint32(cfg_tuple_get(control, "perm"));
|
||||
owner = cfg_obj_asuint32(cfg_tuple_get(control, "owner"));
|
||||
group = cfg_obj_asuint32(cfg_tuple_get(control, "group"));
|
||||
result = ISC_R_SUCCESS;
|
||||
if (listener->perm != perm || listener->owner != owner ||
|
||||
listener->group != group)
|
||||
{
|
||||
result = isc_socket_permunix(&listener->address, perm,
|
||||
owner, group);
|
||||
}
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
listener->perm = perm;
|
||||
listener->owner = owner;
|
||||
listener->group = group;
|
||||
} else if (control != NULL) {
|
||||
cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
|
||||
"couldn't update ownership/permission for "
|
||||
"command channel %s",
|
||||
socktext);
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
*listenerp = listener;
|
||||
}
|
||||
|
||||
@@ -1078,21 +1086,16 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
|
||||
isc_result_t result = ISC_R_SUCCESS;
|
||||
int pf;
|
||||
|
||||
/* Don't create new listener if we are shutting down */
|
||||
if (cp->shuttingdown) {
|
||||
result = ISC_R_SHUTTINGDOWN;
|
||||
goto shuttingdown;
|
||||
}
|
||||
|
||||
listener = isc_mem_get(mctx, sizeof(*listener));
|
||||
*listener = (controllistener_t){ .controls = cp,
|
||||
.address = *addr,
|
||||
.type = type };
|
||||
isc_mem_attach(mctx, &listener->mctx);
|
||||
isc_mutex_init(&listener->connections_lock);
|
||||
ISC_LINK_INIT(listener, link);
|
||||
ISC_LIST_INIT(listener->keys);
|
||||
ISC_LIST_INIT(listener->connections);
|
||||
isc_refcount_init(&listener->references, 1);
|
||||
isc_refcount_init(&listener->refs, 1);
|
||||
|
||||
/*
|
||||
* Make the ACL.
|
||||
@@ -1137,14 +1140,35 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
|
||||
|
||||
pf = isc_sockaddr_pf(&listener->address);
|
||||
if ((pf == AF_INET && isc_net_probeipv4() != ISC_R_SUCCESS) ||
|
||||
(pf == AF_UNIX && isc_net_probeunix() != ISC_R_SUCCESS) ||
|
||||
(pf == AF_INET6 && isc_net_probeipv6() != ISC_R_SUCCESS))
|
||||
{
|
||||
CHECK(ISC_R_FAMILYNOSUPPORT);
|
||||
}
|
||||
|
||||
#if 0
|
||||
/* XXX: no unix socket support yet */
|
||||
if (type == isc_socktype_unix) {
|
||||
isc_socket_cleanunix(&listener->address, false);
|
||||
}
|
||||
#endif
|
||||
|
||||
CHECK(isc_nm_listentcp(named_g_netmgr, ISC_NM_LISTEN_ONE,
|
||||
&listener->address, control_newconn, listener, 5,
|
||||
NULL, &listener->sock));
|
||||
#if 0
|
||||
/* XXX: no unix socket support yet */
|
||||
if (type == isc_socktype_unix) {
|
||||
listener->perm =
|
||||
cfg_obj_asuint32(cfg_tuple_get(control, "perm"));
|
||||
listener->owner =
|
||||
cfg_obj_asuint32(cfg_tuple_get(control, "owner"));
|
||||
listener->group =
|
||||
cfg_obj_asuint32(cfg_tuple_get(control, "group"));
|
||||
result = isc_socket_permunix(&listener->address, listener->perm,
|
||||
listener->owner, listener->group);
|
||||
}
|
||||
#endif
|
||||
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
|
||||
@@ -1153,11 +1177,10 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
|
||||
return;
|
||||
|
||||
cleanup:
|
||||
isc_refcount_decrement(&listener->references);
|
||||
listener->shuttingdown = true;
|
||||
isc_refcount_decrement(&listener->refs);
|
||||
listener->exiting = true;
|
||||
free_listener(listener);
|
||||
|
||||
shuttingdown:
|
||||
if (control != NULL) {
|
||||
cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
|
||||
"couldn't add command channel %s: %s", socktext,
|
||||
@@ -1170,6 +1193,8 @@ shuttingdown:
|
||||
}
|
||||
|
||||
*listenerp = NULL;
|
||||
|
||||
/* XXXDCL return error results? fail hard? */
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
@@ -1202,19 +1227,8 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
|
||||
{
|
||||
const cfg_obj_t *controls = NULL;
|
||||
const cfg_obj_t *inetcontrols = NULL;
|
||||
const cfg_obj_t *unixcontrols = NULL;
|
||||
|
||||
controls = cfg_listelt_value(element);
|
||||
|
||||
(void)cfg_map_get(controls, "unix", &unixcontrols);
|
||||
if (unixcontrols != NULL) {
|
||||
cfg_obj_log(controls, named_g_lctx,
|
||||
ISC_LOG_ERROR,
|
||||
"UNIX domain sockets are not "
|
||||
"supported");
|
||||
return (ISC_R_FAILURE);
|
||||
}
|
||||
|
||||
(void)cfg_map_get(controls, "inet", &inetcontrols);
|
||||
if (inetcontrols == NULL) {
|
||||
continue;
|
||||
@@ -1230,8 +1244,8 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
|
||||
|
||||
/*
|
||||
* The parser handles BIND 8 configuration file
|
||||
* syntax, so it allows inet phrases with no
|
||||
* keys{} clause.
|
||||
* syntax, so it allows unix phrases as well
|
||||
* inet phrases with no keys{} clause.
|
||||
*/
|
||||
control = cfg_listelt_value(element2);
|
||||
|
||||
@@ -1279,6 +1293,91 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
|
||||
}
|
||||
}
|
||||
}
|
||||
for (element = cfg_list_first(controlslist); element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *controls = NULL;
|
||||
const cfg_obj_t *unixcontrols = NULL;
|
||||
|
||||
controls = cfg_listelt_value(element);
|
||||
(void)cfg_map_get(controls, "unix", &unixcontrols);
|
||||
if (unixcontrols == NULL) {
|
||||
continue;
|
||||
}
|
||||
|
||||
cfg_obj_log(controls, named_g_lctx, ISC_LOG_ERROR,
|
||||
"UNIX domain sockets not yet supported");
|
||||
return (ISC_R_FAILURE);
|
||||
|
||||
#if 0
|
||||
/* XXX: no unix domain socket support in netmgr */
|
||||
for (element2 = cfg_list_first(unixcontrols);
|
||||
element2 != NULL;
|
||||
element2 = cfg_list_next(element2))
|
||||
{
|
||||
const cfg_obj_t *control = NULL;
|
||||
const cfg_obj_t *path = NULL;
|
||||
isc_sockaddr_t addr;
|
||||
isc_result_t result;
|
||||
|
||||
/*
|
||||
* The parser handles BIND 8 configuration file
|
||||
* syntax, so it allows unix phrases as well
|
||||
* inet phrases with no keys{} clause.
|
||||
*/
|
||||
control = cfg_listelt_value(element2);
|
||||
|
||||
path = cfg_tuple_get(control, "path");
|
||||
result = isc_sockaddr_frompath(
|
||||
&addr, cfg_obj_asstring(path));
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
isc_log_write(
|
||||
named_g_lctx,
|
||||
NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL,
|
||||
ISC_LOG_DEBUG(9),
|
||||
"control channel '%s': %s",
|
||||
cfg_obj_asstring(path),
|
||||
isc_result_totext(result));
|
||||
continue;
|
||||
}
|
||||
|
||||
isc_log_write(named_g_lctx,
|
||||
NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL,
|
||||
ISC_LOG_DEBUG(9),
|
||||
"processing control channel '%s'",
|
||||
cfg_obj_asstring(path));
|
||||
|
||||
update_listener(cp, &listener, control, config,
|
||||
&addr, aclconfctx,
|
||||
cfg_obj_asstring(path),
|
||||
isc_socktype_unix);
|
||||
|
||||
if (listener != NULL) {
|
||||
/*
|
||||
* Remove the listener from the old
|
||||
* list, so it won't be shut down.
|
||||
*/
|
||||
ISC_LIST_UNLINK(cp->listeners, listener,
|
||||
link);
|
||||
} else {
|
||||
/*
|
||||
* This is a new listener.
|
||||
*/
|
||||
add_listener(cp, &listener, control,
|
||||
config, &addr, aclconfctx,
|
||||
cfg_obj_asstring(path),
|
||||
isc_socktype_unix);
|
||||
}
|
||||
|
||||
if (listener != NULL) {
|
||||
ISC_LIST_APPEND(new_listeners, listener,
|
||||
link);
|
||||
}
|
||||
}
|
||||
#endif
|
||||
}
|
||||
} else {
|
||||
int i;
|
||||
|
||||
@@ -1356,6 +1455,7 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
|
||||
|
||||
ISC_LIST_INIT(controls->listeners);
|
||||
|
||||
atomic_init(&controls->shuttingdown, false);
|
||||
isc_mutex_init(&controls->symtab_lock);
|
||||
LOCK(&controls->symtab_lock);
|
||||
result = isccc_cc_createsymtab(&controls->symtab);
|
||||
@@ -1375,7 +1475,6 @@ named_controls_destroy(named_controls_t **ctrlsp) {
|
||||
named_controls_t *controls = *ctrlsp;
|
||||
*ctrlsp = NULL;
|
||||
|
||||
REQUIRE(controls->shuttingdown);
|
||||
REQUIRE(ISC_LIST_EMPTY(controls->listeners));
|
||||
|
||||
LOCK(&controls->symtab_lock);
|
||||
|
||||
@@ -66,5 +66,8 @@ named_config_getport(const cfg_obj_t *config, const char *type,
|
||||
in_port_t *portp);
|
||||
|
||||
isc_result_t
|
||||
named_config_getkeyalgorithm(const char *str, unsigned int *typep,
|
||||
named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
|
||||
uint16_t *digestbits);
|
||||
isc_result_t
|
||||
named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
|
||||
unsigned int *typep, uint16_t *digestbits);
|
||||
|
||||
@@ -20,10 +20,9 @@
|
||||
|
||||
#include <stdbool.h>
|
||||
|
||||
#include <isccc/types.h>
|
||||
|
||||
#include <isccfg/aclconf.h>
|
||||
|
||||
#include <isccc/types.h>
|
||||
#include <named/types.h>
|
||||
|
||||
#define NAMED_CONTROL_PORT 953
|
||||
@@ -44,6 +43,8 @@
|
||||
#define NAMED_COMMAND_FLUSHNAME "flushname"
|
||||
#define NAMED_COMMAND_FLUSHTREE "flushtree"
|
||||
#define NAMED_COMMAND_STATUS "status"
|
||||
#define NAMED_COMMAND_TSIGLIST "tsig-list"
|
||||
#define NAMED_COMMAND_TSIGDELETE "tsig-delete"
|
||||
#define NAMED_COMMAND_FREEZE "freeze"
|
||||
#define NAMED_COMMAND_UNFREEZE "unfreeze"
|
||||
#define NAMED_COMMAND_THAW "thaw"
|
||||
|
||||
@@ -26,11 +26,10 @@
|
||||
#include <dns/acl.h>
|
||||
#include <dns/zone.h>
|
||||
|
||||
#include <dst/dst.h>
|
||||
|
||||
#include <isccfg/aclconf.h>
|
||||
#include <isccfg/cfg.h>
|
||||
|
||||
#include <dst/dst.h>
|
||||
#include <named/fuzz.h>
|
||||
#include <named/types.h>
|
||||
|
||||
@@ -50,9 +49,9 @@
|
||||
|
||||
EXTERN isc_mem_t *named_g_mctx INIT(NULL);
|
||||
EXTERN unsigned int named_g_cpus INIT(0);
|
||||
EXTERN unsigned int named_g_udpdisp INIT(0);
|
||||
EXTERN isc_loop_t *named_g_mainloop INIT(NULL);
|
||||
EXTERN isc_loopmgr_t *named_g_loopmgr INIT(NULL);
|
||||
EXTERN bool named_g_loopmgr_running INIT(false);
|
||||
EXTERN dns_dispatchmgr_t *named_g_dispatchmgr INIT(NULL);
|
||||
EXTERN unsigned int named_g_cpus_detected INIT(1);
|
||||
|
||||
@@ -118,6 +117,11 @@ EXTERN const char *named_g_logfile INIT(NULL);
|
||||
EXTERN const char *named_g_defaultsessionkeyfile INIT(NAMED_LOCALSTATEDIR
|
||||
"/run/named/"
|
||||
"session.key");
|
||||
EXTERN const char *named_g_defaultlockfile INIT(NAMED_LOCALSTATEDIR "/run/"
|
||||
"named/"
|
||||
"named."
|
||||
"lock");
|
||||
EXTERN bool named_g_forcelock INIT(false);
|
||||
|
||||
#if NAMED_RUN_PID_DIR
|
||||
EXTERN const char *named_g_defaultpidfile INIT(NAMED_LOCALSTATEDIR "/run/named/"
|
||||
|
||||
@@ -56,6 +56,9 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user);
|
||||
void
|
||||
named_os_writepidfile(const char *filename, bool first_time);
|
||||
|
||||
bool
|
||||
named_os_issingleton(const char *filename);
|
||||
|
||||
void
|
||||
named_os_shutdown(void);
|
||||
|
||||
|
||||
@@ -50,22 +50,22 @@ struct named_server {
|
||||
char *statsfile; /*%< Statistics file name */
|
||||
char *dumpfile; /*%< Dump file name */
|
||||
char *secrootsfile; /*%< Secroots file name */
|
||||
char *bindkeysfile; /*%< bind.keys file name */
|
||||
char *bindkeysfile; /*%< bind.keys file name
|
||||
* */
|
||||
char *recfile; /*%< Recursive file name */
|
||||
bool version_set; /*%< User has set version */
|
||||
bool version_set; /*%< User has set version
|
||||
* */
|
||||
char *version; /*%< User-specified version */
|
||||
bool hostname_set; /*%< User has set hostname */
|
||||
char *hostname; /*%< User-specified hostname */
|
||||
#ifdef USE_DNSRPS
|
||||
char *dnsrpslib;
|
||||
#endif /* ifdef USE_DNSRPS */
|
||||
bool hostname_set; /*%< User has set hostname
|
||||
* */
|
||||
char *hostname; /*%< User-specified hostname
|
||||
* */
|
||||
|
||||
/* Server data structures. */
|
||||
dns_loadmgr_t *loadmgr;
|
||||
dns_zonemgr_t *zonemgr;
|
||||
dns_viewlist_t viewlist;
|
||||
dns_kasplist_t kasplist;
|
||||
dns_keystorelist_t keystorelist;
|
||||
ns_interfacemgr_t *interfacemgr;
|
||||
dns_db_t *in_roothints;
|
||||
|
||||
@@ -93,7 +93,7 @@ struct named_server {
|
||||
|
||||
named_statschannellist_t statschannels;
|
||||
|
||||
dst_key_t *sessionkey;
|
||||
dns_tsigkey_t *sessionkey;
|
||||
char *session_keyfile;
|
||||
dns_name_t *session_keyname;
|
||||
unsigned int session_keyalg;
|
||||
@@ -104,6 +104,8 @@ struct named_server {
|
||||
|
||||
dns_dtenv_t *dtenv; /*%< Dnstap environment */
|
||||
|
||||
char *lockfile;
|
||||
|
||||
isc_tlsctx_cache_t *tlsctx_server_cache;
|
||||
isc_tlsctx_cache_t *tlsctx_client_cache;
|
||||
|
||||
@@ -248,6 +250,19 @@ named_server_flushnode(named_server_t *server, isc_lex_t *lex, bool tree);
|
||||
isc_result_t
|
||||
named_server_status(named_server_t *server, isc_buffer_t **text);
|
||||
|
||||
/*%
|
||||
* Report a list of dynamic and static tsig keys, per view.
|
||||
*/
|
||||
isc_result_t
|
||||
named_server_tsiglist(named_server_t *server, isc_buffer_t **text);
|
||||
|
||||
/*%
|
||||
* Delete a specific key (with optional view).
|
||||
*/
|
||||
isc_result_t
|
||||
named_server_tsigdelete(named_server_t *server, isc_lex_t *lex,
|
||||
isc_buffer_t **text);
|
||||
|
||||
/*%
|
||||
* Enable or disable updates for a zone.
|
||||
*/
|
||||
|
||||
@@ -18,10 +18,9 @@
|
||||
* The statistics channels built-in the name server.
|
||||
*/
|
||||
|
||||
#include <isccc/types.h>
|
||||
|
||||
#include <isccfg/aclconf.h>
|
||||
|
||||
#include <isccc/types.h>
|
||||
#include <named/types.h>
|
||||
|
||||
#define NAMED_STATSCHANNEL_HTTPPORT 80
|
||||
|
||||
@@ -22,7 +22,7 @@ ISC_LANG_BEGINDECLS
|
||||
|
||||
isc_result_t
|
||||
named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
isc_mem_t *mctx, dns_tsigkeyring_t **ringp);
|
||||
isc_mem_t *mctx, dns_tsig_keyring_t **ringp);
|
||||
/*%<
|
||||
* Create a TSIG key ring and configure it according to the 'key'
|
||||
* statements in the global and view configuration objects.
|
||||
|
||||
@@ -28,8 +28,8 @@ ISC_LANG_BEGINDECLS
|
||||
isc_result_t
|
||||
named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
|
||||
dns_kasplist_t *kasplist, dns_keystorelist_t *keystores,
|
||||
dns_zone_t *zone, dns_zone_t *raw);
|
||||
dns_kasplist_t *kasplist, dns_zone_t *zone,
|
||||
dns_zone_t *raw);
|
||||
/*%<
|
||||
* Configure or reconfigure a zone according to the named.conf
|
||||
* data.
|
||||
@@ -44,9 +44,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
*/
|
||||
|
||||
bool
|
||||
named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
|
||||
const cfg_obj_t *vconfig, const cfg_obj_t *config,
|
||||
dns_kasplist_t *kasplist);
|
||||
named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig);
|
||||
/*%<
|
||||
* If 'zone' can be safely reconfigured according to the configuration
|
||||
* data in 'zconfig', return true. If the configuration data is so
|
||||
@@ -55,12 +53,10 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
|
||||
*/
|
||||
|
||||
bool
|
||||
named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
|
||||
const cfg_obj_t *config, dns_kasplist_t *kasplist);
|
||||
named_zone_inlinesigning(const cfg_obj_t *zconfig);
|
||||
/*%<
|
||||
* Determine if zone uses inline-signing. This is true if inline-signing
|
||||
* is set to yes, in the zone clause or in the zone's dnssec-policy clause.
|
||||
* By default, dnssec-policy uses inline-signing.
|
||||
* is set to yes.
|
||||
*/
|
||||
|
||||
isc_result_t
|
||||
|
||||
+76
-148
@@ -29,7 +29,6 @@
|
||||
#include <isc/commandline.h>
|
||||
#include <isc/dir.h>
|
||||
#include <isc/file.h>
|
||||
#include <isc/fips.h>
|
||||
#include <isc/hash.h>
|
||||
#include <isc/httpd.h>
|
||||
#include <isc/managers.h>
|
||||
@@ -86,12 +85,7 @@
|
||||
#endif /* ifdef HAVE_LIBSCF */
|
||||
|
||||
#include <openssl/crypto.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/opensslv.h>
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/provider.h>
|
||||
#endif
|
||||
#ifdef HAVE_LIBXML2
|
||||
#include <libxml/parser.h>
|
||||
#include <libxml/xmlversion.h>
|
||||
@@ -102,20 +96,18 @@
|
||||
#ifdef HAVE_LIBNGHTTP2
|
||||
#include <nghttp2/nghttp2.h>
|
||||
#endif
|
||||
|
||||
/* On DragonFly BSD the header does not provide jemalloc API */
|
||||
#if defined(HAVE_MALLOC_NP_H) && !defined(__DragonFly__)
|
||||
#include <malloc_np.h>
|
||||
#include <sys/malloc.h> /* For M_VERSION */
|
||||
#elif defined(HAVE_JEMALLOC)
|
||||
#include <jemalloc/jemalloc.h>
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Include header files for database drivers here.
|
||||
*/
|
||||
/* #include "xxdb.h" */
|
||||
|
||||
/*
|
||||
* The maximum number of stack frames to dump on assertion failure.
|
||||
*/
|
||||
#ifndef BACKTRACE_MAXFRAME
|
||||
#define BACKTRACE_MAXFRAME 128
|
||||
#endif /* ifndef BACKTRACE_MAXFRAME */
|
||||
|
||||
extern unsigned int dns_zone_mkey_hour;
|
||||
extern unsigned int dns_zone_mkey_day;
|
||||
extern unsigned int dns_zone_mkey_month;
|
||||
@@ -142,9 +134,6 @@ static bool nonearest = false;
|
||||
static bool nosoa = false;
|
||||
static bool notcp = false;
|
||||
static bool sigvalinsecs = false;
|
||||
static bool transferinsecs = false;
|
||||
static bool transferslowly = false;
|
||||
static bool transferstuck = false;
|
||||
|
||||
/*
|
||||
* -4 and -6
|
||||
@@ -152,10 +141,6 @@ static bool transferstuck = false;
|
||||
static bool disable6 = false;
|
||||
static bool disable4 = false;
|
||||
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
static OSSL_PROVIDER *fips = NULL, *base = NULL;
|
||||
#endif
|
||||
|
||||
void
|
||||
named_main_earlywarning(const char *format, ...) {
|
||||
va_list args;
|
||||
@@ -194,7 +179,7 @@ named_main_earlyfatal(const char *format, ...) {
|
||||
}
|
||||
va_end(args);
|
||||
|
||||
_exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
noreturn static void
|
||||
@@ -204,6 +189,9 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
|
||||
static void
|
||||
assertion_failed(const char *file, int line, isc_assertiontype_t type,
|
||||
const char *cond) {
|
||||
void *tracebuf[BACKTRACE_MAXFRAME];
|
||||
int nframes;
|
||||
|
||||
/*
|
||||
* Handle assertion failures.
|
||||
*/
|
||||
@@ -215,12 +203,24 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
|
||||
*/
|
||||
isc_assertion_setcallback(NULL);
|
||||
|
||||
nframes = isc_backtrace(tracebuf, BACKTRACE_MAXFRAME);
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
|
||||
"%s:%d: %s(%s) failed", file, line,
|
||||
isc_assertion_typetotext(type), cond);
|
||||
isc_backtrace_log(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL);
|
||||
"%s:%d: %s(%s) failed%s", file, line,
|
||||
isc_assertion_typetotext(type), cond,
|
||||
(nframes > 0) ? ", back trace" : "");
|
||||
if (nframes > 0) {
|
||||
char **strs = isc_backtrace_symbols(tracebuf, nframes);
|
||||
if (strs != NULL) {
|
||||
for (int i = 0; i < nframes; i++) {
|
||||
isc_log_write(named_g_lctx,
|
||||
NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN,
|
||||
ISC_LOG_CRITICAL, "%s",
|
||||
strs[i]);
|
||||
}
|
||||
}
|
||||
}
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
|
||||
"exiting (due to assertion failure)");
|
||||
@@ -233,7 +233,7 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
|
||||
if (named_g_coreok) {
|
||||
abort();
|
||||
}
|
||||
_exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
noreturn static void
|
||||
@@ -273,7 +273,7 @@ library_fatal_error(const char *file, int line, const char *func,
|
||||
if (named_g_coreok) {
|
||||
abort();
|
||||
}
|
||||
_exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -312,7 +312,7 @@ usage(void) {
|
||||
"[-p port] [-s]\n"
|
||||
" [-S sockets] [-t chrootdir] [-u "
|
||||
"username] [-U listeners]\n"
|
||||
" [-m "
|
||||
" [-X lockfile] [-m "
|
||||
"{usage|trace|record|size|mctx}]\n"
|
||||
" [-M fill|nofill]\n"
|
||||
"usage: named [-v|-V|-C]\n");
|
||||
@@ -465,7 +465,7 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
|
||||
static void
|
||||
list_dnssec_algorithms(isc_buffer_t *b) {
|
||||
for (dst_algorithm_t i = DST_ALG_UNKNOWN; i < DST_MAX_ALGS; i++) {
|
||||
if (i == DST_ALG_GSSAPI ||
|
||||
if (i == DST_ALG_DH || i == DST_ALG_GSSAPI ||
|
||||
(i >= DST_ALG_HMAC_FIRST && i <= DST_ALG_HMAC_LAST))
|
||||
{
|
||||
continue;
|
||||
@@ -493,9 +493,6 @@ list_hmac_algorithms(isc_buffer_t *b) {
|
||||
for (dst_algorithm_t i = DST_ALG_HMAC_FIRST; i <= DST_ALG_HMAC_LAST;
|
||||
i++)
|
||||
{
|
||||
if (i == DST_ALG_GSSAPI) {
|
||||
continue;
|
||||
}
|
||||
if (dst_algorithm_supported(i)) {
|
||||
isc_buffer_putstr(b, " ");
|
||||
isc_buffer_putstr(b, dst_hmac_algorithm_totext(i));
|
||||
@@ -543,7 +540,11 @@ format_supported_algorithms(void (*emit)(isc_buffer_t *b)) {
|
||||
(*emit)(&b);
|
||||
|
||||
isc_buffer_init(&b, buf, sizeof(buf));
|
||||
isc_buffer_printf(&b, "TKEY mode 2 support (Diffie-Hellman): %s", "no");
|
||||
isc_buffer_printf(&b, "TKEY mode 2 support (Diffie-Hellman): %s",
|
||||
(dst_algorithm_supported(DST_ALG_DH) &&
|
||||
dst_algorithm_supported(DST_ALG_HMACMD5))
|
||||
? "yes"
|
||||
: "non");
|
||||
(*emit)(&b);
|
||||
|
||||
isc_buffer_init(&b, buf, sizeof(buf));
|
||||
@@ -586,6 +587,9 @@ printversion(bool verbose) {
|
||||
#endif /* ifdef __GNUC__ */
|
||||
#endif /* if defined(__ICC) || defined(__INTEL_COMPILER) */
|
||||
#endif /* ifdef __clang__ */
|
||||
#ifdef _MSC_VER
|
||||
printf("compiled by MSVC %d\n", _MSC_VER);
|
||||
#endif /* ifdef _MSC_VER */
|
||||
#ifdef __SUNPRO_C
|
||||
printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
|
||||
#endif /* ifdef __SUNPRO_C */
|
||||
@@ -603,14 +607,6 @@ printversion(bool verbose) {
|
||||
printf("compiled with libuv version: %d.%d.%d\n", UV_VERSION_MAJOR,
|
||||
UV_VERSION_MINOR, UV_VERSION_PATCH);
|
||||
printf("linked to libuv version: %s\n", uv_version_string());
|
||||
printf("compiled with %s version: %s\n", RCU_FLAVOR, RCU_VERSION);
|
||||
#if defined(JEMALLOC_VERSION)
|
||||
printf("compiled with jemalloc version: %u.%u.%u\n",
|
||||
JEMALLOC_VERSION_MAJOR, JEMALLOC_VERSION_MINOR,
|
||||
JEMALLOC_VERSION_BUGFIX);
|
||||
#elif defined(M_VERSION)
|
||||
printf("compiled with system jemalloc version: %u\n", M_VERSION);
|
||||
#endif
|
||||
#if HAVE_LIBNGHTTP2
|
||||
nghttp2_info *nginfo = NULL;
|
||||
printf("compiled with libnghttp2 version: %s\n", NGHTTP2_VERSION);
|
||||
@@ -671,6 +667,7 @@ printversion(bool verbose) {
|
||||
printf(" rndc configuration: %s\n", rndcconf);
|
||||
printf(" nsupdate session key: %s\n", named_g_defaultsessionkeyfile);
|
||||
printf(" named PID file: %s\n", named_g_defaultpidfile);
|
||||
printf(" named lock file: %s\n", named_g_defaultlockfile);
|
||||
#if defined(HAVE_GEOIP2)
|
||||
#define RTC(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
|
||||
RTC(cfg_parser_create(mctx, named_g_lctx, &parser));
|
||||
@@ -787,12 +784,6 @@ parse_T_opt(char *option) {
|
||||
}
|
||||
} else if (!strcmp(option, "sigvalinsecs")) {
|
||||
sigvalinsecs = true;
|
||||
} else if (!strcmp(option, "transferinsecs")) {
|
||||
transferinsecs = true;
|
||||
} else if (!strcmp(option, "transferslowly")) {
|
||||
transferslowly = true;
|
||||
} else if (!strcmp(option, "transferstuck")) {
|
||||
transferstuck = true;
|
||||
} else if (!strncmp(option, "tat=", 4)) {
|
||||
named_g_tat_interval = atoi(option + 4);
|
||||
} else {
|
||||
@@ -892,7 +883,7 @@ parse_command_line(int argc, char *argv[]) {
|
||||
printf("# Built-in default values. "
|
||||
"This is NOT the run-time configuration!\n");
|
||||
printf("%s", named_config_getdefault());
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
case 'd':
|
||||
named_g_debuglevel = parse_int(isc_commandline_argument,
|
||||
"debug "
|
||||
@@ -948,52 +939,38 @@ parse_command_line(int argc, char *argv[]) {
|
||||
parse_T_opt(isc_commandline_argument);
|
||||
break;
|
||||
case 'U':
|
||||
/* Obsolete. No longer in use. Ignore. */
|
||||
named_g_udpdisp = parse_int(isc_commandline_argument,
|
||||
"number of UDP listeners "
|
||||
"per interface");
|
||||
break;
|
||||
case 'u':
|
||||
named_g_username = isc_commandline_argument;
|
||||
break;
|
||||
case 'v':
|
||||
printversion(false);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
case 'V':
|
||||
printversion(true);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
case 'x':
|
||||
/* Obsolete. No longer in use. Ignore. */
|
||||
break;
|
||||
case 'X':
|
||||
/* Obsolete. No longer in use. Abort. */
|
||||
named_main_earlyfatal("option '-X' has been removed");
|
||||
named_g_forcelock = true;
|
||||
if (strcasecmp(isc_commandline_argument, "none") != 0) {
|
||||
named_g_defaultlockfile =
|
||||
isc_commandline_argument;
|
||||
} else {
|
||||
named_g_defaultlockfile = NULL;
|
||||
}
|
||||
break;
|
||||
case 'F':
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
fips = OSSL_PROVIDER_load(NULL, "fips");
|
||||
if (fips == NULL) {
|
||||
ERR_clear_error();
|
||||
named_main_earlyfatal(
|
||||
"Failed to load FIPS provider");
|
||||
}
|
||||
base = OSSL_PROVIDER_load(NULL, "base");
|
||||
if (base == NULL) {
|
||||
OSSL_PROVIDER_unload(fips);
|
||||
ERR_clear_error();
|
||||
named_main_earlyfatal(
|
||||
"Failed to load base provider");
|
||||
}
|
||||
#endif
|
||||
if (isc_fips_mode()) { /* Already in FIPS mode. */
|
||||
break;
|
||||
}
|
||||
if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
|
||||
named_main_earlyfatal(
|
||||
"setting FIPS mode failed");
|
||||
}
|
||||
break;
|
||||
/* Reserved for FIPS mode */
|
||||
FALLTHROUGH;
|
||||
case '?':
|
||||
usage();
|
||||
if (isc_commandline_option == '?') {
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
}
|
||||
p = strchr(NAMED_MAIN_ARGS, isc_commandline_option);
|
||||
if (p == NULL || *++p != ':') {
|
||||
@@ -1036,6 +1013,16 @@ create_managers(void) {
|
||||
ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
|
||||
named_g_cpus_detected, named_g_cpus_detected == 1 ? "" : "s",
|
||||
named_g_cpus, named_g_cpus == 1 ? "" : "s");
|
||||
if (named_g_udpdisp == 0) {
|
||||
named_g_udpdisp = named_g_cpus_detected;
|
||||
}
|
||||
if (named_g_udpdisp > named_g_cpus) {
|
||||
named_g_udpdisp = named_g_cpus;
|
||||
}
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
|
||||
"using %u UDP listener%s per interface", named_g_udpdisp,
|
||||
named_g_udpdisp == 1 ? "" : "s");
|
||||
|
||||
isc_managers_create(&named_g_mctx, named_g_cpus, &named_g_loopmgr,
|
||||
&named_g_netmgr);
|
||||
@@ -1149,6 +1136,11 @@ setup(void) {
|
||||
#endif /* ifdef __GNUC__ */
|
||||
#endif /* if defined(__ICC) || defined(__INTEL_COMPILER) */
|
||||
#endif /* ifdef __clang__ */
|
||||
#ifdef _MSC_VER
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"compiled by MSVC %d", _MSC_VER);
|
||||
#endif /* ifdef _MSC_VER */
|
||||
#ifdef __SUNPRO_C
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
@@ -1171,37 +1163,6 @@ setup(void) {
|
||||
"linked to OpenSSL version: %s",
|
||||
SSLeay_version(SSLEAY_VERSION));
|
||||
#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"compiled with libuv version: %d.%d.%d", UV_VERSION_MAJOR,
|
||||
UV_VERSION_MINOR, UV_VERSION_PATCH);
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"linked to libuv version: %s", uv_version_string());
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"compiled with %s version: %s", RCU_FLAVOR, RCU_VERSION);
|
||||
#if defined(JEMALLOC_VERSION)
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"compiled with jemalloc version: %u.%u.%u",
|
||||
JEMALLOC_VERSION_MAJOR, JEMALLOC_VERSION_MINOR,
|
||||
JEMALLOC_VERSION_BUGFIX);
|
||||
#elif defined(M_VERSION)
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"compiled with system jemalloc version: %u", M_VERSION);
|
||||
#endif
|
||||
#if HAVE_LIBNGHTTP2
|
||||
nghttp2_info *nginfo = NULL;
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"compiled with libnghttp2 version: %s", NGHTTP2_VERSION);
|
||||
nginfo = nghttp2_version(1);
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"linked to libnghttp2 version: %s", nginfo->version_str);
|
||||
#endif
|
||||
#ifdef HAVE_LIBXML2
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
@@ -1227,21 +1188,6 @@ setup(void) {
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"linked to zlib version: %s", zlibVersion());
|
||||
#endif /* if defined(HAVE_ZLIB) && defined(ZLIB_VERSION) */
|
||||
#if defined(HAVE_GEOIP2)
|
||||
/* Unfortunately, no version define on link time */
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"linked to maxminddb version: %s", MMDB_lib_version());
|
||||
#endif /* if defined(HAVE_GEOIP2) */
|
||||
#if defined(HAVE_DNSTAP)
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"compiled with protobuf-c version: %s",
|
||||
PROTOBUF_C_VERSION);
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"linked to protobuf-c version: %s", protobuf_c_version());
|
||||
#endif /* if defined(HAVE_DNSTAP) */
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"----------------------------------------------------");
|
||||
@@ -1287,7 +1233,11 @@ setup(void) {
|
||||
/*
|
||||
* Record the server's startup time.
|
||||
*/
|
||||
named_g_boottime = isc_time_now();
|
||||
result = isc_time_now(&named_g_boottime);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
named_main_earlyfatal("isc_time_now() failed: %s",
|
||||
isc_result_totext(result));
|
||||
}
|
||||
|
||||
result = create_managers();
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
@@ -1363,15 +1313,6 @@ setup(void) {
|
||||
if (sigvalinsecs) {
|
||||
ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, true);
|
||||
}
|
||||
if (transferinsecs) {
|
||||
ns_server_setoption(sctx, NS_SERVER_TRANSFERINSECS, true);
|
||||
}
|
||||
if (transferslowly) {
|
||||
ns_server_setoption(sctx, NS_SERVER_TRANSFERSLOWLY, true);
|
||||
}
|
||||
if (transferstuck) {
|
||||
ns_server_setoption(sctx, NS_SERVER_TRANSFERSTUCK, true);
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -1567,10 +1508,6 @@ main(int argc, char *argv[]) {
|
||||
*/
|
||||
isc_signal_start(named_g_server->sighup);
|
||||
|
||||
/*
|
||||
* Pause the loop manager in fatal.
|
||||
*/
|
||||
named_g_loopmgr_running = true;
|
||||
isc_loopmgr_run(named_g_loopmgr);
|
||||
|
||||
#ifdef HAVE_LIBSCF
|
||||
@@ -1621,15 +1558,6 @@ main(int argc, char *argv[]) {
|
||||
|
||||
named_os_shutdown();
|
||||
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
if (base != NULL) {
|
||||
OSSL_PROVIDER_unload(base);
|
||||
}
|
||||
if (fips != NULL) {
|
||||
OSSL_PROVIDER_unload(fips);
|
||||
}
|
||||
#endif
|
||||
|
||||
#ifdef HAVE_GPERFTOOLS_PROFILER
|
||||
ProfilerStop();
|
||||
#endif /* ifdef HAVE_GPERFTOOLS_PROFILER */
|
||||
|
||||
@@ -52,6 +52,7 @@ Any of these zone statements can also be set inside the view statement.
|
||||
.. literalinclude:: ../../doc/misc/redirect.zoneopt
|
||||
.. literalinclude:: ../../doc/misc/static-stub.zoneopt
|
||||
.. literalinclude:: ../../doc/misc/stub.zoneopt
|
||||
.. literalinclude:: ../../doc/misc/delegation-only.zoneopt
|
||||
.. literalinclude:: ../../doc/misc/in-view.zoneopt
|
||||
|
||||
Files
|
||||
|
||||
+5
-8
@@ -21,7 +21,7 @@ named - Internet domain name server
|
||||
Synopsis
|
||||
~~~~~~~~
|
||||
|
||||
:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-E** engine-name] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-U** #listeners] [**-u** user] [**-v**] [**-V**] ]
|
||||
:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-E** engine-name] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-U** #listeners] [**-u** user] [**-v**] [**-V**] [**-X** lock-file]
|
||||
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
@@ -86,12 +86,6 @@ Options
|
||||
|
||||
This option runs the server in the foreground (i.e., do not daemonize).
|
||||
|
||||
.. option:: -F
|
||||
|
||||
This options turns on FIPS (US Federal Information Processing Standards)
|
||||
mode if the underlying crytographic library supports running in FIPS
|
||||
mode.
|
||||
|
||||
.. option:: -g
|
||||
|
||||
This option runs the server in the foreground and forces all logging to ``stderr``.
|
||||
@@ -198,7 +192,10 @@ Options
|
||||
|
||||
.. option:: -X lock-file
|
||||
|
||||
This option has been removed and using it will cause a fatal error.
|
||||
This option acquires a lock on the specified file at runtime; this helps to
|
||||
prevent duplicate :program:`named` instances from running simultaneously.
|
||||
Use of this option overrides the ``lock-file`` option in
|
||||
:iscman:`named.conf`. If set to ``none``, the lock file check is disabled.
|
||||
|
||||
Signals
|
||||
~~~~~~~
|
||||
|
||||
+81
-2
@@ -51,7 +51,9 @@
|
||||
#endif /* ifdef HAVE_LIBSCF */
|
||||
|
||||
static char *pidfile = NULL;
|
||||
static char *lockfile = NULL;
|
||||
static int devnullfd = -1;
|
||||
static int singletonfd = -1;
|
||||
|
||||
#ifndef ISC_FACILITY
|
||||
#define ISC_FACILITY LOG_DAEMON
|
||||
@@ -428,10 +430,10 @@ named_os_daemonize(void) {
|
||||
char buf;
|
||||
n = read(dfd[0], &buf, 1);
|
||||
if (n == 1) {
|
||||
_exit(EXIT_SUCCESS);
|
||||
_exit(0);
|
||||
}
|
||||
} while (n == -1 && errno == EINTR);
|
||||
_exit(EXIT_FAILURE);
|
||||
_exit(1);
|
||||
}
|
||||
(void)close(dfd[0]);
|
||||
|
||||
@@ -703,6 +705,24 @@ cleanup_pidfile(void) {
|
||||
pidfile = NULL;
|
||||
}
|
||||
|
||||
static void
|
||||
cleanup_lockfile(void) {
|
||||
if (singletonfd != -1) {
|
||||
close(singletonfd);
|
||||
singletonfd = -1;
|
||||
}
|
||||
|
||||
if (lockfile != NULL) {
|
||||
int n = unlink(lockfile);
|
||||
if (n == -1 && errno != ENOENT) {
|
||||
named_main_earlywarning("unlink '%s': failed",
|
||||
lockfile);
|
||||
}
|
||||
free(lockfile);
|
||||
lockfile = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Ensure that a directory exists.
|
||||
* NOTE: This function overwrites the '/' characters in 'filename' with
|
||||
@@ -886,10 +906,69 @@ named_os_writepidfile(const char *filename, bool first_time) {
|
||||
(void)fclose(fh);
|
||||
}
|
||||
|
||||
bool
|
||||
named_os_issingleton(const char *filename) {
|
||||
char strbuf[ISC_STRERRORSIZE];
|
||||
struct flock lock;
|
||||
|
||||
if (singletonfd != -1) {
|
||||
return (true);
|
||||
}
|
||||
|
||||
if (strcasecmp(filename, "none") == 0) {
|
||||
return (true);
|
||||
}
|
||||
|
||||
/*
|
||||
* Make the containing directory if it doesn't exist.
|
||||
*/
|
||||
lockfile = strdup(filename);
|
||||
if (lockfile == NULL) {
|
||||
strerror_r(errno, strbuf, sizeof(strbuf));
|
||||
named_main_earlyfatal("couldn't allocate memory for '%s': %s",
|
||||
filename, strbuf);
|
||||
} else {
|
||||
int ret = mkdirpath(lockfile, named_main_earlywarning);
|
||||
if (ret == -1) {
|
||||
named_main_earlywarning("couldn't create '%s'",
|
||||
filename);
|
||||
cleanup_lockfile();
|
||||
return (false);
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* named_os_openfile() uses safeopen() which removes any existing
|
||||
* files. We can't use that here.
|
||||
*/
|
||||
singletonfd = open(filename, O_WRONLY | O_CREAT,
|
||||
S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
|
||||
if (singletonfd == -1) {
|
||||
cleanup_lockfile();
|
||||
return (false);
|
||||
}
|
||||
|
||||
memset(&lock, 0, sizeof(lock));
|
||||
lock.l_type = F_WRLCK;
|
||||
lock.l_whence = SEEK_SET;
|
||||
lock.l_start = 0;
|
||||
lock.l_len = 1;
|
||||
|
||||
/* Non-blocking (does not wait for lock) */
|
||||
if (fcntl(singletonfd, F_SETLK, &lock) == -1) {
|
||||
close(singletonfd);
|
||||
singletonfd = -1;
|
||||
return (false);
|
||||
}
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
void
|
||||
named_os_shutdown(void) {
|
||||
closelog();
|
||||
cleanup_pidfile();
|
||||
cleanup_lockfile();
|
||||
}
|
||||
|
||||
void
|
||||
|
||||
+873
-571
File diff suppressed because it is too large
Load Diff
+788
-876
File diff suppressed because it is too large
Load Diff
@@ -48,16 +48,32 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
|
||||
isc_result_t result;
|
||||
dns_tkeyctx_t *tctx = NULL;
|
||||
const char *s;
|
||||
uint32_t n;
|
||||
dns_fixedname_t fname;
|
||||
dns_name_t *name;
|
||||
isc_buffer_t b;
|
||||
const cfg_obj_t *obj;
|
||||
int type;
|
||||
|
||||
result = dns_tkeyctx_create(mctx, &tctx);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (result);
|
||||
}
|
||||
|
||||
obj = NULL;
|
||||
result = cfg_map_get(options, "tkey-dhkey", &obj);
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
s = cfg_obj_asstring(cfg_tuple_get(obj, "name"));
|
||||
n = cfg_obj_asuint32(cfg_tuple_get(obj, "keyid"));
|
||||
isc_buffer_constinit(&b, s, strlen(s));
|
||||
isc_buffer_add(&b, strlen(s));
|
||||
name = dns_fixedname_initname(&fname);
|
||||
RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
|
||||
type = DST_TYPE_PUBLIC | DST_TYPE_PRIVATE | DST_TYPE_KEY;
|
||||
RETERR(dst_key_fromfile(name, (dns_keytag_t)n, DNS_KEYALG_DH,
|
||||
type, NULL, mctx, &tctx->dhkey));
|
||||
}
|
||||
|
||||
obj = NULL;
|
||||
result = cfg_map_get(options, "tkey-domain", &obj);
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
|
||||
@@ -120,13 +120,11 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
|
||||
dns_transport_set_tls_versions);
|
||||
parse_transport_option(doh, transport, "ciphers",
|
||||
dns_transport_set_ciphers);
|
||||
parse_transport_option(doh, transport, "cipher-suites",
|
||||
dns_transport_set_cipher_suites);
|
||||
parse_transport_bool_option(
|
||||
doh, transport, "prefer-server-ciphers",
|
||||
dns_transport_set_prefer_server_ciphers);
|
||||
parse_transport_option(doh, transport, "ca-file",
|
||||
dns_transport_set_cafile);
|
||||
dns_transport_set_prefer_server_ciphers)
|
||||
parse_transport_option(doh, transport, "ca-file",
|
||||
dns_transport_set_cafile);
|
||||
parse_transport_option(doh, transport, "remote-hostname",
|
||||
dns_transport_set_remote_hostname);
|
||||
}
|
||||
@@ -174,13 +172,11 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
|
||||
dns_transport_set_tls_versions);
|
||||
parse_transport_option(tls, transport, "ciphers",
|
||||
dns_transport_set_ciphers);
|
||||
parse_transport_option(tls, transport, "cipher-suites",
|
||||
dns_transport_set_cipher_suites);
|
||||
parse_transport_bool_option(
|
||||
tls, transport, "prefer-server-ciphers",
|
||||
dns_transport_set_prefer_server_ciphers);
|
||||
parse_transport_option(tls, transport, "ca-file",
|
||||
dns_transport_set_cafile);
|
||||
dns_transport_set_prefer_server_ciphers)
|
||||
parse_transport_option(tls, transport, "ca-file",
|
||||
dns_transport_set_cafile);
|
||||
parse_transport_option(tls, transport, "remote-hostname",
|
||||
dns_transport_set_remote_hostname);
|
||||
}
|
||||
|
||||
+19
-18
@@ -31,7 +31,7 @@
|
||||
#include <named/tsigconf.h>
|
||||
|
||||
static isc_result_t
|
||||
add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
|
||||
add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
|
||||
isc_mem_t *mctx) {
|
||||
dns_tsigkey_t *tsigkey = NULL;
|
||||
const cfg_listelt_t *element;
|
||||
@@ -39,7 +39,10 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
|
||||
const char *keyid = NULL;
|
||||
unsigned char *secret = NULL;
|
||||
int secretalloc = 0;
|
||||
int secretlen = 0;
|
||||
isc_result_t ret;
|
||||
isc_stdtime_t now;
|
||||
uint16_t bits;
|
||||
|
||||
for (element = cfg_list_first(list); element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
@@ -47,14 +50,12 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
|
||||
const cfg_obj_t *algobj = NULL;
|
||||
const cfg_obj_t *secretobj = NULL;
|
||||
dns_name_t keyname;
|
||||
dst_algorithm_t alg = DST_ALG_UNKNOWN;
|
||||
const char *algstr = NULL;
|
||||
const dns_name_t *alg;
|
||||
const char *algstr;
|
||||
char keynamedata[1024];
|
||||
isc_buffer_t keynamesrc, keynamebuf;
|
||||
const char *secretstr = NULL;
|
||||
const char *secretstr;
|
||||
isc_buffer_t secretbuf;
|
||||
int secretlen = 0;
|
||||
uint16_t bits;
|
||||
|
||||
key = cfg_listelt_value(element);
|
||||
keyid = cfg_obj_asstring(cfg_map_getname(key));
|
||||
@@ -103,17 +104,13 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
|
||||
}
|
||||
secretlen = isc_buffer_usedlength(&secretbuf);
|
||||
|
||||
ret = dns_tsigkey_create(&keyname, alg, secret, secretlen, mctx,
|
||||
isc_stdtime_get(&now);
|
||||
ret = dns_tsigkey_create(&keyname, alg, secret, secretlen,
|
||||
false, NULL, now, now, mctx, ring,
|
||||
&tsigkey);
|
||||
isc_mem_put(mctx, secret, secretalloc);
|
||||
secret = NULL;
|
||||
if (ret == ISC_R_SUCCESS) {
|
||||
ret = dns_tsigkeyring_add(ring, tsigkey);
|
||||
}
|
||||
if (ret != ISC_R_SUCCESS) {
|
||||
if (tsigkey != NULL) {
|
||||
dns_tsigkey_detach(&tsigkey);
|
||||
}
|
||||
goto failure;
|
||||
}
|
||||
/*
|
||||
@@ -126,20 +123,21 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
|
||||
return (ISC_R_SUCCESS);
|
||||
|
||||
failure:
|
||||
cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
|
||||
"configuring key '%s': %s", keyid, isc_result_totext(ret));
|
||||
|
||||
if (secret != NULL) {
|
||||
isc_mem_put(mctx, secret, secretalloc);
|
||||
}
|
||||
cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
|
||||
"configuring key '%s': %s", keyid, isc_result_totext(ret));
|
||||
return (ret);
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
isc_mem_t *mctx, dns_tsigkeyring_t **ringp) {
|
||||
isc_mem_t *mctx, dns_tsig_keyring_t **ringp) {
|
||||
const cfg_obj_t *maps[3];
|
||||
const cfg_obj_t *keylist;
|
||||
dns_tsigkeyring_t *ring = NULL;
|
||||
dns_tsig_keyring_t *ring = NULL;
|
||||
isc_result_t result;
|
||||
int i;
|
||||
|
||||
@@ -154,7 +152,10 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
}
|
||||
maps[i] = NULL;
|
||||
|
||||
dns_tsigkeyring_create(mctx, &ring);
|
||||
result = dns_tsigkeyring_create(mctx, &ring);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (result);
|
||||
}
|
||||
|
||||
for (i = 0;; i++) {
|
||||
if (maps[i] == NULL) {
|
||||
|
||||
+138
-132
@@ -289,7 +289,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
|
||||
if (n == 0) {
|
||||
types = NULL;
|
||||
} else {
|
||||
types = isc_mem_cget(mctx, n, sizeof(*types));
|
||||
types = isc_mem_get(mctx, n * sizeof(*types));
|
||||
}
|
||||
|
||||
i = 0;
|
||||
@@ -305,7 +305,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
|
||||
|
||||
typeobj = cfg_listelt_value(element2);
|
||||
str = cfg_obj_asstring(typeobj);
|
||||
r.base = UNCONST(str);
|
||||
DE_CONST(str, r.base);
|
||||
|
||||
bracket = strchr(str, '(' /*)*/);
|
||||
if (bracket != NULL) {
|
||||
@@ -319,8 +319,8 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
|
||||
ISC_LOG_ERROR,
|
||||
"'%s' is not a valid count",
|
||||
bracket);
|
||||
isc_mem_cput(mctx, types, n,
|
||||
sizeof(*types));
|
||||
isc_mem_put(mctx, types,
|
||||
n * sizeof(*types));
|
||||
goto cleanup;
|
||||
}
|
||||
} else {
|
||||
@@ -334,7 +334,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
|
||||
ISC_LOG_ERROR,
|
||||
"'%.*s' is not a valid type",
|
||||
(int)r.length, str);
|
||||
isc_mem_cput(mctx, types, n, sizeof(*types));
|
||||
isc_mem_put(mctx, types, n * sizeof(*types));
|
||||
goto cleanup;
|
||||
}
|
||||
}
|
||||
@@ -344,7 +344,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
|
||||
mtype, dns_fixedname_name(&fname), n,
|
||||
types);
|
||||
if (types != NULL) {
|
||||
isc_mem_cput(mctx, types, n, sizeof(*types));
|
||||
isc_mem_put(mctx, types, n * sizeof(*types));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -705,7 +705,7 @@ strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp,
|
||||
if (*s == '\0') {
|
||||
/* We have reached the end of the string. */
|
||||
*argcp = n;
|
||||
*argvp = isc_mem_cget(mctx, n, sizeof(char *));
|
||||
*argvp = isc_mem_get(mctx, n * sizeof(char *));
|
||||
} else {
|
||||
char *p = s;
|
||||
while (*p != ' ' && *p != '\t' && *p != '\0') {
|
||||
@@ -770,27 +770,24 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
|
||||
*/
|
||||
static bool
|
||||
isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
|
||||
const isc_sockaddr_t *dstaddr, dns_rdataclass_t rdclass,
|
||||
void *arg ISC_ATTR_UNUSED) {
|
||||
dns_aclenv_t *env = NULL;
|
||||
dns_view_t *view = NULL;
|
||||
const isc_sockaddr_t *dstaddr, dns_rdataclass_t rdclass, void *arg) {
|
||||
ns_interfacemgr_t *interfacemgr = (ns_interfacemgr_t *)arg;
|
||||
dns_aclenv_t *env = ns_interfacemgr_getaclenv(interfacemgr);
|
||||
dns_view_t *view;
|
||||
dns_tsigkey_t *key = NULL;
|
||||
isc_netaddr_t netsrc;
|
||||
isc_netaddr_t netdst;
|
||||
|
||||
/* interfacemgr can be destroyed only in exclusive mode. */
|
||||
if (named_g_server->interfacemgr == NULL) {
|
||||
if (interfacemgr == NULL) {
|
||||
return (true);
|
||||
}
|
||||
|
||||
if (!ns_interfacemgr_listeningon(named_g_server->interfacemgr, dstaddr))
|
||||
{
|
||||
if (!ns_interfacemgr_listeningon(interfacemgr, dstaddr)) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
isc_netaddr_fromsockaddr(&netsrc, srcaddr);
|
||||
isc_netaddr_fromsockaddr(&netdst, dstaddr);
|
||||
env = ns_interfacemgr_getaclenv(named_g_server->interfacemgr);
|
||||
|
||||
for (view = ISC_LIST_HEAD(named_g_server->viewlist); view != NULL;
|
||||
view = ISC_LIST_NEXT(view, link))
|
||||
@@ -809,7 +806,7 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
|
||||
bool match;
|
||||
isc_result_t result;
|
||||
|
||||
result = dns_view_gettsig(view, mykey->name, &key);
|
||||
result = dns_view_gettsig(view, &mykey->name, &key);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
continue;
|
||||
}
|
||||
@@ -866,8 +863,8 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
|
||||
isc_result_t
|
||||
named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
|
||||
dns_kasplist_t *kasplist, dns_keystorelist_t *keystorelist,
|
||||
dns_zone_t *zone, dns_zone_t *raw) {
|
||||
dns_kasplist_t *kasplist, dns_zone_t *zone,
|
||||
dns_zone_t *raw) {
|
||||
isc_result_t result;
|
||||
const char *zname;
|
||||
dns_rdataclass_t zclass;
|
||||
@@ -880,12 +877,11 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
const char *filename = NULL;
|
||||
const char *kaspname = NULL;
|
||||
const char *dupcheck;
|
||||
dns_checkdstype_t checkdstype = dns_checkdstype_yes;
|
||||
dns_notifytype_t notifytype = dns_notifytype_yes;
|
||||
uint32_t count;
|
||||
unsigned int dbargc;
|
||||
char **dbargv;
|
||||
static char default_dbtype[] = ZONEDB_DEFAULT;
|
||||
static char default_dbtype[] = "rbt";
|
||||
static char dlz_dbtype[] = "dlz";
|
||||
char *cpval = default_dbtype;
|
||||
isc_mem_t *mctx = dns_zone_getmctx(zone);
|
||||
@@ -905,10 +901,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
dns_stats_t *rcvquerystats;
|
||||
dns_stats_t *dnssecsignstats;
|
||||
dns_zonestat_level_t statlevel = dns_zonestat_none;
|
||||
int seconds;
|
||||
dns_ttl_t maxttl = 0; /* unlimited */
|
||||
dns_zone_t *mayberaw = (raw != NULL) ? raw : zone;
|
||||
bool transferinsecs = ns_server_getoption(named_g_server->sctx,
|
||||
NS_SERVER_TRANSFERINSECS);
|
||||
|
||||
i = 0;
|
||||
if (zconfig != NULL) {
|
||||
@@ -1000,7 +995,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
* compiler w/o generating a warning.
|
||||
*/
|
||||
dns_zone_setdbtype(zone, dbargc, (const char *const *)dbargv);
|
||||
isc_mem_cput(mctx, dbargv, dbargc, sizeof(*dbargv));
|
||||
isc_mem_put(mctx, dbargv, dbargc * sizeof(*dbargv));
|
||||
if (cpval != default_dbtype && cpval != dlz_dbtype) {
|
||||
isc_mem_free(mctx, cpval);
|
||||
}
|
||||
@@ -1174,9 +1169,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
rcvquerystats = NULL;
|
||||
dnssecsignstats = NULL;
|
||||
if (statlevel == dns_zonestat_full) {
|
||||
isc_stats_create(mctx, &zoneqrystats, ns_statscounter_max);
|
||||
dns_rdatatypestats_create(mctx, &rcvquerystats);
|
||||
dns_dnssecsignstats_create(mctx, &dnssecsignstats);
|
||||
CHECK(isc_stats_create(mctx, &zoneqrystats,
|
||||
ns_statscounter_max));
|
||||
CHECK(dns_rdatatypestats_create(mctx, &rcvquerystats));
|
||||
CHECK(dns_dnssecsignstats_create(mctx, &dnssecsignstats));
|
||||
}
|
||||
dns_zone_setrequeststats(zone, zoneqrystats);
|
||||
dns_zone_setrcvquerystats(zone, rcvquerystats);
|
||||
@@ -1306,7 +1302,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
dns_zone_setoption(zone, DNS_ZONEOPT_NOTIFYTOSOA,
|
||||
cfg_obj_asboolean(obj));
|
||||
|
||||
dns_zone_setisself(zone, isself, NULL);
|
||||
dns_zone_setisself(zone, isself, named_g_server->interfacemgr);
|
||||
|
||||
CHECK(configure_zone_acl(
|
||||
zconfig, vconfig, config, allow_transfer, ac, zone,
|
||||
@@ -1315,16 +1311,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "max-transfer-time-out", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
dns_zone_setmaxxfrout(
|
||||
zone, transferinsecs ? cfg_obj_asuint32(obj)
|
||||
: cfg_obj_asuint32(obj) * 60);
|
||||
dns_zone_setmaxxfrout(zone, cfg_obj_asuint32(obj) * 60);
|
||||
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "max-transfer-idle-out", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
dns_zone_setidleout(zone, transferinsecs
|
||||
? cfg_obj_asuint32(obj)
|
||||
: cfg_obj_asuint32(obj) * 60);
|
||||
dns_zone_setidleout(zone, cfg_obj_asuint32(obj) * 60);
|
||||
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "max-journal-size", &obj);
|
||||
@@ -1502,7 +1494,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
}
|
||||
|
||||
if (use_kasp) {
|
||||
maxttl = dns_kasp_zonemaxttl(dns_zone_getkasp(zone), false);
|
||||
maxttl = dns_kasp_zonemaxttl(dns_zone_getkasp(zone));
|
||||
} else {
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "max-zone-ttl", &obj);
|
||||
@@ -1545,9 +1537,11 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
* use inline-signing (raw != NULL).
|
||||
*/
|
||||
if (ztype == dns_zone_primary || raw != NULL) {
|
||||
if (use_kasp) {
|
||||
int seconds;
|
||||
const cfg_obj_t *validity, *resign;
|
||||
bool allow = false, maint = false;
|
||||
bool sigvalinsecs;
|
||||
|
||||
if (use_kasp) {
|
||||
if (dns_kasp_nsec3(kasp)) {
|
||||
result = dns_zone_setnsec3param(
|
||||
zone, 1, dns_kasp_nsec3flags(kasp),
|
||||
@@ -1559,15 +1553,53 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
zone, 0, 0, 0, 0, NULL, true, false);
|
||||
}
|
||||
INSIST(result == ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
if (use_kasp) {
|
||||
seconds = (uint32_t)dns_kasp_sigvalidity_dnskey(kasp);
|
||||
dns_zone_setkeyvalidityinterval(zone, seconds);
|
||||
} else {
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "dnskey-sig-validity",
|
||||
&obj);
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
seconds = cfg_obj_asuint32(obj) * 86400;
|
||||
}
|
||||
dns_zone_setkeyvalidityinterval(zone, seconds);
|
||||
|
||||
if (use_kasp) {
|
||||
seconds = (uint32_t)dns_kasp_sigvalidity(kasp);
|
||||
dns_zone_setsigvalidityinterval(zone, seconds);
|
||||
|
||||
seconds = (uint32_t)dns_kasp_sigrefresh(kasp);
|
||||
dns_zone_setsigresigninginterval(zone, seconds);
|
||||
} else {
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "sig-validity-interval",
|
||||
&obj);
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
|
||||
sigvalinsecs = ns_server_getoption(
|
||||
named_g_server->sctx, NS_SERVER_SIGVALINSECS);
|
||||
validity = cfg_tuple_get(obj, "validity");
|
||||
seconds = cfg_obj_asuint32(validity);
|
||||
if (!sigvalinsecs) {
|
||||
seconds *= 86400;
|
||||
}
|
||||
dns_zone_setsigvalidityinterval(zone, seconds);
|
||||
|
||||
resign = cfg_tuple_get(obj, "re-sign");
|
||||
if (cfg_obj_isvoid(resign)) {
|
||||
seconds /= 4;
|
||||
} else if (!sigvalinsecs) {
|
||||
uint32_t r = cfg_obj_asuint32(resign);
|
||||
if (seconds > 7 * 86400) {
|
||||
seconds = r * 86400;
|
||||
} else {
|
||||
seconds = r * 3600;
|
||||
}
|
||||
} else {
|
||||
seconds = cfg_obj_asuint32(resign);
|
||||
}
|
||||
dns_zone_setsigresigninginterval(zone, seconds);
|
||||
}
|
||||
|
||||
obj = NULL;
|
||||
@@ -1576,8 +1608,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
filename = cfg_obj_asstring(obj);
|
||||
CHECK(dns_zone_setkeydirectory(zone, filename));
|
||||
}
|
||||
/* Also save a reference to the keystore list. */
|
||||
dns_zone_setkeystores(zone, keystorelist);
|
||||
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "sig-signing-signatures", &obj);
|
||||
@@ -1594,6 +1624,26 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
dns_zone_setprivatetype(zone, cfg_obj_asuint32(obj));
|
||||
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "update-check-ksk", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
|
||||
cfg_obj_asboolean(obj));
|
||||
/*
|
||||
* This setting will be ignored if dnssec-policy is used.
|
||||
* named-checkconf will error if both are configured.
|
||||
*/
|
||||
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "dnssec-dnskey-kskonly", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
dns_zone_setoption(zone, DNS_ZONEOPT_DNSKEYKSKONLY,
|
||||
cfg_obj_asboolean(obj));
|
||||
/*
|
||||
* This setting will be ignored if dnssec-policy is used.
|
||||
* named-checkconf will error if both are configured.
|
||||
*/
|
||||
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "dnssec-loadkeys-interval",
|
||||
&obj);
|
||||
@@ -1601,12 +1651,28 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
CHECK(dns_zone_setrefreshkeyinterval(zone,
|
||||
cfg_obj_asuint32(obj)));
|
||||
|
||||
obj = NULL;
|
||||
result = cfg_map_get(zoptions, "auto-dnssec", &obj);
|
||||
if (kasp != NULL) {
|
||||
bool s2i = (strcmp(dns_kasp_getname(kasp),
|
||||
"insecure") != 0);
|
||||
dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, true);
|
||||
dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, !s2i);
|
||||
dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, true);
|
||||
} else if (result == ISC_R_SUCCESS) {
|
||||
const char *arg = cfg_obj_asstring(obj);
|
||||
if (strcasecmp(arg, "allow") == 0) {
|
||||
allow = true;
|
||||
} else if (strcasecmp(arg, "maintain") == 0) {
|
||||
allow = maint = true;
|
||||
} else if (strcasecmp(arg, "off") == 0) {
|
||||
/* Default */
|
||||
} else {
|
||||
UNREACHABLE();
|
||||
}
|
||||
dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
|
||||
dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, false);
|
||||
dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1621,47 +1687,19 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
* Configure parental agents, applies to primary and secondary zones.
|
||||
*/
|
||||
if (ztype == dns_zone_primary || ztype == dns_zone_secondary) {
|
||||
const cfg_obj_t *parentals = NULL;
|
||||
(void)cfg_map_get(zoptions, "parental-agents", &parentals);
|
||||
if (parentals != NULL) {
|
||||
obj = NULL;
|
||||
(void)cfg_map_get(zoptions, "parental-agents", &obj);
|
||||
if (obj != NULL) {
|
||||
dns_ipkeylist_t ipkl;
|
||||
dns_ipkeylist_init(&ipkl);
|
||||
CHECK(named_config_getipandkeylist(
|
||||
config, "parental-agents", parentals, mctx,
|
||||
&ipkl));
|
||||
config, "parental-agents", obj, mctx, &ipkl));
|
||||
dns_zone_setparentals(zone, ipkl.addrs, ipkl.sources,
|
||||
ipkl.keys, ipkl.tlss, ipkl.count);
|
||||
dns_ipkeylist_clear(mctx, &ipkl);
|
||||
} else {
|
||||
dns_zone_setparentals(zone, NULL, NULL, NULL, NULL, 0);
|
||||
}
|
||||
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "checkds", &obj);
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
if (cfg_obj_isboolean(obj)) {
|
||||
if (cfg_obj_asboolean(obj)) {
|
||||
checkdstype = dns_checkdstype_yes;
|
||||
} else {
|
||||
checkdstype = dns_checkdstype_no;
|
||||
}
|
||||
} else {
|
||||
const char *str = cfg_obj_asstring(obj);
|
||||
if (strcasecmp(str, "explicit") == 0) {
|
||||
checkdstype = dns_checkdstype_explicit;
|
||||
} else {
|
||||
UNREACHABLE();
|
||||
}
|
||||
}
|
||||
} else if (parentals != NULL) {
|
||||
checkdstype = dns_checkdstype_explicit;
|
||||
} else {
|
||||
checkdstype = dns_checkdstype_yes;
|
||||
}
|
||||
if (raw != NULL) {
|
||||
dns_zone_setcheckdstype(raw, dns_checkdstype_no);
|
||||
}
|
||||
dns_zone_setcheckdstype(zone, checkdstype);
|
||||
}
|
||||
|
||||
/*%
|
||||
@@ -1749,6 +1787,20 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNORESRVCNAME,
|
||||
ignore);
|
||||
|
||||
obj = NULL;
|
||||
result = cfg_map_get(zoptions, "dnssec-update-mode", &obj);
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
const char *arg = cfg_obj_asstring(obj);
|
||||
if (strcasecmp(arg, "no-resign") == 0) {
|
||||
dns_zone_setkeyopt(zone, DNS_ZONEKEY_NORESIGN,
|
||||
true);
|
||||
} else if (strcasecmp(arg, "maintain") == 0) {
|
||||
/* Default */
|
||||
} else {
|
||||
UNREACHABLE();
|
||||
}
|
||||
}
|
||||
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "serial-update-method", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
@@ -1832,16 +1884,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "max-transfer-time-in", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
dns_zone_setmaxxfrin(
|
||||
mayberaw, transferinsecs ? cfg_obj_asuint32(obj)
|
||||
: cfg_obj_asuint32(obj) * 60);
|
||||
dns_zone_setmaxxfrin(mayberaw, cfg_obj_asuint32(obj) * 60);
|
||||
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "max-transfer-idle-in", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
dns_zone_setidlein(mayberaw,
|
||||
transferinsecs ? cfg_obj_asuint32(obj)
|
||||
: cfg_obj_asuint32(obj) * 60);
|
||||
dns_zone_setidlein(mayberaw, cfg_obj_asuint32(obj) * 60);
|
||||
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "max-refresh-time", &obj);
|
||||
@@ -1906,8 +1954,11 @@ isc_result_t
|
||||
named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
|
||||
dns_rdataclass_t rdclass, dns_name_t *name) {
|
||||
dns_db_t *db = NULL;
|
||||
isc_time_t now;
|
||||
isc_result_t result;
|
||||
|
||||
TIME_NOW(&now);
|
||||
|
||||
dns_zone_settype(zone, dns_zone_dlz);
|
||||
result = dns_sdlz_setdb(dlzdatabase, rdclass, name, &db);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
@@ -1919,9 +1970,7 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
|
||||
}
|
||||
|
||||
bool
|
||||
named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
|
||||
const cfg_obj_t *vconfig, const cfg_obj_t *config,
|
||||
dns_kasplist_t *kasplist) {
|
||||
named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
|
||||
const cfg_obj_t *zoptions = NULL;
|
||||
const cfg_obj_t *obj = NULL;
|
||||
const char *cfilename;
|
||||
@@ -1955,8 +2004,7 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
|
||||
has_raw = false;
|
||||
}
|
||||
|
||||
inline_signing = named_zone_inlinesigning(zconfig, vconfig, config,
|
||||
kasplist);
|
||||
inline_signing = named_zone_inlinesigning(zconfig);
|
||||
if (!inline_signing && has_raw) {
|
||||
dns_zone_log(zone, ISC_LOG_DEBUG(1),
|
||||
"not reusable: old zone was inline-signing");
|
||||
@@ -1993,57 +2041,15 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
|
||||
}
|
||||
|
||||
bool
|
||||
named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
|
||||
const cfg_obj_t *config, dns_kasplist_t *kasplist) {
|
||||
const cfg_obj_t *maps[4];
|
||||
named_zone_inlinesigning(const cfg_obj_t *zconfig) {
|
||||
const cfg_obj_t *zoptions = NULL;
|
||||
const cfg_obj_t *signing = NULL;
|
||||
const cfg_obj_t *policy = NULL;
|
||||
dns_kasp_t *kasp = NULL;
|
||||
isc_result_t res;
|
||||
bool inline_signing = false;
|
||||
int i = 0;
|
||||
|
||||
maps[i++] = cfg_tuple_get(zconfig, "options");
|
||||
if (vconfig != NULL) {
|
||||
maps[i++] = cfg_tuple_get(vconfig, "options");
|
||||
}
|
||||
if (config != NULL) {
|
||||
const cfg_obj_t *options = NULL;
|
||||
(void)cfg_map_get(config, "options", &options);
|
||||
if (options != NULL) {
|
||||
maps[i++] = options;
|
||||
}
|
||||
}
|
||||
maps[i] = NULL;
|
||||
|
||||
/* Check the value in dnssec-policy. */
|
||||
policy = NULL;
|
||||
res = named_config_get(maps, "dnssec-policy", &policy);
|
||||
/* If no dnssec-policy found, then zone is not using inline-signing. */
|
||||
if (res != ISC_R_SUCCESS ||
|
||||
strcmp(cfg_obj_asstring(policy), "none") == 0)
|
||||
{
|
||||
return (false);
|
||||
}
|
||||
|
||||
/* Lookup the policy. */
|
||||
res = dns_kasplist_find(kasplist, cfg_obj_asstring(policy), &kasp);
|
||||
if (res != ISC_R_SUCCESS) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
inline_signing = dns_kasp_inlinesigning(kasp);
|
||||
dns_kasp_detach(&kasp);
|
||||
|
||||
/*
|
||||
* The zone option 'inline-signing' may override the value in
|
||||
* dnssec-policy. This is a zone-only option, so look in maps[0]
|
||||
* only.
|
||||
*/
|
||||
res = cfg_map_get(maps[0], "inline-signing", &signing);
|
||||
if (res == ISC_R_SUCCESS && cfg_obj_isboolean(signing)) {
|
||||
return (cfg_obj_asboolean(signing));
|
||||
}
|
||||
zoptions = cfg_tuple_get(zconfig, "options");
|
||||
inline_signing = (cfg_map_get(zoptions, "inline-signing", &signing) ==
|
||||
ISC_R_SUCCESS &&
|
||||
cfg_obj_asboolean(signing));
|
||||
|
||||
return (inline_signing);
|
||||
}
|
||||
|
||||
+185
-226
@@ -21,7 +21,6 @@
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include <isc/async.h>
|
||||
#include <isc/attributes.h>
|
||||
#include <isc/base64.h>
|
||||
#include <isc/buffer.h>
|
||||
@@ -29,6 +28,7 @@
|
||||
#include <isc/file.h>
|
||||
#include <isc/getaddresses.h>
|
||||
#include <isc/hash.h>
|
||||
#include <isc/job.h>
|
||||
#include <isc/lex.h>
|
||||
#include <isc/log.h>
|
||||
#include <isc/loop.h>
|
||||
@@ -94,16 +94,15 @@
|
||||
|
||||
#include "../dig/readline.h"
|
||||
|
||||
#define MAXCMD (128 * 1024)
|
||||
#define MAXWIRE (64 * 1024)
|
||||
#define INITTEXT (2 * 1024)
|
||||
#define MAXTEXT (128 * 1024)
|
||||
#define TTL_MAX 2147483647U /* Maximum signed 32 bit integer. */
|
||||
#define MAXCMD (128 * 1024)
|
||||
#define MAXWIRE (64 * 1024)
|
||||
#define INITTEXT (2 * 1024)
|
||||
#define MAXTEXT (128 * 1024)
|
||||
#define FIND_TIMEOUT 5
|
||||
#define TTL_MAX 2147483647U /* Maximum signed 32 bit integer. */
|
||||
|
||||
#define DNSDEFAULTPORT 53
|
||||
|
||||
#define DEFAULT_EDNS_BUFSIZE 1232
|
||||
|
||||
/* Number of addresses to request from isc_getaddresses() */
|
||||
#define MAX_SERVERADDRS 4
|
||||
|
||||
@@ -121,6 +120,8 @@ static bool is_dst_up = false;
|
||||
static bool use_tls = false;
|
||||
static bool usevc = false;
|
||||
static bool usegsstsig = false;
|
||||
static bool use_win2k_gsstsig = false;
|
||||
static bool tried_other_gsstsig = false;
|
||||
static bool local_only = false;
|
||||
static isc_nm_t *netmgr = NULL;
|
||||
static isc_loopmgr_t *loopmgr = NULL;
|
||||
@@ -137,7 +138,7 @@ static dns_name_t *userzone = NULL;
|
||||
static dns_name_t *zname = NULL;
|
||||
static dns_name_t tmpzonename = DNS_NAME_INITEMPTY;
|
||||
static dns_name_t restart_primary = DNS_NAME_INITEMPTY;
|
||||
static dns_tsigkeyring_t *gssring = NULL;
|
||||
static dns_tsig_keyring_t *gssring = NULL;
|
||||
static dns_tsigkey_t *tsigkey = NULL;
|
||||
static dst_key_t *sig0key = NULL;
|
||||
static isc_sockaddr_t *servers = NULL;
|
||||
@@ -177,8 +178,6 @@ static isc_mutex_t answer_lock;
|
||||
static dns_message_t *answer = NULL;
|
||||
static uint32_t default_ttl = 0;
|
||||
static bool default_ttl_set = false;
|
||||
static uint32_t lease = 0, keylease = 0;
|
||||
static bool lease_set = false, keylease_set = false;
|
||||
static bool checknames = true;
|
||||
static bool checksvcb = true;
|
||||
static const char *resolvconf = RESOLV_CONF;
|
||||
@@ -242,8 +241,8 @@ error(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
|
||||
static void
|
||||
primary_from_servers(void) {
|
||||
if (primary_servers != NULL && primary_servers != servers) {
|
||||
isc_mem_cput(gmctx, primary_servers, primary_alloc,
|
||||
sizeof(isc_sockaddr_t));
|
||||
isc_mem_put(gmctx, primary_servers,
|
||||
primary_alloc * sizeof(isc_sockaddr_t));
|
||||
}
|
||||
primary_servers = servers;
|
||||
primary_total = ns_total;
|
||||
@@ -279,7 +278,7 @@ fatal(const char *format, ...) {
|
||||
vfprintf(stderr, format, args);
|
||||
va_end(args);
|
||||
fprintf(stderr, "\n");
|
||||
_exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -316,7 +315,7 @@ ddebug(const char *format, ...) {
|
||||
}
|
||||
}
|
||||
|
||||
ISC_NO_SANITIZE_ADDRESS static void
|
||||
static void
|
||||
check_result(isc_result_t result, const char *msg) {
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("%s: %s", msg, isc_result_totext(result));
|
||||
@@ -367,8 +366,7 @@ reset_system(void) {
|
||||
if (updatemsg != NULL) {
|
||||
dns_message_reset(updatemsg, DNS_MESSAGE_INTENTRENDER);
|
||||
} else {
|
||||
dns_message_create(gmctx, NULL, NULL, DNS_MESSAGE_INTENTRENDER,
|
||||
&updatemsg);
|
||||
dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &updatemsg);
|
||||
}
|
||||
updatemsg->opcode = dns_opcode_update;
|
||||
if (usegsstsig) {
|
||||
@@ -378,17 +376,18 @@ reset_system(void) {
|
||||
if (gssring != NULL) {
|
||||
dns_tsigkeyring_detach(&gssring);
|
||||
}
|
||||
tried_other_gsstsig = false;
|
||||
}
|
||||
}
|
||||
|
||||
static bool
|
||||
parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
|
||||
parse_hmac(const dns_name_t **hmac, const char *hmacstr, size_t len,
|
||||
uint16_t *digestbitsp) {
|
||||
uint16_t digestbits = 0;
|
||||
isc_result_t result;
|
||||
char buf[20];
|
||||
|
||||
REQUIRE(hmac_alg != NULL);
|
||||
REQUIRE(hmac != NULL && *hmac == NULL);
|
||||
REQUIRE(hmacstr != NULL);
|
||||
|
||||
if (len >= sizeof(buf)) {
|
||||
@@ -400,9 +399,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
|
||||
strlcpy(buf, hmacstr, ISC_MIN(len + 1, sizeof(buf)));
|
||||
|
||||
if (strcasecmp(buf, "hmac-md5") == 0) {
|
||||
*hmac_alg = DST_ALG_HMACMD5;
|
||||
*hmac = DNS_TSIG_HMACMD5_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
|
||||
*hmac_alg = DST_ALG_HMACMD5;
|
||||
*hmac = DNS_TSIG_HMACMD5_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[9], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 128) {
|
||||
error("digest-bits out of range [0..128]");
|
||||
@@ -410,9 +409,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
|
||||
}
|
||||
*digestbitsp = (digestbits + 7) & ~0x7U;
|
||||
} else if (strcasecmp(buf, "hmac-sha1") == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA1;
|
||||
*hmac = DNS_TSIG_HMACSHA1_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha1-", 10) == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA1;
|
||||
*hmac = DNS_TSIG_HMACSHA1_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[10], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 160) {
|
||||
error("digest-bits out of range [0..160]");
|
||||
@@ -420,9 +419,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
|
||||
}
|
||||
*digestbitsp = (digestbits + 7) & ~0x7U;
|
||||
} else if (strcasecmp(buf, "hmac-sha224") == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA224;
|
||||
*hmac = DNS_TSIG_HMACSHA224_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha224-", 12) == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA224;
|
||||
*hmac = DNS_TSIG_HMACSHA224_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[12], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 224) {
|
||||
error("digest-bits out of range [0..224]");
|
||||
@@ -430,9 +429,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
|
||||
}
|
||||
*digestbitsp = (digestbits + 7) & ~0x7U;
|
||||
} else if (strcasecmp(buf, "hmac-sha256") == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA256;
|
||||
*hmac = DNS_TSIG_HMACSHA256_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha256-", 12) == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA256;
|
||||
*hmac = DNS_TSIG_HMACSHA256_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[12], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 256) {
|
||||
error("digest-bits out of range [0..256]");
|
||||
@@ -440,9 +439,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
|
||||
}
|
||||
*digestbitsp = (digestbits + 7) & ~0x7U;
|
||||
} else if (strcasecmp(buf, "hmac-sha384") == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA384;
|
||||
*hmac = DNS_TSIG_HMACSHA384_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha384-", 12) == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA384;
|
||||
*hmac = DNS_TSIG_HMACSHA384_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[12], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 384) {
|
||||
error("digest-bits out of range [0..384]");
|
||||
@@ -450,9 +449,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
|
||||
}
|
||||
*digestbitsp = (digestbits + 7) & ~0x7U;
|
||||
} else if (strcasecmp(buf, "hmac-sha512") == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA512;
|
||||
*hmac = DNS_TSIG_HMACSHA512_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha512-", 12) == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA512;
|
||||
*hmac = DNS_TSIG_HMACSHA512_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[12], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 512) {
|
||||
error("digest-bits out of range [0..512]");
|
||||
@@ -487,12 +486,12 @@ setup_keystr(void) {
|
||||
isc_buffer_t secretbuf;
|
||||
isc_result_t result;
|
||||
isc_buffer_t keynamesrc;
|
||||
char *secretstr = NULL;
|
||||
char *s = NULL, *n = NULL;
|
||||
char *secretstr;
|
||||
char *s, *n;
|
||||
dns_fixedname_t fkeyname;
|
||||
dns_name_t *mykeyname = NULL;
|
||||
char *name = NULL;
|
||||
dst_algorithm_t hmac_alg;
|
||||
dns_name_t *mykeyname;
|
||||
char *name;
|
||||
const dns_name_t *hmacname = NULL;
|
||||
uint16_t digestbits = 0;
|
||||
|
||||
mykeyname = dns_fixedname_initname(&fkeyname);
|
||||
@@ -511,11 +510,11 @@ setup_keystr(void) {
|
||||
}
|
||||
name = secretstr;
|
||||
secretstr = n + 1;
|
||||
if (!parse_hmac(keystr, s - keystr, &hmac_alg, &digestbits)) {
|
||||
exit(EXIT_FAILURE);
|
||||
if (!parse_hmac(&hmacname, keystr, s - keystr, &digestbits)) {
|
||||
exit(1);
|
||||
}
|
||||
} else {
|
||||
hmac_alg = DST_ALG_HMACMD5;
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
name = keystr;
|
||||
n = s;
|
||||
}
|
||||
@@ -542,8 +541,8 @@ setup_keystr(void) {
|
||||
secretlen = isc_buffer_usedlength(&secretbuf);
|
||||
|
||||
debug("keycreate");
|
||||
result = dns_tsigkey_create(mykeyname, hmac_alg, secret, secretlen,
|
||||
gmctx, &tsigkey);
|
||||
result = dns_tsigkey_create(mykeyname, hmacname, secret, secretlen,
|
||||
false, NULL, 0, 0, gmctx, NULL, &tsigkey);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "could not create key from %s: %s\n", keystr,
|
||||
isc_result_totext(result));
|
||||
@@ -626,7 +625,7 @@ static void
|
||||
setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
|
||||
dst_key_t *dstkey = NULL;
|
||||
isc_result_t result;
|
||||
dst_algorithm_t hmac_alg = DST_ALG_UNKNOWN;
|
||||
const dns_name_t *hmacname = NULL;
|
||||
|
||||
debug("Creating key...");
|
||||
|
||||
@@ -657,26 +656,37 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
|
||||
|
||||
switch (dst_key_alg(dstkey)) {
|
||||
case DST_ALG_HMACMD5:
|
||||
case DST_ALG_HMACSHA1:
|
||||
case DST_ALG_HMACSHA224:
|
||||
case DST_ALG_HMACSHA256:
|
||||
case DST_ALG_HMACSHA384:
|
||||
case DST_ALG_HMACSHA512:
|
||||
hmac_alg = dst_key_alg(dstkey);
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
break;
|
||||
default:
|
||||
case DST_ALG_HMACSHA1:
|
||||
hmacname = DNS_TSIG_HMACSHA1_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA224:
|
||||
hmacname = DNS_TSIG_HMACSHA224_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA256:
|
||||
hmacname = DNS_TSIG_HMACSHA256_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA384:
|
||||
hmacname = DNS_TSIG_HMACSHA384_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA512:
|
||||
hmacname = DNS_TSIG_HMACSHA512_NAME;
|
||||
break;
|
||||
}
|
||||
if (hmacname != NULL) {
|
||||
result = dns_tsigkey_createfromkey(
|
||||
dst_key_name(dstkey), hmacname, dstkey, false, NULL, 0,
|
||||
0, mctx, NULL, &tsigkey);
|
||||
dst_key_free(&dstkey);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "could not create key from %s: %s\n",
|
||||
keyfile, isc_result_totext(result));
|
||||
return;
|
||||
}
|
||||
} else {
|
||||
dst_key_attach(dstkey, &sig0key);
|
||||
dst_key_free(&dstkey);
|
||||
return;
|
||||
}
|
||||
|
||||
result = dns_tsigkey_createfromkey(dst_key_name(dstkey), hmac_alg,
|
||||
dstkey, false, false, NULL, 0, 0,
|
||||
mctx, &tsigkey);
|
||||
dst_key_free(&dstkey);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "could not create key from %s: %s\n", keyfile,
|
||||
isc_result_totext(result));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -688,12 +698,12 @@ doshutdown(void) {
|
||||
* to NULL.
|
||||
*/
|
||||
if (primary_servers != NULL && primary_servers != servers) {
|
||||
isc_mem_cput(gmctx, primary_servers, primary_alloc,
|
||||
sizeof(isc_sockaddr_t));
|
||||
isc_mem_put(gmctx, primary_servers,
|
||||
primary_alloc * sizeof(isc_sockaddr_t));
|
||||
}
|
||||
|
||||
if (servers != NULL) {
|
||||
isc_mem_cput(gmctx, servers, ns_alloc, sizeof(isc_sockaddr_t));
|
||||
isc_mem_put(gmctx, servers, ns_alloc * sizeof(isc_sockaddr_t));
|
||||
}
|
||||
|
||||
if (localaddr4 != NULL) {
|
||||
@@ -802,7 +812,7 @@ create_name(const char *str, char *namedata, size_t len, dns_name_t *name) {
|
||||
}
|
||||
|
||||
static void
|
||||
setup_system(void *arg ISC_ATTR_UNUSED) {
|
||||
setup_system(void) {
|
||||
isc_result_t result;
|
||||
isc_sockaddr_t bind_any, bind_any6;
|
||||
isc_sockaddrlist_t *nslist;
|
||||
@@ -834,7 +844,7 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
|
||||
if (primary_servers == servers) {
|
||||
primary_servers = NULL;
|
||||
}
|
||||
isc_mem_cput(gmctx, servers, ns_alloc, sizeof(isc_sockaddr_t));
|
||||
isc_mem_put(gmctx, servers, ns_alloc * sizeof(isc_sockaddr_t));
|
||||
}
|
||||
|
||||
ns_inuse = 0;
|
||||
@@ -849,7 +859,7 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
|
||||
default_servers = !local_only;
|
||||
|
||||
ns_total = ns_alloc = (have_ipv4 ? 1 : 0) + (have_ipv6 ? 1 : 0);
|
||||
servers = isc_mem_cget(gmctx, ns_alloc, sizeof(isc_sockaddr_t));
|
||||
servers = isc_mem_get(gmctx, ns_alloc * sizeof(isc_sockaddr_t));
|
||||
|
||||
if (have_ipv6) {
|
||||
memset(&in6, 0, sizeof(in6));
|
||||
@@ -891,7 +901,7 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
|
||||
}
|
||||
|
||||
ns_alloc = ns_total;
|
||||
servers = isc_mem_cget(gmctx, ns_alloc, sizeof(isc_sockaddr_t));
|
||||
servers = isc_mem_get(gmctx, ns_alloc * sizeof(isc_sockaddr_t));
|
||||
|
||||
i = 0;
|
||||
for (sa = ISC_LIST_HEAD(*nslist); sa != NULL;
|
||||
@@ -923,7 +933,7 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
|
||||
|
||||
irs_resconf_destroy(&resconf);
|
||||
|
||||
result = dns_dispatchmgr_create(gmctx, loopmgr, netmgr, &dispatchmgr);
|
||||
result = dns_dispatchmgr_create(gmctx, netmgr, &dispatchmgr);
|
||||
check_result(result, "dns_dispatchmgr_create");
|
||||
|
||||
result = dst_lib_init(gmctx, NULL);
|
||||
@@ -971,7 +981,7 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
|
||||
dns_transport_set_always_verify_remote(transport,
|
||||
tls_always_verify_remote);
|
||||
|
||||
result = dns_requestmgr_create(gmctx, loopmgr, dispatchmgr, dispatchv4,
|
||||
result = dns_requestmgr_create(gmctx, dispatchmgr, dispatchv4,
|
||||
dispatchv6, &requestmgr);
|
||||
check_result(result, "dns_requestmgr_create");
|
||||
|
||||
@@ -1053,7 +1063,7 @@ pre_parse_args(int argc, char **argv) {
|
||||
"[-A tlscafile] [-H tlshostname] "
|
||||
"[-O] ] [-v] [-V] [-P] [-T] [-4 | -6] "
|
||||
"[filename]\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
|
||||
case 'P':
|
||||
for (t = 0xff00; t <= 0xfffe; t++) {
|
||||
@@ -1091,7 +1101,7 @@ pre_parse_args(int argc, char **argv) {
|
||||
}
|
||||
}
|
||||
if (doexit) {
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
}
|
||||
isc_commandline_reset = true;
|
||||
isc_commandline_index = 1;
|
||||
@@ -1125,6 +1135,7 @@ parse_args(int argc, char **argv) {
|
||||
break;
|
||||
case 'A':
|
||||
use_tls = true;
|
||||
usevc = true;
|
||||
tls_ca_file = isc_commandline_argument;
|
||||
break;
|
||||
case 'C':
|
||||
@@ -1139,10 +1150,12 @@ parse_args(int argc, char **argv) {
|
||||
break;
|
||||
case 'E':
|
||||
use_tls = true;
|
||||
usevc = true;
|
||||
tls_client_cert_file = isc_commandline_argument;
|
||||
break;
|
||||
case 'H':
|
||||
use_tls = true;
|
||||
usevc = true;
|
||||
tls_hostname = isc_commandline_argument;
|
||||
break;
|
||||
case 'M':
|
||||
@@ -1153,6 +1166,7 @@ parse_args(int argc, char **argv) {
|
||||
break;
|
||||
case 'K':
|
||||
use_tls = true;
|
||||
usevc = true;
|
||||
tls_client_key_file = isc_commandline_argument;
|
||||
break;
|
||||
case 'l':
|
||||
@@ -1166,7 +1180,7 @@ parse_args(int argc, char **argv) {
|
||||
"bad library debug value "
|
||||
"'%s'\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
logdebuglevel = i;
|
||||
break;
|
||||
@@ -1181,12 +1195,15 @@ parse_args(int argc, char **argv) {
|
||||
break;
|
||||
case 'g':
|
||||
usegsstsig = true;
|
||||
use_win2k_gsstsig = false;
|
||||
break;
|
||||
case 'o':
|
||||
usegsstsig = true;
|
||||
use_win2k_gsstsig = true;
|
||||
break;
|
||||
case 'O':
|
||||
use_tls = true;
|
||||
usevc = true;
|
||||
tls_always_verify_remote = false;
|
||||
break;
|
||||
case 'p':
|
||||
@@ -1197,11 +1214,12 @@ parse_args(int argc, char **argv) {
|
||||
"bad port number "
|
||||
"'%s'\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
case 'S':
|
||||
use_tls = true;
|
||||
usevc = true;
|
||||
break;
|
||||
case 't':
|
||||
result = isc_parse_uint32(&timeout,
|
||||
@@ -1209,7 +1227,7 @@ parse_args(int argc, char **argv) {
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "bad timeout '%s'\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
if (timeout == 0) {
|
||||
timeout = UINT_MAX;
|
||||
@@ -1221,7 +1239,10 @@ parse_args(int argc, char **argv) {
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "bad udp timeout '%s'\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
if (udp_timeout == 0) {
|
||||
udp_timeout = UINT_MAX;
|
||||
}
|
||||
break;
|
||||
case 'r':
|
||||
@@ -1230,7 +1251,7 @@ parse_args(int argc, char **argv) {
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "bad udp retries '%s'\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -1241,19 +1262,19 @@ parse_args(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option: %c\n", argv[0],
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
if (keyfile != NULL && keystr != NULL) {
|
||||
fprintf(stderr, "%s: cannot specify both -k and -y\n", argv[0]);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
#if HAVE_GSSAPI
|
||||
if (usegsstsig && (keyfile != NULL || keystr != NULL)) {
|
||||
fprintf(stderr, "%s: cannot specify -g with -k or -y\n",
|
||||
argv[0]);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
#else /* HAVE_GSSAPI */
|
||||
if (usegsstsig) {
|
||||
@@ -1261,12 +1282,11 @@ parse_args(int argc, char **argv) {
|
||||
"%s: cannot specify -g or -o, "
|
||||
"program not linked with GSS API Library\n",
|
||||
argv[0]);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
#endif /* HAVE_GSSAPI */
|
||||
|
||||
if (use_tls) {
|
||||
usevc = true;
|
||||
if ((tls_client_key_file == NULL) !=
|
||||
(tls_client_cert_file == NULL))
|
||||
{
|
||||
@@ -1274,14 +1294,14 @@ parse_args(int argc, char **argv) {
|
||||
"%s: cannot specify the -K option without"
|
||||
"the -E option, and vice versa.\n",
|
||||
argv[0]);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
if (tls_ca_file != NULL && tls_always_verify_remote == false) {
|
||||
fprintf(stderr,
|
||||
"%s: cannot specify the -A option in "
|
||||
"conjuction with the -O option.\n",
|
||||
argv[0]);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1295,7 +1315,7 @@ parse_args(int argc, char **argv) {
|
||||
fprintf(stderr, "could not open '%s': %s\n",
|
||||
argv[isc_commandline_index],
|
||||
isc_result_totext(result));
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
if (!force_interactive) {
|
||||
@@ -1521,90 +1541,6 @@ evaluate_prereq(char *cmdline) {
|
||||
return (make_prereq(cmdline, ispositive, isrrset));
|
||||
}
|
||||
|
||||
static void
|
||||
updateopt(void) {
|
||||
isc_result_t result;
|
||||
dns_ednsopt_t ednsopts[1];
|
||||
unsigned char ul[8];
|
||||
unsigned int count = 0;
|
||||
|
||||
if (lease_set) {
|
||||
isc_buffer_t b;
|
||||
INSIST(count < ARRAY_SIZE(ednsopts));
|
||||
ednsopts[count++] = (dns_ednsopt_t){ .code = DNS_OPT_UL,
|
||||
.length = keylease_set ? 8
|
||||
: 4,
|
||||
.value = ul };
|
||||
|
||||
isc_buffer_init(&b, ul, sizeof(ul));
|
||||
isc_buffer_putuint32(&b, lease);
|
||||
isc_buffer_putuint32(&b, keylease);
|
||||
}
|
||||
|
||||
if (count != 0) {
|
||||
dns_rdataset_t *opt = NULL;
|
||||
result = dns_message_buildopt(updatemsg, &opt, 0,
|
||||
DEFAULT_EDNS_BUFSIZE, 0, ednsopts,
|
||||
count);
|
||||
check_result(result, "dns_message_buildopt");
|
||||
result = dns_message_setopt(updatemsg, opt);
|
||||
check_result(result, "dns_message_setopt");
|
||||
} else {
|
||||
result = dns_message_setopt(updatemsg, NULL);
|
||||
check_result(result, "dns_message_setopt");
|
||||
}
|
||||
}
|
||||
|
||||
static uint16_t
|
||||
evaluate_lease(char *cmdline) {
|
||||
char *word;
|
||||
isc_result_t result;
|
||||
uint32_t value1, value2;
|
||||
|
||||
word = nsu_strsep(&cmdline, " \t\r\n");
|
||||
if (word == NULL || *word == 0) {
|
||||
fprintf(stderr, "could not read ttl\n");
|
||||
return (STATUS_SYNTAX);
|
||||
}
|
||||
|
||||
if (!strcasecmp(word, "none")) {
|
||||
lease = 0;
|
||||
lease_set = false;
|
||||
keylease = 0;
|
||||
keylease_set = false;
|
||||
updateopt();
|
||||
return (STATUS_MORE);
|
||||
}
|
||||
|
||||
result = isc_parse_uint32(&value1, word, 10);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (STATUS_SYNTAX);
|
||||
}
|
||||
|
||||
word = nsu_strsep(&cmdline, " \t\r\n");
|
||||
if (word == NULL || *word == 0) {
|
||||
lease = value1;
|
||||
lease_set = true;
|
||||
keylease = 0;
|
||||
keylease_set = false;
|
||||
updateopt();
|
||||
return (STATUS_MORE);
|
||||
}
|
||||
|
||||
result = isc_parse_uint32(&value2, word, 10);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (STATUS_SYNTAX);
|
||||
}
|
||||
|
||||
lease = value1;
|
||||
lease_set = true;
|
||||
keylease = value2;
|
||||
keylease_set = true;
|
||||
updateopt();
|
||||
|
||||
return (STATUS_MORE);
|
||||
}
|
||||
|
||||
static uint16_t
|
||||
evaluate_server(char *cmdline) {
|
||||
char *word, *server;
|
||||
@@ -1644,14 +1580,15 @@ evaluate_server(char *cmdline) {
|
||||
if (primary_servers == servers) {
|
||||
primary_servers = NULL;
|
||||
}
|
||||
isc_mem_cput(gmctx, servers, ns_alloc, sizeof(isc_sockaddr_t));
|
||||
isc_mem_put(gmctx, servers, ns_alloc * sizeof(isc_sockaddr_t));
|
||||
}
|
||||
|
||||
default_servers = false;
|
||||
|
||||
ns_alloc = MAX_SERVERADDRS;
|
||||
ns_inuse = 0;
|
||||
servers = isc_mem_cget(gmctx, ns_alloc, sizeof(isc_sockaddr_t));
|
||||
servers = isc_mem_getx(gmctx, ns_alloc * sizeof(isc_sockaddr_t),
|
||||
ISC_MEM_ZERO);
|
||||
ns_total = get_addresses(server, (in_port_t)port, servers, ns_alloc);
|
||||
if (ns_total == 0) {
|
||||
return (STATUS_SYNTAX);
|
||||
@@ -1721,7 +1658,7 @@ evaluate_key(char *cmdline) {
|
||||
int secretlen;
|
||||
unsigned char *secret = NULL;
|
||||
isc_buffer_t secretbuf;
|
||||
dst_algorithm_t hmac_alg = DST_ALG_UNKNOWN;
|
||||
const dns_name_t *hmacname = NULL;
|
||||
uint16_t digestbits = 0;
|
||||
char *n;
|
||||
|
||||
@@ -1735,12 +1672,12 @@ evaluate_key(char *cmdline) {
|
||||
|
||||
n = strchr(namestr, ':');
|
||||
if (n != NULL) {
|
||||
if (!parse_hmac(namestr, n - namestr, &hmac_alg, &digestbits)) {
|
||||
if (!parse_hmac(&hmacname, namestr, n - namestr, &digestbits)) {
|
||||
return (STATUS_SYNTAX);
|
||||
}
|
||||
namestr = n + 1;
|
||||
} else {
|
||||
hmac_alg = DST_ALG_HMACMD5;
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
}
|
||||
|
||||
isc_buffer_init(&b, namestr, strlen(namestr));
|
||||
@@ -1772,8 +1709,8 @@ evaluate_key(char *cmdline) {
|
||||
if (tsigkey != NULL) {
|
||||
dns_tsigkey_detach(&tsigkey);
|
||||
}
|
||||
result = dns_tsigkey_create(mykeyname, hmac_alg, secret, secretlen,
|
||||
gmctx, &tsigkey);
|
||||
result = dns_tsigkey_create(mykeyname, hmacname, secret, secretlen,
|
||||
false, NULL, 0, 0, gmctx, NULL, &tsigkey);
|
||||
isc_mem_free(gmctx, secret);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "could not create key from %s %s: %s\n",
|
||||
@@ -2246,7 +2183,7 @@ show_message(FILE *stream, dns_message_t *msg, const char *description) {
|
||||
if (bufsz > MAXTEXT) {
|
||||
fprintf(stderr, "could not allocate large enough "
|
||||
"buffer to display message\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
if (buf != NULL) {
|
||||
isc_buffer_free(&buf);
|
||||
@@ -2309,9 +2246,6 @@ do_next_command(char *cmdline) {
|
||||
if (strcasecmp(word, "add") == 0) {
|
||||
return (update_addordelete(cmdline, false));
|
||||
}
|
||||
if (strcasecmp(word, "lease") == 0) {
|
||||
return (evaluate_lease(cmdline));
|
||||
}
|
||||
if (strcasecmp(word, "server") == 0) {
|
||||
return (evaluate_server(cmdline));
|
||||
}
|
||||
@@ -2370,6 +2304,7 @@ do_next_command(char *cmdline) {
|
||||
if (strcasecmp(word, "gsstsig") == 0) {
|
||||
#if HAVE_GSSAPI
|
||||
usegsstsig = true;
|
||||
use_win2k_gsstsig = false;
|
||||
#else /* HAVE_GSSAPI */
|
||||
fprintf(stderr, "gsstsig not supported\n");
|
||||
#endif /* HAVE_GSSAPI */
|
||||
@@ -2378,6 +2313,7 @@ do_next_command(char *cmdline) {
|
||||
if (strcasecmp(word, "oldgsstsig") == 0) {
|
||||
#if HAVE_GSSAPI
|
||||
usegsstsig = true;
|
||||
use_win2k_gsstsig = true;
|
||||
#else /* HAVE_GSSAPI */
|
||||
fprintf(stderr, "gsstsig not supported\n");
|
||||
#endif /* HAVE_GSSAPI */
|
||||
@@ -2403,6 +2339,8 @@ do_next_command(char *cmdline) {
|
||||
"the request)\n"
|
||||
"gsstsig (use GSS_TSIG to "
|
||||
"sign the request)\n"
|
||||
"oldgsstsig (use Microsoft's "
|
||||
"GSS_TSIG to sign the request)\n"
|
||||
"zone name (set the zone to be "
|
||||
"updated)\n"
|
||||
"class CLASS (set the zone's DNS "
|
||||
@@ -2484,7 +2422,7 @@ static void
|
||||
done_update(void) {
|
||||
ddebug("done_update()");
|
||||
|
||||
isc_async_current(getinput, NULL);
|
||||
isc_job_run(loopmgr, getinput, NULL);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -2561,7 +2499,7 @@ update_completed(void *arg) {
|
||||
}
|
||||
|
||||
LOCK(&answer_lock);
|
||||
dns_message_create(gmctx, NULL, NULL, DNS_MESSAGE_INTENTPARSE, &answer);
|
||||
dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &answer);
|
||||
result = dns_request_getresponse(request, answer,
|
||||
DNS_MESSAGEPARSE_PRESERVEORDER);
|
||||
switch (result) {
|
||||
@@ -2749,7 +2687,7 @@ recvsoa(void *arg) {
|
||||
reqinfo = NULL;
|
||||
|
||||
ddebug("About to create rcvmsg");
|
||||
dns_message_create(gmctx, NULL, NULL, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
|
||||
dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
|
||||
result = dns_request_getresponse(request, rcvmsg,
|
||||
DNS_MESSAGEPARSE_PRESERVEORDER);
|
||||
if (result == DNS_R_TSIGERRORSET && servers != NULL) {
|
||||
@@ -2766,9 +2704,9 @@ recvsoa(void *arg) {
|
||||
dns_message_renderreset(soaquery);
|
||||
ddebug("retrying soa request without TSIG");
|
||||
|
||||
if (!default_servers && usevc) {
|
||||
if (usevc) {
|
||||
options |= DNS_REQUESTOPT_TCP;
|
||||
if (use_tls) {
|
||||
if (!default_servers && use_tls) {
|
||||
req_transport = transport;
|
||||
req_tls_ctx_cache = tls_ctx_cache;
|
||||
}
|
||||
@@ -2780,11 +2718,11 @@ recvsoa(void *arg) {
|
||||
srcaddr = localaddr4;
|
||||
}
|
||||
|
||||
result = dns_request_create(requestmgr, soaquery, srcaddr, addr,
|
||||
req_transport, req_tls_ctx_cache,
|
||||
options, NULL, timeout, udp_timeout,
|
||||
udp_retries, isc_loop_main(loopmgr),
|
||||
recvsoa, reqinfo, &request);
|
||||
result = dns_request_create(
|
||||
requestmgr, soaquery, srcaddr, addr, req_transport,
|
||||
req_tls_ctx_cache, options, NULL, FIND_TIMEOUT * 20,
|
||||
FIND_TIMEOUT, 3, isc_loop_main(loopmgr), recvsoa,
|
||||
reqinfo, &request);
|
||||
check_result(result, "dns_request_create");
|
||||
requests++;
|
||||
return;
|
||||
@@ -2914,19 +2852,20 @@ lookforsoa:
|
||||
if (default_servers) {
|
||||
char serverstr[DNS_NAME_MAXTEXT + 1];
|
||||
isc_buffer_t buf;
|
||||
size_t size;
|
||||
|
||||
isc_buffer_init(&buf, serverstr, sizeof(serverstr));
|
||||
result = dns_name_totext(&primary, DNS_NAME_OMITFINALDOT, &buf);
|
||||
result = dns_name_totext(&primary, true, &buf);
|
||||
check_result(result, "dns_name_totext");
|
||||
serverstr[isc_buffer_usedlength(&buf)] = 0;
|
||||
|
||||
if (primary_servers != NULL && primary_servers != servers) {
|
||||
isc_mem_cput(gmctx, primary_servers, primary_alloc,
|
||||
sizeof(isc_sockaddr_t));
|
||||
isc_mem_put(gmctx, primary_servers,
|
||||
primary_alloc * sizeof(isc_sockaddr_t));
|
||||
}
|
||||
primary_alloc = MAX_SERVERADDRS;
|
||||
primary_servers = isc_mem_cget(gmctx, primary_alloc,
|
||||
sizeof(isc_sockaddr_t));
|
||||
size = primary_alloc * sizeof(isc_sockaddr_t);
|
||||
primary_servers = isc_mem_getx(gmctx, size, ISC_MEM_ZERO);
|
||||
primary_total = get_addresses(serverstr, dnsport,
|
||||
primary_servers, primary_alloc);
|
||||
if (primary_total == 0) {
|
||||
@@ -2998,9 +2937,9 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
|
||||
dns_transport_t *req_transport = NULL;
|
||||
isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
|
||||
|
||||
if (!default_servers && usevc) {
|
||||
if (usevc) {
|
||||
options |= DNS_REQUESTOPT_TCP;
|
||||
if (use_tls) {
|
||||
if (!default_servers && use_tls) {
|
||||
req_transport = transport;
|
||||
req_tls_ctx_cache = tls_ctx_cache;
|
||||
}
|
||||
@@ -3019,7 +2958,7 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
|
||||
result = dns_request_create(
|
||||
requestmgr, msg, srcaddr, destaddr, req_transport,
|
||||
req_tls_ctx_cache, options, default_servers ? NULL : tsigkey,
|
||||
timeout, udp_timeout, udp_retries, isc_loop_main(loopmgr),
|
||||
FIND_TIMEOUT * 20, FIND_TIMEOUT, 3, isc_loop_main(loopmgr),
|
||||
recvsoa, reqinfo, request);
|
||||
check_result(result, "dns_request_create");
|
||||
requests++;
|
||||
@@ -3111,8 +3050,13 @@ start_gssrequest(dns_name_t *primary) {
|
||||
if (gssring != NULL) {
|
||||
dns_tsigkeyring_detach(&gssring);
|
||||
}
|
||||
gssring = NULL;
|
||||
result = dns_tsigkeyring_create(gmctx, &gssring);
|
||||
|
||||
dns_tsigkeyring_create(gmctx, &gssring);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("dns_tsigkeyring_create failed: %s",
|
||||
isc_result_totext(result));
|
||||
}
|
||||
|
||||
dns_name_format(primary, namestr, sizeof(namestr));
|
||||
if (kserver == NULL) {
|
||||
@@ -3160,12 +3104,13 @@ start_gssrequest(dns_name_t *primary) {
|
||||
keyname->attributes.nocompress = true;
|
||||
|
||||
rmsg = NULL;
|
||||
dns_message_create(gmctx, NULL, NULL, DNS_MESSAGE_INTENTRENDER, &rmsg);
|
||||
dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &rmsg);
|
||||
|
||||
/* Build first request. */
|
||||
context = GSS_C_NO_CONTEXT;
|
||||
result = dns_tkey_buildgssquery(rmsg, keyname, servname, 0, &context,
|
||||
gmctx, &err_message);
|
||||
result = dns_tkey_buildgssquery(rmsg, keyname, servname, NULL, 0,
|
||||
&context, use_win2k_gsstsig, gmctx,
|
||||
&err_message);
|
||||
if (result == ISC_R_FAILURE) {
|
||||
fprintf(stderr, "tkey query failed: %s\n",
|
||||
err_message != NULL ? err_message : "unknown error");
|
||||
@@ -3220,10 +3165,11 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
|
||||
srcaddr = localaddr4;
|
||||
}
|
||||
|
||||
result = dns_request_create(
|
||||
requestmgr, msg, srcaddr, destaddr, req_transport,
|
||||
req_tls_ctx_cache, options, tsigkey, timeout, udp_timeout,
|
||||
udp_retries, isc_loop_main(loopmgr), recvgss, reqinfo, request);
|
||||
result = dns_request_create(requestmgr, msg, srcaddr, destaddr,
|
||||
req_transport, req_tls_ctx_cache, options,
|
||||
tsigkey, FIND_TIMEOUT * 20, FIND_TIMEOUT, 3,
|
||||
isc_loop_main(loopmgr), recvgss, reqinfo,
|
||||
request);
|
||||
check_result(result, "dns_request_create");
|
||||
if (debugging) {
|
||||
show_message(stdout, msg, "Outgoing update query:");
|
||||
@@ -3275,7 +3221,7 @@ recvgss(void *arg) {
|
||||
isc_mem_put(gmctx, reqinfo, sizeof(nsu_gssinfo_t));
|
||||
|
||||
ddebug("recvgss creating rcvmsg");
|
||||
dns_message_create(gmctx, NULL, NULL, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
|
||||
dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
|
||||
|
||||
result = dns_request_getresponse(request, rcvmsg,
|
||||
DNS_MESSAGEPARSE_PRESERVEORDER);
|
||||
@@ -3290,19 +3236,23 @@ recvgss(void *arg) {
|
||||
fatal("invalid OPCODE in response to GSS-TSIG query");
|
||||
}
|
||||
|
||||
if (rcvmsg->rcode == dns_rcode_formerr && !tried_other_gsstsig) {
|
||||
ddebug("recvgss trying %s GSS-TSIG",
|
||||
use_win2k_gsstsig ? "Standard" : "Win2k");
|
||||
if (use_win2k_gsstsig) {
|
||||
use_win2k_gsstsig = false;
|
||||
} else {
|
||||
use_win2k_gsstsig = true;
|
||||
}
|
||||
tried_other_gsstsig = true;
|
||||
start_gssrequest(&restart_primary);
|
||||
goto done;
|
||||
}
|
||||
|
||||
if (rcvmsg->rcode != dns_rcode_noerror &&
|
||||
rcvmsg->rcode != dns_rcode_nxdomain)
|
||||
{
|
||||
char rcode[64];
|
||||
isc_buffer_t b;
|
||||
|
||||
isc_buffer_init(&b, rcode, sizeof(rcode) - 1);
|
||||
result = dns_rcode_totext(rcvmsg->rcode, &b);
|
||||
check_result(result, "dns_rcode_totext");
|
||||
rcode[isc_buffer_usedlength(&b)] = 0;
|
||||
|
||||
fatal("response to GSS-TSIG query was unsuccessful (%s)",
|
||||
rcode);
|
||||
fatal("response to GSS-TSIG query was unsuccessful");
|
||||
}
|
||||
|
||||
servname = dns_fixedname_initname(&fname);
|
||||
@@ -3311,8 +3261,10 @@ recvgss(void *arg) {
|
||||
result = dns_name_fromtext(servname, &buf, dns_rootname, 0, NULL);
|
||||
check_result(result, "dns_name_fromtext");
|
||||
|
||||
tsigkey = NULL;
|
||||
result = dns_tkey_gssnegotiate(tsigquery, rcvmsg, servname, &context,
|
||||
&tsigkey, gssring, &err_message);
|
||||
&tsigkey, gssring, use_win2k_gsstsig,
|
||||
&err_message);
|
||||
switch (result) {
|
||||
case DNS_R_CONTINUE:
|
||||
dns_message_detach(&rcvmsg);
|
||||
@@ -3338,6 +3290,18 @@ recvgss(void *arg) {
|
||||
* the TSIG -- this too is a spec violation, but it's
|
||||
* the least insane thing to do.
|
||||
*/
|
||||
#if 0
|
||||
/*
|
||||
* Verify the signature.
|
||||
*/
|
||||
rcvmsg->state = DNS_SECTION_ANY;
|
||||
dns_message_setquerytsig(rcvmsg, NULL);
|
||||
result = dns_message_settsigkey(rcvmsg, tsigkey);
|
||||
check_result(result, "dns_message_settsigkey");
|
||||
result = dns_message_checksig(rcvmsg, NULL);
|
||||
ddebug("tsig verification: %s", isc_result_totext(result));
|
||||
check_result(result, "dns_message_checksig");
|
||||
#endif /* 0 */
|
||||
|
||||
send_update(&tmpzonename, &primary_servers[primary_inuse]);
|
||||
setzoneclass(dns_rdataclass_none);
|
||||
@@ -3348,6 +3312,7 @@ recvgss(void *arg) {
|
||||
err_message != NULL ? err_message : "");
|
||||
}
|
||||
|
||||
done:
|
||||
dns_request_destroy(&request);
|
||||
dns_message_detach(&tsigquery);
|
||||
|
||||
@@ -3386,8 +3351,7 @@ start_update(void) {
|
||||
return;
|
||||
}
|
||||
|
||||
dns_message_create(gmctx, NULL, NULL, DNS_MESSAGE_INTENTRENDER,
|
||||
&soaquery);
|
||||
dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &soaquery);
|
||||
|
||||
if (default_servers) {
|
||||
soaquery->flags |= DNS_MESSAGEFLAG_RD;
|
||||
@@ -3539,8 +3503,6 @@ getinput(void *arg) {
|
||||
|
||||
int
|
||||
main(int argc, char **argv) {
|
||||
uint32_t timeoutms;
|
||||
|
||||
style = &dns_master_style_debug;
|
||||
|
||||
input = stdin;
|
||||
@@ -3563,11 +3525,8 @@ main(int argc, char **argv) {
|
||||
|
||||
parse_args(argc, argv);
|
||||
|
||||
/* Set the network manager timeouts in milliseconds. */
|
||||
timeoutms = timeout * 1000;
|
||||
isc_nm_settimeouts(netmgr, timeoutms, timeoutms, timeoutms, timeoutms);
|
||||
setup_system();
|
||||
|
||||
isc_loopmgr_setup(loopmgr, setup_system, NULL);
|
||||
isc_loopmgr_setup(loopmgr, getinput, NULL);
|
||||
isc_loopmgr_teardown(loopmgr, shutdown_program, NULL);
|
||||
isc_loopmgr_run(loopmgr);
|
||||
@@ -3576,7 +3535,7 @@ main(int argc, char **argv) {
|
||||
|
||||
if (seenerror) {
|
||||
return (2);
|
||||
} else {
|
||||
return (0);
|
||||
}
|
||||
|
||||
return (0);
|
||||
}
|
||||
|
||||
@@ -149,10 +149,8 @@ Options
|
||||
|
||||
.. option:: -o
|
||||
|
||||
This option is deprecated. Previously, it enabled a
|
||||
non-standards-compliant variant of GSS-TSIG that was used by Windows
|
||||
2000. Since that OS is now long past its end of life, this option is
|
||||
now treated as a synonym for :option:`-g`.
|
||||
This option enables a non-standards-compliant variant of GSS-TSIG
|
||||
used by Windows 2000.
|
||||
|
||||
.. option:: -O
|
||||
|
||||
@@ -189,11 +187,7 @@ Options
|
||||
.. option:: -t timeout
|
||||
|
||||
This option sets the maximum time an update request can take before it is aborted. The
|
||||
default is 300 seconds. If zero, the timeout is disabled for TCP mode. For UDP mode,
|
||||
the option :option:`-u` takes precedence over this option, unless the option :option:`-u`
|
||||
is set to zero, in which case the interval is computed from the :option:`-t` timeout interval
|
||||
and the number of UDP retries. For UDP mode, the timeout can not be disabled, and will
|
||||
be rounded up to 1 second in case if both :option:`-t` and :option:`-u` are set to zero.
|
||||
default is 300 seconds. If zero, the timeout is disabled.
|
||||
|
||||
.. option:: -T
|
||||
|
||||
@@ -302,9 +296,8 @@ The command formats and their meanings are as follows:
|
||||
:option:`-g` on the command line.
|
||||
|
||||
``oldgsstsig``
|
||||
This command is deprecated and will be removed in a future release.
|
||||
Previously, it caused ``nsupdate`` to use the Windows 2000 version of
|
||||
GSS-TSIG to sign updates. It is now treated as a synonym for ``gsstsig``.
|
||||
This command uses the Windows 2000 version of GSS-TSIG to sign the updates. This is
|
||||
equivalent to specifying :option:`-o` on the command line.
|
||||
|
||||
``realm [realm_name]``
|
||||
When using GSS-TSIG, this command specifies the use of ``realm_name`` rather than the default realm
|
||||
@@ -323,11 +316,6 @@ The command formats and their meanings are as follows:
|
||||
By default check-svcb processing is on. If check-svcb processing
|
||||
fails, the record is not added to the UPDATE message.
|
||||
|
||||
``lease time [keytime]``
|
||||
Set the EDNS Update Lease (UL) option to value to ``time`` and
|
||||
optionally also set the key lease time to ``keytime`` in seconds.
|
||||
If ``time`` is ``none`` the lease times are cleared.
|
||||
|
||||
``prereq nxdomain domain-name``
|
||||
This command requires that no resource record of any type exist with the name
|
||||
``domain-name``.
|
||||
|
||||
@@ -358,7 +358,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
|
||||
*instp = inst;
|
||||
|
||||
cleanup:
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
if (result != ISC_R_SUCCESS && inst != NULL) {
|
||||
plugin_destroy((void **)&inst);
|
||||
}
|
||||
|
||||
|
||||
@@ -362,7 +362,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
|
||||
*instp = inst;
|
||||
|
||||
cleanup:
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
if (result != ISC_R_SUCCESS && inst != NULL) {
|
||||
plugin_destroy((void **)&inst);
|
||||
}
|
||||
|
||||
|
||||
+110
-38
@@ -17,6 +17,7 @@
|
||||
#include <stdbool.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
#include <isc/atomic.h>
|
||||
#include <isc/attributes.h>
|
||||
#include <isc/buffer.h>
|
||||
#include <isc/commandline.h>
|
||||
@@ -50,8 +51,7 @@
|
||||
|
||||
#include "util.h"
|
||||
|
||||
#define SERVERADDRS 10
|
||||
#define RNDC_TIMEOUT 60 * 1000
|
||||
#define SERVERADDRS 10
|
||||
|
||||
const char *progname = NULL;
|
||||
bool verbose;
|
||||
@@ -76,13 +76,18 @@ static isccc_region_t secret;
|
||||
static bool failed = false;
|
||||
static bool c_flag = false;
|
||||
static isc_mem_t *rndc_mctx = NULL;
|
||||
static atomic_uint_fast32_t sends = 0;
|
||||
static atomic_uint_fast32_t recvs = 0;
|
||||
static atomic_uint_fast32_t connects = 0;
|
||||
static char *command = NULL;
|
||||
static char *args = NULL;
|
||||
static char program[256];
|
||||
static uint32_t serial;
|
||||
static bool quiet = false;
|
||||
static bool showresult = false;
|
||||
static int32_t timeout = RNDC_TIMEOUT;
|
||||
static bool shuttingdown = false;
|
||||
static isc_nmhandle_t *recvdone_handle = NULL;
|
||||
static isc_nmhandle_t *recvnonce_handle = NULL;
|
||||
|
||||
static void
|
||||
rndc_startconnect(isc_sockaddr_t *addr);
|
||||
@@ -116,7 +121,7 @@ command is one of the following:\n\
|
||||
Requires the zone to have a dnssec-policy.\n\
|
||||
dnstap -reopen\n\
|
||||
Close, truncate and re-open the DNSTAP output file.\n\
|
||||
dnstap -roll [count]\n\
|
||||
dnstap -roll count\n\
|
||||
Close, rename and re-open the DNSTAP output file(s).\n\
|
||||
dumpdb [-all|-cache|-zones|-adb|-bad|-expired|-fail] [view ...]\n\
|
||||
Dump cache(s) to the dump file (named_dump.db).\n\
|
||||
@@ -212,6 +217,10 @@ command is one of the following:\n\
|
||||
Enable updates to a frozen dynamic zone and reload it.\n\
|
||||
trace Increment debugging level by one.\n\
|
||||
trace level Change the debugging level.\n\
|
||||
tsig-delete keyname [view]\n\
|
||||
Delete a TKEY-negotiated TSIG key.\n\
|
||||
tsig-list List all currently active TSIG keys, including both statically\n\
|
||||
configured and TKEY-negotiated keys.\n\
|
||||
validation [ on | off | status ] [view]\n\
|
||||
Enable / disable DNSSEC validation.\n\
|
||||
zonestatus zone [class [view]]\n\
|
||||
@@ -223,7 +232,7 @@ Version: %s\n",
|
||||
exit(status);
|
||||
}
|
||||
|
||||
#define CMDLINE_FLAGS "46b:c:hk:Mmp:qrs:t:Vy:"
|
||||
#define CMDLINE_FLAGS "46b:c:hk:Mmp:qrs:Vy:"
|
||||
|
||||
static void
|
||||
preparse_args(int argc, char **argv) {
|
||||
@@ -260,11 +269,18 @@ get_addresses(const char *host, in_port_t port) {
|
||||
|
||||
REQUIRE(host != NULL);
|
||||
|
||||
count = SERVERADDRS - nserveraddrs;
|
||||
result = isc_getaddresses(host, port, &serveraddrs[nserveraddrs], count,
|
||||
&found);
|
||||
nserveraddrs += found;
|
||||
|
||||
if (*host == '/') {
|
||||
result = isc_sockaddr_frompath(&serveraddrs[nserveraddrs],
|
||||
host);
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
nserveraddrs++;
|
||||
}
|
||||
} else {
|
||||
count = SERVERADDRS - nserveraddrs;
|
||||
result = isc_getaddresses(
|
||||
host, port, &serveraddrs[nserveraddrs], count, &found);
|
||||
nserveraddrs += found;
|
||||
}
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("couldn't get address for '%s': %s", host,
|
||||
isc_result_totext(result));
|
||||
@@ -273,11 +289,22 @@ get_addresses(const char *host, in_port_t port) {
|
||||
}
|
||||
|
||||
static void
|
||||
rndc_senddone(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
void *arg ISC_ATTR_UNUSED) {
|
||||
rndc_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
|
||||
isc_nmhandle_t *sendhandle = (isc_nmhandle_t *)arg;
|
||||
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("send failed: %s", isc_result_totext(result));
|
||||
}
|
||||
|
||||
REQUIRE(sendhandle == handle);
|
||||
isc_nmhandle_detach(&sendhandle);
|
||||
|
||||
if (atomic_fetch_sub_release(&sends, 1) == 1 &&
|
||||
atomic_load_acquire(&recvs) == 0)
|
||||
{
|
||||
shuttingdown = true;
|
||||
isc_loopmgr_shutdown(loopmgr);
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -289,10 +316,16 @@ rndc_recvdone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
|
||||
char *errormsg = NULL;
|
||||
char *textmsg = NULL;
|
||||
|
||||
REQUIRE(handle != NULL);
|
||||
REQUIRE(ccmsg != NULL);
|
||||
|
||||
if (result == ISC_R_EOF) {
|
||||
if (shuttingdown && (result == ISC_R_EOF || result == ISC_R_CANCELED)) {
|
||||
atomic_fetch_sub_release(&recvs, 1);
|
||||
if (handle != NULL) {
|
||||
REQUIRE(recvdone_handle == handle);
|
||||
isc_nmhandle_detach(&recvdone_handle);
|
||||
}
|
||||
return;
|
||||
} else if (result == ISC_R_EOF) {
|
||||
fatal("connection to remote host closed.\n"
|
||||
"* This may indicate that the\n"
|
||||
"* remote server is using an older\n"
|
||||
@@ -348,27 +381,41 @@ rndc_recvdone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
|
||||
|
||||
isccc_sexpr_free(&response);
|
||||
|
||||
isccc_ccmsg_disconnect(ccmsg);
|
||||
isc_loopmgr_shutdown(loopmgr);
|
||||
REQUIRE(recvdone_handle == handle);
|
||||
isc_nmhandle_detach(&recvdone_handle);
|
||||
|
||||
if (atomic_fetch_sub_release(&recvs, 1) == 1 &&
|
||||
atomic_load_acquire(&sends) == 0)
|
||||
{
|
||||
shuttingdown = true;
|
||||
isc_loopmgr_shutdown(loopmgr);
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
rndc_recvnonce(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
void *arg) {
|
||||
rndc_recvnonce(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
|
||||
isccc_ccmsg_t *ccmsg = (isccc_ccmsg_t *)arg;
|
||||
isccc_sexpr_t *response = NULL;
|
||||
isc_nmhandle_t *sendhandle = NULL;
|
||||
isccc_sexpr_t *_ctrl = NULL;
|
||||
isccc_region_t source;
|
||||
uint32_t nonce;
|
||||
isccc_sexpr_t *request = NULL;
|
||||
isccc_time_t now = isc_stdtime_now();
|
||||
isccc_time_t now;
|
||||
isc_region_t r;
|
||||
isccc_sexpr_t *data = NULL;
|
||||
isc_buffer_t b;
|
||||
|
||||
REQUIRE(ccmsg != NULL);
|
||||
|
||||
if (result == ISC_R_EOF) {
|
||||
if (shuttingdown && (result == ISC_R_EOF || result == ISC_R_CANCELED)) {
|
||||
atomic_fetch_sub_release(&recvs, 1);
|
||||
if (handle != NULL) {
|
||||
REQUIRE(recvnonce_handle == handle);
|
||||
isc_nmhandle_detach(&recvnonce_handle);
|
||||
}
|
||||
return;
|
||||
} else if (result == ISC_R_EOF) {
|
||||
fatal("connection to remote host closed.\n"
|
||||
"* This may indicate that the\n"
|
||||
"* remote server is using an older\n"
|
||||
@@ -396,6 +443,8 @@ rndc_recvnonce(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
nonce = 0;
|
||||
}
|
||||
|
||||
isc_stdtime_get(&now);
|
||||
|
||||
DO("create message", isccc_cc_createmessage(1, NULL, NULL, ++serial,
|
||||
now, now + 60, &request));
|
||||
data = isccc_alist_lookup(request, "_data");
|
||||
@@ -428,8 +477,17 @@ rndc_recvnonce(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
r.base = databuf->base;
|
||||
r.length = databuf->used;
|
||||
|
||||
isc_nmhandle_attach(handle, &recvdone_handle);
|
||||
atomic_fetch_add_relaxed(&recvs, 1);
|
||||
isccc_ccmsg_readmessage(ccmsg, rndc_recvdone, ccmsg);
|
||||
isccc_ccmsg_sendmessage(ccmsg, &r, rndc_senddone, NULL);
|
||||
|
||||
isc_nmhandle_attach(handle, &sendhandle);
|
||||
atomic_fetch_add_relaxed(&sends, 1);
|
||||
isc_nm_send(handle, &r, rndc_senddone, sendhandle);
|
||||
|
||||
REQUIRE(recvnonce_handle == handle);
|
||||
isc_nmhandle_detach(&recvnonce_handle);
|
||||
atomic_fetch_sub_release(&recvs, 1);
|
||||
|
||||
isccc_sexpr_free(&response);
|
||||
isccc_sexpr_free(&request);
|
||||
@@ -442,13 +500,16 @@ rndc_connected(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
|
||||
char socktext[ISC_SOCKADDR_FORMATSIZE];
|
||||
isccc_sexpr_t *request = NULL;
|
||||
isccc_sexpr_t *data = NULL;
|
||||
isccc_time_t now = isc_stdtime_now();
|
||||
isccc_time_t now;
|
||||
isc_region_t r;
|
||||
isc_buffer_t b;
|
||||
isc_nmhandle_t *connhandle = NULL;
|
||||
isc_nmhandle_t *sendhandle = NULL;
|
||||
|
||||
REQUIRE(ccmsg != NULL);
|
||||
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
atomic_fetch_sub_release(&connects, 1);
|
||||
isc_sockaddr_format(&serveraddrs[currentaddr], socktext,
|
||||
sizeof(socktext));
|
||||
if (++currentaddr < nserveraddrs) {
|
||||
@@ -462,6 +523,9 @@ rndc_connected(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
|
||||
isc_result_totext(result));
|
||||
}
|
||||
|
||||
isc_nmhandle_attach(handle, &connhandle);
|
||||
|
||||
isc_stdtime_get(&now);
|
||||
DO("create message", isccc_cc_createmessage(1, NULL, NULL, ++serial,
|
||||
now, now + 60, &request));
|
||||
data = isccc_alist_lookup(request, "_data");
|
||||
@@ -485,12 +549,19 @@ rndc_connected(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
|
||||
r.base = databuf->base;
|
||||
r.length = databuf->used;
|
||||
|
||||
/* isccc_ccmsg_init() attaches to the handle */
|
||||
isccc_ccmsg_init(rndc_mctx, handle, ccmsg);
|
||||
isccc_ccmsg_setmaxsize(ccmsg, 1024 * 1024);
|
||||
|
||||
isc_nmhandle_attach(handle, &recvnonce_handle);
|
||||
atomic_fetch_add_relaxed(&recvs, 1);
|
||||
isccc_ccmsg_readmessage(ccmsg, rndc_recvnonce, ccmsg);
|
||||
isccc_ccmsg_sendmessage(ccmsg, &r, rndc_senddone, NULL);
|
||||
|
||||
isc_nmhandle_attach(handle, &sendhandle);
|
||||
atomic_fetch_add_relaxed(&sends, 1);
|
||||
isc_nm_send(handle, &r, rndc_senddone, sendhandle);
|
||||
|
||||
isc_nmhandle_detach(&connhandle);
|
||||
atomic_fetch_sub_release(&connects, 1);
|
||||
|
||||
isccc_sexpr_free(&request);
|
||||
}
|
||||
@@ -511,12 +582,18 @@ rndc_startconnect(isc_sockaddr_t *addr) {
|
||||
case AF_INET6:
|
||||
local = &local6;
|
||||
break;
|
||||
case AF_UNIX:
|
||||
/*
|
||||
* TODO: support UNIX domain sockets in netgmr.
|
||||
*/
|
||||
fatal("UNIX domain sockets not currently supported");
|
||||
default:
|
||||
UNREACHABLE();
|
||||
}
|
||||
|
||||
atomic_fetch_add_relaxed(&connects, 1);
|
||||
isc_nm_tcpconnect(netmgr, local, addr, rndc_connected, &rndc_ccmsg,
|
||||
timeout);
|
||||
60000);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -816,7 +893,7 @@ main(int argc, char **argv) {
|
||||
const char *keyname = NULL;
|
||||
struct in_addr in;
|
||||
struct in6_addr in6;
|
||||
char *p = NULL;
|
||||
char *p;
|
||||
size_t argslen;
|
||||
int ch;
|
||||
int i;
|
||||
@@ -902,15 +979,6 @@ main(int argc, char **argv) {
|
||||
servername = isc_commandline_argument;
|
||||
break;
|
||||
|
||||
case 't':
|
||||
timeout = strtol(isc_commandline_argument, &p, 10);
|
||||
if (*p != '\0' || timeout < 0 || timeout > 86400) {
|
||||
fatal("invalid timeout '%s'",
|
||||
isc_commandline_argument);
|
||||
}
|
||||
timeout *= 1000;
|
||||
break;
|
||||
|
||||
case 'V':
|
||||
verbose = true;
|
||||
break;
|
||||
@@ -932,7 +1000,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -954,8 +1022,6 @@ main(int argc, char **argv) {
|
||||
isc_managers_create(&rndc_mctx, 1, &loopmgr, &netmgr);
|
||||
isc_loopmgr_setup(loopmgr, rndc_start, NULL);
|
||||
|
||||
isc_nm_settimeouts(netmgr, timeout, timeout, timeout, 0);
|
||||
|
||||
isc_log_create(rndc_mctx, &log, &logconfig);
|
||||
isc_log_setcontext(log);
|
||||
isc_log_settag(logconfig, progname);
|
||||
@@ -1003,6 +1069,12 @@ main(int argc, char **argv) {
|
||||
|
||||
isc_loopmgr_run(loopmgr);
|
||||
|
||||
/*
|
||||
* Note: when TCP connections are shut down, there will be a final
|
||||
* call to the isccc callback routine with &rndc_ccmsg as its
|
||||
* argument. We therefore need to delay invalidating it until
|
||||
* after the netmgr is closed down.
|
||||
*/
|
||||
isccc_ccmsg_invalidate(&rndc_ccmsg);
|
||||
|
||||
isc_log_destroy(&log);
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
/*
|
||||
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
*
|
||||
* SPDX-License-Identifier: MPL-2.0
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
*/
|
||||
|
||||
/*
|
||||
* Sample rndc configuration file.
|
||||
*/
|
||||
|
||||
options {
|
||||
default-server localhost;
|
||||
default-key "key";
|
||||
};
|
||||
|
||||
server localhost {
|
||||
key "key";
|
||||
};
|
||||
|
||||
key "cc64b3d1db63fc88d7cb5d2f9f57d258" {
|
||||
algorithm hmac-sha256;
|
||||
secret "34f88008d07deabbe65bd01f1d233d47";
|
||||
};
|
||||
|
||||
server "test1" {
|
||||
key "cc64b3d1db63fc88d7cb5d2f9f57d258";
|
||||
port 5353;
|
||||
addresses { 10.53.0.1; };
|
||||
};
|
||||
|
||||
key "key" {
|
||||
algorithm hmac-sha256;
|
||||
secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
|
||||
};
|
||||
+23
-21
@@ -97,12 +97,6 @@ Options
|
||||
after executing the requested command (e.g., ISC_R_SUCCESS,
|
||||
ISC_R_FAILURE, etc.).
|
||||
|
||||
.. option:: -t timeout
|
||||
|
||||
This option sets the idle timeout period for :program:`rndc` to
|
||||
``timeout`` seconds. The default is 60 seconds, and the maximum settable
|
||||
value is 86400 seconds (1 day). If set to 0, there is no timeout.
|
||||
|
||||
.. option:: -V
|
||||
|
||||
This option enables verbose logging.
|
||||
@@ -195,13 +189,9 @@ Currently supported commands are:
|
||||
|
||||
.. option:: dnstap (-reopen | -roll [number])
|
||||
|
||||
This command closes and re-opens DNSTAP output files.
|
||||
|
||||
``rndc dnstap -reopen`` allows
|
||||
This command closes and re-opens DNSTAP output files. ``rndc dnstap -reopen`` allows
|
||||
the output file to be renamed externally, so that :iscman:`named` can
|
||||
truncate and re-open it.
|
||||
|
||||
``rndc dnstap -roll`` causes the output file
|
||||
truncate and re-open it. ``rndc dnstap -roll`` causes the output file
|
||||
to be rolled automatically, similar to log files. The most recent
|
||||
output file has ".0" appended to its name; the previous most recent
|
||||
output file is moved to ".1", and so on. If ``number`` is specified, then
|
||||
@@ -265,9 +255,10 @@ Currently supported commands are:
|
||||
immediately re-signed by the new keys, but is allowed to
|
||||
incrementally re-sign over time.
|
||||
|
||||
This command requires that the zone be configured with a ``dnssec-policy``, and
|
||||
also requires the zone to be configured to allow dynamic DNS. (See "Dynamic
|
||||
Update Policies" in the Administrator Reference Manual for more details.)
|
||||
This command requires that the zone be configured with a ``dnssec-policy``, or
|
||||
that the ``auto-dnssec`` zone option be set to ``maintain``, and also requires the
|
||||
zone to be configured to allow dynamic DNS. (See "Dynamic Update Policies" in
|
||||
the Administrator Reference Manual for more details.)
|
||||
|
||||
.. option:: managed-keys (status | refresh | sync | destroy) [class [view]]
|
||||
|
||||
@@ -440,7 +431,6 @@ Currently supported commands are:
|
||||
.. option:: zone [class [view]]
|
||||
|
||||
If a zone is specified, this command reloads only the given zone.
|
||||
If no zone is specified, the reloading happens asynchronously.
|
||||
|
||||
.. program:: rndc
|
||||
|
||||
@@ -504,9 +494,11 @@ Currently supported commands are:
|
||||
the zone's DNSKEY RRset. If the DNSKEY RRset is changed, then the
|
||||
zone is automatically re-signed with the new key set.
|
||||
|
||||
This command requires that the zone be configured with a ``dnssec-policy``, and
|
||||
also requires the zone to be configured to allow dynamic DNS. (See "Dynamic
|
||||
Update Policies" in the Administrator Reference Manual for more details.)
|
||||
This command requires that the zone be configured with a ``dnssec-policy``, or
|
||||
that the ``auto-dnssec`` zone option be set to ``allow`` or ``maintain``,
|
||||
and also requires the zone to be configured to allow dynamic DNS. (See
|
||||
"Dynamic Update Policies" in the BIND 9 Administrator Reference Manual for more
|
||||
details.)
|
||||
|
||||
See also :option:`rndc loadkeys`.
|
||||
|
||||
@@ -605,8 +597,7 @@ Currently supported commands are:
|
||||
refused. If the zone has changed and the ``ixfr-from-differences``
|
||||
option is in use, the journal file is updated to reflect
|
||||
changes in the zone. Otherwise, if the zone has changed, any existing
|
||||
journal file is removed. If no zone is specified, the reloading happens
|
||||
asynchronously.
|
||||
journal file is removed.
|
||||
|
||||
See also :option:`rndc freeze`.
|
||||
|
||||
@@ -625,6 +616,17 @@ Currently supported commands are:
|
||||
|
||||
.. program:: rndc
|
||||
|
||||
.. option:: tsig-delete keyname [view]
|
||||
|
||||
This command deletes a given TKEY-negotiated key from the server. This does not
|
||||
apply to statically configured TSIG keys.
|
||||
|
||||
.. option:: tsig-list
|
||||
|
||||
This command lists the names of all TSIG keys currently configured for use by
|
||||
:iscman:`named` in each view. The list includes both statically configured keys and
|
||||
dynamic TKEY-negotiated keys.
|
||||
|
||||
.. option:: validation (on | off | status) [view ...]
|
||||
|
||||
This command enables, disables, or checks the current status of DNSSEC validation. By
|
||||
|
||||
+1
-4
@@ -18,9 +18,6 @@
|
||||
#include <stdbool.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include <isc/tls.h>
|
||||
|
||||
extern bool verbose;
|
||||
extern const char *progname;
|
||||
@@ -46,5 +43,5 @@ fatal(const char *format, ...) {
|
||||
vfprintf(stderr, format, args);
|
||||
va_end(args);
|
||||
fprintf(stderr, "\n");
|
||||
_exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
@@ -19,7 +19,7 @@ $len = @ARGV[1] if (@ARGV == 2);
|
||||
|
||||
my @chars = split("", "abcdefghijklmnopqrstuvwxyz123456789");
|
||||
|
||||
srand;
|
||||
srand;
|
||||
for (my $i = 0; $i < @ARGV[0]; $i++) {
|
||||
my $name = "";
|
||||
for (my $j = 0; $j < $len; $j++) {
|
||||
|
||||
@@ -31,7 +31,7 @@ print"\$TTL 300 ; 5 minutes
|
||||
NS ns
|
||||
ns A 10.53.0.3\n";
|
||||
|
||||
srand;
|
||||
srand;
|
||||
for (my $i = 0; $i < $nrecords; $i++) {
|
||||
my $name = "";
|
||||
for (my $j = 0; $j < 8; $j++) {
|
||||
|
||||
@@ -11,20 +11,20 @@
|
||||
# See the COPYRIGHT file distributed with this work for additional
|
||||
# information regarding copyright ownership.
|
||||
|
||||
usage() {
|
||||
echo "Usage: $0 [-s] <number of zones> [<records per zone>]"
|
||||
echo " -s: use the same zone file all zones"
|
||||
exit 1
|
||||
usage () {
|
||||
echo "Usage: $0 [-s] <number of zones> [<records per zone>]"
|
||||
echo " -s: use the same zone file all zones"
|
||||
exit 1
|
||||
}
|
||||
|
||||
if [ "$#" -lt 1 -o "$#" -gt 3 ]; then
|
||||
usage
|
||||
usage
|
||||
fi
|
||||
|
||||
single_file=""
|
||||
if [ $1 = "-s" ]; then
|
||||
single_file=yes
|
||||
shift
|
||||
single_file=yes
|
||||
shift
|
||||
fi
|
||||
|
||||
nzones=$1
|
||||
@@ -35,9 +35,9 @@ nrecords=5
|
||||
|
||||
. ../system/conf.sh
|
||||
|
||||
cat <<EOF
|
||||
cat << EOF
|
||||
options {
|
||||
directory "$(pwd)";
|
||||
directory "`pwd`";
|
||||
listen-on { localhost; };
|
||||
listen-on-v6 { localhost; };
|
||||
port 5300;
|
||||
@@ -58,7 +58,7 @@ controls {
|
||||
|
||||
logging {
|
||||
channel basic {
|
||||
file "$(pwd)/named.log" versions 3 size 100m;
|
||||
file "`pwd`/named.log" versions 3 size 100m;
|
||||
severity info;
|
||||
print-time yes;
|
||||
print-severity no;
|
||||
@@ -72,11 +72,11 @@ logging {
|
||||
EOF
|
||||
|
||||
$PERL makenames.pl $nzones | while read zonename; do
|
||||
if [ $single_file ]; then
|
||||
echo "zone $zonename { type primary; file \"smallzone.db\"; };"
|
||||
else
|
||||
[ -d zones ] || mkdir zones
|
||||
$PERL mkzonefile.pl $zonename $nrecords >zones/$zonename.db
|
||||
echo "zone $zonename { type primary; file \"zones/$zonename.db\"; };"
|
||||
fi
|
||||
if [ $single_file ]; then
|
||||
echo "zone $zonename { type primary; file \"smallzone.db\"; };"
|
||||
else
|
||||
[ -d zones ] || mkdir zones
|
||||
$PERL mkzonefile.pl $zonename $nrecords > zones/$zonename.db
|
||||
echo "zone $zonename { type primary; file \"zones/$zonename.db\"; };"
|
||||
fi
|
||||
done
|
||||
|
||||
@@ -13,17 +13,9 @@ named.run
|
||||
/random.data
|
||||
/*.log
|
||||
/*.trs
|
||||
/*.xml
|
||||
/resolve
|
||||
/run.sh
|
||||
/run.log
|
||||
/start.sh
|
||||
/stop.sh
|
||||
/ifconfig.sh
|
||||
|
||||
# Ignore file names with underscore in their name except python or shell files.
|
||||
# This is done to ignore the temporary directories and symlinks created by the
|
||||
# pytest runner, which contain underscore in their file names.
|
||||
/*_*
|
||||
!/*_*.py
|
||||
!/*_*.sh
|
||||
!/_common
|
||||
|
||||
+102
-73
@@ -11,38 +11,26 @@ dist-hook:
|
||||
|
||||
SUBDIRS = dyndb/driver dlzexternal/driver hooks/driver
|
||||
|
||||
if DNSRPS
|
||||
SUBDIRS += rpz/testlib
|
||||
endif
|
||||
|
||||
AM_CPPFLAGS += \
|
||||
$(LIBISC_CFLAGS) \
|
||||
$(LIBDNS_CFLAGS)
|
||||
$(LIBISC_CFLAGS)
|
||||
|
||||
LDADD += \
|
||||
$(LIBISC_LIBS) \
|
||||
$(LIBDNS_LIBS)
|
||||
$(LIBISC_LIBS)
|
||||
|
||||
if HAVE_PERL
|
||||
if HAVE_PYTHON
|
||||
if HAVE_PYTEST
|
||||
|
||||
noinst_PROGRAMS = \
|
||||
check_PROGRAMS = \
|
||||
feature-test \
|
||||
makejournal \
|
||||
pipelined/pipequeries \
|
||||
rndc/gencheck \
|
||||
rpz/dnsrps
|
||||
rpz/dnsrps \
|
||||
tkey/keycreate \
|
||||
tkey/keydelete
|
||||
|
||||
feature_test_CPPFLAGS = \
|
||||
$(AM_CPPFLAGS) \
|
||||
$(LIBDNS_CFLAGS) \
|
||||
$(OPENSSL_CFLAGS)
|
||||
|
||||
feature_test_LDADD = \
|
||||
$(LDADD) \
|
||||
$(LIBDNS_LIBS) \
|
||||
$(OPENSSL_LIBS)
|
||||
$(LIBDNS_CFLAGS)
|
||||
|
||||
makejournal_CPPFLAGS = \
|
||||
$(AM_CPPFLAGS) \
|
||||
@@ -62,22 +50,45 @@ pipelined_pipequeries_LDADD = \
|
||||
|
||||
rpz_dnsrps_CPPFLAGS = \
|
||||
$(AM_CPPFLAGS) \
|
||||
$(LIBDNS_CFLAGS) \
|
||||
-DLIBRPZ_LIB_OPEN=\"$(abs_builddir)/rpz/testlib/.libs/libdummyrpz.so\"
|
||||
$(LIBDNS_CFLAGS)
|
||||
|
||||
rpz_dnsrps_LDADD = \
|
||||
$(LDADD) \
|
||||
$(LIBDNS_LIBS) \
|
||||
$(DLOPEN_LIBS)
|
||||
$(LIBDNS_LIBS)
|
||||
|
||||
# Longer running tests are listed (and executed) first to take the most
|
||||
# advantage of parallel execution.
|
||||
TESTS = \
|
||||
rpz \
|
||||
rpzrecurse \
|
||||
serve-stale \
|
||||
timeouts \
|
||||
upforwd \
|
||||
tkey_keycreate_CPPFLAGS = \
|
||||
$(AM_CPPFLAGS) \
|
||||
$(LIBDNS_CFLAGS)
|
||||
|
||||
tkey_keycreate_LDADD = \
|
||||
$(LDADD) \
|
||||
$(LIBDNS_LIBS)
|
||||
|
||||
tkey_keydelete_CPPFLAGS = \
|
||||
$(AM_CPPFLAGS) \
|
||||
$(LIBDNS_CFLAGS)
|
||||
|
||||
tkey_keydelete_LDADD = \
|
||||
$(LDADD) \
|
||||
$(LIBDNS_LIBS)
|
||||
|
||||
TESTS =
|
||||
|
||||
if HAVE_PERLMOD_TIME_HIRES
|
||||
TESTS += serve-stale
|
||||
endif HAVE_PERLMOD_TIME_HIRES
|
||||
|
||||
if HAVE_PERLMOD_NET_DNS
|
||||
TESTS += \
|
||||
rpzrecurse
|
||||
endif HAVE_PERLMOD_NET_DNS
|
||||
|
||||
if HAVE_LIBNGHTTP2
|
||||
TESTS += \
|
||||
doth
|
||||
endif
|
||||
|
||||
TESTS += \
|
||||
acl \
|
||||
additional \
|
||||
addzone \
|
||||
@@ -89,22 +100,15 @@ TESTS = \
|
||||
case \
|
||||
catz \
|
||||
cds \
|
||||
chain \
|
||||
checkconf \
|
||||
checkds \
|
||||
checknames \
|
||||
checkzone \
|
||||
cookie \
|
||||
database \
|
||||
dialup \
|
||||
digdelv \
|
||||
dispatch \
|
||||
dlzexternal \
|
||||
dns64 \
|
||||
dnssec \
|
||||
dnstap \
|
||||
doth \
|
||||
dsdigest \
|
||||
dupsigs \
|
||||
dyndb \
|
||||
ecdsa \
|
||||
eddsa \
|
||||
@@ -112,20 +116,16 @@ TESTS = \
|
||||
emptyzones \
|
||||
enginepkcs11 \
|
||||
filter-aaaa \
|
||||
fetchlimit \
|
||||
formerr \
|
||||
forward \
|
||||
geoip2 \
|
||||
glue \
|
||||
idna \
|
||||
include-multiplecfg \
|
||||
inline \
|
||||
integrity \
|
||||
ixfr \
|
||||
hooks \
|
||||
host \
|
||||
journal \
|
||||
kasp \
|
||||
keepalive \
|
||||
keyfromlabel \
|
||||
legacy \
|
||||
@@ -136,41 +136,29 @@ TESTS = \
|
||||
metadata \
|
||||
mirror \
|
||||
mkeys \
|
||||
multisigner \
|
||||
names \
|
||||
notify \
|
||||
nsec3 \
|
||||
nslookup \
|
||||
nsupdate \
|
||||
nzd2nzf \
|
||||
padding \
|
||||
pending \
|
||||
proxy \
|
||||
pipelined \
|
||||
qmin \
|
||||
reclimit \
|
||||
redirect \
|
||||
resolver \
|
||||
rndc \
|
||||
rootkeysentinel \
|
||||
rpzextra \
|
||||
rpz \
|
||||
rrchecker \
|
||||
rrl \
|
||||
rrsetorder \
|
||||
rsabigexponent \
|
||||
runtime \
|
||||
sfcache \
|
||||
shutdown \
|
||||
smartsign \
|
||||
sortlist \
|
||||
spf \
|
||||
staticstub \
|
||||
statistics \
|
||||
statschannel \
|
||||
stress \
|
||||
stub \
|
||||
synthfromdnssec \
|
||||
tcp \
|
||||
tkey \
|
||||
tools \
|
||||
transport-acl \
|
||||
tsig \
|
||||
@@ -180,21 +168,62 @@ TESTS = \
|
||||
verify \
|
||||
views \
|
||||
wildcard \
|
||||
xfer \
|
||||
xferquota \
|
||||
zero \
|
||||
zonechecks
|
||||
|
||||
else !HAVE_PYTEST
|
||||
check:
|
||||
echo pytest is not available, no tests were ran
|
||||
exit 1
|
||||
endif !HAVE_PYTEST
|
||||
else !HAVE_PYTHON
|
||||
check:
|
||||
echo Python is not available, no tests were ran
|
||||
exit 1
|
||||
endif !HAVE_PYTHON
|
||||
if HAVE_LMDB
|
||||
TESTS += nzd2nzf
|
||||
endif # HAVE_LMDB
|
||||
|
||||
if HAVE_PERLMOD_NET_DNS
|
||||
|
||||
TESTS += \
|
||||
fetchlimit \
|
||||
ixfr \
|
||||
nsupdate \
|
||||
resolver \
|
||||
statistics \
|
||||
stress \
|
||||
upforwd \
|
||||
zero
|
||||
|
||||
if HAVE_DNSTAP
|
||||
TESTS += dnstap
|
||||
endif
|
||||
|
||||
if HAVE_PERLMOD_FILE_FETCH
|
||||
TESTS += statschannel
|
||||
endif HAVE_PERLMOD_FILE_FETCH
|
||||
|
||||
if HAVE_PERLMOD_DIGEST_HMAC
|
||||
TESTS += xfer
|
||||
endif HAVE_PERLMOD_DIGEST_HMAC
|
||||
|
||||
if HAVE_PERLMOD_NET_DNS_NAMESERVER
|
||||
TESTS += reclimit
|
||||
endif HAVE_PERLMOD_NET_DNS_NAMESERVER
|
||||
|
||||
endif HAVE_PERLMOD_NET_DNS
|
||||
|
||||
if HAVE_PYTHON
|
||||
TESTS += kasp keymgr2kasp tcp pipelined
|
||||
|
||||
if HAVE_PYTEST
|
||||
TESTS += checkds dispatch rpzextra shutdown timeouts
|
||||
endif
|
||||
|
||||
if HAVE_PYMOD_DNS
|
||||
TESTS += qmin cookie
|
||||
if HAVE_PERLMOD_NET_DNS
|
||||
TESTS += digdelv dnssec forward
|
||||
if HAVE_PERLMOD_NET_DNS_NAMESERVER
|
||||
TESTS += chain
|
||||
endif HAVE_PERLMOD_NET_DNS_NAMESERVER
|
||||
endif HAVE_PERLMOD_NET_DNS
|
||||
endif HAVE_PYMOD_DNS
|
||||
|
||||
endif HAVE_PYTHON
|
||||
|
||||
else !HAVE_PERL
|
||||
check:
|
||||
echo Perl is not available, no tests were ran
|
||||
@@ -209,9 +238,9 @@ LOG_DRIVER_V_1 = --verbose yes
|
||||
LOG_DRIVER = $(srcdir)/custom-test-driver
|
||||
AM_LOG_DRIVER_FLAGS = $(LOG_DRIVER_V)
|
||||
|
||||
LOG_COMPILER = $(srcdir)/run.sh
|
||||
LOG_COMPILER = $(builddir)/run.sh
|
||||
AM_LOG_FLAGS = -r
|
||||
|
||||
$(TESTS): run.sh
|
||||
|
||||
test-local: check
|
||||
|
||||
clean-local::
|
||||
-find -L . -mindepth 1 -maxdepth 1 -type d -name "*_*" -and -not -name "_common" -exec rm -rf {} \;
|
||||
|
||||
@@ -0,0 +1,651 @@
|
||||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
|
||||
SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
|
||||
Introduction
|
||||
===
|
||||
This directory holds a simple test environment for running bind9 system tests
|
||||
involving multiple name servers.
|
||||
|
||||
With the exception of "common" (which holds configuration information common to
|
||||
multiple tests), each directory holds a set of scripts and configuration
|
||||
files to test different parts of BIND. The directories are named for the
|
||||
aspect of BIND they test, for example:
|
||||
|
||||
dnssec/ DNSSEC tests
|
||||
forward/ Forwarding tests
|
||||
glue/ Glue handling tests
|
||||
|
||||
etc.
|
||||
|
||||
Typically each set of tests sets up 2-5 name servers and then performs one or
|
||||
more tests against them. Within the test subdirectory, each name server has a
|
||||
separate subdirectory containing its configuration data. These subdirectories
|
||||
are named "nsN" or "ansN" (where N is a number between 1 and 8, e.g. ns1, ans2
|
||||
etc.)
|
||||
|
||||
The tests are completely self-contained and do not require access to the real
|
||||
DNS. Generally, one of the test servers (usually ns1) is set up as a root
|
||||
nameserver and is listed in the hints file of the others.
|
||||
|
||||
|
||||
Preparing to Run the Tests
|
||||
===
|
||||
To enable all servers to run on the same machine, they bind to separate virtual
|
||||
IP addresses on the loopback interface. ns1 runs on 10.53.0.1, ns2 on
|
||||
10.53.0.2, etc. Before running any tests, you must set up these addresses by
|
||||
running the command
|
||||
|
||||
sh ifconfig.sh up
|
||||
|
||||
as root. The interfaces can be removed by executing the command:
|
||||
|
||||
sh ifconfig.sh down
|
||||
|
||||
... also as root.
|
||||
|
||||
The servers use unprivileged ports (above 1024) instead of the usual port 53,
|
||||
so they can be run without root privileges once the interfaces have been set
|
||||
up.
|
||||
|
||||
|
||||
Note for MacOS Users
|
||||
---
|
||||
If you wish to make the interfaces survive across reboots, copy
|
||||
org.isc.bind.system and org.isc.bind.system.plist to /Library/LaunchDaemons
|
||||
then run
|
||||
|
||||
launchctl load /Library/LaunchDaemons/org.isc.bind.system.plist
|
||||
|
||||
... as root.
|
||||
|
||||
|
||||
Running the System Tests
|
||||
===
|
||||
|
||||
Running an Individual Test
|
||||
---
|
||||
The tests can be run individually using the following command:
|
||||
|
||||
sh run.sh [flags] <test-name> [<test-arguments>]
|
||||
|
||||
e.g.
|
||||
|
||||
sh run.sh [flags] notify
|
||||
|
||||
Optional flags are:
|
||||
|
||||
-k Keep servers running after the test completes. Each test
|
||||
usually starts a number of nameservers, either instances
|
||||
of the "named" being tested, or custom servers (written in
|
||||
Python or Perl) that feature test-specific behavior. The
|
||||
servers are automatically started before the test is run
|
||||
and stopped after it ends. This flag leaves them running
|
||||
at the end of the test, so that additional queries can be
|
||||
sent by hand. To stop the servers afterwards, use the
|
||||
command "sh stop.sh <test-name>".
|
||||
|
||||
-n Noclean - do not remove the output files if the test
|
||||
completes successfully. By default, files created by the
|
||||
test are deleted if it passes; they are not deleted if the
|
||||
test fails.
|
||||
|
||||
-p <number> Sets the range of ports used by the test. A block of 100
|
||||
ports is available for each test, the number given to the
|
||||
"-p" switch being the number of the start of that block
|
||||
(e.g. "-p 7900" will mean that the test is able to use
|
||||
ports 7900 through 7999). If not specified, the test will
|
||||
have ports 5000 to 5099 available to it.
|
||||
|
||||
Arguments are:
|
||||
|
||||
test-name Mandatory. The name of the test, which is the name of the
|
||||
subdirectory in bin/tests/system holding the test files.
|
||||
|
||||
test-arguments Optional arguments that are passed to each of the test's
|
||||
scripts.
|
||||
|
||||
|
||||
Running All The System Tests
|
||||
---
|
||||
To run all the system tests, enter the command:
|
||||
|
||||
make [-j numproc] test
|
||||
|
||||
The optional "numproc" argument specifies the maximum number of tests that can
|
||||
run in parallel. The default is 1, which means that all of the tests run
|
||||
sequentially. If greater than 1, up to "numproc" tests will run simultaneously,
|
||||
new tests being started as tests finish. Each test will get a unique set of
|
||||
ports, so there is no danger of tests interfering with one another. Parallel
|
||||
running will reduce the total time taken to run the BIND system tests, but will
|
||||
mean that the output from all the tests sent to the screen will be mixed up
|
||||
with one another.
|
||||
|
||||
In this case, retention of the output files after a test completes successfully
|
||||
is specified by setting the environment variable SYSTEMTEST_NO_CLEAN to 1 prior
|
||||
to running make, e.g.
|
||||
|
||||
SYSTEMTEST_NO_CLEAN=1 make [-j numproc] test
|
||||
|
||||
while setting environment variable SYSTEMTEST_FORCE_COLOR to 1 forces system
|
||||
test output to be printed in color.
|
||||
|
||||
|
||||
Format of Test Output
|
||||
---
|
||||
All output from the system tests is in the form of lines with the following
|
||||
structure:
|
||||
|
||||
<letter>:<test-name>:<message> [(<number>)]
|
||||
|
||||
e.g.
|
||||
|
||||
I:catz:checking that dom1.example is not served by primary (1)
|
||||
|
||||
The meanings of the fields are as follows:
|
||||
|
||||
<letter>
|
||||
This indicates the type of message. This is one of:
|
||||
|
||||
S Start of the test
|
||||
A Start of test (retained for backwards compatibility)
|
||||
T Start of test (retained for backwards compatibility)
|
||||
E End of the test
|
||||
I Information. A test will typically output many of these messages
|
||||
during its run, indicating test progress. Note that such a message may
|
||||
be of the form "I:testname:failed", indicating that a sub-test has
|
||||
failed.
|
||||
R Result. Each test will result in one such message, which is of the
|
||||
form:
|
||||
|
||||
R:<test-name>:<result>
|
||||
|
||||
where <result> is one of:
|
||||
|
||||
PASS The test passed
|
||||
FAIL The test failed
|
||||
SKIPPED The test was not run, usually because some
|
||||
prerequisites required to run the test are missing.
|
||||
|
||||
<test-name>
|
||||
This is the name of the test from which the message emanated, which is also the
|
||||
name of the subdirectory holding the test files.
|
||||
|
||||
<message>
|
||||
This is text output by the test during its execution.
|
||||
|
||||
(<number>)
|
||||
If present, this will correlate with a file created by the test. The tests
|
||||
execute commands and route the output of each command to a file. The name of
|
||||
this file depends on the command and the test, but will usually be of the form:
|
||||
|
||||
<command>.out.<suffix><number>
|
||||
|
||||
e.g. nsupdate.out.test28, dig.out.q3. This aids diagnosis of problems by
|
||||
allowing the output that caused the problem message to be identified.
|
||||
|
||||
|
||||
Re-Running the Tests
|
||||
---
|
||||
If there is a requirement to re-run a test (or the entire test suite), the
|
||||
files produced by the tests should be deleted first. Normally, these files are
|
||||
deleted if the test succeeds but are retained on error. The run.sh script
|
||||
automatically calls a given test's clean.sh script before invoking its setup.sh
|
||||
script.
|
||||
|
||||
Deletion of the files produced by the set of tests (e.g. after the execution of
|
||||
make) can be carried out using the command:
|
||||
|
||||
sh cleanall.sh
|
||||
|
||||
or
|
||||
|
||||
make testclean
|
||||
|
||||
(Note that the Makefile has two other targets for cleaning up files: "clean"
|
||||
will delete all the files produced by the tests, as well as the object and
|
||||
executable files used by the tests. "distclean" does all the work of "clean"
|
||||
as well as deleting configuration files produced by "configure".)
|
||||
|
||||
|
||||
Developer Notes
|
||||
===
|
||||
This section is intended for developers writing new tests.
|
||||
|
||||
|
||||
Overview
|
||||
---
|
||||
As noted above, each test is in a separate directory. To interact with the
|
||||
test framework, the directories contain the following standard files:
|
||||
|
||||
prereq.sh Run at the beginning to determine whether the test can be run at
|
||||
all; if not, we see a R:SKIPPED result. This file is optional:
|
||||
if not present, the test is assumed to have all its prerequisites
|
||||
met.
|
||||
|
||||
setup.sh Run after prereq.sh, this sets up the preconditions for the tests.
|
||||
Although optional, virtually all tests will require such a file to
|
||||
set up the ports they should use for the test.
|
||||
|
||||
tests.sh Runs the actual tests. This file is mandatory.
|
||||
|
||||
clean.sh Run at the end to clean up temporary files, but only if the test
|
||||
was completed successfully and its running was not inhibited by the
|
||||
"-n" switch being passed to "run.sh". Otherwise the temporary
|
||||
files are left in place for inspection.
|
||||
|
||||
ns<N> These subdirectories contain test name servers that can be queried
|
||||
or can interact with each other. The value of N indicates the
|
||||
address the server listens on: for example, ns2 listens on
|
||||
10.53.0.2, and ns4 on 10.53.0.4. All test servers use an
|
||||
unprivileged port, so they don't need to run as root. These
|
||||
servers log at the highest debug level and the log is captured in
|
||||
the file "named.run".
|
||||
|
||||
ans<N> Like ns[X], but these are simple mock name servers implemented in
|
||||
Perl or Python. They are generally programmed to misbehave in ways
|
||||
named would not so as to exercise named's ability to interoperate
|
||||
with badly behaved name servers.
|
||||
|
||||
|
||||
Port Usage
|
||||
---
|
||||
In order for the tests to run in parallel, each test requires a unique set of
|
||||
ports. These are specified by the "-p" option passed to "run.sh", which sets
|
||||
environment variables that the scripts listed above can reference.
|
||||
|
||||
The convention used in the system tests is that the number passed is the start
|
||||
of a range of 100 ports. The test is free to use the ports as required,
|
||||
although the first ten ports in the block are named and generally tests use the
|
||||
named ports for their intended purpose. The names of the environment variables
|
||||
are:
|
||||
|
||||
PORT Number to be used for the query port.
|
||||
CONTROLPORT Number to be used as the RNDC control port.
|
||||
EXTRAPORT1 - EXTRAPORT8 Eight port numbers that can be used as needed.
|
||||
|
||||
Two other environment variables are defined:
|
||||
|
||||
LOWPORT The lowest port number in the range.
|
||||
HIGHPORT The highest port number in the range.
|
||||
|
||||
Since port ranges usually start on a boundary of 10, the variables are set such
|
||||
that the last digit of the port number corresponds to the number of the
|
||||
EXTRAPORTn variable. For example, if the port range were to start at 5200, the
|
||||
port assignments would be:
|
||||
|
||||
PORT = 5200
|
||||
EXTRAPORT1 = 5201
|
||||
:
|
||||
EXTRAPORT8 = 5208
|
||||
CONTROLPORT = 5209
|
||||
LOWPORT = 5200
|
||||
HIGHPORT = 5299
|
||||
|
||||
When running tests in parallel (i.e. giving a value of "numproc" greater than 1
|
||||
in the "make" command listed above), it is guaranteed that each
|
||||
test will get a set of unique port numbers.
|
||||
|
||||
|
||||
Writing a Test
|
||||
---
|
||||
The test framework requires up to four shell scripts (listed above) as well as
|
||||
a number of nameserver instances to run. Certain expectations are put on each
|
||||
script:
|
||||
|
||||
|
||||
General
|
||||
---
|
||||
1. Each of the four scripts will be invoked with the command
|
||||
|
||||
(cd <test-directory> ; sh <script> [<arguments>] )
|
||||
|
||||
... so that working directory when the script starts executing is the test
|
||||
directory.
|
||||
|
||||
2. Arguments can be only passed to the script if the test is being run as a
|
||||
one-off with "run.sh". In this case, everything on the command line after the
|
||||
name of the test is passed to each script. For example, the command:
|
||||
|
||||
sh run.sh -p 12300 mytest -D xyz
|
||||
|
||||
... will run "mytest" with a port range of 12300 to 12399. Each of the
|
||||
framework scripts provided by the test will be invoked using the remaining
|
||||
arguments, e.g.:
|
||||
|
||||
(cd mytest ; sh prereq.sh -D xyz)
|
||||
(cd mytest ; sh setup.sh -D xyz)
|
||||
(cd mytest ; sh tests.sh -D xyz)
|
||||
(cd mytest ; sh clean.sh -D xyz)
|
||||
|
||||
No arguments will be passed to the test scripts if the test is run as part of
|
||||
a run of the full test suite (e.g. the tests are started with make).
|
||||
|
||||
3. Each script should start with the following lines:
|
||||
|
||||
. ../conf.sh
|
||||
|
||||
"conf.sh" defines a series of environment variables together with functions
|
||||
useful for the test scripts.
|
||||
|
||||
|
||||
prereq.sh
|
||||
---
|
||||
As noted above, this is optional. If present, it should check whether specific
|
||||
software needed to run the test is available and/or whether BIND has been
|
||||
configured with the appropriate options required.
|
||||
|
||||
* If the software required to run the test is present and the BIND
|
||||
configure options are correct, prereq.sh should return with a status code
|
||||
of 0.
|
||||
|
||||
* If the software required to run the test is not available and/or BIND
|
||||
has not been configured with the appropriate options, prereq.sh should
|
||||
return with a status code of 1.
|
||||
|
||||
* If there is some other problem (e.g. prerequisite software is available
|
||||
but is not properly configured), a status code of 255 should be returned.
|
||||
|
||||
|
||||
setup.sh
|
||||
---
|
||||
This is responsible for setting up the configuration files used in the test.
|
||||
|
||||
To cope with the varying port number, ports are not hard-coded into
|
||||
configuration files (or, for that matter, scripts that emulate nameservers).
|
||||
Instead, setup.sh is responsible for editing the configuration files to set the
|
||||
port numbers.
|
||||
|
||||
To do this, configuration files should be supplied in the form of templates
|
||||
containing tokens identifying ports. The tokens have the same name as the
|
||||
environment variables listed above, but are prefixed and suffixed by the "@"
|
||||
symbol. For example, a fragment of a configuration file template might look
|
||||
like:
|
||||
|
||||
controls {
|
||||
inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
|
||||
};
|
||||
|
||||
options {
|
||||
query-source address 10.53.0.1;
|
||||
notify-source 10.53.0.1;
|
||||
transfer-source 10.53.0.1;
|
||||
port @PORT@;
|
||||
allow-new-zones yes;
|
||||
};
|
||||
|
||||
setup.sh should copy the template to the desired filename using the
|
||||
"copy_setports" shell function defined in "conf.sh", i.e.
|
||||
|
||||
copy_setports ns1/named.conf.in ns1/named.conf
|
||||
|
||||
This replaces the tokens @PORT@, @CONTROLPORT@, @EXTRAPORT1@ through
|
||||
@EXTRAPORT8@ with the contents of the environment variables listed above.
|
||||
setup.sh should do this for all configuration files required when the test
|
||||
starts.
|
||||
|
||||
("setup.sh" should also use this method for replacing the tokens in any Perl or
|
||||
Python name servers used in the test.)
|
||||
|
||||
|
||||
tests.sh
|
||||
---
|
||||
This is the main test file and the contents depend on the test. The contents
|
||||
are completely up to the developer, although most test scripts have a form
|
||||
similar to the following for each sub-test:
|
||||
|
||||
1. n=`expr $n + 1`
|
||||
2. echo_i "prime cache nodata.example ($n)"
|
||||
3. ret=0
|
||||
4. $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
|
||||
5. grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
||||
6. grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
|
||||
7. if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
8. status=`expr $status + $ret`
|
||||
|
||||
1. Increment the test number "n" (initialized to zero at the start of the
|
||||
script).
|
||||
|
||||
2. Indicate that the sub-test is about to begin. Note that "echo_i" instead
|
||||
of "echo" is used. echo_i is a function defined in "conf.sh" which will
|
||||
prefix the message with "I:<testname>:", so allowing the output from each
|
||||
test to be identified within the output. The test number is included in
|
||||
the message in order to tie the sub-test with its output.
|
||||
|
||||
3. Initialize return status.
|
||||
|
||||
4 - 6. Carry out the sub-test. In this case, a nameserver is queried (note
|
||||
that the port used is given by the PORT environment variable, which was set
|
||||
by the inclusion of the file "conf.sh" at the start of the script). The
|
||||
output is routed to a file whose suffix includes the test number. The
|
||||
response from the server is examined and, in this case, if the required
|
||||
string is not found, an error is indicated by setting "ret" to 1.
|
||||
|
||||
7. If the sub-test failed, a message is printed. "echo_i" is used to print
|
||||
the message to add the prefix "I:<test-name>:" before it is output.
|
||||
|
||||
8. "status", used to track how many of the sub-tests have failed, is
|
||||
incremented accordingly. The value of "status" determines the status
|
||||
returned by "tests.sh", which in turn determines whether the framework
|
||||
prints the PASS or FAIL message.
|
||||
|
||||
Regardless of this, rules that should be followed are:
|
||||
|
||||
a. Use the environment variables set by conf.sh to determine the ports to use
|
||||
for sending and receiving queries.
|
||||
|
||||
b. Use a counter to tag messages and to associate the messages with the output
|
||||
files.
|
||||
|
||||
c. Store all output produced by queries/commands into files. These files
|
||||
should be named according to the command that produced them, e.g. "dig"
|
||||
output should be stored in a file "dig.out.<suffix>", the suffix being
|
||||
related to the value of the counter.
|
||||
|
||||
d. Use "echo_i" to output informational messages.
|
||||
|
||||
e. Retain a count of test failures and return this as the exit status from
|
||||
the script.
|
||||
|
||||
|
||||
clean.sh
|
||||
---
|
||||
The inverse of "setup.sh", this is invoked by the framework to clean up the
|
||||
test directory. It should delete all files that have been created by the test
|
||||
during its run.
|
||||
|
||||
|
||||
Starting Nameservers
|
||||
---
|
||||
As noted earlier, a system test will involve a number of nameservers. These
|
||||
will be either instances of named, or special servers written in a language
|
||||
such as Perl or Python.
|
||||
|
||||
For the former, the version of "named" being run is that in the "bin/named"
|
||||
directory in the tree holding the tests (i.e. if "make test" is being run
|
||||
immediately after "make", the version of "named" used is that just built). The
|
||||
configuration files, zone files etc. for these servers are located in
|
||||
subdirectories of the test directory named "nsN", where N is a small integer.
|
||||
The latter are special nameservers, mostly used for generating deliberately bad
|
||||
responses, located in subdirectories named "ansN" (again, N is an integer).
|
||||
In addition to configuration files, these directories should hold the
|
||||
appropriate script files as well.
|
||||
|
||||
Note that the "N" for a particular test forms a single number space, e.g. if
|
||||
there is an "ns2" directory, there cannot be an "ans2" directory as well.
|
||||
Ideally, the directory numbers should start at 1 and work upwards.
|
||||
|
||||
When running a test, the servers are started using "start.sh" (which is nothing
|
||||
more than a wrapper for start.pl). The options for "start.pl" are documented
|
||||
in the header for that file, so will not be repeated here. In summary, when
|
||||
invoked by "run.sh", start.pl looks for directories named "nsN" or "ansN" in
|
||||
the test directory and starts the servers it finds there.
|
||||
|
||||
|
||||
"named" Command-Line Options
|
||||
---
|
||||
By default, start.pl starts a "named" server with the following options:
|
||||
|
||||
-c named.conf Specifies the configuration file to use (so by implication,
|
||||
each "nsN" nameserver's configuration file must be called
|
||||
named.conf).
|
||||
|
||||
-d 99 Sets the maximum debugging level.
|
||||
|
||||
-D <name> The "-D" option sets a string used to identify the
|
||||
nameserver in a process listing. In this case, the string
|
||||
is the name of the subdirectory.
|
||||
|
||||
-g Runs the server in the foreground and logs everything to
|
||||
stderr.
|
||||
|
||||
-m record
|
||||
Turns on these memory usage debugging flags.
|
||||
|
||||
-U 4 Uses four listeners.
|
||||
|
||||
-X named.lock Acquires a lock on this file in the "nsN" directory, so
|
||||
preventing multiple instances of this named running in this
|
||||
directory (which could possibly interfere with the test).
|
||||
|
||||
All output is sent to a file called "named.run" in the nameserver directory.
|
||||
|
||||
The options used to start named can be altered. There are three ways of doing
|
||||
this. "start.pl" checks the methods in a specific order: if a check succeeds,
|
||||
the options are set and any other specification is ignored. In order, these
|
||||
are:
|
||||
|
||||
1. Specifying options to "start.sh"/"start.pl" after the name of the test
|
||||
directory, e.g.
|
||||
|
||||
sh start.sh reclimit ns1 -- "-c n.conf -d 43"
|
||||
|
||||
(This is only really useful when running tests interactively.)
|
||||
|
||||
2. Including a file called "named.args" in the "nsN" directory. If present,
|
||||
the contents of the first non-commented, non-blank line of the file are used as
|
||||
the named command-line arguments. The rest of the file is ignored.
|
||||
|
||||
3. Tweaking the default command line arguments with "-T" options. This flag is
|
||||
used to alter the behavior of BIND for testing and is not documented in the
|
||||
ARM. The presence of certain files in the "nsN" directory adds flags to
|
||||
the default command line (the content of the files is irrelevant - it
|
||||
is only the presence that counts):
|
||||
|
||||
named.noaa Appends "-T noaa" to the command line, which causes
|
||||
"named" to never set the AA bit in an answer.
|
||||
|
||||
named.dropedns Adds "-T dropedns" to the command line, which causes
|
||||
"named" to recognise EDNS options in messages, but drop
|
||||
messages containing them.
|
||||
|
||||
named.maxudp1460 Adds "-T maxudp1460" to the command line, setting the
|
||||
maximum UDP size handled by named to 1460.
|
||||
|
||||
named.maxudp512 Adds "-T maxudp512" to the command line, setting the
|
||||
maximum UDP size handled by named to 512.
|
||||
|
||||
named.noedns Appends "-T noedns" to the command line, which disables
|
||||
recognition of EDNS options in messages.
|
||||
|
||||
named.notcp Adds "-T notcp", which disables TCP in "named".
|
||||
|
||||
named.soa Appends "-T nosoa" to the command line, which disables
|
||||
the addition of SOA records to negative responses (or to
|
||||
the additional section if the response is triggered by RPZ
|
||||
rewriting).
|
||||
|
||||
Starting Other Nameservers
|
||||
---
|
||||
In contrast to "named", nameservers written in Perl or Python (whose script
|
||||
file should have the name "ans.pl" or "ans.py" respectively) are started with a
|
||||
fixed command line. In essence, the server is given the address and nothing
|
||||
else.
|
||||
|
||||
(This is not strictly true: Python servers are provided with the number of the
|
||||
query port to use. Altering the port used by Perl servers currently requires
|
||||
creating a template file containing the "@PORT@" token, and having "setup.sh"
|
||||
substitute the actual port being used before the test starts.)
|
||||
|
||||
|
||||
Stopping Nameservers
|
||||
---
|
||||
As might be expected, the test system stops nameservers with the script
|
||||
"stop.sh", which is little more than a wrapper for "stop.pl". Like "start.pl",
|
||||
the options available are listed in the file's header and will not be repeated
|
||||
here.
|
||||
|
||||
In summary though, the nameservers for a given test, if left running by
|
||||
specifying the "-k" flag to "run.sh" when the test is started, can be stopped
|
||||
by the command:
|
||||
|
||||
sh stop.sh <test-name> [server]
|
||||
|
||||
... where if the server (e.g. "ns1", "ans3") is not specified, all servers
|
||||
associated with the test are stopped.
|
||||
|
||||
|
||||
Adding a Test to the System Test Suite
|
||||
---
|
||||
Once a test has been created, the following files should be edited:
|
||||
|
||||
* conf.sh.common The name of the test should be added to the PARALLEL_COMMON
|
||||
variable.
|
||||
|
||||
* Makefile.am The name of the test should be added to the TESTS variable.
|
||||
|
||||
(It is likely that a future iteration of the system test suite will remove the
|
||||
need to edit multiple files to add a test.)
|
||||
|
||||
|
||||
Valgrind
|
||||
---
|
||||
When running system tests, named can be run under Valgrind. The output from
|
||||
Valgrind are sent to per-process files that can be reviewed after the test has
|
||||
completed. To enable this, set the USE_VALGRIND environment variable to
|
||||
"helgrind" to run the Helgrind tool, or any other value to run the Memcheck
|
||||
tool. To use "helgrind" effectively, build BIND with --disable-atomic.
|
||||
|
||||
|
||||
Maintenance Notes
|
||||
===
|
||||
This section is aimed at developers maintaining BIND's system test framework.
|
||||
|
||||
Notes on Parallel Execution
|
||||
---
|
||||
Although execution of an individual test is controlled by "run.sh", which
|
||||
executes the above shell scripts (and starts the relevant servers) for each
|
||||
test, the running of all tests in the test suite is controlled by the Makefile.
|
||||
|
||||
All system tests are capable of being run in parallel. For this to work, each
|
||||
test needs to use a unique set of ports. To avoid the need to define which
|
||||
tests use which ports (and so risk port clashes as further tests are added),
|
||||
the ports are determined by "get_ports.sh", a port broker script which keeps
|
||||
track of ports given to each individual system test.
|
||||
|
||||
|
||||
Cleaning Up From Tests
|
||||
---
|
||||
When a test is run, up to three different types of files are created:
|
||||
|
||||
1. Files generated by the test itself, e.g. output from "dig" and "rndc", are
|
||||
stored in the test directory.
|
||||
|
||||
2. Files produced by named which may not be cleaned up if named exits
|
||||
abnormally, e.g. core files, PID files etc., are stored in the test directory.
|
||||
|
||||
If the test fails, all these files are retained. But if the test succeeds,
|
||||
they are cleaned up at different times:
|
||||
|
||||
1. Files generated by the test itself are cleaned up by the test's own
|
||||
"clean.sh", which is called from "run.sh".
|
||||
|
||||
2. Files that may not be cleaned up if named exits abnormally can be removed
|
||||
using the "cleanall.sh" script.
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user