Compare commits
5
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Petr Špaček
|
78959765da | ||
|
Petr Špaček
|
1e9e0402d3 | ||
|
Petr Špaček
|
689692493e | ||
|
Petr Špaček
|
5e7cc35fd7 | ||
 manu
|
a09e1cdd98 |
+1
-1
@@ -78,4 +78,4 @@ PenaltyBreakString: 80
|
||||
PenaltyExcessCharacter: 100
|
||||
Standard: Cpp11
|
||||
ContinuationIndentWidth: 8
|
||||
ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe', 'ISC_LIST_FOREACH', 'ISC_LIST_FOREACH_SAFE', 'ISC_LIST_FOREACH_REV', 'ISC_LIST_FOREACH_REV_SAFE' ]
|
||||
ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe', 'ISC_LIST_FOREACH', 'ISC_LIST_FOREACH_SAFE' ]
|
||||
|
||||
+3
-3
@@ -52,7 +52,7 @@
|
||||
;; libtest
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "tests/include"))
|
||||
|
||||
|
||||
;; bin
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "bin/check"))
|
||||
@@ -61,7 +61,7 @@
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "bin/confgen"))
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "bin/confgen/include"))
|
||||
(concat directory-of-current-dir-locals-file "bin/confgen/include"))
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "bin/dig/include"))
|
||||
(expand-file-name
|
||||
@@ -79,7 +79,7 @@
|
||||
|
||||
(expand-file-name "/usr/include/libxml2")
|
||||
(expand-file-name "/usr/include/json-c")
|
||||
|
||||
|
||||
(expand-file-name "/usr/local/opt/openssl@1.1/include")
|
||||
(expand-file-name "/usr/local/opt/libxml2/include/libxml2")
|
||||
(expand-file-name "/usr/local/opt/json-c/include/json-c/")
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
[*.sh{,.in}]
|
||||
indent_style = space
|
||||
indent_size = 2
|
||||
binary_next_line = true
|
||||
switch_case_indent = true
|
||||
@@ -1526,15 +1526,3 @@ ffaab41a01621c0e02196e225f9269daf8b2ec8f
|
||||
ffac31097d25039951063bbb9f864e223a46ad1b
|
||||
# update copyright notice / whitespace
|
||||
ffbe6b95371c99b7fb05e6de17a8d6b7bf4f629f
|
||||
# remove trailing whitespace
|
||||
5893debf46ce1b5fbe793114a59da28fac4cccb7
|
||||
# arithmetic expansion in system tests
|
||||
4d42bdc245a1db1654abb502a52a5a8a3a570881
|
||||
# arithmetic expansion in system tests
|
||||
1436025e20ae13cfe55df14d62f5812c0cea2ee9
|
||||
# subshell notation in system tests
|
||||
05baf7206b7baaf91cb8e049ad13e413c52cdf3f
|
||||
# reformat shell scripts with shfmt
|
||||
4cb8b13987b930952238cc88e84272b8cf911933
|
||||
# Reformat sources with up-to-date clang-format-17
|
||||
79d93600116faabd89798522817ad95a69684fff
|
||||
|
||||
@@ -5,7 +5,6 @@
|
||||
*.la
|
||||
*.lo
|
||||
*.log
|
||||
*.log.txt
|
||||
*.o
|
||||
*.orig
|
||||
*.plist/ # ccc-analyzer store its results in .plist directories
|
||||
|
||||
+283
-483
File diff suppressed because it is too large
Load Diff
@@ -2,62 +2,45 @@
|
||||
If the bug you are reporting is potentially security-related - for example,
|
||||
if it involves an assertion failure or other crash in `named` that can be
|
||||
triggered repeatedly - then please make sure that you make the new issue
|
||||
confidential by clicking the checkbox at the bottom!
|
||||
confidential!
|
||||
-->
|
||||
|
||||
### Summary
|
||||
|
||||
<!-- Concisely summarize the bug encountered. -->
|
||||
(Summarize the bug encountered concisely.)
|
||||
|
||||
### BIND version affected
|
||||
<!--
|
||||
Make sure you are testing with the **latest** supported version of BIND
|
||||
for a given branch. Many bugs have been fixed over time!
|
||||
### BIND version used
|
||||
|
||||
See https://kb.isc.org/docs/supported-platforms for the current list.
|
||||
The latest source is available from https://www.isc.org/download/#BIND
|
||||
|
||||
Paste the output of `named -V` here.
|
||||
-->
|
||||
(Paste the output of `named -V`.)
|
||||
|
||||
### Steps to reproduce
|
||||
|
||||
<!--
|
||||
This is extremely important! Be precise and use itemized lists, please.
|
||||
|
||||
Even if a default configuration is affected, please include the full configuration
|
||||
files _you were testing with_.
|
||||
|
||||
Example:
|
||||
1. Use _attached_ configuration file
|
||||
2. Start BIND server with command: `named -g -c named.conf ...`
|
||||
3. Simulate legitimate clients using command `dnsperf -S1 -d legit-queries ...`
|
||||
4. Simulate attack traffic using command `dnsperf -S1 -d attack-queries ...`
|
||||
-->
|
||||
|
||||
1.
|
||||
2.
|
||||
3.
|
||||
(How one can reproduce the issue - this is very important.)
|
||||
|
||||
### What is the current *bug* behavior?
|
||||
|
||||
<!-- What actually happens. -->
|
||||
(What actually happens.)
|
||||
|
||||
### What is the expected *correct* behavior?
|
||||
|
||||
<!-- What you should see instead. -->
|
||||
(What you should see instead.)
|
||||
|
||||
### Relevant configuration files
|
||||
|
||||
<!-- Paste any relevant configuration files here - please use code blocks (```)
|
||||
(Paste any relevant configuration files - please use code blocks (```)
|
||||
to format console output. If submitting the contents of your
|
||||
configuration file in a non-confidential issue, it is advisable to
|
||||
obscure key secrets; this can be done automatically by using
|
||||
`named-checkconf -px`. -->
|
||||
configuration file in a non-confidential Issue, it is advisable to
|
||||
obscure key secrets: this can be done automatically by using
|
||||
`named-checkconf -px`.)
|
||||
|
||||
### Relevant logs
|
||||
### Relevant logs and/or screenshots
|
||||
|
||||
<!-- Paste any relevant logs here - please use code blocks (```) to format console
|
||||
output, logs, and code, as it's very hard to read otherwise. -->
|
||||
(Paste any relevant logs - please use code blocks (```) to format console
|
||||
output, logs, and code, as it's very hard to read otherwise.)
|
||||
|
||||
/label ~Bug
|
||||
### Possible fixes
|
||||
|
||||
(If you can, link to the line of code that might be responsible for the
|
||||
problem.)
|
||||
|
||||
/label ~bug
|
||||
|
||||
@@ -16,9 +16,11 @@ confidential!
|
||||
| Mattermost Channel: | [CVE-YYYY-NNNN][mattermost_url] |
|
||||
| Support Ticket: | [URL] |
|
||||
| Release Checklist: | #NNNN |
|
||||
| Post-mortem Etherpad: | [postmortem-YYYY-MM][postmortem_url] |
|
||||
|
||||
[cvss_score]: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X&version=3.1
|
||||
[mattermost_url]:
|
||||
[postmortem_url]:
|
||||
|
||||
:bulb: **Click [here][checklist_explanations] (internal resource) for general information about the security incident handling process.**
|
||||
|
||||
@@ -28,14 +30,14 @@ confidential!
|
||||
|
||||
- [ ] [:link:][step_deputy] **(IM)** Pick a Deputy Incident Manager
|
||||
- [ ] [:link:][step_respond] **(IM)** Respond to the bug reporter
|
||||
- [ ] [:link:][step_etherpad] **(IM)** Create an Etherpad for post-mortem
|
||||
- [ ] [:link:][step_public_mrs] **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
|
||||
- [ ] [:link:][step_assign_cve_id] **(IM)** Assign a CVE identifier
|
||||
- [ ] [:link:][step_note_cve_info] **(SwEng)** Update this issue with the assigned CVE identifier and the CVSS score
|
||||
- [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
|
||||
- [ ] [:link:][step_workarounds] **(SwEng)** Determine whether workarounds for the problem exist
|
||||
- [ ] [:link:][step_coordinate] **(SwEng)** If necessary, coordinate with other parties
|
||||
- [ ] [:link:][step_earliest_prepare] **(Support)** Prepare "earliest" notification text and hand it off to Marketing
|
||||
- [ ] [:link:][step_earliest_send] **(Marketing)** Update "earliest" notification document in SF portal and send bulk email to earliest customers
|
||||
- [ ] [:link:][step_earliest] **(Support)** Prepare and send out "earliest" notifications
|
||||
- [ ] [:link:][step_advisory_mr] **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
|
||||
- [ ] [:link:][step_reproducer_mr] **(SwEng)** Prepare a private merge request containing a system test reproducing the problem
|
||||
- [ ] [:link:][step_notify_support] **(SwEng)** Notify Support when a reproducer is ready
|
||||
@@ -53,42 +55,46 @@ confidential!
|
||||
|
||||
### At T-5
|
||||
|
||||
- [ ] [:link:][step_asn_documents] **(Marketing)** Update the text on the T-5 (from the Printing Press project) and "earliest" ASN documents in the SF portal
|
||||
- [ ] [:link:][step_asn_links] **(Marketing)** (BIND 9 only) Update the BIND -S information document in SF with download links to the new versions
|
||||
- [ ] [:link:][step_asn_send] **(Marketing)** Bulk email eligible customers to check the SF portal
|
||||
- [ ] [:link:][step_preannouncement] **(Marketing)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes
|
||||
- [ ] [:link:][step_send_asn] **(Support)** Send ASN to eligible customers
|
||||
- [ ] [:link:][step_preannouncement] **(Support)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes
|
||||
|
||||
### At T-4
|
||||
|
||||
- [ ] [:link:][step_verify_asn] **(Support)** Verify that all ASN-eligible customers have received the notification email
|
||||
|
||||
### At T-1
|
||||
|
||||
- [ ] [:link:][step_check_customers] **(Support)** Verify that any new or reinstated customers have received the notification email
|
||||
- [ ] [:link:][step_packager_emails] **(First IM)** Send notifications to OS packagers
|
||||
|
||||
### On the Day of Public Disclosure
|
||||
|
||||
- [ ] [:link:][step_clearance] **(IM)** Grant QA & Marketing clearance to proceed with public release
|
||||
- [ ] [:link:][step_publish] **(QA/Marketing)** Publish the releases (as outlined in the release checklist)
|
||||
- [ ] [:link:][step_matrix] **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
|
||||
- [ ] [:link:][step_clearance] **(IM)** Grant Support clearance to proceed with public release
|
||||
- [ ] [:link:][step_publish] **(Support)** Publish the releases (as outlined in the release checklist)
|
||||
- [ ] [:link:][step_matrix] **(Support)** (BIND 9 only) Update vulnerability matrix in the Knowledge Base
|
||||
- [ ] [:link:][step_publish_advisory] **(Support)** Bump Document Version for the Security Advisory and publish it in the Knowledge Base
|
||||
- [ ] [:link:][step_notifications] **(First IM)** Send notification emails to third parties
|
||||
- [ ] [:link:][step_mitre] **(First IM)** Advise MITRE about the disclosed CVEs
|
||||
- [ ] [:link:][step_merge_advisory] **(First IM)** Merge the Security Advisory merge request
|
||||
- [ ] [:link:][step_embargo_end] **(IM)** Inform original reporter (if external) that the security disclosure process is complete
|
||||
- [ ] [:link:][step_asn_clear] **(Marketing)** Update the SF portal to clear the ASN
|
||||
- [ ] [:link:][step_customers] **(Marketing)** Email ASN recipients that the embargo is lifted
|
||||
- [ ] [:link:][step_customers] **(Support)** Inform customers a fix has been released
|
||||
|
||||
### After Public Disclosure
|
||||
|
||||
- [ ] [:link:][step_postmortem] **(First IM)** Organize post-mortem meeting and make sure it happens
|
||||
- [ ] [:link:][step_tickets] **(Support)** Close support tickets
|
||||
- [ ] [:link:][step_regression] **(QA)** Merge a regression test reproducing the bug into all affected (and still maintained) branches
|
||||
|
||||
[step_deputy]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#pick-a-deputy-incident-manager
|
||||
[step_respond]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
|
||||
[step_etherpad]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-an-etherpad-for-post-mortem
|
||||
[step_public_mrs]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
|
||||
[step_assign_cve_id]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
|
||||
[step_note_cve_info]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-and-the-cvss-score
|
||||
[step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
|
||||
[step_workarounds]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
|
||||
[step_coordinate]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
|
||||
[step_earliest_prepare]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-earliest-notification-text-and-hand-it-off-to-marketing
|
||||
[step_earliest_send]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-earliest-notification-document-in-sf-portal-and-send-bulk-email-to-earliest-customers
|
||||
[step_earliest]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-and-send-out-earliest-notifications
|
||||
[step_advisory_mr]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-a-merge-request-for-the-security-advisory-and-include-all-readily-available-information-in-it
|
||||
[step_reproducer_mr]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-containing-a-system-test-reproducing-the-problem
|
||||
[step_notify_support]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-support-when-a-reproducer-is-ready
|
||||
@@ -103,21 +109,20 @@ confidential!
|
||||
[step_merge_fixes]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-cve-fixes-in-cve-identifier-order
|
||||
[step_patches]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-standalone-patch-for-the-last-stable-release-of-each-affected-and-still-maintained-product-branch
|
||||
[step_asn_releases]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-asn-releases-as-outlined-in-the-release-checklist
|
||||
[step_asn_documents]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-text-on-the-t-5-from-the-printing-press-project-and-earliest-asn-documents-in-the-sf-portal
|
||||
[step_asn_links]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-the-bind-s-information-document-in-sf-with-download-links-to-the-new-versions
|
||||
[step_asn_send]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bulk-email-eligible-customers-to-check-the-sf-portal
|
||||
[step_send_asn]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-asn-to-eligible-customers
|
||||
[step_preannouncement]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-send-a-pre-announcement-email-to-the-bind-announce-mailing-list-to-alert-users-that-the-upcoming-release-will-include-security-fixes
|
||||
[step_verify_asn]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#verify-that-all-asn-eligible-customers-have-received-the-notification-email
|
||||
[step_check_customers]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#verify-that-any-new-or-reinstated-customers-have-received-the-notification-email
|
||||
[step_packager_emails]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notifications-to-os-packagers
|
||||
[step_clearance]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-qa-marketing-clearance-to-proceed-with-public-release
|
||||
[step_clearance]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-support-clearance-to-proceed-with-public-release
|
||||
[step_publish]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
|
||||
[step_matrix]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
|
||||
[step_matrix]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-vulnerability-matrix-in-the-knowledge-base
|
||||
[step_publish_advisory]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-and-publish-it-in-the-knowledge-base
|
||||
[step_notifications]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notification-emails-to-third-parties
|
||||
[step_mitre]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#advise-mitre-about-the-disclosed-cves
|
||||
[step_merge_advisory]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-security-advisory-merge-request
|
||||
[step_embargo_end]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-original-reporter-if-external-that-the-security-disclosure-process-is-complete
|
||||
[step_asn_clear]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-sf-portal-to-clear-the-asn
|
||||
[step_customers]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#email-asn-recipients-that-the-embargo-is-lifted
|
||||
[step_customers]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-customers-a-fix-has-been-released
|
||||
[step_postmortem]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#organize-post-mortem-meeting-and-make-sure-it-happens
|
||||
[step_tickets]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#close-support-tickets
|
||||
[step_regression]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-a-regression-test-reproducing-the-bug-into-all-affected-and-still-maintained-branches
|
||||
|
||||
/confidential
|
||||
@@ -1,8 +0,0 @@
|
||||
Hi and thanks for filing an issue! It will be read with care by human beings.
|
||||
|
||||
It would be a tremendous help if you could follow these steps first:
|
||||
- [ ] Search the existing issues in GitLab (both open and closed) to see if your report might be a duplicate. We have a large database here and many issues have already been fixed in the latest versions!
|
||||
- [ ] Make sure this is **not** a support question. If you have specific trouble configuring or debugging your setup, please use the bind-users mailing list: https://lists.isc.org/mailman/listinfo/bind-users
|
||||
- [ ] You have read and understood the "out in the open" support policy: https://blog.powerdns.com/2016/01/18/open-source-support-out-in-the-open/ . Even though it was written by the PowerDNS folks, we follow it as well!
|
||||
|
||||
Before continuing, **please select the appropriate issue template in the drop-down menu above, under the heading _Description_**.
|
||||
@@ -8,4 +8,4 @@
|
||||
|
||||
### Links / references
|
||||
|
||||
/label ~Feature
|
||||
/label ~"feature request"
|
||||
|
||||
@@ -0,0 +1,97 @@
|
||||
## Release Schedule
|
||||
|
||||
**Code Freeze:**
|
||||
|
||||
**Tagging Deadline:**
|
||||
|
||||
**Public Release:**
|
||||
|
||||
## Documentation Review Links
|
||||
|
||||
**Closed issues assigned to the milestone without a release note:**
|
||||
|
||||
- []()
|
||||
- []()
|
||||
- []()
|
||||
|
||||
**Merge requests merged into the milestone without a release note:**
|
||||
|
||||
- []()
|
||||
- []()
|
||||
- []()
|
||||
|
||||
**Merge requests merged into the milestone without a `CHANGES` entry:**
|
||||
|
||||
- []()
|
||||
- []()
|
||||
- []()
|
||||
|
||||
## Release Checklist
|
||||
|
||||
### Before the Code Freeze
|
||||
|
||||
- [ ] ***(QA)*** Rebase -S editions on top of current open-source versions: `git checkout bind-9.18-sub && git rebase origin/bind-9.18`
|
||||
- [ ] ***(QA)*** [Inform](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/inform_supp_marketing.py) Support and Marketing of impending release (and give estimated release dates).
|
||||
- [ ] ***(QA)*** Ensure there are no permanent test failures on any platform. Check [public](https://gitlab.isc.org/isc-projects/bind9/-/pipelines?scope=all&source=schedule) and [private](https://gitlab.isc.org/isc-private/bind9/-/pipelines?scope=all&source=schedule) scheduled pipelines.
|
||||
- [ ] ***(QA)*** Check [Perflab](https://perflab.isc.org/) to ensure there has been no unexplained drop in performance for the versions being released.
|
||||
- [ ] ***(QA)*** Check whether all issues assigned to the release milestone are resolved[^1].
|
||||
- [ ] ***(QA)*** Ensure that there are no outstanding [merge requests in the private repository](https://gitlab.isc.org/isc-private/bind9/-/merge_requests/)[^1] (Subscription Edition only).
|
||||
- [ ] ***(QA)*** [Ensure](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/check_backports.py) all merge requests marked for backporting have been indeed backported.
|
||||
- [ ] ***(QA)*** [Announce](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/inform_code_freeze.py) (on Mattermost) that the code freeze is in effect.
|
||||
|
||||
### Before the Tagging Deadline
|
||||
|
||||
- [ ] ***(QA)*** Ensure release notes are correct, ask Support and Marketing to check them as well. [Example](https://gitlab.isc.org/isc-private/bind9/-/merge_requests/510)
|
||||
- [ ] ***(QA)*** Add a release marker to `CHANGES`. Examples: [9.18](https://gitlab.isc.org/isc-projects/bind9/-/commit/f14d8ad78c0506fd4247187f2177f8eceeb6b3b9), [9.16](https://gitlab.isc.org/isc-projects/bind9/-/commit/1bcdf21874f99a00da389d723e0ad07dfd70f9f1)
|
||||
- [ ] ***(QA)*** Add a release marker to `CHANGES.SE` (Subscription Edition only). [Example](https://gitlab.isc.org/isc-private/bind9/-/commit/0f03d5737bcbdaa1bf713c6db1887b14938c3421)
|
||||
- [ ] ***(QA)*** Update BIND 9 version in `configure.ac` ([9.18+](https://gitlab.isc.org/isc-projects/bind9/-/commit/3c85ab7f4c35e6d8acef1393606002a0a8730100)) or `version` ([9.16](https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7692/diffs?commit_id=1bcdf21874f99a00da389d723e0ad07dfd70f9f1)).
|
||||
- [ ] ***(QA)*** Rebuild `configure` using Autoconf on `docs.isc.org` (9.16).
|
||||
- [ ] ***(QA)*** Update GitLab settings for all maintained branches to disallow merging to them: [public](https://gitlab.isc.org/isc-projects/bind9/-/settings/repository), [private](https://gitlab.isc.org/isc-private/bind9/-/settings/repository)
|
||||
- [ ] ***(QA)*** Tag the releases in the private repository (`git tag -s -m "BIND 9.x.y" v9.x.y`).
|
||||
|
||||
### Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)
|
||||
|
||||
- [ ] ***(QA)*** Check that the formatting is correct for HTML and PDF versions of release notes.
|
||||
- [ ] ***(QA)*** Check that the formatting of the generated man pages is correct.
|
||||
- [ ] ***(QA)*** Verify GitLab CI results [for the tags](https://gitlab.isc.org/isc-private/bind9/-/pipelines?scope=tags) created and sign off on the releases to be published.
|
||||
- [ ] ***(QA)*** Update GitLab settings for all maintained branches to allow merging to them again: [public](https://gitlab.isc.org/isc-projects/bind9/-/settings/repository), [private](https://gitlab.isc.org/isc-private/bind9/-/settings/repository)
|
||||
- [ ] ***(QA)*** Prepare and merge MRs resetting the release notes and updating the version string for each maintained branch: [9.16](https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7652/diffs) and [newer](https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7651/diffs)
|
||||
- [ ] ***(QA)*** Announce (on Mattermost) that the code freeze is over.
|
||||
- [ ] ***(QA)*** Request signatures for the tarballs, providing their location and checksums. Ask [signers on Mattermost](https://mattermost.isc.org/isc/channels/bind-9-qa).
|
||||
- [ ] ***(Signers)*** Ensure that the contents of tarballs and tags are identical.
|
||||
- [ ] ***(Signers)*** Validate tarball checksums, sign tarballs, and upload signatures.
|
||||
- [ ] ***(QA)*** Verify tarball signatures and check tarball checksums again: Run `publish_bind.sh` on repo.isc.org to pre-publish.
|
||||
- [ ] ***(Support)*** Pre-publish ASN and/or Subscription Edition tarballs so that packages can be built.
|
||||
- [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages (in [cloudsmith branch in private repo](https://gitlab.isc.org/isc-private/rpms/bind/-/tree/cloudsmith)). [Example](https://gitlab.isc.org/isc-private/rpms/bind/-/commit/e2512f4cfaf991827a635e374e7e93b27a5f38ba)
|
||||
- [ ] ***(QA)*** Prepare the `patches/` subdirectory for each security release (if applicable).
|
||||
- [ ] ***(QA)*** Notify Support that the releases have been prepared.
|
||||
- [ ] ***(Support)*** Send out ASNs (if applicable).
|
||||
|
||||
### On the Day of Public Release
|
||||
|
||||
- [ ] ***(Support)*** Wait for clearance from Security Officer to proceed with the public release (if applicable).
|
||||
- [ ] ***(Support)*** Place tarballs in public location on FTP site.
|
||||
- [ ] ***(Support)*** Publish links to downloads on ISC website. [Example](https://gitlab.isc.org/website/theme-staging-site/-/commit/1ac7b30b73cb03228df4cd5651fa4e774ac35625)
|
||||
- [ ] ***(Support)*** Write release email to *bind-announce*. [Example](https://lists.isc.org/pipermail/bind-announce/2023-March/001231.html)
|
||||
- [ ] ***(Support)*** Write email to *bind-users* (if a major release). [Example](https://lists.isc.org/pipermail/bind-users/2022-January/105624.html)
|
||||
- [ ] ***(Support)*** Send eligible customers updated links to the Subscription Edition (update the -S edition delivery tickets, even if those links were provided earlier via an ASN ticket).
|
||||
- [ ] ***(Support)*** Update tickets in case of waiting support customers.
|
||||
- [ ] ***(QA)*** Build and test any outstanding private packages in [private repo](https://gitlab.isc.org/isc-private/rpms/bind/-/tree/cloudsmith). [Example](https://gitlab.isc.org/isc-private/rpms/bind/-/commit/2007d566db81dd9dfd79e571e2f600a3bc284da4)
|
||||
- [ ] ***(QA)*** Build [public RPMs](https://gitlab.isc.org/isc-packages/rpms/bind). [Example commit](https://gitlab.isc.org/isc-packages/rpms/bind/-/commit/3b5e851ea7c4e3570371a4878b5461f02a44f8cc) which triggers [Copr builds](https://copr.fedorainfracloud.org/coprs/isc/) automatically
|
||||
- [ ] ***(SwEng)*** Build Debian/Ubuntu packages.
|
||||
- [ ] ***(SwEng)*** Update Docker files [here](https://gitlab.isc.org/isc-projects/bind9-docker/-/branches) and make sure push is synchronized to [GitHub](https://github.com/isc-projects/bind9-docker). [Docker Hub](https://hub.docker.com/r/internetsystemsconsortium/bind9) should pick it up automatically. [Example](https://gitlab.isc.org/isc-projects/bind9-docker/-/commit/cada7e10e9af951595c98bfffc4bd42512faac05)
|
||||
- [ ] ***(QA)*** Inform Marketing of the release.
|
||||
- [ ] ***(Marketing)*** Post short note to Twitter.
|
||||
- [ ] ***(Marketing)*** Update [Wikipedia entry for BIND](https://en.wikipedia.org/wiki/BIND).
|
||||
- [ ] ***(Marketing)*** Write blog article (if a major release).
|
||||
- [ ] ***(QA)*** Ensure all new tags are annotated and signed. `git show --show-signature v9.19.12`
|
||||
- [ ] ***(QA)*** Push tags for the published releases to the public repository.
|
||||
- [ ] ***(QA)*** Merge published release tags (non-linearly) back into the their relevant development/maintenance branches. [Step 7 of the new workflow](https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6124#new-workflow)
|
||||
- [ ] ***(QA)*** Sanitize confidential issues which are assigned to the current release milestone and do not describe a security vulnerability, then make them public.
|
||||
- [ ] ***(QA)*** Sanitize [confidential issues](https://gitlab.isc.org/isc-projects/bind9/-/issues/?sort=milestone_due_desc&state=opened&confidential=yes) which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
|
||||
- [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Black, PyLint, Sphinx) by modifying the relevant [`Dockerfile`](https://gitlab.isc.org/isc-projects/images/-/merge_requests/228/diffs).
|
||||
- [ ] ***(QA)*** Run a pipeline to rebuild all [images](https://gitlab.isc.org/isc-projects/images) used in GitLab CI.
|
||||
- [ ] ***(QA)*** Update [`metadata.json`](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/metadata.json) with the upcoming release information.
|
||||
|
||||
[^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
|
||||
[^2]: As a rule of thumb, security vulnerabilities which have reproducers merged to the public repository are considered okay for full disclosure.
|
||||
@@ -1,139 +0,0 @@
|
||||
### Summary
|
||||
<!--
|
||||
Concisely summarize the bug encountered,
|
||||
preferably in one paragraph or less.
|
||||
-->
|
||||
|
||||
### BIND versions affected
|
||||
<!--
|
||||
Make sure you are testing with the **latest** supported version of BIND.
|
||||
See https://kb.isc.org/docs/supported-platforms for the current list.
|
||||
The latest source is available from https://www.isc.org/download/#BIND
|
||||
|
||||
Paste the output of `named -V` here.
|
||||
-->
|
||||
|
||||
### Preconditions and assumptions
|
||||
<!--
|
||||
Is a specific setup needed?
|
||||
|
||||
Please check the BIND Security Assumptions chapter in the ARM:
|
||||
https://bind9.readthedocs.io/en/latest/chapter7.html#security-assumptions
|
||||
|
||||
E.g. DNSSEC validation must be disabled, etc.
|
||||
E.g. Resolver must be configured to forward to attacker's server via DNS-over-TLS, etc.
|
||||
E.g. Authoritative server must be configured to transfer specific primary zone.
|
||||
E.g. Attacker must be in posession of a key authorized to modify at least one zone.
|
||||
E.g. Attacker can affect system clock on the server running BIND.
|
||||
-->
|
||||
|
||||
### Attacker's abilities
|
||||
<!--
|
||||
What resources does an attacker need to have under their control to mount this attack?
|
||||
|
||||
E.g. If attacking an authoritative server, does the attacked have to have prior
|
||||
relationship with it? "The authoritative server under attack needs to
|
||||
transfer a malicious zone from attacker's authoritative server via TLS."
|
||||
|
||||
E.g. If attacking a resolver, does the attacker need the ability to send
|
||||
arbitrary queries to the resolver under attack? Do they need to _also_ control
|
||||
an authoritative server at the same time?
|
||||
-->
|
||||
|
||||
|
||||
### Impact
|
||||
<!--
|
||||
Who or what is the victim of the attack and what is the impact?
|
||||
|
||||
Is a third party receiving many packets generated by a reflection attack?
|
||||
|
||||
If the affected party is the BIND server itself, please quantify the impact
|
||||
on legitimate clients:
|
||||
E.g. After launching the attack, the answers-per-second metric for legitimate
|
||||
traffic drops to 1/1000 within the first minute of the attack.
|
||||
-->
|
||||
|
||||
|
||||
### Steps to reproduce
|
||||
<!--
|
||||
This is extremely important! Be precise and use itemized lists, please.
|
||||
|
||||
Even if a default configuration is affected, please include the full configuration
|
||||
files _you were testing with_.
|
||||
|
||||
Example:
|
||||
1. Use the _attached_ configuration file
|
||||
2. Start the BIND server with command: `named -g -c named.conf ...`
|
||||
3. Simulate legitimate clients using the command `dnsperf -S1 -d legit-queries ...`
|
||||
4. Simulate attack traffic using the command `dnsperf -S1 -d attack-queries ...`
|
||||
-->
|
||||
|
||||
1.
|
||||
2.
|
||||
3.
|
||||
|
||||
### What is the current *bug* behavior?
|
||||
|
||||
<!--
|
||||
Examples:
|
||||
Legitimate QPS drops 1000x.
|
||||
Memory consumption increases out of bounds and the server crashes.
|
||||
The server crashes immediately.
|
||||
-->
|
||||
|
||||
### What is the expected *correct* behavior?
|
||||
|
||||
<!--
|
||||
If the attack causes resource exhaustion, what do you think the correct
|
||||
behavior should be? Should BIND refuse to process more requests?
|
||||
|
||||
What heuristic do you propose to distinguish legitimate and attack traffic?
|
||||
-->
|
||||
|
||||
### Relevant logs
|
||||
<!--
|
||||
Please provide log files from your testing. Include full named logs and also
|
||||
the output from any testing tools (e.g. dnsperf, DNS Shotgun, kxdpgun, etc.)
|
||||
|
||||
If multiple log files are needed, make sure all the files have matching timestamps
|
||||
so we can correlate log events across log files.
|
||||
|
||||
In the case of resource exhaustion attacks, please _also_ include system monitoring
|
||||
data. You can use https://gitlab.isc.org/isc-projects/resource-monitor/ to
|
||||
gather system-wide statistics.
|
||||
-->
|
||||
|
||||
### Coordination
|
||||
- Does this issue affect multiple implementations?
|
||||
<!--
|
||||
Issues affecting multiple implementations require very careful coordination. We
|
||||
have to make sure the information does not leak to the public until vendors are ready to
|
||||
release fixed versions. If it is a multi-vendor issue, we need to know about the situation
|
||||
as soon as possible to start the (confidential!) coordination process within
|
||||
DNS-OARC and other suitable fora.
|
||||
|
||||
Please list implementations you have tested.
|
||||
-->
|
||||
|
||||
- Have you shared the information with anyone else?
|
||||
<!--
|
||||
Have you informed other affected vendors? Or maybe submitted a paper for
|
||||
review?
|
||||
-->
|
||||
|
||||
- What is your plan to publicize this issue?
|
||||
<!--
|
||||
E.g. we plan to go public during conference XYZ on 20XX-XX-XX
|
||||
-->
|
||||
|
||||
### Acknowledgements
|
||||
<!--
|
||||
Please specify whether and how you would like to be publicly credited with
|
||||
discovering the issue. We normally use the format:
|
||||
First_name Last_name, Company_or_Team.
|
||||
-->
|
||||
|
||||
<!-- DO NOT modify the following two lines. -->
|
||||
|
||||
/label ~Bug ~Security
|
||||
/confidential
|
||||
@@ -7,4 +7,3 @@ disable=
|
||||
C0209, # consider-using-f-string
|
||||
C0415, # import-outside-toplevel
|
||||
R0801, # duplicate-code
|
||||
R0903, # too-few-public-methods
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
|
||||
|
||||
version: 2
|
||||
|
||||
build:
|
||||
os: ubuntu-22.04
|
||||
tools:
|
||||
python: "3.11"
|
||||
|
||||
# Build documentation in doc/arm/ with Sphinx
|
||||
sphinx:
|
||||
configuration: doc/arm/conf.py
|
||||
|
||||
# Build all formats
|
||||
formats: all
|
||||
|
||||
# Explicitly set the version of Python and its requirements
|
||||
python:
|
||||
install:
|
||||
- requirements: doc/arm/requirements.txt
|
||||
+1
-9
@@ -54,9 +54,6 @@ Files: **/*.after*
|
||||
bin/tests/system/keepalive/expected
|
||||
bin/tests/system/legacy/ns6/edns512.db.signed
|
||||
bin/tests/system/legacy/ns7/edns512-notcp.db.signed
|
||||
bin/tests/system/masterfile/knowngood.include
|
||||
bin/tests/system/masterfile/knowngood.ttl1
|
||||
bin/tests/system/masterfile/knowngood.ttl2
|
||||
bin/tests/system/nsupdate/CA/CA.cfg
|
||||
bin/tests/system/nsupdate/CA/README
|
||||
bin/tests/system/nsupdate/CA/index.txt
|
||||
@@ -84,10 +81,7 @@ Files: **/*.after*
|
||||
bin/tests/system/unknown/large.out
|
||||
bin/tests/system/xfer/ans5/badkeydata
|
||||
bin/tests/system/xfer/ans5/badmessageid
|
||||
bin/tests/system/xfer/ans5/ednsformerr
|
||||
bin/tests/system/xfer/ans5/ednsnotimp
|
||||
bin/tests/system/xfer/ans5/goodaxfr
|
||||
bin/tests/system/xfer/ans5/ixfrnotimp
|
||||
bin/tests/system/xfer/ans5/partial
|
||||
bin/tests/system/xfer/ans5/soamismatch
|
||||
bin/tests/system/xfer/ans5/unknownkey
|
||||
@@ -163,21 +157,19 @@ Files: **/.clang-format
|
||||
.clang-format
|
||||
.clang-format.headers
|
||||
.dir-locals.el
|
||||
.editorconfig
|
||||
.git-blame-ignore-revs
|
||||
.gitattributes
|
||||
.gitignore
|
||||
.gitlab-ci.yml
|
||||
.lgtm.yml
|
||||
.pylintrc
|
||||
.readthedocs.yaml
|
||||
.tsan-suppress
|
||||
.tsan-suppress-extra
|
||||
.uncrustify.cfg
|
||||
doc/misc/*.zoneopt
|
||||
doc/misc/options
|
||||
doc/misc/rndc.grammar
|
||||
sonar-project.properties
|
||||
tests/bench/names.csv
|
||||
Copyright: Internet Systems Consortium, Inc. ("ISC")
|
||||
License: CC0-1.0
|
||||
|
||||
|
||||
+4
-3
@@ -1,3 +1,4 @@
|
||||
# Uninstrumented libraries
|
||||
called_from_lib:libfstrm.so
|
||||
race:dummyrpz
|
||||
# be more selective with liburcu
|
||||
race:rcu_barrier
|
||||
race:rcu_*_barrier
|
||||
thread:*
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
# Uninstrumented libraries
|
||||
called_from_lib:libfstrm.so
|
||||
called_from_lib:libdummyrpz.so
|
||||
# be more selective with liburcu
|
||||
race:rcu_barrier
|
||||
race:rcu_memb_barrier
|
||||
thread:*
|
||||
@@ -1,752 +1,5 @@
|
||||
6369. [func] The 'fixed' value for the 'rrset-order' option has
|
||||
been marked and documented as deprecated. [GL #4446]
|
||||
|
||||
6368. [func] The 'sortlist' option has been marked and documented
|
||||
as deprecated. [GL #4593]
|
||||
|
||||
6367. [bug] Since the dns_validator_destroy() function doesn't
|
||||
guarantee that it destroys the validator, rename it to
|
||||
dns_validator_shutdown() and require explicit
|
||||
dns_validator_detach() to follow. Implement an expected
|
||||
behavior of the function to release a name associated
|
||||
with the validator. [GL #4654]
|
||||
|
||||
6366. [bug] An assertion could be triggered in the QPDB cache when
|
||||
encountering a delegation below a DNAME. [GL #4652]
|
||||
|
||||
6365. [placeholder]
|
||||
|
||||
6364. [protocol] Add RESOLVER.ARPA to the built in empty zones.
|
||||
[GL #4580]
|
||||
|
||||
6363. [bug] dig/mdig +ednsflags=<non-zero-value> did not re-enable
|
||||
EDNS if it had been disabled. [GL #4641]
|
||||
|
||||
6362. [bug] Reduce memory consumption of QP-trie based databases
|
||||
by dynamically allocating the nodenames. [GL #4614]
|
||||
|
||||
6361. [bug] Some invalid ISO 8601 durations were accepted
|
||||
erroneously. [GL #4624]
|
||||
|
||||
6360. [bug] Don't return static-stub synthesised NS RRset.
|
||||
[GL #4608]
|
||||
|
||||
6359. [bug] Fix bug in Depends (keymgr_dep) function. [GL #4552]
|
||||
|
||||
--- 9.19.22 released ---
|
||||
|
||||
6358. [bug] Fix validate_dnskey_dsset when KSK is not signing,
|
||||
do not skip remainder of DS RRset. [GL #4625]
|
||||
|
||||
6357. [func] The QP zone database implementation introduced in
|
||||
change #6355 has now been replaced with a version
|
||||
based on the multithreaded dns_qpmulti API, which
|
||||
is based on RCU and reduces the need for locking.
|
||||
The new implementation is called "qpzone". The
|
||||
previous "qp" implementation has been renamed
|
||||
"qpcache", and can only be used for the cache.
|
||||
[GL #4348]
|
||||
|
||||
6356. [bug] Attach the loop also in the dns_cache_flush(), so
|
||||
the cache pruning still works after the flush.
|
||||
[GL #4621]
|
||||
|
||||
6355. [func] The red-black tree data structure underlying the
|
||||
RBTDB has been replaced with QP-tries. This is
|
||||
expected to improve scalability and reduce
|
||||
CPU consumption under load. It is currently known to
|
||||
have higher memory consumption than the traditional
|
||||
RBTDB; this will be addressed in future releases.
|
||||
|
||||
Nodes in a QP-trie contain the full domain name,
|
||||
while nodes in a red-black tree only contain names
|
||||
relative to a parent. Because of this difference,
|
||||
zone files dumped with masterfile-style "relative"
|
||||
will no longer have multiple different $ORIGIN
|
||||
statements throughout the file.
|
||||
|
||||
This version is a minimal adaptation, keeping RBTDB
|
||||
code largely unchanged, except as needed to replace
|
||||
the underlying data structure. It uses the
|
||||
single-thread "dns_qp" interface with locks for
|
||||
synchronization. A future version will use the
|
||||
multithreaded "dns_qpmulti" interface instead,
|
||||
and will be renamed to QPDB.
|
||||
|
||||
The RBT-based version of RBTDB is still in place
|
||||
for now, and can be used by specifying "database rbt"
|
||||
in a "zone" statement, or by compiling with
|
||||
"configure --with-zonedb=rbt --with-cachedb=rbt".
|
||||
[GL #4411]
|
||||
|
||||
6354. [bug] Change 6035 introduced a regression when chasing DS
|
||||
records resulting in an assertion failure. [GL #4612]
|
||||
|
||||
6353. [bug] Improve the TTL-based cleaning by removing the expired
|
||||
headers from the heap, so they don't block the next
|
||||
cleaning round and clean more than a single item for
|
||||
each new addition to the RBTDB. [GL #4591]
|
||||
|
||||
6352. [bug] Revert change 6319 and decrease lock contention during
|
||||
RBTDB tree pruning by not cleaning up nodes recursively
|
||||
within a single prune_tree() call. [GL #4596]
|
||||
|
||||
6351. [protocol] Support for the RESINFO record type has been added.
|
||||
[GL #4413]
|
||||
|
||||
6350. [bug] Address use after free in expire_lru_headers. [GL #4495]
|
||||
|
||||
6349. [placeholder]
|
||||
|
||||
6348. [bug] BIND could previously abort when trying to
|
||||
establish a connection to a remote server using an
|
||||
incorrect 'tls' configuration. That has been
|
||||
fixed. Thanks to Tobias Wolter for bringing
|
||||
the issue to our attention. [GL #4572]
|
||||
|
||||
6347. [func] Disallow stale-answer-client-timeout non-zero values.
|
||||
[GL #4447]
|
||||
|
||||
6346. [bug] Cleaned up several minor bugs in the RBTDB dbiterator
|
||||
implementation. [GL !8741]
|
||||
|
||||
6345. [bug] Added missing dns_rdataset_disassociate calls in
|
||||
validator.c:findnsec3proofs. [GL #4571]
|
||||
|
||||
6344. [bug] Fix case insensitive setting for isc_ht hashtable.
|
||||
[GL #4568]
|
||||
|
||||
6343. [bug] Fix case insensitive setting for isc_ht hashtable.
|
||||
[GL #4568]
|
||||
|
||||
6342. [placeholder]
|
||||
|
||||
6341. [bug] Address use after free in ccmsg_senddone. [GL #4549]
|
||||
|
||||
6340. [test] Fix incorrectly reported errors when running tests
|
||||
with `make test` on platforms with older pytest.
|
||||
[GL #4560]
|
||||
|
||||
6339. [bug] The alignas() can't be used on types larger than
|
||||
max_align_t; instead add padding into the structures
|
||||
where we want avoid false memory sharing. [GL #4187]
|
||||
|
||||
6338. [func] Optimize slabheader placement, so the infrastructure
|
||||
records are put in the beginning of the slabheader
|
||||
linked list. [GL !8675]
|
||||
|
||||
6337. [bug] Nsupdate could assert while shutting down. [GL #4529]
|
||||
|
||||
6336. [func] Expose the zones with the 'first refresh' flag set in
|
||||
statistics channel's "Incoming Zone Transfers" section
|
||||
to indicate the zones that are not yet fully ready, and
|
||||
their first refresh is pending or is in-progress. Also
|
||||
expose the number of such zones in the output of the
|
||||
'rndc status' command. [GL #4241]
|
||||
|
||||
6335. [func] The 'dnssec-validation yes' option now requires an
|
||||
explicitly configured 'trust-anchors' statement (or
|
||||
'managed-keys' or 'trusted-keys' statements, both
|
||||
deprecated). [GL #4373]
|
||||
|
||||
6334. [doc] Improve ARM parental-agents definition. [GL #4531]
|
||||
|
||||
6333. [bug] Fix the DNS_GETDB_STALEFIRST flag, which was defined
|
||||
incorrectly in lib/ns/query.c. [GL !8683]
|
||||
|
||||
6332. [bug] Range-check the arguments to fetch-quota-param.
|
||||
[GL #362]
|
||||
|
||||
6331. [func] Add HSM support for dnssec-policy. You can now
|
||||
configure keys with a key-store that allows you to
|
||||
set the directory to store key files and to set a
|
||||
PKCS #11 URI string. [GL #1129]
|
||||
|
||||
6330. [doc] Update ZSK minimum lifetime documentation in ARM, also
|
||||
depends on signing delay. [GL #4510]
|
||||
|
||||
6329. [func] Nsupdate can now set the UL EDNS option when sending
|
||||
UPDATE requests. [GL #4419]
|
||||
|
||||
6328. [func] Add workaround to enforce dynamic linker to pull
|
||||
jemalloc earlier than libc to ensure all memory
|
||||
allocations are done via jemalloc. [GL #4404]
|
||||
|
||||
6327. [func] Expose the TCP client count in statistics channel.
|
||||
[GL #4425]
|
||||
|
||||
6326. [bug] Changes to "listen-on" statements were ignored on
|
||||
reconfiguration unless the port or interface address was
|
||||
changed, making it impossible to change a related
|
||||
listener transport type. Thanks to Thomas Amgarten.
|
||||
[GL #4518] [GL #4528]
|
||||
|
||||
6325. [func] The 'tls' block was extended with a new
|
||||
'cipher-suites' option that allows setting
|
||||
allowed cipher suites for TLSv1.3.
|
||||
[GL #3504]
|
||||
|
||||
6324. [bug] Fix a possible crash in 'dig +nssearch +nofail' and
|
||||
'host -C' commands when one of the name servers returns
|
||||
SERVFAIL. [GL #4508]
|
||||
|
||||
--- 9.19.21 released ---
|
||||
|
||||
6323. [placeholder]
|
||||
|
||||
6322. [security] Specific DNS answers could cause a denial-of-service
|
||||
condition due to DNS validation taking a long time.
|
||||
(CVE-2023-50387) [GL #4424]
|
||||
|
||||
The same code change also addresses another problem:
|
||||
preparing NSEC3 closest encloser proofs could exhaust
|
||||
available CPU resources. (CVE-2023-50868) [GL #4459]
|
||||
|
||||
6321. [security] Change 6315 inadvertently introduced regressions that
|
||||
could cause named to crash. [GL #4234]
|
||||
|
||||
6320. [placeholder]
|
||||
|
||||
--- 9.19.20 released ---
|
||||
|
||||
6319. [func] Limit isc_async_run() overhead for RBTDB tree pruning.
|
||||
[GL #4383]
|
||||
|
||||
6318. [placeholder]
|
||||
|
||||
6317. [security] Restore DNS64 state when handling a serve-stale timeout.
|
||||
(CVE-2023-5679) [GL #4334]
|
||||
|
||||
6316. [security] Specific queries could trigger an assertion check with
|
||||
nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281]
|
||||
|
||||
6315. [security] Speed up parsing of DNS messages with many different
|
||||
names. (CVE-2023-4408) [GL #4234]
|
||||
|
||||
6314. [bug] Address race conditions in dns_tsigkey_find().
|
||||
[GL #4182]
|
||||
|
||||
6313. [bug] When dnssec-policy is in effect the DNSKEY's TTLs in
|
||||
the zone where not being updated to match the policy.
|
||||
This lead to failures when DNSKEYs where updated as the
|
||||
TTLs mismatched. [GL #4466]
|
||||
|
||||
6312. [bug] Conversion from NSEC3 signed to NSEC signed could
|
||||
temporarily put the zone into a state where it was
|
||||
treated as unsigned until the NSEC chain was built.
|
||||
Additionally conversion from one set of NSEC3 parameters
|
||||
to another could also temporarily put the zone into a
|
||||
state where it was treated as unsigned until the new
|
||||
NSEC3 chain was built. [GL #1794] [GL #4495]
|
||||
|
||||
6311. [func] Zone content checks are now disabled by default
|
||||
when running named-compilezone. named-checkzone
|
||||
can still be used for checking zone integrity,
|
||||
or the former checks in named-compilezone can be
|
||||
re-enabled by using "named-compilezone -i full
|
||||
-k fail -n fail -r warn -m warn -M warn -S warn
|
||||
-T warn -W warn -C check-svcb:fail". [GL #4364]
|
||||
|
||||
6310. [bug] Memory leak in zone.c:sign_zone. When named signed a
|
||||
zone it could leak dst_keys due to a misplaced
|
||||
'continue'. [GL #4488]
|
||||
|
||||
6309. [bug] Changing a zone's primaries while a refresh was in
|
||||
progress could trigger an assertion. [GL #4310]
|
||||
|
||||
6308. [bug] Prevent crashes caused by the zone journal getting
|
||||
destroyed before all changes from an incoming IXFR are
|
||||
written to it. [GL #4496]
|
||||
|
||||
6307. [bug] Obtain a client->handle reference when calling
|
||||
async_restart. [GL #4439]
|
||||
|
||||
6306. [func] Log more details about the cause of "not exact" errors.
|
||||
[GL #4500]
|
||||
|
||||
6305. [placeholder]
|
||||
|
||||
6304. [bug] The wrong time was being used to determine what RRSIGs
|
||||
where to be generated when dnssec-policy was in use.
|
||||
[GL #4494]
|
||||
|
||||
6303. [bug] Dig failed to correctly process a SIGINT received while
|
||||
waiting for a TCP connection to complete. [GL #4138]
|
||||
|
||||
6302. [func] The "trust-anchor-telemetry" statement is no longer
|
||||
marked as experimental. This silences a relevant log
|
||||
message that was emitted even when the feature was
|
||||
explicitly disabled. [GL #4497]
|
||||
|
||||
6301. [bug] Fix data races with atomic members of the xfrin
|
||||
structure in xfrin_start() and xfrin_send_request()
|
||||
functions. [GL #4493]
|
||||
|
||||
6300. [bug] Fix statistics export to use full 64 bit signed numbers
|
||||
instead of truncating values to unsigned 32 bits.
|
||||
[GL #4467]
|
||||
|
||||
6299. [port] NetBSD has added 'hmac' to libc which collides with our
|
||||
use of 'hmac'. [GL #4478]
|
||||
|
||||
6298. [bug] Fix dns_qp_lookup bugs related to the iterator.
|
||||
[GL !8558]
|
||||
|
||||
--- 9.19.19 released ---
|
||||
|
||||
6297. [bug] Improve LRU cleaning behaviour. [GL #4448]
|
||||
|
||||
6296. [func] The "resolver-nonbackoff-tries" and
|
||||
"resolver-retry-interval" options have been removed;
|
||||
Using them is now a fatal error. [GL #4405]
|
||||
|
||||
6295. [bug] Fix an assertion failure which could occur during
|
||||
shutdown when DNSSEC validation was running. [GL #4462]
|
||||
|
||||
6294. [bug] BIND might sometimes crash after startup or
|
||||
re-configuration when one 'tls' entry is used multiple
|
||||
times to connect to remote servers due to initialisation
|
||||
attempts from contexts of multiple threads. That has
|
||||
been fixed. [GL #4464]
|
||||
|
||||
6293. [func] Initial support for accepting the PROXYv2 protocol in
|
||||
all currently implemented DNS transports in BIND and
|
||||
complementary support for sending it in dig are included
|
||||
into this release. [GL #4388]
|
||||
|
||||
6292. [func] Lower the maximum number of allowed NSEC3 iterations,
|
||||
from 150 to 50. DNSSEC responses with a higher
|
||||
iteration count are treated as insecure. For signing
|
||||
with dnssec-policy, iterations must be set to zero.
|
||||
[GL #4363]
|
||||
|
||||
6291. [bug] SIGTERM failed to properly stop multiple outstanding
|
||||
lookup in dig. [GL #4457]
|
||||
|
||||
6290. [bug] Dig +yaml will now report "no servers could be reached"
|
||||
also for UDP setup failure when no other servers or
|
||||
tries are left. [GL #1229]
|
||||
|
||||
6289. [test] Remove legacy system test runner in favor of pytest.
|
||||
[GL #4251]
|
||||
|
||||
6288. [func] Refactor the isc_mem overmem handling to always use
|
||||
isc_mem_isovermem and remove the water callback.
|
||||
[GL #4451]
|
||||
|
||||
6287. [bug] Recognize escapes when reading the public key from file.
|
||||
[GL !8502]
|
||||
|
||||
6286. [bug] Dig +yaml will now report "no servers could be reached"
|
||||
on TCP connection failure as well as for UDP timeouts.
|
||||
[GL #4396]
|
||||
|
||||
6285. [func] Remove AES-based DNS cookies. [GL #4421]
|
||||
|
||||
6284. [bug] Fix a catz db update notification callback registration
|
||||
logic error, which could cause an assertion failure when
|
||||
receiving an AXFR update for a catalog zone while the
|
||||
previous update process of the catalog zone was already
|
||||
running. [GL #4418]
|
||||
|
||||
6283. [bug] Fix a data race in isc_hashmap by using atomics for the
|
||||
iterators number. [GL !8474]
|
||||
|
||||
6282. [func] Deprecate AES-based DNS cookies. [GL #4421]
|
||||
|
||||
6281. [bug] Fix a data race in dns_tsigkeyring_dump(). [GL #4328]
|
||||
|
||||
--- 9.19.18 released ---
|
||||
|
||||
6280. [bug] Fix missing newlines in the output of "rndc nta -dump".
|
||||
[GL !8454]
|
||||
|
||||
6279. [func] Use QNAME minimization when fetching nameserver
|
||||
addresses. [GL #4209]
|
||||
|
||||
6278. [bug] The call to isc_mem_setwater() was incorrectly
|
||||
removed from dns_cache_setcachesize(), causing
|
||||
cache overmem conditions not to be detected. [GL #4340]
|
||||
|
||||
6277. [bug] Take into account local authoritative zones when
|
||||
falling back to serve-stale. [GL #4355]
|
||||
|
||||
6276. [cleanup] Remove both lock-file configuration option and the
|
||||
-X argument to named. [GL #4391]
|
||||
|
||||
6275. [bug] Fix assertion failure when using lock-file configuration
|
||||
option together -X argument to named. [GL #4386]
|
||||
|
||||
6274. [bug] The 'lock-file' file was being removed when it
|
||||
shouldn't have been making it ineffective if named was
|
||||
started 3 or more times. [GL #4387]
|
||||
|
||||
6273. [bug] Don't reuse the existing TCP streams in dns_xfrin, so
|
||||
parallel TCP transfers works again. [GL #4379]
|
||||
|
||||
6272. [func] Enable systemd units support with the 'notify-reload'
|
||||
service type by settng the MONOTONIC_USEC field when
|
||||
sending an sd_notify() message to the service manager
|
||||
to notify it about reloading the service. Note that the
|
||||
'NotifyAccess=all' option is required in the systemd
|
||||
unit file's '[Service]' section. [GL #4377]
|
||||
|
||||
6271. [bug] Fix a shutdown race in dns__catz_update_cb(). [GL #4381]
|
||||
|
||||
6270. [bug] Handle an assertion when the primary server returned
|
||||
NOTIMP to IXFR or FORMERR to EDNS to SOA/IXFR/AXFR
|
||||
request when transfering a zone. [GL #4372]
|
||||
|
||||
6269. [maint] B.ROOT-SERVERS.NET addresses are now 170.247.170.2 and
|
||||
2801:1b8:10::b. [GL #4101]
|
||||
|
||||
6268. [func] Offload the IXFR and AXFR processing to unblock
|
||||
the networking threads. [GL #4367]
|
||||
|
||||
6267. [func] The timeouts for resending zone refresh queries over UDP
|
||||
were lowered to enable named to more quickly determine
|
||||
that a primary is down. [GL #4260]
|
||||
|
||||
6266. [func] The zone option 'inline-signing' is ignored from now
|
||||
on iff there is no 'dnssec-policy' configured for the
|
||||
corresponding zone. [GL #4349]
|
||||
|
||||
6265. [bug] Don't schedule resign operations on the raw version
|
||||
of an inline-signing zone. [GL #4350]
|
||||
|
||||
6264. [func] Use atomics to handle some ADB entry members
|
||||
to reduce ADB locking contention. [GL #4326]
|
||||
|
||||
6263. [func] Convert the RPZ summary database to use a QP trie
|
||||
instead of an RBT. [GL !8352]
|
||||
|
||||
6262. [bug] Duplicate control sockets didn't generate a
|
||||
configuration failure leading to hard to diagnose
|
||||
rndc connection errors. These are now caught by
|
||||
named-checkconf and named. [GL #4253]
|
||||
|
||||
6261. [bug] Fix a possible assertion failure on an error path in
|
||||
resolver.c:fctx_query(), when using an uninitialized
|
||||
link. [GL #4331]
|
||||
|
||||
6260. [func] Added options to the QP trie that will be needed
|
||||
when it is used as a zone or cache database: backward
|
||||
iteration, and retrieval of DNSSEC predecessor
|
||||
nodes and node chains. [GL !8338]
|
||||
|
||||
6259. [placeholder]
|
||||
|
||||
6258. [func] Use explictly created external memory pools for
|
||||
dns_message in the ns_client and dns_resolver.
|
||||
[GL #4325]
|
||||
|
||||
6257. [func] Expose the "Refresh SOA" query state (before the XFR)
|
||||
in the incoming zone transfers section of the
|
||||
statistics channel and show the local and remote
|
||||
addresses for that query. Also Improve the
|
||||
"Duration (s)" field to show the duration of the
|
||||
"Pending" and "Refresh SOA" states too, before the
|
||||
actual transfer starts. [GL !8305]
|
||||
|
||||
6256. [func] Expose the SOA query transport type (used before/during
|
||||
XFR) in the incoming zone transfers section of the
|
||||
statistics channel. [GL !8240]
|
||||
|
||||
6255. [func] Expose data about incoming zone transfers in progress
|
||||
using statistics channel. [GL #3883]
|
||||
|
||||
6254. [cleanup] Add semantic patch to do an explicit cast from char
|
||||
to unsigned char in ctype.h class of functions.
|
||||
[GL #4327]
|
||||
|
||||
6253. [cleanup] Remove the support for control channel over Unix
|
||||
Domain Sockets. [GL #4311]
|
||||
|
||||
6252. [test] Python system tests have to be executed by invoking
|
||||
pytest directly. Executing them with the legacy test
|
||||
runner is no longer supported. [GL #4250]
|
||||
|
||||
6251. [bug] Interating a hashmap could return the same element
|
||||
twice. [GL #3422]
|
||||
|
||||
6250. [bug] The wrong covered value was being set by
|
||||
dns_ncache_current for RRSIG records in the returned
|
||||
rdataset structure. This resulted in TYPE0 being
|
||||
reported as the covered value of the RRSIG when dumping
|
||||
the cache contents. [GL #4314]
|
||||
|
||||
6249. [cleanup] Reduce the number of reserved UDP dispatches
|
||||
to the number of loops, replace the round-robin
|
||||
mechanism in dns_dispatchset_t with dispatches
|
||||
pinned to loops, and use lock-free hash tables
|
||||
for looking up query IDs and active TCP
|
||||
connections. [GL !8304]
|
||||
|
||||
6248. [func] Add an option "resolver-use-dns64", which enables
|
||||
application of DNS64 rules to server addresses
|
||||
when sending recursive queries. This allows
|
||||
resolution to be performed via NAT64. [GL #608]
|
||||
|
||||
6247. [func] Implement incremental hashing in both isc_siphash
|
||||
and isc_hash units. [GL #4306]
|
||||
|
||||
--- 9.19.17 released ---
|
||||
|
||||
6246. [placeholder]
|
||||
|
||||
6245. [security] Limit the amount of recursion that can be performed
|
||||
by isccc_cc_fromwire. (CVE-2023-3341) [GL #4152]
|
||||
|
||||
6244. [bug] Adjust log levels on malformed messages to NOTICE when
|
||||
transferring in a zone. [GL #4290]
|
||||
|
||||
6243. [bug] Restore the call order of dns_validator_destroy and
|
||||
fetchctx_detach to prevent use after free. [GL #4214]
|
||||
|
||||
6242. [func] Ignore jemalloc versions before 4.0.0 as we now
|
||||
need explicit memory arenas and tcache support.
|
||||
[GL #4296]
|
||||
|
||||
6241. [placeholder]
|
||||
|
||||
6240. [bug] Use dedicated per-worker thread jemalloc memory
|
||||
arenas for send buffers allocation to reduce memory
|
||||
consumption and avoid lock contention. [GL #4038]
|
||||
|
||||
6239. [func] Deprecate the 'dnssec-must-be-secure' option.
|
||||
[GL #3700]
|
||||
|
||||
6238. [cleanup] Refactor several objects relying on dns_rbt trees
|
||||
to instead of dns_nametree, a wrapper around dns_qp.
|
||||
[GL !8213]
|
||||
|
||||
6237. [bug] Address memory leaks due to not clearing OpenSSL error
|
||||
stack. [GL #4159]
|
||||
|
||||
6236. [func] Add isc_mem_cget() and isc_mem_cput() calloc-like
|
||||
functions that take nmemb and size, do checked
|
||||
multiplication and zero the memory before returning
|
||||
it to the user. Replace isc_mem_getx(..., ISC_MEM_ZERO)
|
||||
with isc_mem_cget(...) usage. [GL !8237]
|
||||
|
||||
6235. [doc] Clarify BIND 9 time formats. [GL #4266]
|
||||
|
||||
6234. [bug] Restore stale-refresh-time value after flushing the
|
||||
cache. [GL #4278]
|
||||
|
||||
6233. [func] Extend client side support for the EDNS EXPIRE option
|
||||
to IXFR and AXFR query types. [GL #4170]
|
||||
|
||||
6232. [bug] Following the introduction of krb5-subdomain-self-rhs
|
||||
and ms-subdomain-self-rhs update rules, removal of
|
||||
nonexistent PTR and SRV records via UPDATE could fail.
|
||||
[GL #4280]
|
||||
|
||||
6231. [func] Make nsupdate honor -v for SOA requests only if the
|
||||
server is specified. [GL #1181]
|
||||
|
||||
6230. [bug] Prevent an unnecessary query restart if a synthesized
|
||||
CNAME target points to the CNAME owner. [GL #3835]
|
||||
|
||||
6229. [func] Add basic USDT framework for adding static
|
||||
tracing points. [GL #4041]
|
||||
|
||||
6228. [func] Limit the number of inactive network manager handles
|
||||
and uvreq objects that we keep around for reusing
|
||||
later. [GL #4265]
|
||||
|
||||
6227. [bug] Check the statistics-channel HTTP Content-length
|
||||
to prevent negative or overflowing values from
|
||||
causing a crash. [GL #4125]
|
||||
|
||||
6226. [bug] Attach dispatchmgr in the dns_view object to prevent
|
||||
use-after-free when shutting down. [GL #4228]
|
||||
|
||||
6225. [func] Convert dns_nta, dns_forward and dns_keytable units
|
||||
to use QP trie instead of an RBT. [GL !7811]
|
||||
|
||||
6224. [bug] Check the If-Modified-Since value length to prevent
|
||||
out-of-bounds write. [GL #4124]
|
||||
|
||||
6223. [func] Make -E engine option for OpenSSL Engine API use only.
|
||||
OpenSSL Provider API will now require engine to not be
|
||||
set. [GL #8153]
|
||||
|
||||
6222. [func] Fixes to provider/engine based ECDSA key handling.
|
||||
[GL !8152]
|
||||
|
||||
--- 9.19.16 released ---
|
||||
|
||||
6221. [cleanup] Refactor dns_rdataset internals, move rdatasetheader
|
||||
declarations out of rbtdb.c so they can be used by other
|
||||
databases in the future, and split the zone and cache
|
||||
functions from rbtdb.c into separate modules. [GL !7873]
|
||||
|
||||
6220. [func] Deprecate the 'dialup' and 'heartbeat-interval'
|
||||
options. [GL #3700]
|
||||
|
||||
6219. [bug] Ignore 'max-zone-ttl' on 'dnssec-policy insecure'.
|
||||
[GL #4032]
|
||||
|
||||
6218. [func] Add inline-signing to dnssec-policy. [GL #3677]
|
||||
|
||||
6217. [func] The dns_badcache unit was refactored to use cds_lfht
|
||||
instead of hand-crafted locked hashtable. [GL #4223]
|
||||
|
||||
6216. [bug] Pin dns_request events to the originating loop
|
||||
to serialize access to the data. [GL #4086]
|
||||
|
||||
6215. [protocol] Return REFUSED to GSS-API TKEY requests if GSS-API
|
||||
support is not configured. [GL #4225]
|
||||
|
||||
6214. [bug] Fix the memory leak in for struct stub_glue_request
|
||||
allocated in stub_request_nameserver_address() but not
|
||||
freed in stub_glue_response(). [GL #4227]
|
||||
|
||||
6213. [bug] Mark a primary server as temporarily unreachable if the
|
||||
TCP connection attempt times out. [GL #4215]
|
||||
|
||||
6212. [placeholder]
|
||||
|
||||
6211. [func] Remove 'auto-dnssec'. This obsoletes the configuration
|
||||
options 'dnskey-sig-validity', 'dnssec-dnskey-kskonly',
|
||||
'dnssec-update-mode', 'sig-validity-interval', and
|
||||
'update-check-ksk'. [GL #3672]
|
||||
|
||||
6210. [func] Don't add signing records for DNSKEY added with dynamic
|
||||
update. The dynamic update DNSSEC management feature was
|
||||
removed with GL #3686. [GL !8070]
|
||||
|
||||
6209. [func] Reduce query-response latency by making recursive
|
||||
queries (CNAME, DNAME, NSEC) asynchronous instead
|
||||
of directly calling the respective functions. [GL #4185]
|
||||
|
||||
6208. [func] Return BADCOOKIE for out-of-date or otherwise bad, well
|
||||
formed DNS SERVER COOKIES. [GL #4194]
|
||||
|
||||
--- 9.19.15 released ---
|
||||
|
||||
6207. [cleanup] The code implementing TSIG/TKEY support has been cleaned
|
||||
up and refactored for improved robustness, readability,
|
||||
and consistency with other code modules. [GL !7828]
|
||||
|
||||
6206. [bug] Add shutdown checks in dns_catz_dbupdate_callback() to
|
||||
avoid a race with dns_catz_shutdown_catzs(). [GL #4171]
|
||||
|
||||
6205. [bug] Restore support to read legacy HMAC-MD5 K file pairs.
|
||||
[GL #4154]
|
||||
|
||||
6204. [bug] Use NS records for relaxed QNAME-minimization mode.
|
||||
This reduces the number of queries named makes when
|
||||
resolving, as it allows the non-existence of NS RRsets
|
||||
at non-referral nodes to be cached in addition to the
|
||||
referrals that are normally cached. [GL #3325]
|
||||
|
||||
6203. [cleanup] Ensure that the size calculation does not overflow
|
||||
when allocating memory for an array.
|
||||
[GL #4120] [GL #4121] [GL #4122]
|
||||
|
||||
6202. [func] Use per-loop memory contexts for dns_resolver
|
||||
objects. [GL !8015]
|
||||
|
||||
6201. [bug] The free_all_cpu_call_rcu_data() call at the end
|
||||
of isc_loopmgr_run() was causing ~200 ms extra
|
||||
latency. [GL #4163]
|
||||
|
||||
6200. [placeholder]
|
||||
|
||||
6199. [bug] Improve HTTP Connection: header protocol conformance
|
||||
in the statistics channel. [GL #4126]
|
||||
|
||||
6198. [func] Remove the holes in the isc_result_t enum to compact
|
||||
the isc_result tables. [GL #4149]
|
||||
|
||||
6197. [bug] Fix a data race between the dns_zone and dns_catz
|
||||
modules when registering/unregistering a database
|
||||
update notification callback for a catalog zone.
|
||||
[GL #4132]
|
||||
|
||||
6196. [cleanup] Report "permission denied" instead of "unexpected error"
|
||||
when trying to update a zone file on a read-only file
|
||||
system. Thanks to Midnight Veil. [GL #4134]
|
||||
|
||||
6195. [bug] Use rcu to reference view->adb. [GL #4021]
|
||||
|
||||
6194. [func] Change function 'find_zone_keys()' to look for signing
|
||||
keys by looking for key files instead of a DNSKEY
|
||||
RRset lookup. [GL #4141]
|
||||
|
||||
6193. [bug] Fix a catz db update notification callback registration
|
||||
logic error, which could crash named when receiving an
|
||||
AXFR update for a catalog zone while the previous update
|
||||
process of the catalog zone was already running.
|
||||
[GL #4136]
|
||||
|
||||
--- 9.19.14 released ---
|
||||
|
||||
6192. [placeholder]
|
||||
|
||||
6191. [placeholder]
|
||||
|
||||
6190. [security] Improve the overmem cleaning process to prevent the
|
||||
cache going over the configured limit. (CVE-2023-2828)
|
||||
[GL #4055]
|
||||
|
||||
6189. [bug] Fix an extra dns_validator deatch when encountering
|
||||
deadling which would lead to assertion failure.
|
||||
[GL #4115]
|
||||
|
||||
6188. [performance] Reduce memory consumption by allocating properly
|
||||
sized send buffers for stream-based transports.
|
||||
[GL #4038]
|
||||
|
||||
6187. [bug] Address view shutdown INSIST when accessing the
|
||||
zonetable. [GL #4093]
|
||||
|
||||
6186. [bug] Fix a 'clients-per-query' miscalculation bug. When the
|
||||
'stale-answer-enable' options was enabled and the
|
||||
'stale-answer-client-timeout' option was enabled and
|
||||
larger than 0, named was taking two places from the
|
||||
'clients-per-query' limit for each client and was
|
||||
failing to gradually auto-tune its value, as configured.
|
||||
[GL #4074]
|
||||
|
||||
6185. [func] Add "ClientQuota" statistics channel counter, which
|
||||
indicates the number of the resolver's spilled queries
|
||||
due to reaching the clients per query quota. [GL !7978]
|
||||
|
||||
6184. [func] Special-case code that was added to allow GSS-TSIG
|
||||
to work around bugs in the Windows 2000 version of
|
||||
Active Directory has been removed. The 'nsupdate -o'
|
||||
option and 'oldgsstsig' command have been
|
||||
deprecated, and are now treated as synonyms for
|
||||
'nsupdate -g' and 'gsstsig' respectively. [GL #4012]
|
||||
|
||||
6183. [bug] Fix a serve-stale bug where a delegation from cache
|
||||
could be returned to the client. [GL #3950]
|
||||
|
||||
6182. [cleanup] Remove configure checks for epoll, kqueue and
|
||||
/dev/poll. [GL #4098]
|
||||
|
||||
6181. [placeholder]
|
||||
|
||||
6180. [bug] The session key object could be incorrectly added
|
||||
to multiple different views' keyrings. [GL #4079]
|
||||
|
||||
6179. [bug] Fix an interfacemgr use-after-free error in
|
||||
zoneconf.c:isself(). [GL #3765]
|
||||
|
||||
6178. [func] Add support for the multi-signer model 2 (RFC 8901) when
|
||||
using inline-signing. [GL #2710]
|
||||
|
||||
6177. [placeholder]
|
||||
|
||||
6176. [test] Add support for using pytest & pytest-xdist to
|
||||
execute the system test suite. [GL #3978]
|
||||
|
||||
6175. [test] Fix the `upforwd` system test to be more reliable,
|
||||
|
||||
6174. [placeholder]
|
||||
6174. [test] Fix the `upforwd` system test to be more reliable,
|
||||
especially when using thread sanitizer. [GL #4069]
|
||||
|
||||
6173. [bug] Properly process extra "nameserver" lines in
|
||||
resolv.conf otherwise the next line is not properly
|
||||
@@ -783,8 +36,6 @@
|
||||
dighost_shutdown() callback twice and cause problems
|
||||
if the callback function was not idempotent. [GL #4039]
|
||||
|
||||
--- 9.19.13 released ---
|
||||
|
||||
6164. [bug] Set the rndc idle read timeout back to 60 seconds,
|
||||
from the netmgr default of 30 seconds, in order to
|
||||
match the behavior of 9.16 and earlier. [GL #4046]
|
||||
@@ -809,14 +60,14 @@
|
||||
|
||||
6157. [bug] When removing delegations in an OPTOUT range
|
||||
empty-non-terminal NSEC3 records generated by
|
||||
those delegations were not removed. [GL #4027]
|
||||
those delegations where not removed. [GL #4027]
|
||||
|
||||
6156. [bug] Reimplement the maximum and idle timeouts for incoming
|
||||
zone tranfers. [GL #4004]
|
||||
|
||||
6155. [bug] Treat ISC_R_INVALIDPROTO as a networking error
|
||||
in the dispatch code to avoid retrying with the
|
||||
same server. [GL #4005]
|
||||
same server. [GL #4005]<
|
||||
|
||||
6154. [func] Add spinlock implementation. The spinlock is much
|
||||
smaller (8 bytes) than pthread_mutex (40 bytes), so
|
||||
|
||||
+17
-2
@@ -102,7 +102,22 @@ Twitter, or Facebook.
|
||||
|
||||
### Reporting possible security issues
|
||||
|
||||
See `SECURITY.md`.
|
||||
If you think you may be seeing a potential security vulnerability in BIND
|
||||
(for example, a crash with REQUIRE, INSIST, or ASSERT failure), please
|
||||
report it immediately by emailing to security-officer@isc.org. Plain-text
|
||||
e-mail is not a secure choice for communications concerning undisclosed
|
||||
security issues so please encrypt your communications to us if possible,
|
||||
using the [ISC Security Officer public key](https://www.isc.org/pgpkey/).
|
||||
|
||||
Do not discuss undisclosed security vulnerabilities on any public mailing list.
|
||||
ISC has a long history of handling reported vulnerabilities promptly and
|
||||
effectively and we respect and acknowledge responsible reporters.
|
||||
|
||||
ISC's Security Vulnerability Disclosure Policy is documented at
|
||||
[https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
|
||||
|
||||
If you have a crash, you may want to consult
|
||||
["What to do if your BIND or DHCP server has crashed."](https://kb.isc.org/docs/aa-00340)
|
||||
|
||||
### <a name="contrib"></a>Contributing code
|
||||
|
||||
@@ -173,7 +188,7 @@ of documentation in the BIND source tree:
|
||||
they document, in files ending in `.rst`: for example, the
|
||||
`named` man page is `bin/named/named.rst`.
|
||||
* The *BIND 9 Administrator Reference Manual* is in the .rst files in
|
||||
`doc/arm/`; the HTML version is automatically generated from
|
||||
`doc/arm/`; the PDF and HTML versions are automatically generated from
|
||||
the `.rst` files.
|
||||
* API documentation is in the header file describing the API, in
|
||||
Doxygen-formatted comments.
|
||||
|
||||
@@ -133,7 +133,7 @@ modification, are permitted provided that the following conditions are met:
|
||||
3. Neither the name of the University nor the names of its contributors may
|
||||
be used to endorse or promote products derived from this software
|
||||
without specific prior written permission.
|
||||
|
||||
|
||||
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
||||
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
@@ -149,35 +149,35 @@ POSSIBILITY OF SUCH DAMAGE.
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
|
||||
(Royal Institute of Technology, Stockholm, Sweden).
|
||||
All rights reserved.
|
||||
(Royal Institute of Technology, Stockholm, Sweden).
|
||||
All rights reserved.
|
||||
|
||||
Redistribution and use in source and binary forms, with or without
|
||||
modification, are permitted provided that the following conditions
|
||||
are met:
|
||||
Redistribution and use in source and binary forms, with or without
|
||||
modification, are permitted provided that the following conditions
|
||||
are met:
|
||||
|
||||
1. Redistributions of source code must retain the above copyright
|
||||
notice, this list of conditions and the following disclaimer.
|
||||
1. Redistributions of source code must retain the above copyright
|
||||
notice, this list of conditions and the following disclaimer.
|
||||
|
||||
2. Redistributions in binary form must reproduce the above copyright
|
||||
notice, this list of conditions and the following disclaimer in the
|
||||
documentation and/or other materials provided with the distribution.
|
||||
2. Redistributions in binary form must reproduce the above copyright
|
||||
notice, this list of conditions and the following disclaimer in the
|
||||
documentation and/or other materials provided with the distribution.
|
||||
|
||||
3. Neither the name of the Institute nor the names of its contributors
|
||||
may be used to endorse or promote products derived from this software
|
||||
without specific prior written permission.
|
||||
3. Neither the name of the Institute nor the names of its contributors
|
||||
may be used to endorse or promote products derived from this software
|
||||
without specific prior written permission.
|
||||
|
||||
THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGE.
|
||||
THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGE.
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
|
||||
+2
-3
@@ -8,8 +8,8 @@ SUBDIRS += tests
|
||||
# run fuzz tests before system tests
|
||||
SUBDIRS += fuzz bin
|
||||
|
||||
BUILT_SOURCES += bind.keys.h
|
||||
CLEANFILES += bind.keys.h
|
||||
BUILT_SOURCES = bind.keys.h
|
||||
CLEANFILES = bind.keys.h
|
||||
|
||||
bind.keys.h: bind.keys Makefile
|
||||
${PERL} ${top_srcdir}/util/bindkeys.pl ${top_srcdir}/bind.keys > $@
|
||||
@@ -19,7 +19,6 @@ bind.keys.h: bind.keys Makefile
|
||||
EXTRA_DIST = \
|
||||
bind.keys \
|
||||
util/bindkeys.pl \
|
||||
util/dtrace.sh \
|
||||
contrib \
|
||||
CHANGES \
|
||||
COPYRIGHT \
|
||||
|
||||
@@ -25,8 +25,11 @@ common_SPHINXOPTS = \
|
||||
-a \
|
||||
$(SPHINX_V)
|
||||
|
||||
# The "today" variable set below is not directly used in the ARM, but its value
|
||||
# is implicitly inserted on the title page of the PDF file produced by Sphinx.
|
||||
ALLSPHINXOPTS = \
|
||||
$(common_SPHINXOPTS) \
|
||||
-D today="$(RELEASE_DATE)" \
|
||||
-D rst_epilog="$$(printf "$${RST_EPILOG}")" \
|
||||
$(SPHINXOPTS) \
|
||||
$(srcdir)
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
# Hey Emacs, this is -*- makefile-automake -*- file!
|
||||
# vim: filetype=automake
|
||||
|
||||
AM_V_DTRACE = $(AM_V_DTRACE_@AM_V@)
|
||||
AM_V_DTRACE_ = $(AM_V_DTRACE_@AM_DEFAULT_V@)
|
||||
AM_V_DTRACE_0 = @echo " DTRACE $@";
|
||||
|
||||
BUILT_SOURCES += probes.h
|
||||
CLEANFILES += probes.h probes.o
|
||||
|
||||
probes.h: Makefile probes.d
|
||||
$(AM_V_DTRACE)$(DTRACE) -s $(srcdir)/probes.d -h -o $@
|
||||
probes.lo: Makefile probes.d $(DTRACE_DEPS)
|
||||
$(AM_V_DTRACE)$(LIBTOOL) --mode=compile --tag=CC $(DTRACE) -s $(srcdir)/probes.d -G -o $@ $(DTRACE_OBJS)
|
||||
|
||||
if HAVE_DTRACE
|
||||
if !HOST_MACOS
|
||||
DTRACE_LIBADD = probes.lo
|
||||
endif
|
||||
endif
|
||||
@@ -21,8 +21,3 @@ AM_CPPFLAGS += \
|
||||
LDADD += \
|
||||
$(top_builddir)/tests/libtest/libtest.la \
|
||||
$(CMOCKA_LIBS)
|
||||
|
||||
if HAVE_JEMALLOC
|
||||
AM_CFLAGS += $(JEMALLOC_CFLAGS)
|
||||
LDADD += $(JEMALLOC_LIBS)
|
||||
endif
|
||||
|
||||
+2
-22
@@ -15,31 +15,17 @@ AM_LDFLAGS = \
|
||||
$(STD_LDFLAGS)
|
||||
LDADD =
|
||||
|
||||
BUILT_SOURCES =
|
||||
CLEANFILES =
|
||||
|
||||
if HOST_MACOS
|
||||
AM_LDFLAGS += \
|
||||
-Wl,-flat_namespace
|
||||
endif HOST_MACOS
|
||||
|
||||
if HAVE_JEMALLOC
|
||||
LIBISC_CFLAGS = $(JEMALLOC_CFLAGS)
|
||||
LIBISC_LIBS = $(JEMALLOC_LIBS)
|
||||
else
|
||||
LIBISC_CFLAGS =
|
||||
LIBISC_LIBS =
|
||||
endif
|
||||
|
||||
LIBISC_CFLAGS += \
|
||||
LIBISC_CFLAGS = \
|
||||
-I$(top_srcdir)/include \
|
||||
-I$(top_srcdir)/lib/isc/include \
|
||||
-I$(top_builddir)/lib/isc/include
|
||||
|
||||
LIBISC_LIBS += $(top_builddir)/lib/isc/libisc.la
|
||||
if HAVE_DTRACE
|
||||
LIBISC_DTRACE = $(top_builddir)/lib/isc/probes.lo
|
||||
endif
|
||||
LIBISC_LIBS = $(top_builddir)/lib/isc/libisc.la
|
||||
|
||||
LIBDNS_CFLAGS = \
|
||||
-I$(top_srcdir)/lib/dns/include \
|
||||
@@ -47,18 +33,12 @@ LIBDNS_CFLAGS = \
|
||||
|
||||
LIBDNS_LIBS = \
|
||||
$(top_builddir)/lib/dns/libdns.la
|
||||
if HAVE_DTRACE
|
||||
LIBDNS_DTRACE = $(top_builddir)/lib/dns/probes.lo
|
||||
endif
|
||||
|
||||
LIBNS_CFLAGS = \
|
||||
-I$(top_srcdir)/lib/ns/include
|
||||
|
||||
LIBNS_LIBS = \
|
||||
$(top_builddir)/lib/ns/libns.la
|
||||
if HAVE_DTRACE
|
||||
LIBNS_DTRACE = $(top_builddir)/lib/ns/probes.lo
|
||||
endif
|
||||
|
||||
LIBISCCFG_CFLAGS = \
|
||||
-I$(top_srcdir)/lib/isccfg/include
|
||||
|
||||
@@ -74,9 +74,17 @@ contents of your configuration file in a non-confidential issue, it is
|
||||
advisable to obscure key secrets; this can be done automatically by
|
||||
using `named-checkconf -px`.
|
||||
|
||||
For information about ISC's Security Vulnerability Disclosure Policy and
|
||||
information about reporting potential security issues, please see
|
||||
`SECURITY.md`.
|
||||
If you are reporting a bug that is a potential security issue, such as an
|
||||
assertion failure or other crash in `named`, please do *NOT* use GitLab to
|
||||
report it. Instead, send mail to
|
||||
[security-officer@isc.org](mailto:security-officer@isc.org) using our
|
||||
OpenPGP key to secure your message. (Information about OpenPGP and links
|
||||
to our key can be found at
|
||||
[https://www.isc.org/pgpkey](https://www.isc.org/pgpkey).) Please do not
|
||||
discuss the bug on any public mailing list.
|
||||
|
||||
For a general overview of ISC security policies, read the Knowledgebase
|
||||
article at [https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
|
||||
|
||||
Professional support and training for BIND are available from
|
||||
ISC. Contact us at [https://www.isc.org/contact](https://www.isc.org/contact)
|
||||
@@ -128,7 +136,7 @@ multiple servers to run locally and communicate with each other). These
|
||||
IP addresses can be configured by running the command
|
||||
`bin/tests/system/ifconfig.sh up` as root.
|
||||
|
||||
Some tests require Perl and the `Net::DNS` and/or `IO::Socket::IP` modules,
|
||||
Some tests require Perl and the `Net::DNS` and/or `IO::Socket::INET6` modules,
|
||||
and are skipped if these are not available. Some tests require Python
|
||||
and the `dnspython` module and are skipped if these are not available.
|
||||
See bin/tests/system/README for further details.
|
||||
@@ -141,18 +149,9 @@ parallel test driver; unit tests are also run by `make check`.
|
||||
|
||||
The *BIND 9 Administrator Reference Manual* (ARM) is included with the source
|
||||
distribution, and in .rst format, in the `doc/arm`
|
||||
directory. The HTML version is automatically generated and can
|
||||
directory. HTML and PDF versions are automatically generated and can
|
||||
be viewed at [https://bind9.readthedocs.io/en/latest/index.html](https://bind9.readthedocs.io/en/latest/index.html).
|
||||
|
||||
The PDF version can be built by running:
|
||||
|
||||
cd doc/arm/
|
||||
sphinx-build -b latex . pdf/
|
||||
make -C pdf/ all-pdf
|
||||
|
||||
The above requires TeX Live in order to work. The PDF will be written to
|
||||
`doc/arm/pdf/Bv9ARM.pdf`.
|
||||
|
||||
Man pages for some of the programs in the BIND 9 distribution
|
||||
are also included in the BIND ARM.
|
||||
|
||||
|
||||
-35
@@ -1,35 +0,0 @@
|
||||
<!--
|
||||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
|
||||
SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
-->
|
||||
# Security Policy
|
||||
|
||||
ISC's Security Vulnerability Disclosure Policy is documented in the
|
||||
relevant [ISC Knowledgebase article][1].
|
||||
|
||||
## Reporting possible security issues
|
||||
|
||||
If you think you may be seeing a potential security vulnerability in
|
||||
BIND (for example, a crash with a REQUIRE, INSIST, or ASSERT failure),
|
||||
please report it immediately by [opening a confidential GitLab issue][2]
|
||||
(preferred) or emailing bind-security@isc.org.
|
||||
|
||||
Please do not discuss undisclosed security vulnerabilities on any public
|
||||
mailing list. ISC has a long history of handling reported
|
||||
vulnerabilities promptly and effectively and we respect and acknowledge
|
||||
responsible reporters.
|
||||
|
||||
If you have a crash, you may want to consult the Knowledgebase article
|
||||
entitled ["What to do if your BIND or DHCP server has crashed"][3].
|
||||
|
||||
[1]: https://kb.isc.org/docs/aa-00861
|
||||
[2]: https://gitlab.isc.org/isc-projects/bind9/-/issues/new?issue[confidential]=true&issuable_template=Bug
|
||||
[3]: https://kb.isc.org/docs/aa-00340
|
||||
@@ -73,7 +73,7 @@
|
||||
#define ERR_IS_MXCNAME 6
|
||||
#define ERR_IS_SRVCNAME 7
|
||||
|
||||
static const char *dbtype[] = { ZONEDB_DEFAULT };
|
||||
static const char *dbtype[] = { "rbt" };
|
||||
|
||||
int debug = 0;
|
||||
const char *journal = NULL;
|
||||
@@ -88,7 +88,6 @@ bool dochecksrv = false;
|
||||
bool docheckns = false;
|
||||
#endif /* if CHECK_LOCAL */
|
||||
dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
|
||||
DNS_ZONEOPT_CHECKDUPRR | DNS_ZONEOPT_CHECKSPF |
|
||||
DNS_ZONEOPT_MANYERRORS | DNS_ZONEOPT_CHECKNAMES |
|
||||
DNS_ZONEOPT_CHECKINTEGRITY |
|
||||
#if CHECK_SIBLING
|
||||
@@ -596,7 +595,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
|
||||
zonename, filename, classname);
|
||||
}
|
||||
|
||||
dns_zone_create(&zone, mctx, 0);
|
||||
CHECK(dns_zone_create(&zone, mctx, 0));
|
||||
|
||||
dns_zone_settype(zone, dns_zone_primary);
|
||||
|
||||
|
||||
@@ -63,7 +63,7 @@ usage(void) {
|
||||
"usage: %s [-achijlvz] [-p [-x]] [-t directory] "
|
||||
"[named.conf]\n",
|
||||
program);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/*% directory callback */
|
||||
@@ -242,9 +242,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
|
||||
* Skip checks when using an alternate data source.
|
||||
*/
|
||||
cfg_map_get(zoptions, "database", &dbobj);
|
||||
if (dbobj != NULL &&
|
||||
strcmp(ZONEDB_DEFAULT, cfg_obj_asstring(dbobj)) != 0)
|
||||
{
|
||||
if (dbobj != NULL && strcmp("rbt", cfg_obj_asstring(dbobj)) != 0) {
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
|
||||
+28
-25
@@ -79,7 +79,7 @@ usage(void) {
|
||||
"%s zonename [ (filename|-) ]\n",
|
||||
prog_name,
|
||||
progmode == progmode_check ? "[-o filename]" : "-o filename");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -147,12 +147,15 @@ main(int argc, char **argv) {
|
||||
UNREACHABLE();
|
||||
}
|
||||
|
||||
/* When compiling, disable checks by default */
|
||||
/* Compilation specific defaults */
|
||||
if (progmode == progmode_compile) {
|
||||
zone_options = 0;
|
||||
docheckmx = false;
|
||||
docheckns = false;
|
||||
dochecksrv = false;
|
||||
zone_options |= (DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_FATALNS |
|
||||
DNS_ZONEOPT_CHECKSPF | DNS_ZONEOPT_CHECKDUPRR |
|
||||
DNS_ZONEOPT_CHECKNAMES |
|
||||
DNS_ZONEOPT_CHECKNAMESFAIL |
|
||||
DNS_ZONEOPT_CHECKWILDCARD);
|
||||
} else {
|
||||
zone_options |= (DNS_ZONEOPT_CHECKDUPRR | DNS_ZONEOPT_CHECKSPF);
|
||||
}
|
||||
|
||||
#define ARGCMP(X) (strcmp(isc_commandline_argument, X) == 0)
|
||||
@@ -206,7 +209,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -i: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -240,7 +243,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -k: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -251,7 +254,7 @@ main(int argc, char **argv) {
|
||||
if (*endp != '\0') {
|
||||
fprintf(stderr, "source serial number "
|
||||
"must be numeric");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -262,7 +265,7 @@ main(int argc, char **argv) {
|
||||
if (*endp != '\0') {
|
||||
fprintf(stderr, "maximum TTL "
|
||||
"must be numeric");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -279,7 +282,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -n: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -296,7 +299,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -m: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -321,7 +324,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -r: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -334,7 +337,7 @@ main(int argc, char **argv) {
|
||||
fprintf(stderr,
|
||||
"unknown or unsupported style: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -344,13 +347,13 @@ main(int argc, char **argv) {
|
||||
fprintf(stderr, "isc_dir_chroot: %s: %s\n",
|
||||
isc_commandline_argument,
|
||||
isc_result_totext(result));
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
case 'v':
|
||||
printf("%s\n", PACKAGE_VERSION);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
|
||||
case 'w':
|
||||
workdir = isc_commandline_argument;
|
||||
@@ -364,7 +367,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -C: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -385,7 +388,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -M: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -402,7 +405,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -S: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -414,7 +417,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -T: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -438,7 +441,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", prog_name,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -447,7 +450,7 @@ main(int argc, char **argv) {
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "isc_dir_chdir: %s: %s\n", workdir,
|
||||
isc_result_totext(result));
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -463,7 +466,7 @@ main(int argc, char **argv) {
|
||||
} else {
|
||||
fprintf(stderr, "unknown file format: %s\n",
|
||||
inputformatstr);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -481,12 +484,12 @@ main(int argc, char **argv) {
|
||||
rawversion > 1U)
|
||||
{
|
||||
fprintf(stderr, "unknown raw format version\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
} else {
|
||||
fprintf(stderr, "unknown file format: %s\n",
|
||||
outputformatstr);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -30,16 +30,10 @@ Description
|
||||
|
||||
:program:`named-compilezone` checks the syntax and integrity of a zone file,
|
||||
and dumps the zone contents to a specified file in a specified format.
|
||||
|
||||
Unlike :program:`named-checkzone`, zone contents are not strictly checked
|
||||
by default. If the output is to be used as an actual zone file to be loaded
|
||||
by :iscman:`named`, then the check levels should be manually configured to
|
||||
be at least as strict as those specified in the :iscman:`named` configuration
|
||||
file.
|
||||
|
||||
Running :program:`named-checkzone` on the input prior to compiling will
|
||||
ensure that the zone compiles with the default requirements of
|
||||
:iscman:`named`.
|
||||
It applies strict check levels by default, since the
|
||||
dump output is used as an actual zone file loaded by :iscman:`named`.
|
||||
When manually specified otherwise, the check levels must at least be as
|
||||
strict as those specified in the :iscman:`named` configuration file.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
@@ -83,13 +77,13 @@ Options
|
||||
|
||||
``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
|
||||
records and ``check-svcb:ignore`` disables these checks. The
|
||||
default is ``check-svcb:ignore``.
|
||||
default is ``check-svcb:fail``.
|
||||
|
||||
.. option:: -i mode
|
||||
|
||||
This option performs post-load zone integrity checks. Possible modes are
|
||||
``full``, ``full-sibling``, ``local``,
|
||||
``local-sibling``, and ``none`` (the default).
|
||||
``full`` (the default), ``full-sibling``, ``local``,
|
||||
``local-sibling``, and ``none``.
|
||||
|
||||
Mode ``full`` checks that MX records refer to A or AAAA records
|
||||
(both in-zone and out-of-zone hostnames). Mode ``local`` only
|
||||
@@ -133,7 +127,7 @@ Options
|
||||
.. option:: -k mode
|
||||
|
||||
This option performs ``check-names`` checks with the specified failure mode.
|
||||
Possible modes are ``fail``, ``warn``, and ``ignore`` (the default).
|
||||
Possible modes are ``fail`` (the default), ``warn``, and ``ignore``.
|
||||
|
||||
.. option:: -l ttl
|
||||
|
||||
@@ -150,19 +144,19 @@ Options
|
||||
.. option:: -m mode
|
||||
|
||||
This option specifies whether MX records should be checked to see if they are
|
||||
addresses. Possible modes are ``fail``, ``warn``, and
|
||||
``ignore`` (the default).
|
||||
addresses. Possible modes are ``fail``, ``warn`` (the default), and
|
||||
``ignore``.
|
||||
|
||||
.. option:: -M mode
|
||||
|
||||
This option checks whether a MX record refers to a CNAME. Possible modes are
|
||||
``fail``, ``warn``, and ``ignore`` (the default).
|
||||
``fail``, ``warn`` (the default), and ``ignore``.
|
||||
|
||||
.. option:: -n mode
|
||||
|
||||
This option specifies whether NS records should be checked to see if they are
|
||||
addresses. Possible modes are ``fail``, ``warn``, and
|
||||
``ignore`` (the default).
|
||||
addresses. Possible modes are ``fail`` (the default), ``warn``, and
|
||||
``ignore``.
|
||||
|
||||
.. option:: -o filename
|
||||
|
||||
@@ -173,7 +167,7 @@ Options
|
||||
|
||||
This option checks for records that are treated as different by DNSSEC but are
|
||||
semantically equal in plain DNS. Possible modes are ``fail``,
|
||||
``warn``, and ``ignore`` (the default).
|
||||
``warn`` (the default), and ``ignore``.
|
||||
|
||||
.. option:: -s style
|
||||
|
||||
@@ -186,7 +180,7 @@ Options
|
||||
.. option:: -S mode
|
||||
|
||||
This option checks whether an SRV record refers to a CNAME. Possible modes are
|
||||
``fail``, ``warn``, and ``ignore`` (the default).
|
||||
``fail``, ``warn`` (the default), and ``ignore``.
|
||||
|
||||
.. option:: -t directory
|
||||
|
||||
@@ -198,7 +192,7 @@ Options
|
||||
|
||||
This option checks whether Sender Policy Framework (SPF) records exist and issues a
|
||||
warning if an SPF-formatted TXT record is not also present. Possible
|
||||
modes are ``warn`` and ``ignore`` (the default).
|
||||
modes are ``warn`` (the default) and ``ignore``.
|
||||
|
||||
.. option:: -w directory
|
||||
|
||||
@@ -216,7 +210,7 @@ Options
|
||||
This option specifies whether to check for non-terminal wildcards. Non-terminal
|
||||
wildcards are almost always the result of a failure to understand the
|
||||
wildcard matching algorithm (:rfc:`4592`). Possible modes are ``warn``
|
||||
and ``ignore`` (the default).
|
||||
(the default) and ``ignore``.
|
||||
|
||||
.. option:: zonename
|
||||
|
||||
|
||||
@@ -124,7 +124,7 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
|
||||
|
||||
DO("generate key",
|
||||
dst_key_generate(dns_rootname, alg, keysize, 0, 0, DNS_KEYPROTO_ANY,
|
||||
dns_rdataclass_in, NULL, mctx, &key, NULL));
|
||||
dns_rdataclass_in, mctx, &key, NULL));
|
||||
|
||||
isc_buffer_init(&key_rawbuffer, &key_rawsecret, sizeof(key_rawsecret));
|
||||
|
||||
|
||||
@@ -146,8 +146,7 @@ main(int argc, char **argv) {
|
||||
keyfile = isc_commandline_argument;
|
||||
break;
|
||||
case 'h':
|
||||
usage(EXIT_SUCCESS);
|
||||
break;
|
||||
usage(0);
|
||||
case 'k':
|
||||
case 'y': /* Compatible with rndc -y. */
|
||||
keyname = isc_commandline_argument;
|
||||
@@ -193,15 +192,15 @@ main(int argc, char **argv) {
|
||||
if (isc_commandline_option != '?') {
|
||||
fprintf(stderr, "%s: invalid argument -%c\n",
|
||||
program, isc_commandline_option);
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
} else {
|
||||
usage(EXIT_SUCCESS);
|
||||
usage(0);
|
||||
}
|
||||
break;
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -210,7 +209,7 @@ main(int argc, char **argv) {
|
||||
POST(argv);
|
||||
|
||||
if (argc > 0) {
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
}
|
||||
|
||||
if (alg == DST_ALG_HMACMD5) {
|
||||
|
||||
+10
-10
@@ -138,13 +138,13 @@ main(int argc, char **argv) {
|
||||
keysize = alg_bits(alg);
|
||||
break;
|
||||
case 'h':
|
||||
usage(EXIT_SUCCESS);
|
||||
usage(0);
|
||||
case 'k':
|
||||
case 'y':
|
||||
if (progmode == progmode_confgen) {
|
||||
keyname = isc_commandline_argument;
|
||||
} else {
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
}
|
||||
break;
|
||||
case 'M':
|
||||
@@ -157,7 +157,7 @@ main(int argc, char **argv) {
|
||||
if (progmode == progmode_confgen) {
|
||||
quiet = true;
|
||||
} else {
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
}
|
||||
break;
|
||||
case 'r':
|
||||
@@ -167,29 +167,29 @@ main(int argc, char **argv) {
|
||||
if (progmode == progmode_confgen) {
|
||||
self_domain = isc_commandline_argument;
|
||||
} else {
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
}
|
||||
break;
|
||||
case 'z':
|
||||
if (progmode == progmode_confgen) {
|
||||
zone = isc_commandline_argument;
|
||||
} else {
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
}
|
||||
break;
|
||||
case '?':
|
||||
if (isc_commandline_option != '?') {
|
||||
fprintf(stderr, "%s: invalid argument -%c\n",
|
||||
program, isc_commandline_option);
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
} else {
|
||||
usage(EXIT_SUCCESS);
|
||||
usage(0);
|
||||
}
|
||||
break;
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -200,11 +200,11 @@ main(int argc, char **argv) {
|
||||
POST(argv);
|
||||
|
||||
if (self_domain != NULL && zone != NULL) {
|
||||
usage(EXIT_FAILURE); /* -s and -z cannot coexist */
|
||||
usage(1); /* -s and -z cannot coexist */
|
||||
}
|
||||
|
||||
if (argc > isc_commandline_index) {
|
||||
usage(EXIT_FAILURE);
|
||||
usage(1);
|
||||
}
|
||||
|
||||
/* Use canonical algorithm name */
|
||||
|
||||
@@ -27,10 +27,9 @@ Synopsis
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
:program:`tsig-keygen` is an utility that generates keys for use with TSIG
|
||||
(Transaction Signatures) as defined in :rfc:`2845`. The resulting keys can be used,
|
||||
for example, to secure dynamic DNS updates to a zone, or for the :iscman:`rndc`
|
||||
command channel.
|
||||
:program:`tsig-keygen` is an utility that generates keys for use in TSIG signing.
|
||||
The resulting keys can be used, for example, to secure dynamic DNS updates
|
||||
to a zone, or for the :iscman:`rndc` command channel.
|
||||
|
||||
A domain name can be specified on the command line to be used as the name
|
||||
of the generated key. If no name is specified, the default is ``tsig-key``.
|
||||
|
||||
+3
-4
@@ -13,16 +13,14 @@
|
||||
|
||||
/*! \file */
|
||||
|
||||
#include "util.h"
|
||||
#include <stdarg.h>
|
||||
#include <stdbool.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include <isc/tls.h>
|
||||
|
||||
#include "util.h"
|
||||
|
||||
extern bool verbose;
|
||||
extern const char *progname;
|
||||
|
||||
@@ -47,5 +45,6 @@ fatal(const char *format, ...) {
|
||||
vfprintf(stderr, format, args);
|
||||
va_end(args);
|
||||
fprintf(stderr, "\n");
|
||||
_exit(EXIT_FAILURE);
|
||||
isc__tls_setfatalmode();
|
||||
exit(1);
|
||||
}
|
||||
|
||||
+28
-31
@@ -247,7 +247,7 @@ usage(void) {
|
||||
"process)\n"
|
||||
" +[no]yaml (Present the results as "
|
||||
"YAML)\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
noreturn static void
|
||||
@@ -263,7 +263,8 @@ fatal(const char *format, ...) {
|
||||
vfprintf(stderr, format, args);
|
||||
va_end(args);
|
||||
fprintf(stderr, "\n");
|
||||
_exit(EXIT_FAILURE);
|
||||
isc__tls_setfatalmode();
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -1162,7 +1163,7 @@ plus_option(char *option) {
|
||||
if (state) {
|
||||
fprintf(stderr, "Invalid option: "
|
||||
"+dlv is obsolete\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
case 'n': /* dnssec */
|
||||
@@ -1377,6 +1378,10 @@ plus_option(char *option) {
|
||||
fprintf(stderr, "Invalid option: +%s\n", option);
|
||||
usage();
|
||||
}
|
||||
|
||||
if (qmin && !fulltrace) {
|
||||
fatal("'+qmin' cannot be used without '+ns'");
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
@@ -1429,7 +1434,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
|
||||
break;
|
||||
case 'h':
|
||||
usage();
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
case 'i':
|
||||
no_sigs = true;
|
||||
root_validation = false;
|
||||
@@ -1439,7 +1444,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
|
||||
break;
|
||||
case 'v':
|
||||
printf("delv %s\n", PACKAGE_VERSION);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
default:
|
||||
UNREACHABLE();
|
||||
}
|
||||
@@ -1576,7 +1581,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
|
||||
typeset = true;
|
||||
} else {
|
||||
fprintf(stderr, "Invalid IP address %s\n", value);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
return (value_from_next);
|
||||
invalid_option:
|
||||
@@ -1725,11 +1730,6 @@ parse_args(int argc, char **argv) {
|
||||
}
|
||||
}
|
||||
|
||||
/* check consistency */
|
||||
if (qmin && !fulltrace) {
|
||||
fatal("'+qmin' cannot be used without '+ns'");
|
||||
}
|
||||
|
||||
/*
|
||||
* If no qname or qtype specified, search for root/NS
|
||||
* If no qtype specified, use A
|
||||
@@ -1927,7 +1927,6 @@ cleanup:
|
||||
static void
|
||||
shutdown_server(void) {
|
||||
if (requestmgr != NULL) {
|
||||
dns_requestmgr_shutdown(requestmgr);
|
||||
dns_requestmgr_detach(&requestmgr);
|
||||
}
|
||||
if (interfacemgr != NULL) {
|
||||
@@ -1959,8 +1958,7 @@ recvresponse(void *arg) {
|
||||
fatal("request event result: %s", isc_result_totext(result));
|
||||
}
|
||||
|
||||
dns_message_create(mctx, NULL, NULL, DNS_MESSAGE_INTENTPARSE,
|
||||
&response);
|
||||
dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &response);
|
||||
|
||||
result = dns_request_getresponse(request, response,
|
||||
DNS_MESSAGEPARSE_PRESERVEORDER);
|
||||
@@ -2075,8 +2073,7 @@ sendquery(void *arg) {
|
||||
/* Construct query message */
|
||||
CHECK(convert_name(&qfn, &query_name, qname));
|
||||
|
||||
dns_message_create(mctx, NULL, NULL, DNS_MESSAGE_INTENTRENDER,
|
||||
&message);
|
||||
dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &message);
|
||||
message->opcode = dns_opcode_query;
|
||||
message->flags = DNS_MESSAGEFLAG_RD | DNS_MESSAGEFLAG_AD;
|
||||
if (cdflag) {
|
||||
@@ -2098,13 +2095,14 @@ sendquery(void *arg) {
|
||||
NULL, 0));
|
||||
CHECK(dns_message_setopt(message, opt));
|
||||
|
||||
CHECK(dns_requestmgr_create(mctx, loopmgr, dispatchmgr, NULL, NULL,
|
||||
CHECK(dns_requestmgr_create(mctx, dispatchmgr, NULL, NULL,
|
||||
&requestmgr));
|
||||
|
||||
dns_view_attach(view, &(dns_view_t *){ NULL });
|
||||
CHECK(dns_request_create(requestmgr, message, NULL, &peer, NULL, NULL,
|
||||
DNS_REQUESTOPT_TCP, NULL, 1, 0, 0, isc_loop(),
|
||||
recvresponse, message, &request));
|
||||
DNS_REQUESTOPT_TCP, NULL, 1, 0, 0,
|
||||
isc_loop_current(loopmgr), recvresponse,
|
||||
message, &request));
|
||||
return;
|
||||
|
||||
cleanup:
|
||||
@@ -2141,16 +2139,15 @@ run_server(void *arg) {
|
||||
RUNTIME_CHECK(inet_pton(AF_INET, "127.0.0.1", &in));
|
||||
isc_sockaddr_fromin(&addr, &in, 0);
|
||||
|
||||
ns_server_create(mctx, matchview, &sctx);
|
||||
CHECK(ns_server_create(mctx, matchview, &sctx));
|
||||
|
||||
CHECK(dns_dispatchmgr_create(mctx, loopmgr, netmgr, &dispatchmgr));
|
||||
CHECK(dns_dispatchmgr_create(mctx, netmgr, &dispatchmgr));
|
||||
isc_sockaddr_any(&any);
|
||||
CHECK(dns_dispatch_createudp(dispatchmgr, &any, &dispatch));
|
||||
CHECK(ns_interfacemgr_create(mctx, sctx, loopmgr, netmgr, dispatchmgr,
|
||||
NULL, false, &interfacemgr));
|
||||
|
||||
CHECK(dns_view_create(mctx, dispatchmgr, dns_rdataclass_in, "_default",
|
||||
&view));
|
||||
CHECK(dns_view_create(mctx, dns_rdataclass_in, "_default", &view));
|
||||
CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", &cache));
|
||||
dns_view_setcache(view, cache, false);
|
||||
dns_cache_detach(&cache);
|
||||
@@ -2163,17 +2160,18 @@ run_server(void *arg) {
|
||||
view->qminimization = qmin;
|
||||
view->qmin_strict = qmin_strict;
|
||||
|
||||
dns_view_initsecroots(view);
|
||||
CHECK(dns_view_initsecroots(view, mctx));
|
||||
CHECK(setup_dnsseckeys(NULL, view));
|
||||
|
||||
CHECK(dns_view_createresolver(view, netmgr, 0, tlsctx_client_cache,
|
||||
dispatch, NULL));
|
||||
dns_view_setdispatchmgr(view, dispatchmgr);
|
||||
CHECK(dns_view_createresolver(view, loopmgr, 1, netmgr, 0,
|
||||
tlsctx_client_cache, dispatch, NULL));
|
||||
|
||||
isc_stats_create(mctx, &resstats, dns_resstatscounter_max);
|
||||
CHECK(isc_stats_create(mctx, &resstats, dns_resstatscounter_max));
|
||||
dns_resolver_setstats(view->resolver, resstats);
|
||||
isc_stats_detach(&resstats);
|
||||
|
||||
dns_rdatatypestats_create(mctx, &resquerystats);
|
||||
CHECK(dns_rdatatypestats_create(mctx, &resquerystats));
|
||||
dns_resolver_setquerystats(view->resolver, resquerystats);
|
||||
dns_stats_detach(&resquerystats);
|
||||
|
||||
@@ -2183,10 +2181,9 @@ run_server(void *arg) {
|
||||
|
||||
CHECK(isc_nm_listenstreamdns(netmgr, ISC_NM_LISTEN_ONE, &addr,
|
||||
ns_client_request, ifp, accept_cb, ifp, 10,
|
||||
NULL, NULL, ISC_NM_PROXY_NONE,
|
||||
&ifp->tcplistensocket));
|
||||
NULL, NULL, &ifp->tcplistensocket));
|
||||
ifp->flags |= NS_INTERFACEFLAG_LISTENING;
|
||||
isc_async_current(sendquery, ifp->tcplistensocket);
|
||||
isc_async_current(loopmgr, sendquery, ifp->tcplistensocket);
|
||||
|
||||
return;
|
||||
|
||||
|
||||
+1
-1
@@ -293,7 +293,7 @@ assign values to options like the timeout interval. They have the form
|
||||
|
||||
This option toggles logging of messages sent. This produces a detailed
|
||||
dump of the queries sent by :program:`delv` in the process of carrying
|
||||
out the resolution and validation process. Turning on this option
|
||||
out the resolution and validation process. Turning on this option
|
||||
also activates ``+mtrace``.
|
||||
|
||||
This is equivalent to setting the debug level to 11 for the "packets"
|
||||
|
||||
+42
-406
@@ -119,7 +119,7 @@ usage(void) {
|
||||
print_usage(stderr);
|
||||
fprintf(stderr, "\nUse \"dig -h\" (or \"dig -h | more\") "
|
||||
"for complete list of options\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
#endif /* if TARGET_OS_IPHONE */
|
||||
|
||||
@@ -225,7 +225,7 @@ help(void) {
|
||||
" +[no]http-plain[=###] (DNS over plain HTTP "
|
||||
"mode) "
|
||||
"[/]\n"
|
||||
" +[no]http-plain-get (Use GET instead of "
|
||||
" +[no]https-plain-get (Use GET instead of "
|
||||
"default POST method while using plain HTTP)\n"
|
||||
" +[no]identify (ID responders in short "
|
||||
"answers)\n"
|
||||
@@ -252,14 +252,6 @@ help(void) {
|
||||
"request)\n"
|
||||
" +padding=### (Set padding block size "
|
||||
"[0])\n"
|
||||
" "
|
||||
"+[no]proxy[=src_addr[#src_port]-dst_addr[#dst_port]] "
|
||||
"(Add PROXYv2 headers to the queries. If addresses are omitted, "
|
||||
"LOCAL PROXYv2 headers are added)\n"
|
||||
" "
|
||||
"+[no]proxy-plain[=src_addr[#src_port]-dst_addr[#dst_port]] "
|
||||
"(The same as '+[no]proxy', but send PROXYv2 headers ahead of "
|
||||
"any encryption if an encrypted transport is used)\n"
|
||||
" +qid=### (Specify the query ID to "
|
||||
"use when sending queries)\n"
|
||||
" +[no]qr (Print question before "
|
||||
@@ -306,7 +298,8 @@ help(void) {
|
||||
" +[no]tls-keyfile=file (Load client TLS "
|
||||
"private key from file)\n"
|
||||
" +[no]trace (Trace delegation down "
|
||||
"from root [implies +dnssec])\n"
|
||||
"from root "
|
||||
"[+dnssec])\n"
|
||||
" +tries=### (Set number of UDP "
|
||||
"attempts) [3]\n"
|
||||
" +[no]ttlid (Control display of ttls "
|
||||
@@ -372,39 +365,6 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
|
||||
}
|
||||
printf(";; SERVER: %s(%s) (%s)\n", fromtext, query->userarg,
|
||||
proto);
|
||||
|
||||
if (query->lookup->proxy_mode) {
|
||||
printf(";; CLIENT PROXY HEADER");
|
||||
|
||||
if ((dig_lookup_is_tls(query->lookup) ||
|
||||
(query->lookup->https_mode &&
|
||||
!query->lookup->http_plain)) &&
|
||||
query->lookup->proxy_plain)
|
||||
{
|
||||
printf(" (plain)");
|
||||
}
|
||||
|
||||
printf(": ");
|
||||
|
||||
if (!query->lookup->proxy_local) {
|
||||
char src_buf[ISC_SOCKADDR_FORMATSIZE] = { 0 };
|
||||
char dst_buf[ISC_SOCKADDR_FORMATSIZE] = { 0 };
|
||||
|
||||
isc_sockaddr_format(
|
||||
&query->lookup->proxy_src_addr, src_buf,
|
||||
sizeof(src_buf));
|
||||
|
||||
isc_sockaddr_format(
|
||||
&query->lookup->proxy_dst_addr, dst_buf,
|
||||
sizeof(dst_buf));
|
||||
printf("source: %s, destination: %s", src_buf,
|
||||
dst_buf);
|
||||
} else {
|
||||
printf("LOCAL");
|
||||
}
|
||||
|
||||
printf("\n");
|
||||
}
|
||||
time(&tnow);
|
||||
(void)localtime_r(&tnow, &tmnow);
|
||||
|
||||
@@ -527,8 +487,7 @@ dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
|
||||
size_t i, count = 10;
|
||||
|
||||
name = dns_fixedname_initname(&fixed);
|
||||
result = dns_name_fromstring(name, "ipv4only.arpa", dns_rootname, 0,
|
||||
NULL);
|
||||
result = dns_name_fromstring(name, "ipv4only.arpa", 0, NULL);
|
||||
check_result(result, "dns_name_fromstring");
|
||||
|
||||
result = dns_message_findname(msg, DNS_SECTION_ANSWER, name,
|
||||
@@ -1092,323 +1051,6 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
|
||||
goto invalid_option; \
|
||||
} while (0)
|
||||
|
||||
/*
|
||||
* Parse source and destination addresses in the same format as used by "kdig":
|
||||
*
|
||||
* SRC_ADDR[#SRC_PORT]-DST_ADDR[#DST_PORT]
|
||||
*
|
||||
* This can be described (pretty closely for our purpose) using the
|
||||
* following EBNF grammar:
|
||||
*
|
||||
* S = proxy-addrs. (* start rule *)
|
||||
* proxy-addrs = addr "-" addr EOF.
|
||||
* addr = addr-char { addr-char } ["#" port ].
|
||||
* port = digit { digit }.
|
||||
* addr-char = <aby but "#", "-", EOF >.
|
||||
* EOF = '\0'.
|
||||
*/
|
||||
#define MATCH(ch) (st->str[0] == (ch))
|
||||
#define MATCH_DIGIT() isdigit((unsigned char)(st->str[0]))
|
||||
#define ADVANCE() st->str++
|
||||
#define GETP() (st->str)
|
||||
|
||||
typedef struct isc_proxy_addrs_parser_state {
|
||||
const char *str;
|
||||
|
||||
const char *last_addr_start;
|
||||
size_t last_addr_len;
|
||||
|
||||
const char *last_port_start;
|
||||
size_t last_port_len;
|
||||
|
||||
const char *src_addr_start;
|
||||
size_t src_addr_len;
|
||||
|
||||
const char *src_port_start;
|
||||
size_t src_port_len;
|
||||
|
||||
const char *dst_addr_start;
|
||||
size_t dst_addr_len;
|
||||
|
||||
const char *dst_port_start;
|
||||
size_t dst_port_len;
|
||||
} isc_proxy_addrs_parser_state_t;
|
||||
|
||||
static bool
|
||||
rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st);
|
||||
|
||||
static bool
|
||||
rule_addr(isc_proxy_addrs_parser_state_t *st);
|
||||
|
||||
static bool
|
||||
rule_port(isc_proxy_addrs_parser_state_t *st);
|
||||
|
||||
static bool
|
||||
rule_addr_char(isc_proxy_addrs_parser_state_t *st);
|
||||
|
||||
static void
|
||||
proxy_handle_port_string(const char *port_start, const size_t port_len,
|
||||
in_port_t *pport) {
|
||||
char buf[512] = { 0 }; /* max */
|
||||
size_t string_size = 0, max_string_bytes = 0;
|
||||
unsigned int tmp;
|
||||
isc_result_t result;
|
||||
|
||||
string_size = port_len + 1;
|
||||
max_string_bytes = string_size > sizeof(buf) ? sizeof(buf)
|
||||
: string_size;
|
||||
|
||||
(void)strlcpy(buf, port_start, max_string_bytes);
|
||||
result = parse_uint(&tmp, buf, MAXPORT, "port number");
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("Couldn't parse port number");
|
||||
}
|
||||
*pport = tmp;
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
proxy_handle_addr_string(const char *addr_start, const size_t addr_len,
|
||||
const in_port_t addr_port, isc_sockaddr_t *addr) {
|
||||
isc_result_t result = ISC_R_FAILURE;
|
||||
char buf[512] = { 0 }; /* max */
|
||||
size_t string_size = 0, max_string_bytes = 0;
|
||||
struct in_addr ipv4 = { 0 };
|
||||
struct in6_addr ipv6 = { 0 };
|
||||
int ret = 0;
|
||||
|
||||
string_size = addr_len + 1;
|
||||
max_string_bytes = string_size > sizeof(buf) ? sizeof(buf)
|
||||
: string_size;
|
||||
|
||||
(void)strlcpy(buf, addr_start, max_string_bytes);
|
||||
|
||||
ret = inet_pton(AF_INET, buf, &ipv4);
|
||||
if (ret == 1) {
|
||||
isc_sockaddr_fromin(addr, &ipv4, addr_port);
|
||||
result = ISC_R_SUCCESS;
|
||||
} else {
|
||||
ret = inet_pton(AF_INET6, buf, &ipv6);
|
||||
if (ret == 1) {
|
||||
isc_sockaddr_fromin6(addr, &ipv6, addr_port);
|
||||
result = ISC_R_SUCCESS;
|
||||
}
|
||||
}
|
||||
|
||||
return (result);
|
||||
}
|
||||
|
||||
static bool
|
||||
parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
|
||||
isc_sockaddr_t *pdst) {
|
||||
isc_result_t result = ISC_R_FAILURE;
|
||||
isc_sockaddr_t src = { 0 }, dst = { 0 };
|
||||
isc_proxy_addrs_parser_state_t st = { 0 };
|
||||
in_port_t src_port = 0, dst_port = 53; /* Follow kdig footsteps */
|
||||
|
||||
REQUIRE(addrs != NULL && *addrs != '\0');
|
||||
REQUIRE(psrc != NULL);
|
||||
REQUIRE(pdst != NULL);
|
||||
|
||||
st.str = addrs;
|
||||
|
||||
/* start syntax analysis and verification */
|
||||
if (!rule_proxy_addrs(&st)) {
|
||||
warn("PROXY source and destination addresses cannot be parsed");
|
||||
return (false);
|
||||
}
|
||||
|
||||
/* get port numeric values */
|
||||
if (st.src_port_len > 0) {
|
||||
INSIST(st.src_port_start != NULL);
|
||||
proxy_handle_port_string(st.src_port_start, st.src_port_len,
|
||||
&src_port);
|
||||
}
|
||||
|
||||
if (st.dst_port_len > 0) {
|
||||
INSIST(st.dst_port_start != NULL);
|
||||
proxy_handle_port_string(st.dst_port_start, st.dst_port_len,
|
||||
&dst_port);
|
||||
}
|
||||
|
||||
/* get addresses */
|
||||
INSIST(st.src_addr_len > 0);
|
||||
INSIST(st.src_addr_start != NULL);
|
||||
INSIST(st.dst_addr_len > 0);
|
||||
INSIST(st.dst_addr_start != NULL);
|
||||
|
||||
result = proxy_handle_addr_string(st.src_addr_start, st.src_addr_len,
|
||||
src_port, &src);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
warn("Cannot get PROXY source address: %s",
|
||||
isc_result_totext(result));
|
||||
return (false);
|
||||
}
|
||||
|
||||
result = proxy_handle_addr_string(st.dst_addr_start, st.dst_addr_len,
|
||||
dst_port, &dst);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
warn("Cannot get PROXY destination address: %s",
|
||||
isc_result_totext(result));
|
||||
return (false);
|
||||
}
|
||||
|
||||
/* addresses should be of the same type */
|
||||
if (isc_sockaddr_pf(&src) != isc_sockaddr_pf(&dst)) {
|
||||
warn("PROXY source and destination addresses must be of the "
|
||||
"same type");
|
||||
return (false);
|
||||
}
|
||||
|
||||
*psrc = src;
|
||||
*pdst = dst;
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
static bool
|
||||
rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
|
||||
if (!rule_addr(st)) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
st->src_addr_start = st->last_addr_start;
|
||||
st->src_addr_len = st->last_addr_len;
|
||||
st->src_port_start = st->last_port_start;
|
||||
st->src_port_len = st->last_port_len;
|
||||
|
||||
if (!MATCH('-')) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
ADVANCE();
|
||||
|
||||
if (!rule_addr(st)) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
st->dst_addr_start = st->last_addr_start;
|
||||
st->dst_addr_len = st->last_addr_len;
|
||||
st->dst_port_start = st->last_port_start;
|
||||
st->dst_port_len = st->last_port_len;
|
||||
|
||||
if (!MATCH('\0')) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
static bool
|
||||
rule_addr(isc_proxy_addrs_parser_state_t *st) {
|
||||
const char *start = GETP();
|
||||
if (!rule_addr_char(st)) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
while (rule_addr_char(st)) {
|
||||
/* skip */
|
||||
}
|
||||
|
||||
st->last_addr_start = start;
|
||||
st->last_addr_len = GETP() - start;
|
||||
|
||||
if (MATCH('#')) {
|
||||
ADVANCE();
|
||||
|
||||
if (!rule_port(st)) {
|
||||
return (false);
|
||||
}
|
||||
}
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
static bool
|
||||
rule_port(isc_proxy_addrs_parser_state_t *st) {
|
||||
const char *start = GETP();
|
||||
if (!MATCH_DIGIT()) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
ADVANCE();
|
||||
|
||||
while (MATCH_DIGIT()) {
|
||||
ADVANCE();
|
||||
}
|
||||
|
||||
st->last_port_start = start;
|
||||
st->last_port_len = GETP() - start;
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
static bool
|
||||
rule_addr_char(isc_proxy_addrs_parser_state_t *st) {
|
||||
if (MATCH('#') || MATCH('-') || MATCH('\0')) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
ADVANCE();
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
#undef GETP
|
||||
#undef ADVANCE
|
||||
#undef MATCH_DIGIT
|
||||
#undef MATCH
|
||||
|
||||
static bool
|
||||
plus_proxy_handle_addresses(const char *value, const bool state,
|
||||
dig_lookup_t *lookup) {
|
||||
lookup->proxy_mode = state;
|
||||
if (!state) {
|
||||
/*
|
||||
* We are not interested in the option value in that
|
||||
* case
|
||||
*/
|
||||
return (true);
|
||||
}
|
||||
|
||||
if (value == NULL || *value == '\0') {
|
||||
lookup->proxy_local = true;
|
||||
return (true);
|
||||
}
|
||||
|
||||
if (!parse_proxy_addresses(value, &lookup->proxy_src_addr,
|
||||
&lookup->proxy_dst_addr))
|
||||
{
|
||||
return (false);
|
||||
}
|
||||
return (true);
|
||||
}
|
||||
|
||||
static bool
|
||||
plus_proxy_options(const char *cmd, const char *value, const bool state,
|
||||
dig_lookup_t *lookup) {
|
||||
switch (cmd[5]) {
|
||||
case '-':
|
||||
FULLCHECK("proxy-plain");
|
||||
lookup->proxy_plain = state;
|
||||
if (!plus_proxy_handle_addresses(value, state, lookup)) {
|
||||
goto invalid_option;
|
||||
}
|
||||
break;
|
||||
case '\0':
|
||||
FULLCHECK("proxy");
|
||||
if (!plus_proxy_handle_addresses(value, state, lookup)) {
|
||||
goto invalid_option;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
return (true);
|
||||
|
||||
invalid_option:
|
||||
return (false);
|
||||
}
|
||||
|
||||
static bool
|
||||
plus_tls_options(const char *cmd, const char *value, const bool state,
|
||||
dig_lookup_t *lookup) {
|
||||
@@ -1675,8 +1317,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
switch (cmd[1]) {
|
||||
case 'e': /* defname */
|
||||
FULLCHECK("defname");
|
||||
fprintf(stderr, ";; +[no]defname option is "
|
||||
"deprecated; use +[no]search\n");
|
||||
if (!lookup->trace) {
|
||||
usesearch = state;
|
||||
}
|
||||
@@ -1797,10 +1437,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
"ednsflags");
|
||||
goto exit_or_usage;
|
||||
}
|
||||
if (lookup->edns == -1) {
|
||||
lookup->edns =
|
||||
DEFAULT_EDNS_VERSION;
|
||||
}
|
||||
lookup->ednsflags = num;
|
||||
break;
|
||||
case 'n':
|
||||
@@ -2055,11 +1691,12 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
goto invalid_option;
|
||||
}
|
||||
break;
|
||||
case 'm':
|
||||
case 'm': /* multiline */
|
||||
switch (cmd[1]) {
|
||||
case 'a':
|
||||
FULLCHECK("mapped");
|
||||
fatal("+mapped option no longer supported");
|
||||
fprintf(stderr, ";; +mapped option is deprecated");
|
||||
break;
|
||||
case 'u':
|
||||
FULLCHECK("multiline");
|
||||
lookup->multiline = state;
|
||||
@@ -2159,30 +1796,19 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
}
|
||||
break;
|
||||
case 'p':
|
||||
switch (cmd[1]) {
|
||||
case 'a':
|
||||
FULLCHECK("padding");
|
||||
if (state && lookup->edns == -1) {
|
||||
lookup->edns = DEFAULT_EDNS_VERSION;
|
||||
}
|
||||
if (value == NULL) {
|
||||
goto need_value;
|
||||
}
|
||||
result = parse_uint(&num, value, 512, "padding");
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
warn("Couldn't parse padding");
|
||||
goto exit_or_usage;
|
||||
}
|
||||
lookup->padding = (uint16_t)num;
|
||||
break;
|
||||
case 'r':
|
||||
if (!plus_proxy_options(cmd, value, state, lookup)) {
|
||||
goto invalid_option;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
FULLCHECK("padding");
|
||||
if (state && lookup->edns == -1) {
|
||||
lookup->edns = DEFAULT_EDNS_VERSION;
|
||||
}
|
||||
if (value == NULL) {
|
||||
goto need_value;
|
||||
}
|
||||
result = parse_uint(&num, value, 512, "padding");
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
warn("Couldn't parse padding");
|
||||
goto exit_or_usage;
|
||||
}
|
||||
lookup->padding = (uint16_t)num;
|
||||
break;
|
||||
case 'q':
|
||||
switch (cmd[1]) {
|
||||
@@ -2313,7 +1939,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
break;
|
||||
case 'i': /* sigchase */
|
||||
FULLCHECK("sigchase");
|
||||
fatal("+sigchase option no longer supported");
|
||||
fprintf(stderr, ";; +sigchase option is deprecated");
|
||||
break;
|
||||
case 'p': /* split */
|
||||
FULLCHECK("split");
|
||||
if (value != NULL && !state) {
|
||||
@@ -2437,7 +2064,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
break;
|
||||
case 'o':
|
||||
FULLCHECK("topdown");
|
||||
fatal("+topdown option no longer supported");
|
||||
fprintf(stderr, ";; +topdown option is deprecated");
|
||||
break;
|
||||
case 'r':
|
||||
switch (cmd[2]) {
|
||||
case 'a': /* trace */
|
||||
@@ -2478,8 +2106,9 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
break;
|
||||
case 'u': /* trusted-key */
|
||||
FULLCHECK("trusted-key");
|
||||
fatal("+trusted-key option "
|
||||
"no longer supported");
|
||||
fprintf(stderr, ";; +trusted-key option is "
|
||||
"deprecated");
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
@@ -2516,8 +2145,9 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
switch (cmd[2]) {
|
||||
case 'e':
|
||||
FULLCHECK("unexpected");
|
||||
fatal("+unexpected option "
|
||||
"no longer supported");
|
||||
fprintf(stderr, ";; +unexpected option "
|
||||
"is deprecated");
|
||||
break;
|
||||
case 'k':
|
||||
FULLCHECK("unknownformat");
|
||||
lookup->print_unknown_format = state;
|
||||
@@ -2525,7 +2155,11 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
goto invalid_option;
|
||||
}
|
||||
|
||||
break;
|
||||
case 'v':
|
||||
FULLCHECK("vc");
|
||||
@@ -2628,15 +2262,17 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
|
||||
break;
|
||||
case 'h':
|
||||
help();
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
break;
|
||||
case 'i':
|
||||
fatal("-%c removed", option[0]);
|
||||
/* deprecated */
|
||||
break;
|
||||
case 'm': /* memdebug */
|
||||
/* memdebug is handled in preparse_args() */
|
||||
break;
|
||||
case 'n':
|
||||
fatal("-%c removed", option[0]);
|
||||
/* deprecated */
|
||||
break;
|
||||
case 'r':
|
||||
debug("digrc (late)");
|
||||
digrc = false;
|
||||
@@ -2646,7 +2282,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
|
||||
break;
|
||||
case 'v':
|
||||
printf("DiG %s\n", PACKAGE_VERSION);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
break;
|
||||
}
|
||||
if (strlen(option) > 1U) {
|
||||
@@ -2821,7 +2457,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
|
||||
ptr = ptr2;
|
||||
ptr2 = ptr3;
|
||||
} else {
|
||||
hmac_alg = DST_ALG_HMACMD5;
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
digestbits = 0;
|
||||
}
|
||||
/* XXXONDREJ: FIXME */
|
||||
@@ -2855,7 +2491,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
|
||||
ISC_LIST_APPEND(lookup_list, *lookup, link);
|
||||
} else {
|
||||
fprintf(stderr, "Invalid IP address %s\n", value);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
return (value_from_next);
|
||||
invalid_option:
|
||||
|
||||
+23
-49
@@ -507,44 +507,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
|
||||
mandatory. Responses to padded queries may also be padded, but only
|
||||
if the query uses TCP or DNS COOKIE.
|
||||
|
||||
.. option:: +proxy[=src_addr[#src_port]-dst_addr[#dst_port]], +noproxy
|
||||
|
||||
When this option is set, :program:`dig` adds PROXYv2 headers to the
|
||||
queries. When source and destination addresses are specified, the
|
||||
headers contain them and use the ``PROXY`` command. It means for
|
||||
the remote peer that the queries were sent on behalf of another
|
||||
node and that the PROXYv2 header reflects the original connection
|
||||
endpoints. The default source port is ``0`` and destination port is
|
||||
`53`.
|
||||
|
||||
For encrypted DNS transports, to prevent accidental information
|
||||
leakage, encryption is applied to the PROXYv2 headers: the headers
|
||||
are sent right after the handshake process has been completed.
|
||||
|
||||
For plain DNS transports, no encryption is applied to the PROXYv2
|
||||
headers.
|
||||
|
||||
If the addressees are omitted, PROXYv2 headers, that use the
|
||||
``LOCAL`` command set, are added instead. For the remote peer, that
|
||||
means that the queries were sent on purpose without being relayed,
|
||||
so the real connection endpoint addresses must be used.
|
||||
|
||||
.. option:: +proxy-plain[=src_addr[#src_port]-dst_addr[#dst_port], +noproxy-plain
|
||||
|
||||
The same as ``+[no]proxy``, but instructs ``dig`` to send PROXYv2
|
||||
headers ahead of any encryption, before any handshake messages are
|
||||
sent. That makes :program:`dig` behave exactly how it is described
|
||||
in the PROXY protocol specification, but not all software expects
|
||||
such behaviour.
|
||||
|
||||
Please consult the software documentation to find out if you need
|
||||
this option. (for example, ``dnsdist`` expects encrypted PROXYv2
|
||||
headers sent over TLS when encryption is used, while ``HAProxy``
|
||||
and many other software packages expect plain ones).
|
||||
|
||||
For plain DNS transports the option is effectively an alias for the
|
||||
``+[no]proxy`` described above.
|
||||
|
||||
.. option:: +qid=value
|
||||
|
||||
This option specifies the query ID to use when sending queries.
|
||||
@@ -614,6 +576,11 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
|
||||
|
||||
This option performs [or does not perform] a search showing intermediate results.
|
||||
|
||||
.. option:: +sigchase, +nosigchase
|
||||
|
||||
This feature is now obsolete and has been removed; use :iscman:`delv`
|
||||
instead.
|
||||
|
||||
.. option:: +split=W
|
||||
|
||||
This option splits long hex- or base64-formatted fields in resource records into
|
||||
@@ -683,23 +650,25 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
|
||||
server TLS certificate verification. Otherwise, the DNS server name
|
||||
is used. This option has no effect if :option:`+tls-ca` is not specified.
|
||||
|
||||
.. option:: +topdown, +notopdown
|
||||
|
||||
This feature is related to :option:`dig +sigchase`, which is obsolete and
|
||||
has been removed. Use :iscman:`delv` instead.
|
||||
|
||||
.. option:: +trace, +notrace
|
||||
|
||||
This option toggles tracing of the delegation path from the root name
|
||||
servers for the name being looked up. Tracing is disabled by default.
|
||||
When tracing is enabled, :program:`dig` makes iterative queries to
|
||||
resolve the name being looked up. It follows referrals from the root
|
||||
servers, showing the answer from each server that was used to resolve
|
||||
the lookup.
|
||||
This option toggles tracing of the delegation path from the root name servers for
|
||||
the name being looked up. Tracing is disabled by default. When
|
||||
tracing is enabled, :program:`dig` makes iterative queries to resolve the
|
||||
name being looked up. It follows referrals from the root servers,
|
||||
showing the answer from each server that was used to resolve the
|
||||
lookup.
|
||||
|
||||
If ``@server`` is also specified, it affects only the initial query for
|
||||
the root zone name servers.
|
||||
|
||||
:option:`+dnssec` is set when :option:`+trace` is set, to better
|
||||
emulate the default queries from a name server.
|
||||
|
||||
Note that the ``delv +ns`` option can also be used for tracing the
|
||||
resolution of a name from the root (see :iscman:`delv`).
|
||||
:option:`+dnssec` is also set when :option:`+trace` is set, to better emulate the
|
||||
default queries from a name server.
|
||||
|
||||
.. option:: +tries=T
|
||||
|
||||
@@ -707,6 +676,11 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
|
||||
instead of the default, 3. If ``T`` is less than or equal to zero,
|
||||
the number of tries is silently rounded up to 1.
|
||||
|
||||
.. option:: +trusted-key=####
|
||||
|
||||
This option formerly specified trusted keys for use with :option:`dig +sigchase`. This
|
||||
feature is now obsolete and has been removed; use :iscman:`delv` instead.
|
||||
|
||||
.. option:: +ttlid, +nottlid
|
||||
|
||||
This option displays [or does not display] the TTL when printing the record.
|
||||
|
||||
+68
-111
@@ -138,7 +138,7 @@ char keyfile[MXNAME] = "";
|
||||
char keysecret[MXNAME] = "";
|
||||
unsigned char cookie_secret[33];
|
||||
unsigned char cookie[8];
|
||||
dst_algorithm_t hmac_alg = DST_ALG_UNKNOWN;
|
||||
const dns_name_t *hmacname = NULL;
|
||||
unsigned int digestbits = 0;
|
||||
isc_buffer_t *namebuf = NULL;
|
||||
dns_tsigkey_t *tsigkey = NULL;
|
||||
@@ -359,6 +359,8 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
|
||||
}
|
||||
}
|
||||
|
||||
void (*dighost_pre_exit_hook)(void) = NULL;
|
||||
|
||||
#if TARGET_OS_IPHONE
|
||||
void
|
||||
warn(const char *format, ...) {
|
||||
@@ -391,7 +393,10 @@ digexit(void) {
|
||||
exitcode = 10;
|
||||
}
|
||||
if (fatalexit != 0) {
|
||||
_exit(fatalexit);
|
||||
exitcode = fatalexit;
|
||||
}
|
||||
if (dighost_pre_exit_hook != NULL) {
|
||||
dighost_pre_exit_hook();
|
||||
}
|
||||
exit(exitcode);
|
||||
}
|
||||
@@ -406,11 +411,7 @@ fatal(const char *format, ...) {
|
||||
vfprintf(stderr, format, args);
|
||||
va_end(args);
|
||||
fprintf(stderr, "\n");
|
||||
if (fatalexit == 0 && exitcode != 0) {
|
||||
fatalexit = exitcode;
|
||||
} else if (fatalexit == 0) {
|
||||
fatalexit = EXIT_FAILURE;
|
||||
}
|
||||
isc__tls_setfatalmode();
|
||||
digexit();
|
||||
}
|
||||
|
||||
@@ -793,11 +794,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
|
||||
looknew->rrcomments = lookold->rrcomments;
|
||||
looknew->fuzzing = lookold->fuzzing;
|
||||
looknew->fuzztime = lookold->fuzztime;
|
||||
looknew->proxy_mode = lookold->proxy_mode;
|
||||
looknew->proxy_plain = lookold->proxy_plain;
|
||||
looknew->proxy_local = lookold->proxy_local;
|
||||
looknew->proxy_src_addr = lookold->proxy_src_addr;
|
||||
looknew->proxy_dst_addr = lookold->proxy_dst_addr;
|
||||
|
||||
if (lookold->ecs_addr != NULL) {
|
||||
looknew->ecs_addr = isc_mem_get(mctx,
|
||||
@@ -878,7 +874,7 @@ setup_text_key(void) {
|
||||
|
||||
secretsize = isc_buffer_usedlength(&secretbuf);
|
||||
|
||||
if (hmac_alg == DST_ALG_UNKNOWN) {
|
||||
if (hmacname == NULL) {
|
||||
result = DST_R_UNSUPPORTEDALG;
|
||||
goto failure;
|
||||
}
|
||||
@@ -888,8 +884,9 @@ setup_text_key(void) {
|
||||
goto failure;
|
||||
}
|
||||
|
||||
result = dns_tsigkey_create(&keyname, hmac_alg, secretstore,
|
||||
(int)secretsize, mctx, &tsigkey);
|
||||
result = dns_tsigkey_create(&keyname, hmacname, secretstore,
|
||||
(int)secretsize, false, false, NULL, 0, 0,
|
||||
mctx, NULL, &tsigkey);
|
||||
failure:
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
printf(";; Couldn't create key %s: %s\n", keynametext,
|
||||
@@ -1025,50 +1022,50 @@ done:
|
||||
* Parse HMAC algorithm specification
|
||||
*/
|
||||
void
|
||||
parse_hmac(const char *algname) {
|
||||
parse_hmac(const char *hmac) {
|
||||
char buf[20];
|
||||
size_t len;
|
||||
|
||||
REQUIRE(algname != NULL);
|
||||
REQUIRE(hmac != NULL);
|
||||
|
||||
len = strlen(algname);
|
||||
len = strlen(hmac);
|
||||
if (len >= sizeof(buf)) {
|
||||
fatal("unknown key type '%.*s'", (int)len, algname);
|
||||
fatal("unknown key type '%.*s'", (int)len, hmac);
|
||||
}
|
||||
strlcpy(buf, algname, sizeof(buf));
|
||||
strlcpy(buf, hmac, sizeof(buf));
|
||||
|
||||
digestbits = 0;
|
||||
|
||||
if (strcasecmp(buf, "hmac-md5") == 0) {
|
||||
hmac_alg = DST_ALG_HMACMD5;
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
|
||||
hmac_alg = DST_ALG_HMACMD5;
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
digestbits = parse_bits(&buf[9], "digest-bits [0..128]", 128);
|
||||
} else if (strcasecmp(buf, "hmac-sha1") == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA1;
|
||||
hmacname = DNS_TSIG_HMACSHA1_NAME;
|
||||
digestbits = 0;
|
||||
} else if (strncasecmp(buf, "hmac-sha1-", 10) == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA1;
|
||||
hmacname = DNS_TSIG_HMACSHA1_NAME;
|
||||
digestbits = parse_bits(&buf[10], "digest-bits [0..160]", 160);
|
||||
} else if (strcasecmp(buf, "hmac-sha224") == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA224;
|
||||
hmacname = DNS_TSIG_HMACSHA224_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha224-", 12) == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA224;
|
||||
hmacname = DNS_TSIG_HMACSHA224_NAME;
|
||||
digestbits = parse_bits(&buf[12], "digest-bits [0..224]", 224);
|
||||
} else if (strcasecmp(buf, "hmac-sha256") == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA256;
|
||||
hmacname = DNS_TSIG_HMACSHA256_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha256-", 12) == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA256;
|
||||
hmacname = DNS_TSIG_HMACSHA256_NAME;
|
||||
digestbits = parse_bits(&buf[12], "digest-bits [0..256]", 256);
|
||||
} else if (strcasecmp(buf, "hmac-sha384") == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA384;
|
||||
hmacname = DNS_TSIG_HMACSHA384_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha384-", 12) == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA384;
|
||||
hmacname = DNS_TSIG_HMACSHA384_NAME;
|
||||
digestbits = parse_bits(&buf[12], "digest-bits [0..384]", 384);
|
||||
} else if (strcasecmp(buf, "hmac-sha512") == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA512;
|
||||
hmacname = DNS_TSIG_HMACSHA512_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha512-", 12) == 0) {
|
||||
hmac_alg = DST_ALG_HMACSHA512;
|
||||
hmacname = DNS_TSIG_HMACSHA512_NAME;
|
||||
digestbits = parse_bits(&buf[12], "digest-bits [0..512]", 512);
|
||||
} else {
|
||||
fprintf(stderr,
|
||||
@@ -1169,29 +1166,38 @@ setup_file_key(void) {
|
||||
|
||||
switch (dst_key_alg(dstkey)) {
|
||||
case DST_ALG_HMACMD5:
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA1:
|
||||
hmacname = DNS_TSIG_HMACSHA1_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA224:
|
||||
hmacname = DNS_TSIG_HMACSHA224_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA256:
|
||||
hmacname = DNS_TSIG_HMACSHA256_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA384:
|
||||
hmacname = DNS_TSIG_HMACSHA384_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA512:
|
||||
hmac_alg = dst_key_alg(dstkey);
|
||||
hmacname = DNS_TSIG_HMACSHA512_NAME;
|
||||
break;
|
||||
default:
|
||||
dst_key_attach(dstkey, &sig0key);
|
||||
dst_key_free(&dstkey);
|
||||
return;
|
||||
}
|
||||
|
||||
if (dstkey != NULL) {
|
||||
if (hmacname != NULL) {
|
||||
result = dns_tsigkey_createfromkey(
|
||||
dst_key_name(dstkey), hmac_alg, dstkey, false, false,
|
||||
NULL, 0, 0, mctx, &tsigkey);
|
||||
dst_key_name(dstkey), hmacname, dstkey, false, false,
|
||||
NULL, 0, 0, mctx, NULL, &tsigkey);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
printf(";; Couldn't create key %s: %s\n", keynametext,
|
||||
isc_result_totext(result));
|
||||
goto failure;
|
||||
}
|
||||
} else {
|
||||
dst_key_attach(dstkey, &sig0key);
|
||||
dst_key_free(&dstkey);
|
||||
}
|
||||
|
||||
failure:
|
||||
if (dstkey != NULL) {
|
||||
dst_key_free(&dstkey);
|
||||
@@ -1387,7 +1393,6 @@ typedef struct dig_ednsoptname {
|
||||
|
||||
dig_ednsoptname_t optnames[] = {
|
||||
{ 1, "LLQ" }, /* draft-sekar-dns-llq */
|
||||
{ 2, "UL" }, /* draft-ietf-dnssd-update-lease */
|
||||
{ 3, "NSID" }, /* RFC 5001 */
|
||||
{ 5, "DAU" }, /* RFC 6975 */
|
||||
{ 6, "DHU" }, /* RFC 6975 */
|
||||
@@ -2034,7 +2039,7 @@ next_origin(dig_lookup_t *oldlookup) {
|
||||
* Check for a absolute name or ndots being met.
|
||||
*/
|
||||
name = dns_fixedname_initname(&fixed);
|
||||
result = dns_name_fromstring(name, oldlookup->textname, NULL, 0, NULL);
|
||||
result = dns_name_fromstring2(name, oldlookup->textname, NULL, 0, NULL);
|
||||
if (result == ISC_R_SUCCESS &&
|
||||
(dns_name_isabsolute(name) ||
|
||||
(int)dns_name_countlabels(name) > ndots))
|
||||
@@ -2197,8 +2202,7 @@ setup_lookup(dig_lookup_t *lookup) {
|
||||
|
||||
debug("setup_lookup(%p)", lookup);
|
||||
|
||||
dns_message_create(mctx, NULL, NULL, DNS_MESSAGE_INTENTRENDER,
|
||||
&lookup->sendmsg);
|
||||
dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &lookup->sendmsg);
|
||||
|
||||
if (lookup->new_search) {
|
||||
debug("resetting lookup counter.");
|
||||
@@ -2926,9 +2930,6 @@ start_tcp(dig_query_t *query) {
|
||||
bool tls_mode = false;
|
||||
isc_tlsctx_client_session_cache_t *sess_cache = NULL;
|
||||
int local_timeout;
|
||||
isc_nm_proxy_type_t proxy_type = ISC_NM_PROXY_NONE;
|
||||
isc_nm_proxyheader_info_t proxy_info = { 0 };
|
||||
isc_nm_proxyheader_info_t *ppi = NULL;
|
||||
|
||||
REQUIRE(DIG_VALID_QUERY(query));
|
||||
|
||||
@@ -3020,22 +3021,6 @@ start_tcp(dig_query_t *query) {
|
||||
}
|
||||
}
|
||||
|
||||
if (query->lookup->proxy_mode) {
|
||||
proxy_type = ISC_NM_PROXY_PLAIN;
|
||||
if ((tls_mode || (query->lookup->https_mode &&
|
||||
!query->lookup->http_plain)) &&
|
||||
!query->lookup->proxy_plain)
|
||||
{
|
||||
proxy_type = ISC_NM_PROXY_ENCRYPTED;
|
||||
}
|
||||
if (!query->lookup->proxy_local) {
|
||||
isc_nm_proxyheader_info_init(
|
||||
&proxy_info, &query->lookup->proxy_src_addr,
|
||||
&query->lookup->proxy_dst_addr, NULL);
|
||||
ppi = &proxy_info;
|
||||
}
|
||||
}
|
||||
|
||||
REQUIRE(query != NULL);
|
||||
|
||||
query_attach(query, &connectquery);
|
||||
@@ -3048,8 +3033,7 @@ start_tcp(dig_query_t *query) {
|
||||
}
|
||||
isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
|
||||
tcp_connected, connectquery,
|
||||
local_timeout, tlsctx, sess_cache,
|
||||
proxy_type, ppi);
|
||||
local_timeout, tlsctx, sess_cache);
|
||||
#if HAVE_LIBNGHTTP2
|
||||
} else if (query->lookup->https_mode) {
|
||||
char uri[4096] = { 0 };
|
||||
@@ -3069,13 +3053,12 @@ start_tcp(dig_query_t *query) {
|
||||
isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr, uri,
|
||||
!query->lookup->https_get, tcp_connected,
|
||||
connectquery, tlsctx, sess_cache,
|
||||
local_timeout, proxy_type, ppi);
|
||||
local_timeout);
|
||||
#endif
|
||||
} else {
|
||||
isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
|
||||
tcp_connected, connectquery,
|
||||
local_timeout, NULL, NULL, proxy_type,
|
||||
ppi);
|
||||
local_timeout, NULL, NULL);
|
||||
}
|
||||
|
||||
return;
|
||||
@@ -3231,7 +3214,6 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
|
||||
start_udp(next);
|
||||
check_if_done();
|
||||
} else {
|
||||
dighost_error("no servers could be reached\n");
|
||||
clear_current_lookup();
|
||||
}
|
||||
|
||||
@@ -3325,24 +3307,9 @@ start_udp(dig_query_t *query) {
|
||||
}
|
||||
|
||||
query_attach(query, &connectquery);
|
||||
if (query->lookup->proxy_mode) {
|
||||
isc_nm_proxyheader_info_t proxy_info = { 0 };
|
||||
isc_nm_proxyheader_info_t *ppi = NULL;
|
||||
if (!query->lookup->proxy_local) {
|
||||
isc_nm_proxyheader_info_init(
|
||||
&proxy_info, &query->lookup->proxy_src_addr,
|
||||
&query->lookup->proxy_dst_addr, NULL);
|
||||
ppi = &proxy_info;
|
||||
}
|
||||
isc_nm_proxyudpconnect(netmgr, &localaddr, &query->sockaddr,
|
||||
udp_ready, connectquery,
|
||||
(timeout ? timeout : UDP_TIMEOUT) * 1000,
|
||||
ppi);
|
||||
} else {
|
||||
isc_nm_udpconnect(netmgr, &localaddr, &query->sockaddr,
|
||||
udp_ready, connectquery,
|
||||
(timeout ? timeout : UDP_TIMEOUT) * 1000);
|
||||
}
|
||||
isc_nm_udpconnect(netmgr, &localaddr, &query->sockaddr, udp_ready,
|
||||
connectquery,
|
||||
(timeout ? timeout : UDP_TIMEOUT) * 1000);
|
||||
}
|
||||
|
||||
/*%
|
||||
@@ -3566,12 +3533,6 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
|
||||
debug("tcp_connected(%p, %s, %p)", handle, isc_result_totext(eresult),
|
||||
query);
|
||||
|
||||
if (eresult == ISC_R_SHUTTINGDOWN) {
|
||||
query_detach(&query);
|
||||
cancel_all();
|
||||
return;
|
||||
}
|
||||
|
||||
lookup_attach(query->lookup, &l);
|
||||
|
||||
if (eresult == ISC_R_CANCELED || eresult == ISC_R_TLSBADPEERCERT ||
|
||||
@@ -3650,7 +3611,6 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
|
||||
start_tcp(next);
|
||||
check_if_done();
|
||||
} else {
|
||||
dighost_error("no servers could be reached\n");
|
||||
clear_current_lookup();
|
||||
}
|
||||
|
||||
@@ -3957,9 +3917,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
|
||||
{
|
||||
debug("recv_done: cancel");
|
||||
isc_nmhandle_detach(&query->readhandle);
|
||||
if (eresult == ISC_R_SHUTTINGDOWN) {
|
||||
cancel_all();
|
||||
} else if (!query->canceled) {
|
||||
if (!query->canceled) {
|
||||
cancel_lookup(l);
|
||||
}
|
||||
query_detach(&query);
|
||||
@@ -4176,7 +4134,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
|
||||
goto keep_query;
|
||||
}
|
||||
|
||||
dns_message_create(mctx, NULL, NULL, DNS_MESSAGE_INTENTPARSE, &msg);
|
||||
dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &msg);
|
||||
|
||||
if (tsigkey != NULL) {
|
||||
if (l->querysig == NULL) {
|
||||
@@ -4354,32 +4312,29 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
|
||||
if ((msg->rcode == dns_rcode_servfail && !l->servfail_stops) ||
|
||||
(check_ra && (msg->flags & DNS_MESSAGEFLAG_RA) == 0 && l->recurse))
|
||||
{
|
||||
const char *err = (msg->rcode == dns_rcode_servfail &&
|
||||
!l->servfail_stops)
|
||||
? "SERVFAIL reply"
|
||||
: "recursion not available";
|
||||
dig_query_t *next = ISC_LIST_NEXT(query, link);
|
||||
if (l->current_query == query) {
|
||||
query_detach(&l->current_query);
|
||||
}
|
||||
if (next != NULL && (!l->ns_search_only || l->trace_root)) {
|
||||
dighost_comments(l,
|
||||
"Got %s from %s, trying next server",
|
||||
err, query->servname);
|
||||
if (next != NULL) {
|
||||
debug("sending query %p", next);
|
||||
if (l->tcp_mode) {
|
||||
start_tcp(next);
|
||||
} else {
|
||||
start_udp(next);
|
||||
}
|
||||
dighost_comments(l,
|
||||
"Got %s from %s, trying next "
|
||||
"server",
|
||||
msg->rcode == dns_rcode_servfail
|
||||
? "SERVFAIL reply"
|
||||
: "recursion not available",
|
||||
query->servname);
|
||||
if (check_if_queries_done(l, query)) {
|
||||
goto cancel_lookup;
|
||||
}
|
||||
|
||||
goto detach_query;
|
||||
} else {
|
||||
dighost_comments(l, "Got %s from %s", err,
|
||||
query->servname);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -4598,7 +4553,9 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
|
||||
result = isc_getaddresses(host, 0, sockaddrs, DIG_MAX_ADDRESSES,
|
||||
&count);
|
||||
isc_loopmgr_nonblocking(loopmgr);
|
||||
SET_IF_NOT_NULL(resultp, result);
|
||||
if (resultp != NULL) {
|
||||
*resultp = result;
|
||||
}
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
if (resultp == NULL) {
|
||||
fatal("couldn't get address for '%s': %s", host,
|
||||
|
||||
+2
-9
@@ -187,13 +187,6 @@ struct dig_lookup {
|
||||
char *tls_key_file;
|
||||
isc_tlsctx_cache_t *tls_ctx_cache;
|
||||
};
|
||||
struct {
|
||||
bool proxy_mode;
|
||||
bool proxy_plain;
|
||||
bool proxy_local;
|
||||
isc_sockaddr_t proxy_src_addr;
|
||||
isc_sockaddr_t proxy_dst_addr;
|
||||
};
|
||||
isc_stdtime_t fuzztime;
|
||||
};
|
||||
|
||||
@@ -266,7 +259,7 @@ extern isc_sockaddr_t localaddr;
|
||||
extern char keynametext[MXNAME];
|
||||
extern char keyfile[MXNAME];
|
||||
extern char keysecret[MXNAME];
|
||||
extern dst_algorithm_t hmac_alg;
|
||||
extern const dns_name_t *hmacname;
|
||||
extern unsigned int digestbits;
|
||||
extern dns_tsigkey_t *tsigkey;
|
||||
extern bool validated;
|
||||
@@ -348,7 +341,7 @@ isc_result_t
|
||||
parse_netprefix(isc_sockaddr_t **sap, const char *value);
|
||||
|
||||
void
|
||||
parse_hmac(const char *algname);
|
||||
parse_hmac(const char *hmacstr);
|
||||
|
||||
dig_lookup_t *
|
||||
requeue_lookup(dig_lookup_t *lookold, bool servers);
|
||||
|
||||
+2
-2
@@ -132,7 +132,7 @@ show_usage(void) {
|
||||
" -W specifies how long to wait for a reply\n"
|
||||
" -4 use IPv4 query transport only\n"
|
||||
" -6 use IPv6 query transport only\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -654,7 +654,7 @@ pre_parse_args(int argc, char **argv) {
|
||||
break;
|
||||
case 'V':
|
||||
printf("host %s\n", PACKAGE_VERSION);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
break;
|
||||
case 'w':
|
||||
break;
|
||||
|
||||
+2
-2
@@ -849,7 +849,7 @@ usage(void) {
|
||||
"'host' using default server\n");
|
||||
fprintf(stderr, " nslookup [-opt ...] host server # just look up "
|
||||
"'host' using 'server'\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -862,7 +862,7 @@ parse_args(int argc, char **argv) {
|
||||
if (argv[0][0] == '-') {
|
||||
if (strncasecmp(argv[0], "-ver", 4) == 0) {
|
||||
printf("nslookup %s\n", PACKAGE_VERSION);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
} else if (argv[0][1] != 0) {
|
||||
setoption(&argv[0][1]);
|
||||
} else {
|
||||
|
||||
+15
-16
@@ -247,8 +247,8 @@ static void
|
||||
load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
|
||||
isc_result_t result;
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
|
||||
rdclass, 0, NULL, dbp);
|
||||
result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
|
||||
NULL, dbp);
|
||||
check_result(result, "dns_db_create()");
|
||||
|
||||
result = dns_db_load(*dbp, filename, dns_masterformat_text,
|
||||
@@ -537,7 +537,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
|
||||
|
||||
nkey = dns_rdataset_count(keyset);
|
||||
|
||||
keytable = isc_mem_cget(mctx, nkey, sizeof(keytable[0]));
|
||||
keytable = isc_mem_getx(mctx, sizeof(keytable[0]) * nkey, ISC_MEM_ZERO);
|
||||
|
||||
for (result = dns_rdataset_first(keyset), i = 0, ki = keytable;
|
||||
result == ISC_R_SUCCESS;
|
||||
@@ -593,7 +593,7 @@ free_keytable(keyinfo_t **keytable_p) {
|
||||
}
|
||||
}
|
||||
|
||||
isc_mem_cput(mctx, keytable, nkey, sizeof(keytable[0]));
|
||||
isc_mem_put(mctx, keytable, sizeof(keytable[0]) * nkey);
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -614,7 +614,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
|
||||
|
||||
REQUIRE(keytbl != NULL);
|
||||
|
||||
algo = isc_mem_cget(mctx, nkey, sizeof(algo[0]));
|
||||
algo = isc_mem_getx(mctx, nkey * sizeof(algo[0]), ISC_MEM_ZERO);
|
||||
|
||||
for (result = dns_rdataset_first(sigset); result == ISC_R_SUCCESS;
|
||||
result = dns_rdataset_next(sigset))
|
||||
@@ -697,7 +697,7 @@ signed_loose(dns_secalg_t *algo) {
|
||||
ok = true;
|
||||
}
|
||||
}
|
||||
isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
|
||||
isc_mem_put(mctx, algo, nkey * sizeof(algo[0]));
|
||||
return (ok);
|
||||
}
|
||||
|
||||
@@ -739,7 +739,7 @@ signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
|
||||
}
|
||||
}
|
||||
|
||||
isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
|
||||
isc_mem_put(mctx, algo, nkey);
|
||||
return (all_ok);
|
||||
}
|
||||
|
||||
@@ -894,7 +894,7 @@ consistent_digests(dns_rdataset_t *dsset) {
|
||||
|
||||
n = dns_rdataset_count(dsset);
|
||||
|
||||
arrdata = isc_mem_cget(mctx, n, sizeof(dns_rdata_t));
|
||||
arrdata = isc_mem_get(mctx, n * sizeof(dns_rdata_t));
|
||||
|
||||
for (result = dns_rdataset_first(dsset), i = 0; result == ISC_R_SUCCESS;
|
||||
result = dns_rdataset_next(dsset), i++)
|
||||
@@ -908,7 +908,7 @@ consistent_digests(dns_rdataset_t *dsset) {
|
||||
/*
|
||||
* Convert sorted arrdata to more accessible format
|
||||
*/
|
||||
ds = isc_mem_cget(mctx, n, sizeof(dns_rdata_ds_t));
|
||||
ds = isc_mem_get(mctx, n * sizeof(dns_rdata_ds_t));
|
||||
|
||||
for (i = 0; i < n; i++) {
|
||||
result = dns_rdata_tostruct(&arrdata[i], &ds[i], NULL);
|
||||
@@ -947,8 +947,8 @@ consistent_digests(dns_rdataset_t *dsset) {
|
||||
/*
|
||||
* Done!
|
||||
*/
|
||||
isc_mem_cput(mctx, ds, n, sizeof(dns_rdata_ds_t));
|
||||
isc_mem_cput(mctx, arrdata, n, sizeof(dns_rdata_t));
|
||||
isc_mem_put(mctx, ds, n * sizeof(dns_rdata_ds_t));
|
||||
isc_mem_put(mctx, arrdata, n * sizeof(dns_rdata_t));
|
||||
|
||||
return (match);
|
||||
}
|
||||
@@ -979,8 +979,8 @@ update_diff(const char *cmd, uint32_t ttl, dns_rdataset_t *addset,
|
||||
dns_rdataset_t diffset;
|
||||
uint32_t save;
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
|
||||
rdclass, 0, NULL, &update_db);
|
||||
result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
|
||||
NULL, &update_db);
|
||||
check_result(result, "dns_db_create()");
|
||||
|
||||
result = dns_db_newversion(update_db, &update_version);
|
||||
@@ -1056,7 +1056,7 @@ usage(void) {
|
||||
" -T <ttl> TTL of DS records\n"
|
||||
" -V print version\n"
|
||||
" -v <verbosity>\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -1354,6 +1354,5 @@ main(int argc, char *argv[]) {
|
||||
cleanup:
|
||||
print_mem_stats = true;
|
||||
cleanup();
|
||||
|
||||
return (0);
|
||||
exit(0);
|
||||
}
|
||||
|
||||
@@ -100,8 +100,8 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
|
||||
|
||||
dns_name_format(name, setname, sizeof(setname));
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
|
||||
rdclass, 0, NULL, &db);
|
||||
result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
|
||||
NULL, &db);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("can't create database");
|
||||
}
|
||||
@@ -274,7 +274,7 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
|
||||
fatal("can't build record");
|
||||
}
|
||||
|
||||
result = dns_name_totext(name, 0, &nameb);
|
||||
result = dns_name_totext(name, false, &nameb);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("can't print name");
|
||||
}
|
||||
@@ -353,7 +353,7 @@ usage(void) {
|
||||
" -V: print version information\n");
|
||||
fprintf(stderr, "Output: DS or CDS RRs\n");
|
||||
|
||||
exit(EXIT_FAILURE);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
int
|
||||
@@ -452,7 +452,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -103,8 +103,8 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
|
||||
|
||||
dns_name_format(name, setname, sizeof(setname));
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
|
||||
rdclass, 0, NULL, &db);
|
||||
result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
|
||||
NULL, &db);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("can't create database");
|
||||
}
|
||||
@@ -289,7 +289,7 @@ usage(void) {
|
||||
fprintf(stderr, " -D sync date/[+-]offset/none: set/unset "
|
||||
"CDS and CDNSKEY deletion date\n");
|
||||
|
||||
exit(EXIT_FAILURE);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
int
|
||||
@@ -395,7 +395,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -102,7 +102,7 @@ usage(void) {
|
||||
fprintf(stderr, " K<name>+<alg>+<id>.key, "
|
||||
"K<name>+<alg>+<id>.private\n");
|
||||
|
||||
exit(EXIT_FAILURE);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
int
|
||||
@@ -331,7 +331,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -606,7 +606,7 @@ main(int argc, char **argv) {
|
||||
fatal("failed to get key %s/%s: %s", namestr, algstr,
|
||||
isc_result_totext(ret));
|
||||
UNREACHABLE();
|
||||
exit(EXIT_FAILURE);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
/*
|
||||
|
||||
+11
-79
@@ -61,7 +61,6 @@
|
||||
#include <isccfg/kaspconf.h>
|
||||
#include <isccfg/namedconf.h>
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/provider.h>
|
||||
#endif
|
||||
|
||||
@@ -92,7 +91,6 @@ struct keygen_ctx {
|
||||
const char *policy;
|
||||
const char *configfile;
|
||||
const char *directory;
|
||||
dns_keystore_t *keystore;
|
||||
char *algname;
|
||||
char *nametype;
|
||||
char *type;
|
||||
@@ -227,7 +225,7 @@ usage(void) {
|
||||
fprintf(stderr, " K<name>+<alg>+<id>.key, "
|
||||
"K<name>+<alg>+<id>.private\n");
|
||||
|
||||
exit(EXIT_FAILURE);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -256,42 +254,14 @@ progress(int p) {
|
||||
|
||||
static void
|
||||
kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
|
||||
const char *keydir, const char *engine, dns_kasp_t **kaspp) {
|
||||
isc_result_t result = ISC_R_NOTFOUND;
|
||||
dns_kasp_t **kaspp) {
|
||||
const cfg_listelt_t *element;
|
||||
const cfg_obj_t *kasps = NULL;
|
||||
dns_kasp_t *kasp = NULL, *kasp_next;
|
||||
isc_result_t result = ISC_R_NOTFOUND;
|
||||
dns_kasplist_t kasplist;
|
||||
const cfg_obj_t *keystores = NULL;
|
||||
dns_keystore_t *ks = NULL, *ks_next;
|
||||
dns_keystorelist_t kslist;
|
||||
|
||||
ISC_LIST_INIT(kasplist);
|
||||
ISC_LIST_INIT(kslist);
|
||||
|
||||
(void)cfg_map_get(config, "key-store", &keystores);
|
||||
for (element = cfg_list_first(keystores); element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
cfg_obj_t *kconfig = cfg_listelt_value(element);
|
||||
ks = NULL;
|
||||
result = cfg_keystore_fromconfig(kconfig, mctx, lctx, engine,
|
||||
&kslist, NULL);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("failed to configure key-store '%s': %s",
|
||||
cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
|
||||
isc_result_totext(result));
|
||||
}
|
||||
}
|
||||
/* Default key-directory key store. */
|
||||
ks = NULL;
|
||||
(void)cfg_keystore_fromconfig(NULL, mctx, lctx, engine, &kslist, &ks);
|
||||
INSIST(ks != NULL);
|
||||
if (keydir != NULL) {
|
||||
/* '-K keydir' takes priority */
|
||||
dns_keystore_setdirectory(ks, keydir);
|
||||
}
|
||||
dns_keystore_detach(&ks);
|
||||
|
||||
(void)cfg_map_get(config, "dnssec-policy", &kasps);
|
||||
for (element = cfg_list_first(kasps); element != NULL;
|
||||
@@ -306,7 +276,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
|
||||
}
|
||||
|
||||
result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, lctx,
|
||||
&kslist, &kasplist, &kasp);
|
||||
&kasplist, &kasp);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("failed to configure dnssec-policy '%s': %s",
|
||||
cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
|
||||
@@ -327,15 +297,6 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
|
||||
ISC_LIST_UNLINK(kasplist, kasp, link);
|
||||
dns_kasp_detach(&kasp);
|
||||
}
|
||||
|
||||
/*
|
||||
* Cleanup keystore list.
|
||||
*/
|
||||
for (ks = ISC_LIST_HEAD(kslist); ks != NULL; ks = ks_next) {
|
||||
ks_next = ISC_LIST_NEXT(ks, link);
|
||||
ISC_LIST_UNLINK(kslist, ks, link);
|
||||
dns_keystore_detach(&ks);
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -693,27 +654,16 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
|
||||
|
||||
if (!ctx->quiet && show_progress) {
|
||||
fprintf(stderr, "Generating key pair.");
|
||||
}
|
||||
|
||||
if (ctx->keystore != NULL && ctx->policy != NULL) {
|
||||
ret = dns_keystore_keygen(
|
||||
ctx->keystore, name, ctx->policy, ctx->rdclass,
|
||||
mctx, ctx->alg, ctx->size, flags, &key);
|
||||
} else if (!ctx->quiet && show_progress) {
|
||||
ret = dst_key_generate(name, ctx->alg, ctx->size, param,
|
||||
flags, ctx->protocol,
|
||||
ctx->rdclass, NULL, mctx, &key,
|
||||
ctx->rdclass, mctx, &key,
|
||||
&progress);
|
||||
putc('\n', stderr);
|
||||
fflush(stderr);
|
||||
} else {
|
||||
ret = dst_key_generate(name, ctx->alg, ctx->size, param,
|
||||
flags, ctx->protocol,
|
||||
ctx->rdclass, NULL, mctx, &key,
|
||||
NULL);
|
||||
}
|
||||
|
||||
if (!ctx->quiet && show_progress) {
|
||||
putc('\n', stderr);
|
||||
fflush(stderr);
|
||||
ctx->rdclass, mctx, &key, NULL);
|
||||
}
|
||||
|
||||
if (ret != ISC_R_SUCCESS) {
|
||||
@@ -909,18 +859,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
check_keystore_options(keygen_ctx_t *ctx) {
|
||||
ctx->directory = dns_keystore_directory(ctx->keystore, NULL);
|
||||
if (ctx->directory != NULL) {
|
||||
isc_result_t ret = try_dir(ctx->directory);
|
||||
if (ret != ISC_R_SUCCESS) {
|
||||
fatal("cannot open directory %s: %s", ctx->directory,
|
||||
isc_result_totext(ret));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
int
|
||||
main(int argc, char **argv) {
|
||||
char *algname = NULL, *freeit = NULL;
|
||||
@@ -1196,7 +1134,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1208,13 +1146,11 @@ main(int argc, char **argv) {
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
fips = OSSL_PROVIDER_load(NULL, "fips");
|
||||
if (fips == NULL) {
|
||||
ERR_clear_error();
|
||||
fatal("Failed to load FIPS provider");
|
||||
}
|
||||
base = OSSL_PROVIDER_load(NULL, "base");
|
||||
if (base == NULL) {
|
||||
OSSL_PROVIDER_unload(fips);
|
||||
ERR_clear_error();
|
||||
fatal("Failed to load base provider");
|
||||
}
|
||||
#endif
|
||||
@@ -1330,8 +1266,7 @@ main(int argc, char **argv) {
|
||||
ctx.policy, ctx.configfile);
|
||||
}
|
||||
|
||||
kasp_from_conf(config, mctx, ctx.policy, ctx.directory,
|
||||
engine, &kasp);
|
||||
kasp_from_conf(config, mctx, ctx.policy, &kasp);
|
||||
if (kasp == NULL) {
|
||||
fatal("failed to load dnssec-policy '%s'",
|
||||
ctx.policy);
|
||||
@@ -1357,10 +1292,7 @@ main(int argc, char **argv) {
|
||||
ctx.ksk = dns_kasp_key_ksk(kaspkey);
|
||||
ctx.zsk = dns_kasp_key_zsk(kaspkey);
|
||||
ctx.lifetime = dns_kasp_key_lifetime(kaspkey);
|
||||
ctx.keystore = dns_kasp_key_keystore(kaspkey);
|
||||
if (ctx.keystore != NULL) {
|
||||
check_keystore_options(&ctx);
|
||||
}
|
||||
|
||||
keygen(&ctx, mctx, argc, argv);
|
||||
|
||||
kaspkey = ISC_LIST_NEXT(kaspkey, link);
|
||||
|
||||
@@ -27,7 +27,9 @@ Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
:program:`dnssec-keygen` generates keys for DNSSEC (Secure DNS), as defined in
|
||||
:rfc:`2535` and :rfc:`4034`.
|
||||
:rfc:`2535` and :rfc:`4034`. It can also generate keys for use with TSIG
|
||||
(Transaction Signatures) as defined in :rfc:`2845`, or TKEY (Transaction
|
||||
Key) as defined in :rfc:`2930`.
|
||||
|
||||
The ``name`` of the key is specified on the command line. For DNSSEC
|
||||
keys, this must match the name of the zone for which the key is being
|
||||
|
||||
@@ -58,7 +58,7 @@ usage(void) {
|
||||
fprintf(stderr, " K<name>+<alg>+<new id>.key, "
|
||||
"K<name>+<alg>+<new id>.private\n");
|
||||
|
||||
exit(EXIT_FAILURE);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
int
|
||||
@@ -130,7 +130,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -101,7 +101,7 @@ usage(void) {
|
||||
fprintf(stderr, " K<name>+<alg>+<new id>.key, "
|
||||
"K<name>+<alg>+<new id>.private\n");
|
||||
|
||||
exit(EXIT_FAILURE);
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -536,7 +536,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -148,7 +148,7 @@ All these formats are case-insensitive.
|
||||
.. option:: -A date/offset
|
||||
|
||||
This option sets the date on which the key is to be activated. After that date,
|
||||
the key is included in the zone and used to sign it.
|
||||
the key is included in the zone and used to sign it.
|
||||
|
||||
.. option:: -R date/offset
|
||||
|
||||
|
||||
@@ -89,7 +89,6 @@
|
||||
|
||||
#include <dst/dst.h>
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/provider.h>
|
||||
#endif
|
||||
|
||||
@@ -106,7 +105,7 @@ static int nsec_datatype = dns_rdatatype_nsec;
|
||||
"dns_dbiterator_current()")
|
||||
|
||||
#define IS_NSEC3 (nsec_datatype == dns_rdatatype_nsec3)
|
||||
#define OPTOUT(x) (((x) & DNS_NSEC3FLAG_OPTOUT) != 0)
|
||||
#define OPTOUT(x) (((x)&DNS_NSEC3FLAG_OPTOUT) != 0)
|
||||
|
||||
#define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) != 0)
|
||||
|
||||
@@ -529,8 +528,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
|
||||
if (!nosigs) {
|
||||
arraysize += dns_rdataset_count(&sigset);
|
||||
}
|
||||
wassignedby = isc_mem_cget(mctx, arraysize, sizeof(bool));
|
||||
nowsignedby = isc_mem_cget(mctx, arraysize, sizeof(bool));
|
||||
wassignedby = isc_mem_get(mctx, arraysize * sizeof(bool));
|
||||
nowsignedby = isc_mem_get(mctx, arraysize * sizeof(bool));
|
||||
|
||||
for (i = 0; i < arraysize; i++) {
|
||||
wassignedby[i] = nowsignedby[i] = false;
|
||||
@@ -782,8 +781,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
|
||||
}
|
||||
}
|
||||
|
||||
isc_mem_cput(mctx, wassignedby, arraysize, sizeof(bool));
|
||||
isc_mem_cput(mctx, nowsignedby, arraysize, sizeof(bool));
|
||||
isc_mem_put(mctx, wassignedby, arraysize * sizeof(bool));
|
||||
isc_mem_put(mctx, nowsignedby, arraysize * sizeof(bool));
|
||||
}
|
||||
|
||||
struct hashlist {
|
||||
@@ -998,8 +997,8 @@ opendb(const char *prefix, dns_name_t *name, dns_rdataclass_t rdclass,
|
||||
}
|
||||
isc_buffer_putuint8(&b, 0);
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, dns_rootname,
|
||||
dns_dbtype_zone, rdclass, 0, NULL, dbp);
|
||||
result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
|
||||
rdclass, 0, NULL, dbp);
|
||||
check_result(result, "dns_db_create()");
|
||||
|
||||
result = dns_db_load(*dbp, filename, inputformat, DNS_MASTER_HINT);
|
||||
@@ -1674,7 +1673,7 @@ assignwork(void *arg) {
|
||||
lock_and_dumpnode(dns_fixedname_name(&fname), node);
|
||||
dns_db_detachnode(gdb, &node);
|
||||
|
||||
isc_async_current(assignwork, NULL);
|
||||
isc_async_current(loopmgr, assignwork, NULL);
|
||||
}
|
||||
|
||||
/*%
|
||||
@@ -2572,8 +2571,8 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
|
||||
isc_result_totext(result));
|
||||
}
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
|
||||
rdclass, 0, NULL, db);
|
||||
result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
|
||||
NULL, db);
|
||||
check_result(result, "dns_db_create()");
|
||||
|
||||
result = dns_db_load(*db, file, inputformat, 0);
|
||||
@@ -2639,7 +2638,7 @@ loadzonekeys(bool preserve_keys, bool load_public) {
|
||||
|
||||
/* Load keys corresponding to the existing DNSKEY RRset. */
|
||||
result = dns_dnssec_keylistfromrdataset(
|
||||
gorigin, NULL, directory, mctx, &rdataset, &keysigs, &soasigs,
|
||||
gorigin, directory, mctx, &rdataset, &keysigs, &soasigs,
|
||||
preserve_keys, load_public, &keylist);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("failed to load the zone keys: %s",
|
||||
@@ -2830,8 +2829,8 @@ findkeys:
|
||||
/*
|
||||
* Find keys that match this zone in the key repository.
|
||||
*/
|
||||
result = dns_dnssec_findmatchingkeys(gorigin, NULL, directory, NULL,
|
||||
now, mctx, &matchkeys);
|
||||
result = dns_dnssec_findmatchingkeys(gorigin, directory, now, mctx,
|
||||
&matchkeys);
|
||||
if (result == ISC_R_NOTFOUND) {
|
||||
result = ISC_R_SUCCESS;
|
||||
}
|
||||
@@ -3162,8 +3161,8 @@ writeset(const char *prefix, dns_rdatatype_t type) {
|
||||
dns_diff_append(&diff, &tuple);
|
||||
}
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, dns_rootname,
|
||||
dns_dbtype_zone, gclass, 0, NULL, &db);
|
||||
result = dns_db_create(mctx, "rbt", dns_rootname, dns_dbtype_zone,
|
||||
gclass, 0, NULL, &db);
|
||||
check_result(result, "dns_db_create");
|
||||
|
||||
result = dns_db_newversion(db, &dbversion);
|
||||
@@ -3300,7 +3299,7 @@ usage(void) {
|
||||
fprintf(stderr, "(default: all zone keys that have private keys)\n");
|
||||
fprintf(stderr, "\tkeyfile (Kname+alg+tag)\n");
|
||||
|
||||
exit(EXIT_FAILURE);
|
||||
exit(0);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -3494,7 +3493,7 @@ main(int argc, char *argv[]) {
|
||||
set_iter = true;
|
||||
/* too-many is NOT DOCUMENTED */
|
||||
if (strcmp(isc_commandline_argument, "too-many") == 0) {
|
||||
nsec3iter = 51;
|
||||
nsec3iter = 151;
|
||||
no_max_check = true;
|
||||
break;
|
||||
}
|
||||
@@ -3550,7 +3549,7 @@ main(int argc, char *argv[]) {
|
||||
if (*endp != '\0') {
|
||||
fprintf(stderr, "source serial number "
|
||||
"must be numeric");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -3565,7 +3564,7 @@ main(int argc, char *argv[]) {
|
||||
if (*endp != '\0') {
|
||||
fprintf(stderr, "maximum TTL "
|
||||
"must be numeric");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -3689,7 +3688,7 @@ main(int argc, char *argv[]) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3738,13 +3737,11 @@ main(int argc, char *argv[]) {
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
fips = OSSL_PROVIDER_load(NULL, "fips");
|
||||
if (fips == NULL) {
|
||||
ERR_clear_error();
|
||||
fatal("Failed to load FIPS provider");
|
||||
}
|
||||
base = OSSL_PROVIDER_load(NULL, "base");
|
||||
if (base == NULL) {
|
||||
OSSL_PROVIDER_unload(fips);
|
||||
ERR_clear_error();
|
||||
fatal("Failed to load base provider");
|
||||
}
|
||||
#endif
|
||||
@@ -3818,7 +3815,7 @@ main(int argc, char *argv[]) {
|
||||
rawversion > 1U)
|
||||
{
|
||||
fprintf(stderr, "unknown raw format version\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
} else {
|
||||
fatal("unknown file format: %s", outputformatstr);
|
||||
|
||||
@@ -359,12 +359,15 @@ Options
|
||||
.. option:: -x
|
||||
|
||||
This option indicates that BIND 9 should only sign the DNSKEY, CDNSKEY, and CDS RRsets with key-signing keys,
|
||||
and should omit signatures from zone-signing keys.
|
||||
and should omit signatures from zone-signing keys. (This is similar to the
|
||||
``dnssec-dnskey-kskonly yes;`` zone option in :iscman:`named`.)
|
||||
|
||||
.. option:: -z
|
||||
|
||||
This option indicates that BIND 9 should ignore the KSK flag on keys when determining what to sign. This causes
|
||||
KSK-flagged keys to sign all records, not just the DNSKEY RRset.
|
||||
(This is similar to the ``update-check-ksk no;`` zone option in
|
||||
:iscman:`named`.)
|
||||
|
||||
.. option:: -3 salt
|
||||
|
||||
|
||||
@@ -109,8 +109,8 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
|
||||
isc_result_totext(result));
|
||||
}
|
||||
|
||||
result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
|
||||
rdclass, 0, NULL, db);
|
||||
result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
|
||||
NULL, db);
|
||||
check_result(result, "dns_db_create()");
|
||||
|
||||
result = dns_db_load(*db, file, inputformat, 0);
|
||||
@@ -162,7 +162,7 @@ usage(void) {
|
||||
fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
|
||||
"not ZSKs\n");
|
||||
fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
}
|
||||
|
||||
int
|
||||
@@ -271,7 +271,7 @@ main(int argc, char *argv[]) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
+10
-7
@@ -20,7 +20,6 @@
|
||||
#include <inttypes.h>
|
||||
#include <stdbool.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include <isc/base32.h>
|
||||
#include <isc/buffer.h>
|
||||
@@ -84,7 +83,8 @@ fatal(const char *format, ...) {
|
||||
if (fatalcallback != NULL) {
|
||||
(*fatalcallback)();
|
||||
}
|
||||
_exit(EXIT_FAILURE);
|
||||
isc__tls_setfatalmode();
|
||||
exit(1);
|
||||
}
|
||||
|
||||
void
|
||||
@@ -114,7 +114,7 @@ vbprintf(int level, const char *fmt, ...) {
|
||||
void
|
||||
version(const char *name) {
|
||||
printf("%s %s\n", name, PACKAGE_VERSION);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
}
|
||||
|
||||
void
|
||||
@@ -291,11 +291,15 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
|
||||
struct tm tm;
|
||||
|
||||
if (isnone(str)) {
|
||||
SET_IF_NOT_NULL(setp, false);
|
||||
if (setp != NULL) {
|
||||
*setp = false;
|
||||
}
|
||||
return ((isc_stdtime_t)0);
|
||||
}
|
||||
|
||||
SET_IF_NOT_NULL(setp, true);
|
||||
if (setp != NULL) {
|
||||
*setp = true;
|
||||
}
|
||||
|
||||
if ((str[0] == '0' || str[0] == '-') && str[1] == '\0') {
|
||||
return ((isc_stdtime_t)0);
|
||||
@@ -498,8 +502,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
|
||||
alg = dst_key_alg(dstkey);
|
||||
|
||||
ISC_LIST_INIT(matchkeys);
|
||||
result = dns_dnssec_findmatchingkeys(name, NULL, dir, NULL, now, mctx,
|
||||
&matchkeys);
|
||||
result = dns_dnssec_findmatchingkeys(name, dir, now, mctx, &matchkeys);
|
||||
if (result == ISC_R_NOTFOUND) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
@@ -38,8 +38,8 @@ AM_CPPFLAGS += \
|
||||
sbin_PROGRAMS = named
|
||||
|
||||
nodist_named_SOURCES = xsl.c
|
||||
BUILT_SOURCES += xsl.c
|
||||
CLEANFILES += xsl.c
|
||||
BUILT_SOURCES = xsl.c
|
||||
CLEANFILES = xsl.c
|
||||
|
||||
EXTRA_DIST = bind9.xsl
|
||||
|
||||
|
||||
@@ -303,7 +303,6 @@
|
||||
<a href="/xml/v3/status">Status</a>,
|
||||
<a href="/xml/v3/server">Server</a>,
|
||||
<a href="/xml/v3/zones">Zones</a>,
|
||||
<a href="/xml/v3/xfrins">Incoming Zone Transfers</a>,
|
||||
<a href="/xml/v3/net">Network</a>,
|
||||
<a href="/xml/v3/mem">Memory</a> and
|
||||
<a href="/xml/v3/traffic">Traffic Size</a></p>
|
||||
@@ -908,63 +907,6 @@
|
||||
</xsl:for-each>
|
||||
</xsl:for-each>
|
||||
</xsl:if>
|
||||
<xsl:if test="views/view/xfrins/xfrin">
|
||||
<xsl:for-each select="views/view">
|
||||
<h3>Incoming Zone Transfers for View <xsl:value-of select="@name"/></h3>
|
||||
<table class="xfrins">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Zone Name</th>
|
||||
<th>Zone Type</th>
|
||||
<th>Local Serial</th>
|
||||
<th>Remote Serial</th>
|
||||
<th>IXFR</th>
|
||||
<th>First Refresh</th>
|
||||
<th>State</th>
|
||||
<th>Additional Refresh Queued</th>
|
||||
<th>Local Address</th>
|
||||
<th>Remote Address</th>
|
||||
<th>SOA Transport</th>
|
||||
<th>Transport</th>
|
||||
<th>TSIG Key Name</th>
|
||||
<th>Duration (s)</th>
|
||||
<th>Messages Received</th>
|
||||
<th>Records Received</th>
|
||||
<th>Bytes Received</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<xsl:for-each select="xfrins/xfrin">
|
||||
<xsl:variable name="css-class16">
|
||||
<xsl:choose>
|
||||
<xsl:when test="position() mod 2 = 0">even</xsl:when>
|
||||
<xsl:otherwise>odd</xsl:otherwise>
|
||||
</xsl:choose>
|
||||
</xsl:variable>
|
||||
<tr class="{$css-class16}">
|
||||
<td><xsl:value-of select="@name"/></td>
|
||||
<td><xsl:value-of select="type"/></td>
|
||||
<td><xsl:value-of select="serial"/></td>
|
||||
<td><xsl:value-of select="remoteserial"/></td>
|
||||
<td><xsl:value-of select="ixfr"/></td>
|
||||
<td><xsl:value-of select="firstrefresh"/></td>
|
||||
<td><xsl:value-of select="state"/></td>
|
||||
<td><xsl:value-of select="refreshqueued"/></td>
|
||||
<td><xsl:value-of select="localaddr"/></td>
|
||||
<td><xsl:value-of select="remoteaddr"/></td>
|
||||
<td><xsl:value-of select="soatransport"/></td>
|
||||
<td><xsl:value-of select="transport"/></td>
|
||||
<td><xsl:value-of select="tsigkeyname"/></td>
|
||||
<td><xsl:value-of select="duration"/></td>
|
||||
<td><xsl:value-of select="nmsg"/></td>
|
||||
<td><xsl:value-of select="nrecs"/></td>
|
||||
<td><xsl:value-of select="nbytes"/></td>
|
||||
</tr>
|
||||
</xsl:for-each>
|
||||
</tbody>
|
||||
</table>
|
||||
</xsl:for-each>
|
||||
</xsl:if>
|
||||
<xsl:if test="memory/summary">
|
||||
<h2>Memory Usage Summary</h2>
|
||||
<table class="counters">
|
||||
|
||||
+5
-4
@@ -608,7 +608,7 @@ ipv4reverse_lookup(bdbnode_t *node) {
|
||||
*/
|
||||
static void
|
||||
disassociate(dns_rdataset_t *rdataset DNS__DB_FLARG) {
|
||||
dns_dbnode_t *node = rdataset->rdlist.node;
|
||||
dns_dbnode_t *node = rdataset->private5;
|
||||
bdbnode_t *bdbnode = (bdbnode_t *)node;
|
||||
dns_db_t *db = (dns_db_t *)bdbnode->bdb;
|
||||
|
||||
@@ -618,12 +618,13 @@ disassociate(dns_rdataset_t *rdataset DNS__DB_FLARG) {
|
||||
|
||||
static void
|
||||
rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target DNS__DB_FLARG) {
|
||||
dns_dbnode_t *node = source->rdlist.node;
|
||||
dns_dbnode_t *node = source->private5;
|
||||
bdbnode_t *bdbnode = (bdbnode_t *)node;
|
||||
dns_db_t *db = (dns_db_t *)bdbnode->bdb;
|
||||
|
||||
dns_rdatalist_clone(source, target DNS__DB_FLARG_PASS);
|
||||
attachnode(db, node, &target->rdlist.node DNS__DB_FLARG_PASS);
|
||||
attachnode(db, node,
|
||||
(dns_dbnode_t **)&target->private5 DNS__DB_FLARG_PASS);
|
||||
}
|
||||
|
||||
static dns_rdatasetmethods_t bdb_rdataset_methods = {
|
||||
@@ -643,7 +644,7 @@ new_rdataset(dns_rdatalist_t *rdatalist, dns_db_t *db, dns_dbnode_t *node,
|
||||
dns_rdatalist_tordataset(rdatalist, rdataset);
|
||||
|
||||
rdataset->methods = &bdb_rdataset_methods;
|
||||
dns_db_attachnode(db, node, &rdataset->rdlist.node);
|
||||
dns_db_attachnode(db, node, &rdataset->private5);
|
||||
}
|
||||
|
||||
/*
|
||||
|
||||
+70
-29
@@ -67,6 +67,7 @@ options {\n\
|
||||
interface-interval 60;\n\
|
||||
listen-on {any;};\n\
|
||||
listen-on-v6 {any;};\n\
|
||||
# lock-file \"" NAMED_LOCALSTATEDIR "/run/named/named.lock\";\n\
|
||||
match-mapped-addresses no;\n\
|
||||
max-ixfr-ratio 100%;\n\
|
||||
max-rsa-exponent-size 0; /* no limit */\n\
|
||||
@@ -132,8 +133,6 @@ options {\n\
|
||||
/* view */\n\
|
||||
allow-new-zones no;\n\
|
||||
allow-notify {none;};\n\
|
||||
allow-proxy {none;};\n\
|
||||
allow-proxy-on {any;};\n\
|
||||
allow-query-cache { localnets; localhost; };\n\
|
||||
allow-query-cache-on { any; };\n\
|
||||
allow-recursion { localnets; localhost; };\n\
|
||||
@@ -189,6 +188,8 @@ options {\n\
|
||||
request-expire true;\n\
|
||||
request-ixfr true;\n\
|
||||
require-server-cookie no;\n\
|
||||
resolver-nonbackoff-tries 3;\n\
|
||||
resolver-retry-interval 800; /* in milliseconds */\n\
|
||||
root-key-sentinel yes;\n\
|
||||
servfail-ttl 1;\n\
|
||||
# sortlist <none>\n\
|
||||
@@ -200,7 +201,6 @@ options {\n\
|
||||
synth-from-dnssec yes;\n\
|
||||
# topology <none>\n\
|
||||
transfer-format many-answers;\n\
|
||||
resolver-use-dns64 false;\n\
|
||||
v6-bias 50;\n\
|
||||
zero-no-soa-ttl-cache no;\n\
|
||||
\n\
|
||||
@@ -215,7 +215,9 @@ options {\n\
|
||||
check-srv-cname warn;\n\
|
||||
check-wildcard yes;\n\
|
||||
dialup no;\n\
|
||||
dnssec-dnskey-kskonly yes;\n\
|
||||
dnssec-loadkeys-interval 60;\n\
|
||||
dnssec-update-mode maintain;\n\
|
||||
# forward <none>\n\
|
||||
# forwarders <none>\n\
|
||||
# inline-signing no;\n\
|
||||
@@ -238,9 +240,12 @@ options {\n\
|
||||
sig-signing-nodes 100;\n\
|
||||
sig-signing-signatures 10;\n\
|
||||
sig-signing-type 65534;\n\
|
||||
sig-validity-interval 30; /* days */\n\
|
||||
dnskey-sig-validity 0; /* default: sig-validity-interval */\n\
|
||||
transfer-source *;\n\
|
||||
transfer-source-v6 *;\n\
|
||||
try-tcp-refresh yes; /* BIND 8 compat */\n\
|
||||
update-check-ksk yes;\n\
|
||||
zero-no-soa-ttl yes;\n\
|
||||
zone-statistics terse;\n\
|
||||
};\n\
|
||||
@@ -294,7 +299,6 @@ dnssec-policy \"default\" {\n\
|
||||
cdnskey yes;\n\
|
||||
cds-digest-types { 2; };\n\
|
||||
dnskey-ttl " DNS_KASP_KEY_TTL ";\n\
|
||||
inline-signing yes;\n\
|
||||
publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\
|
||||
retire-safety " DNS_KASP_RETIRE_SAFETY "; \n\
|
||||
purge-keys " DNS_KASP_PURGE_KEYS "; \n\
|
||||
@@ -308,9 +312,7 @@ dnssec-policy \"default\" {\n\
|
||||
};\n\
|
||||
\n\
|
||||
dnssec-policy \"insecure\" {\n\
|
||||
max-zone-ttl 0; \n\
|
||||
keys { };\n\
|
||||
inline-signing yes;\n\
|
||||
};\n\
|
||||
\n\
|
||||
"
|
||||
@@ -327,14 +329,14 @@ dnssec-policy \"insecure\" {\n\
|
||||
"# END TRUST ANCHORS\n\
|
||||
\n\
|
||||
primaries " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
|
||||
2801:1b8:10::b; # b.root-servers.net\n\
|
||||
2001:500:200::b; # b.root-servers.net\n\
|
||||
2001:500:2::c; # c.root-servers.net\n\
|
||||
2001:500:2f::f; # f.root-servers.net\n\
|
||||
2001:500:12::d0d; # g.root-servers.net\n\
|
||||
2001:7fd::1; # k.root-servers.net\n\
|
||||
2620:0:2830:202::132; # xfr.cjr.dns.icann.org\n\
|
||||
2620:0:2d0:202::132; # xfr.lax.dns.icann.org\n\
|
||||
170.247.170.2; # b.root-servers.net\n\
|
||||
199.9.14.201; # b.root-servers.net\n\
|
||||
192.33.4.12; # c.root-servers.net\n\
|
||||
192.5.5.241; # f.root-servers.net\n\
|
||||
192.112.36.4; # g.root-servers.net\n\
|
||||
@@ -576,18 +578,22 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
#define grow_array(mctx, array, newlen, oldlen) \
|
||||
if (newlen >= oldlen) { \
|
||||
array = isc_mem_creget(mctx, array, oldlen, newlen + 16, \
|
||||
sizeof(array[0])); \
|
||||
oldlen = newlen + 16; \
|
||||
#define grow_array(mctx, array, newlen, oldlen) \
|
||||
if (newlen >= oldlen) { \
|
||||
size_t newsize = (newlen + 16) * sizeof(array[0]); \
|
||||
size_t oldsize = oldlen * sizeof(array[0]); \
|
||||
array = isc_mem_regetx(mctx, array, oldsize, newsize, \
|
||||
ISC_MEM_ZERO); \
|
||||
oldlen = newlen + 16; \
|
||||
}
|
||||
|
||||
#define shrink_array(mctx, array, newlen, oldlen) \
|
||||
if (newlen < oldlen) { \
|
||||
array = isc_mem_creget(mctx, array, oldlen, newlen, \
|
||||
sizeof(array[0])); \
|
||||
oldlen = newlen; \
|
||||
#define shrink_array(mctx, array, newlen, oldlen) \
|
||||
if (newlen < oldlen) { \
|
||||
size_t newsize = newlen * sizeof(array[0]); \
|
||||
size_t oldsize = oldlen * sizeof(array[0]); \
|
||||
array = isc_mem_regetx(mctx, array, oldsize, newsize, \
|
||||
ISC_MEM_ZERO); \
|
||||
oldlen = newlen; \
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
@@ -804,10 +810,10 @@ resume:
|
||||
shrink_array(mctx, sources, i, srccount);
|
||||
|
||||
if (lists != NULL) {
|
||||
isc_mem_cput(mctx, lists, listcount, sizeof(lists[0]));
|
||||
isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
|
||||
}
|
||||
if (stack != NULL) {
|
||||
isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
|
||||
isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
|
||||
}
|
||||
|
||||
INSIST(keycount == addrcount);
|
||||
@@ -825,7 +831,7 @@ resume:
|
||||
|
||||
cleanup:
|
||||
if (addrs != NULL) {
|
||||
isc_mem_cput(mctx, addrs, addrcount, sizeof(addrs[0]));
|
||||
isc_mem_put(mctx, addrs, addrcount * sizeof(addrs[0]));
|
||||
}
|
||||
if (keys != NULL) {
|
||||
for (size_t j = 0; j < i; j++) {
|
||||
@@ -837,7 +843,7 @@ cleanup:
|
||||
}
|
||||
isc_mem_put(mctx, keys[j], sizeof(*keys[j]));
|
||||
}
|
||||
isc_mem_cput(mctx, keys, keycount, sizeof(keys[0]));
|
||||
isc_mem_put(mctx, keys, keycount * sizeof(keys[0]));
|
||||
}
|
||||
if (tlss != NULL) {
|
||||
for (size_t j = 0; j < i; j++) {
|
||||
@@ -849,16 +855,16 @@ cleanup:
|
||||
}
|
||||
isc_mem_put(mctx, tlss[j], sizeof(*tlss[j]));
|
||||
}
|
||||
isc_mem_cput(mctx, tlss, tlscount, sizeof(tlss[0]));
|
||||
isc_mem_put(mctx, tlss, tlscount * sizeof(tlss[0]));
|
||||
}
|
||||
if (sources != NULL) {
|
||||
isc_mem_cput(mctx, sources, srccount, sizeof(sources[0]));
|
||||
isc_mem_put(mctx, sources, srccount * sizeof(sources[0]));
|
||||
}
|
||||
if (lists != NULL) {
|
||||
isc_mem_cput(mctx, lists, listcount, sizeof(lists[0]));
|
||||
isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
|
||||
}
|
||||
if (stack != NULL) {
|
||||
isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
|
||||
isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
|
||||
}
|
||||
return (result);
|
||||
}
|
||||
@@ -916,8 +922,14 @@ struct keyalgorithms {
|
||||
{ NULL, hmacnone, DST_ALG_UNKNOWN, 0 } };
|
||||
|
||||
isc_result_t
|
||||
named_config_getkeyalgorithm(const char *str, unsigned int *typep,
|
||||
named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
|
||||
uint16_t *digestbits) {
|
||||
return (named_config_getkeyalgorithm2(str, name, NULL, digestbits));
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
|
||||
unsigned int *typep, uint16_t *digestbits) {
|
||||
int i;
|
||||
size_t len = 0;
|
||||
uint16_t bits;
|
||||
@@ -948,7 +960,36 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
|
||||
} else {
|
||||
bits = algorithms[i].size;
|
||||
}
|
||||
SET_IF_NOT_NULL(typep, algorithms[i].type);
|
||||
SET_IF_NOT_NULL(digestbits, bits);
|
||||
|
||||
if (name != NULL) {
|
||||
switch (algorithms[i].hmac) {
|
||||
case hmacmd5:
|
||||
*name = dns_tsig_hmacmd5_name;
|
||||
break;
|
||||
case hmacsha1:
|
||||
*name = dns_tsig_hmacsha1_name;
|
||||
break;
|
||||
case hmacsha224:
|
||||
*name = dns_tsig_hmacsha224_name;
|
||||
break;
|
||||
case hmacsha256:
|
||||
*name = dns_tsig_hmacsha256_name;
|
||||
break;
|
||||
case hmacsha384:
|
||||
*name = dns_tsig_hmacsha384_name;
|
||||
break;
|
||||
case hmacsha512:
|
||||
*name = dns_tsig_hmacsha512_name;
|
||||
break;
|
||||
default:
|
||||
UNREACHABLE();
|
||||
}
|
||||
}
|
||||
if (typep != NULL) {
|
||||
*typep = algorithms[i].type;
|
||||
}
|
||||
if (digestbits != NULL) {
|
||||
*digestbits = bits;
|
||||
}
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
@@ -177,7 +177,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
|
||||
/* Do not flush master files */
|
||||
named_server_flushonshutdown(named_g_server, false);
|
||||
named_os_shutdownmsg(cmdline, *text);
|
||||
isc_loopmgr_shutdown(named_g_loopmgr);
|
||||
result = ISC_R_SHUTTINGDOWN;
|
||||
} else if (command_compare(command, NAMED_COMMAND_STOP)) {
|
||||
/*
|
||||
@@ -195,7 +194,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
|
||||
#endif /* ifdef HAVE_LIBSCF */
|
||||
named_server_flushonshutdown(named_g_server, true);
|
||||
named_os_shutdownmsg(cmdline, *text);
|
||||
isc_loopmgr_shutdown(named_g_loopmgr);
|
||||
result = ISC_R_SHUTTINGDOWN;
|
||||
} else if (command_compare(command, NAMED_COMMAND_ADDZONE) ||
|
||||
command_compare(command, NAMED_COMMAND_MODZONE))
|
||||
|
||||
+244
-159
@@ -49,7 +49,7 @@
|
||||
#include <named/main.h>
|
||||
#include <named/server.h>
|
||||
|
||||
/* Add -DNAMED_CONTROLCONF_TRACE=1 to CFLAGS for detailed reference tracing */
|
||||
#undef NAMED_CONTROLCONF_TRACE
|
||||
|
||||
typedef struct controlkey controlkey_t;
|
||||
typedef ISC_LIST(controlkey_t) controlkeylist_t;
|
||||
@@ -91,9 +91,10 @@ struct controllistener {
|
||||
isc_sockaddr_t address;
|
||||
isc_nmsocket_t *sock;
|
||||
dns_acl_t *acl;
|
||||
bool shuttingdown;
|
||||
bool exiting;
|
||||
isc_refcount_t references;
|
||||
controlkeylist_t keys;
|
||||
isc_mutex_t connections_lock;
|
||||
controlconnectionlist_t connections;
|
||||
isc_socktype_t type;
|
||||
uint32_t perm;
|
||||
@@ -119,8 +120,6 @@ static void
|
||||
conn_cleanup(controlconnection_t *conn);
|
||||
static void
|
||||
conn_free(controlconnection_t *conn);
|
||||
static void
|
||||
conn_shutdown(controlconnection_t *conn);
|
||||
|
||||
#if NAMED_CONTROLCONF_TRACE
|
||||
#define controllistener_ref(ptr) \
|
||||
@@ -149,14 +148,6 @@ ISC_REFCOUNT_DECL(controlconnection);
|
||||
|
||||
#define CLOCKSKEW 300
|
||||
|
||||
#define CHECK(x) \
|
||||
{ \
|
||||
result = (x); \
|
||||
if (result != ISC_R_SUCCESS) { \
|
||||
goto cleanup; \
|
||||
} \
|
||||
}
|
||||
|
||||
static void
|
||||
free_controlkey(controlkey_t *key, isc_mem_t *mctx) {
|
||||
if (key->keyname != NULL) {
|
||||
@@ -179,8 +170,11 @@ free_controlkeylist(controlkeylist_t *keylist, isc_mem_t *mctx) {
|
||||
|
||||
static void
|
||||
free_listener(controllistener_t *listener) {
|
||||
REQUIRE(listener->shuttingdown);
|
||||
REQUIRE(ISC_LIST_EMPTY(listener->connections));
|
||||
INSIST(listener->exiting);
|
||||
INSIST(ISC_LIST_EMPTY(listener->connections));
|
||||
|
||||
isc_refcount_destroy(&listener->references);
|
||||
|
||||
REQUIRE(listener->sock == NULL);
|
||||
|
||||
free_controlkeylist(&listener->keys, listener->mctx);
|
||||
@@ -188,6 +182,7 @@ free_listener(controllistener_t *listener) {
|
||||
if (listener->acl != NULL) {
|
||||
dns_acl_detach(&listener->acl);
|
||||
}
|
||||
isc_mutex_destroy(&listener->connections_lock);
|
||||
|
||||
isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
|
||||
}
|
||||
@@ -202,32 +197,32 @@ ISC_REFCOUNT_IMPL(controlconnection, conn_free);
|
||||
|
||||
static void
|
||||
shutdown_listener(controllistener_t *listener) {
|
||||
controlconnection_t *conn = NULL;
|
||||
controlconnection_t *next = NULL;
|
||||
if (!listener->exiting) {
|
||||
char socktext[ISC_SOCKADDR_FORMATSIZE];
|
||||
|
||||
/* Don't shutdown the same listener twice */
|
||||
if (listener->shuttingdown) {
|
||||
return;
|
||||
for (controlconnection_t *conn =
|
||||
ISC_LIST_HEAD(listener->connections);
|
||||
conn != NULL; conn = ISC_LIST_HEAD(listener->connections))
|
||||
{
|
||||
control_recvmessage(conn->ccmsg.handle,
|
||||
ISC_R_SHUTTINGDOWN, conn);
|
||||
}
|
||||
|
||||
ISC_LIST_UNLINK(listener->controls->listeners, listener, link);
|
||||
|
||||
isc_sockaddr_format(&listener->address, socktext,
|
||||
sizeof(socktext));
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
|
||||
"stopping command channel on %s", socktext);
|
||||
#if 0
|
||||
/* XXX: no unix domain socket support */
|
||||
if (listener->type == isc_socktype_unix) {
|
||||
isc_socket_cleanunix(&listener->address, true);
|
||||
}
|
||||
#endif
|
||||
listener->exiting = true;
|
||||
}
|
||||
listener->shuttingdown = true;
|
||||
|
||||
for (conn = ISC_LIST_HEAD(listener->connections); conn != NULL;
|
||||
conn = next)
|
||||
{
|
||||
/*
|
||||
* 'conn' is likely to be freed by the conn_shutdown() call.
|
||||
*/
|
||||
next = ISC_LIST_NEXT(conn, link);
|
||||
conn_shutdown(conn);
|
||||
}
|
||||
|
||||
ISC_LIST_UNLINK(listener->controls->listeners, listener, link);
|
||||
|
||||
char socktext[ISC_SOCKADDR_FORMATSIZE];
|
||||
isc_sockaddr_format(&listener->address, socktext, sizeof(socktext));
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
|
||||
"stopping command channel on %s", socktext);
|
||||
|
||||
isc_nm_stoplistening(listener->sock);
|
||||
isc_nmsocket_close(&listener->sock);
|
||||
@@ -242,6 +237,11 @@ address_ok(isc_sockaddr_t *sockaddr, controllistener_t *listener) {
|
||||
isc_result_t result;
|
||||
int match;
|
||||
|
||||
/* ACL doesn't apply to unix domain sockets */
|
||||
if (listener->type != isc_socktype_tcp) {
|
||||
return (true);
|
||||
}
|
||||
|
||||
isc_netaddr_fromsockaddr(&netaddr, sockaddr);
|
||||
|
||||
result = dns_acl_match(&netaddr, NULL, listener->acl, env, &match,
|
||||
@@ -252,36 +252,33 @@ address_ok(isc_sockaddr_t *sockaddr, controllistener_t *listener) {
|
||||
static void
|
||||
control_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
|
||||
controlconnection_t *conn = (controlconnection_t *)arg;
|
||||
controllistener_t *listener = conn->listener;
|
||||
isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);
|
||||
|
||||
if (conn->shuttingdown) {
|
||||
/* The connection is shuttingdown */
|
||||
result = ISC_R_SHUTTINGDOWN;
|
||||
if (conn->result == ISC_R_SHUTTINGDOWN) {
|
||||
isc_loopmgr_shutdown(named_g_loopmgr);
|
||||
goto cleanup_sendhandle;
|
||||
}
|
||||
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
/* Everything is peachy, continue reading from the socket */
|
||||
isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage,
|
||||
conn);
|
||||
/* Detach the sending reference */
|
||||
controlconnection_detach(&conn);
|
||||
return;
|
||||
}
|
||||
|
||||
if (result != ISC_R_SHUTTINGDOWN) {
|
||||
if (listener->controls->shuttingdown || result == ISC_R_SHUTTINGDOWN) {
|
||||
goto cleanup_sendhandle;
|
||||
} else if (result != ISC_R_SUCCESS) {
|
||||
char socktext[ISC_SOCKADDR_FORMATSIZE];
|
||||
isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);
|
||||
|
||||
isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
|
||||
"error sending command response to %s: %s",
|
||||
socktext, isc_result_totext(result));
|
||||
goto cleanup_sendhandle;
|
||||
}
|
||||
|
||||
/* Shutdown the reading */
|
||||
conn_shutdown(conn);
|
||||
isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);
|
||||
|
||||
/* Detach the sending reference */
|
||||
cleanup_sendhandle:
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
control_recvmessage(handle, result, conn);
|
||||
}
|
||||
controlconnection_detach(&conn);
|
||||
}
|
||||
|
||||
@@ -388,7 +385,6 @@ control_respond(controlconnection_t *conn) {
|
||||
r.base = conn->buffer->base;
|
||||
r.length = conn->buffer->used;
|
||||
|
||||
/* Attach the sending reference */
|
||||
controlconnection_ref(conn);
|
||||
isccc_ccmsg_sendmessage(&conn->ccmsg, &r, control_senddone, conn);
|
||||
|
||||
@@ -399,33 +395,13 @@ cleanup:
|
||||
static void
|
||||
control_command(void *arg) {
|
||||
controlconnection_t *conn = (controlconnection_t *)arg;
|
||||
controllistener_t *listener = conn->listener;
|
||||
|
||||
/* Don't run the command if we already started the shutdown */
|
||||
if (!conn->shuttingdown) {
|
||||
if (!listener->controls->shuttingdown) {
|
||||
conn->result = named_control_docommand(
|
||||
conn->request, conn->listener->readonly, &conn->text);
|
||||
conn->request, listener->readonly, &conn->text);
|
||||
control_respond(conn);
|
||||
}
|
||||
|
||||
/* Detach the control command reference */
|
||||
controlconnection_detach(&conn);
|
||||
}
|
||||
|
||||
static void
|
||||
conn_shutdown(controlconnection_t *conn) {
|
||||
/* Don't shutdown the same controlconnection twice */
|
||||
if (conn->shuttingdown) {
|
||||
return;
|
||||
}
|
||||
conn->shuttingdown = true;
|
||||
|
||||
/*
|
||||
* Close the TCP connection to make sure that no read callback will be
|
||||
* called for it ever again.
|
||||
*/
|
||||
isccc_ccmsg_disconnect(&conn->ccmsg);
|
||||
|
||||
/* Detach the reading reference */
|
||||
controlconnection_detach(&conn);
|
||||
}
|
||||
|
||||
@@ -439,7 +415,21 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
isccc_time_t exp;
|
||||
uint32_t nonce;
|
||||
|
||||
if (conn->shuttingdown) {
|
||||
return;
|
||||
}
|
||||
|
||||
/* Is the server shutting down? */
|
||||
if (listener->controls->shuttingdown) {
|
||||
result = ISC_R_SHUTTINGDOWN;
|
||||
}
|
||||
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
if (result == ISC_R_SHUTTINGDOWN) {
|
||||
listener->controls->shuttingdown = true;
|
||||
} else if (result != ISC_R_EOF) {
|
||||
log_invalid(&conn->ccmsg, result);
|
||||
}
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
@@ -465,13 +455,13 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
}
|
||||
|
||||
if (key == NULL) {
|
||||
result = ISCCC_R_BADAUTH;
|
||||
log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
/* We shouldn't be getting a reply. */
|
||||
if (isccc_cc_isreply(conn->request)) {
|
||||
result = ISC_R_FAILURE;
|
||||
log_invalid(&conn->ccmsg, ISC_R_FAILURE);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
@@ -482,7 +472,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
*/
|
||||
conn->ctrl = isccc_alist_lookup(conn->request, "_ctrl");
|
||||
if (!isccc_alist_alistp(conn->ctrl)) {
|
||||
result = ISC_R_FAILURE;
|
||||
log_invalid(&conn->ccmsg, ISC_R_FAILURE);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
@@ -490,11 +480,11 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
if ((sent + CLOCKSKEW) < conn->now ||
|
||||
(sent - CLOCKSKEW) > conn->now)
|
||||
{
|
||||
result = ISCCC_R_CLOCKSKEW;
|
||||
log_invalid(&conn->ccmsg, ISCCC_R_CLOCKSKEW);
|
||||
goto cleanup;
|
||||
}
|
||||
} else {
|
||||
result = ISC_R_FAILURE;
|
||||
log_invalid(&conn->ccmsg, ISC_R_FAILURE);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
@@ -504,7 +494,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
if (isccc_cc_lookupuint32(conn->ctrl, "_exp", &exp) == ISC_R_SUCCESS &&
|
||||
conn->now > exp)
|
||||
{
|
||||
result = ISCCC_R_EXPIRED;
|
||||
log_invalid(&conn->ccmsg, ISCCC_R_EXPIRED);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
@@ -520,6 +510,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
if (result == ISC_R_EXISTS) {
|
||||
result = ISCCC_R_DUPLICATE;
|
||||
}
|
||||
log_invalid(&conn->ccmsg, result);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
@@ -528,7 +519,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
ISC_R_SUCCESS ||
|
||||
conn->nonce != nonce))
|
||||
{
|
||||
result = ISCCC_R_BADAUTH;
|
||||
log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
@@ -546,48 +537,40 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
|
||||
return;
|
||||
}
|
||||
|
||||
/* Attach the command reference */
|
||||
/*
|
||||
* Trigger the command.
|
||||
*/
|
||||
controlconnection_ref(conn);
|
||||
|
||||
/* Trigger the command asynchronously. */
|
||||
isc_async_run(named_g_mainloop, control_command, conn);
|
||||
|
||||
return;
|
||||
|
||||
cleanup:
|
||||
switch (result) {
|
||||
case ISC_R_SHUTTINGDOWN:
|
||||
case ISC_R_EOF:
|
||||
break;
|
||||
default:
|
||||
log_invalid(&conn->ccmsg, result);
|
||||
}
|
||||
|
||||
conn_shutdown(conn);
|
||||
conn->shuttingdown = true;
|
||||
controlconnection_detach(&conn);
|
||||
}
|
||||
|
||||
static void
|
||||
conn_free(controlconnection_t *conn) {
|
||||
/* Make sure that the connection was shutdown first */
|
||||
REQUIRE(conn->shuttingdown);
|
||||
|
||||
controllistener_t *listener = conn->listener;
|
||||
|
||||
isccc_ccmsg_invalidate(&conn->ccmsg);
|
||||
|
||||
conn_cleanup(conn);
|
||||
|
||||
if (conn->buffer != NULL) {
|
||||
isc_buffer_free(&conn->buffer);
|
||||
}
|
||||
|
||||
LOCK(&listener->connections_lock);
|
||||
ISC_LIST_UNLINK(listener->connections, conn, link);
|
||||
UNLOCK(&listener->connections_lock);
|
||||
#ifdef ENABLE_AFL
|
||||
if (named_g_fuzz_type == isc_fuzz_rndc) {
|
||||
named_fuzz_notify();
|
||||
}
|
||||
#endif /* ifdef ENABLE_AFL */
|
||||
|
||||
isccc_ccmsg_invalidate(&conn->ccmsg);
|
||||
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
|
||||
"freeing control connection");
|
||||
@@ -599,26 +582,15 @@ conn_free(controlconnection_t *conn) {
|
||||
|
||||
static void
|
||||
newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
|
||||
/* Don't create new connection if we are shutting down */
|
||||
if (listener->shuttingdown) {
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
|
||||
"rejected new control connection: %s",
|
||||
isc_result_totext(ISC_R_SHUTTINGDOWN));
|
||||
return;
|
||||
}
|
||||
|
||||
controlconnection_t *conn = isc_mem_get(listener->mctx, sizeof(*conn));
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
|
||||
"allocate new control connection");
|
||||
|
||||
*conn = (controlconnection_t){
|
||||
.alg = DST_ALG_UNKNOWN,
|
||||
.references = ISC_REFCOUNT_INITIALIZER(1),
|
||||
.listener = controllistener_ref(listener),
|
||||
.link = ISC_LINK_INITIALIZER,
|
||||
};
|
||||
*conn = (controlconnection_t){ .alg = DST_ALG_UNKNOWN };
|
||||
|
||||
isc_refcount_init(&conn->references, 1);
|
||||
controllistener_attach(listener, &conn->listener);
|
||||
|
||||
/* isccc_ccmsg_init() attaches to the handle */
|
||||
isccc_ccmsg_init(listener->mctx, handle, &conn->ccmsg);
|
||||
@@ -626,9 +598,10 @@ newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
|
||||
/* Set a 32 KiB upper limit on incoming message. */
|
||||
isccc_ccmsg_setmaxsize(&conn->ccmsg, 32768);
|
||||
|
||||
ISC_LIST_APPEND(listener->connections, conn, link);
|
||||
LOCK(&listener->connections_lock);
|
||||
ISC_LIST_INITANDAPPEND(listener->connections, conn, link);
|
||||
UNLOCK(&listener->connections_lock);
|
||||
|
||||
/* The reading reference has been initialized in the initializer */
|
||||
isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);
|
||||
}
|
||||
|
||||
@@ -668,7 +641,8 @@ controls_shutdown(named_controls_t *controls) {
|
||||
listener = next)
|
||||
{
|
||||
/*
|
||||
* As listeners shut down, they will call their callbacks.
|
||||
* This is asynchronous. As listeners shut down, they will
|
||||
* call their callbacks.
|
||||
*/
|
||||
next = ISC_LIST_NEXT(listener, link);
|
||||
shutdown_listener(listener);
|
||||
@@ -677,20 +651,8 @@ controls_shutdown(named_controls_t *controls) {
|
||||
|
||||
void
|
||||
named_controls_shutdown(named_controls_t *controls) {
|
||||
/*
|
||||
* Don't ever shutdown the controls twice.
|
||||
*
|
||||
* NOTE: This functions is called when the server is shutting down, but
|
||||
* controls_shutdown() can and will be called multiple times - on each
|
||||
* reconfiguration, the listeners will be torn down and recreated again,
|
||||
* see named_controls_configure() for details.
|
||||
*/
|
||||
if (controls->shuttingdown) {
|
||||
return;
|
||||
}
|
||||
controls->shuttingdown = true;
|
||||
|
||||
controls_shutdown(controls);
|
||||
controls->shuttingdown = true;
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
@@ -780,8 +742,8 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
|
||||
algstr = cfg_obj_asstring(algobj);
|
||||
secretstr = cfg_obj_asstring(secretobj);
|
||||
|
||||
result = named_config_getkeyalgorithm(algstr, &algtype,
|
||||
NULL);
|
||||
result = named_config_getkeyalgorithm2(algstr, NULL,
|
||||
&algtype, NULL);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
cfg_obj_log(control, named_g_lctx,
|
||||
ISC_LOG_WARNING,
|
||||
@@ -819,6 +781,14 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
|
||||
}
|
||||
}
|
||||
|
||||
#define CHECK(x) \
|
||||
do { \
|
||||
result = (x); \
|
||||
if (result != ISC_R_SUCCESS) { \
|
||||
goto cleanup; \
|
||||
} \
|
||||
} while (0)
|
||||
|
||||
static isc_result_t
|
||||
get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
|
||||
isc_result_t result;
|
||||
@@ -866,7 +836,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
|
||||
algstr = cfg_obj_asstring(algobj);
|
||||
secretstr = cfg_obj_asstring(secretobj);
|
||||
|
||||
result = named_config_getkeyalgorithm(algstr, &algtype, NULL);
|
||||
result = named_config_getkeyalgorithm2(algstr, NULL, &algtype, NULL);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
|
||||
"unsupported algorithm '%s' in "
|
||||
@@ -1061,6 +1031,33 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
|
||||
socktext, isc_result_totext(result));
|
||||
}
|
||||
|
||||
#if 0
|
||||
/* XXX: no unix socket support yet */
|
||||
if (result == ISC_R_SUCCESS && type == isc_socktype_unix) {
|
||||
uint32_t perm, owner, group;
|
||||
perm = cfg_obj_asuint32(cfg_tuple_get(control, "perm"));
|
||||
owner = cfg_obj_asuint32(cfg_tuple_get(control, "owner"));
|
||||
group = cfg_obj_asuint32(cfg_tuple_get(control, "group"));
|
||||
result = ISC_R_SUCCESS;
|
||||
if (listener->perm != perm || listener->owner != owner ||
|
||||
listener->group != group)
|
||||
{
|
||||
result = isc_socket_permunix(&listener->address, perm,
|
||||
owner, group);
|
||||
}
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
listener->perm = perm;
|
||||
listener->owner = owner;
|
||||
listener->group = group;
|
||||
} else if (control != NULL) {
|
||||
cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
|
||||
"couldn't update ownership/permission for "
|
||||
"command channel %s",
|
||||
socktext);
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
*listenerp = listener;
|
||||
}
|
||||
|
||||
@@ -1078,17 +1075,12 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
|
||||
isc_result_t result = ISC_R_SUCCESS;
|
||||
int pf;
|
||||
|
||||
/* Don't create new listener if we are shutting down */
|
||||
if (cp->shuttingdown) {
|
||||
result = ISC_R_SHUTTINGDOWN;
|
||||
goto shuttingdown;
|
||||
}
|
||||
|
||||
listener = isc_mem_get(mctx, sizeof(*listener));
|
||||
*listener = (controllistener_t){ .controls = cp,
|
||||
.address = *addr,
|
||||
.type = type };
|
||||
isc_mem_attach(mctx, &listener->mctx);
|
||||
isc_mutex_init(&listener->connections_lock);
|
||||
ISC_LINK_INIT(listener, link);
|
||||
ISC_LIST_INIT(listener->keys);
|
||||
ISC_LIST_INIT(listener->connections);
|
||||
@@ -1137,14 +1129,35 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
|
||||
|
||||
pf = isc_sockaddr_pf(&listener->address);
|
||||
if ((pf == AF_INET && isc_net_probeipv4() != ISC_R_SUCCESS) ||
|
||||
(pf == AF_UNIX && isc_net_probeunix() != ISC_R_SUCCESS) ||
|
||||
(pf == AF_INET6 && isc_net_probeipv6() != ISC_R_SUCCESS))
|
||||
{
|
||||
CHECK(ISC_R_FAMILYNOSUPPORT);
|
||||
}
|
||||
|
||||
#if 0
|
||||
/* XXX: no unix socket support yet */
|
||||
if (type == isc_socktype_unix) {
|
||||
isc_socket_cleanunix(&listener->address, false);
|
||||
}
|
||||
#endif
|
||||
|
||||
CHECK(isc_nm_listentcp(named_g_netmgr, ISC_NM_LISTEN_ONE,
|
||||
&listener->address, control_newconn, listener, 5,
|
||||
NULL, &listener->sock));
|
||||
#if 0
|
||||
/* XXX: no unix socket support yet */
|
||||
if (type == isc_socktype_unix) {
|
||||
listener->perm =
|
||||
cfg_obj_asuint32(cfg_tuple_get(control, "perm"));
|
||||
listener->owner =
|
||||
cfg_obj_asuint32(cfg_tuple_get(control, "owner"));
|
||||
listener->group =
|
||||
cfg_obj_asuint32(cfg_tuple_get(control, "group"));
|
||||
result = isc_socket_permunix(&listener->address, listener->perm,
|
||||
listener->owner, listener->group);
|
||||
}
|
||||
#endif
|
||||
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
|
||||
@@ -1154,10 +1167,9 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
|
||||
|
||||
cleanup:
|
||||
isc_refcount_decrement(&listener->references);
|
||||
listener->shuttingdown = true;
|
||||
listener->exiting = true;
|
||||
free_listener(listener);
|
||||
|
||||
shuttingdown:
|
||||
if (control != NULL) {
|
||||
cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
|
||||
"couldn't add command channel %s: %s", socktext,
|
||||
@@ -1202,19 +1214,8 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
|
||||
{
|
||||
const cfg_obj_t *controls = NULL;
|
||||
const cfg_obj_t *inetcontrols = NULL;
|
||||
const cfg_obj_t *unixcontrols = NULL;
|
||||
|
||||
controls = cfg_listelt_value(element);
|
||||
|
||||
(void)cfg_map_get(controls, "unix", &unixcontrols);
|
||||
if (unixcontrols != NULL) {
|
||||
cfg_obj_log(controls, named_g_lctx,
|
||||
ISC_LOG_ERROR,
|
||||
"UNIX domain sockets are not "
|
||||
"supported");
|
||||
return (ISC_R_FAILURE);
|
||||
}
|
||||
|
||||
(void)cfg_map_get(controls, "inet", &inetcontrols);
|
||||
if (inetcontrols == NULL) {
|
||||
continue;
|
||||
@@ -1230,8 +1231,8 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
|
||||
|
||||
/*
|
||||
* The parser handles BIND 8 configuration file
|
||||
* syntax, so it allows inet phrases with no
|
||||
* keys{} clause.
|
||||
* syntax, so it allows unix phrases as well
|
||||
* inet phrases with no keys{} clause.
|
||||
*/
|
||||
control = cfg_listelt_value(element2);
|
||||
|
||||
@@ -1279,6 +1280,91 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
|
||||
}
|
||||
}
|
||||
}
|
||||
for (element = cfg_list_first(controlslist); element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *controls = NULL;
|
||||
const cfg_obj_t *unixcontrols = NULL;
|
||||
|
||||
controls = cfg_listelt_value(element);
|
||||
(void)cfg_map_get(controls, "unix", &unixcontrols);
|
||||
if (unixcontrols == NULL) {
|
||||
continue;
|
||||
}
|
||||
|
||||
cfg_obj_log(controls, named_g_lctx, ISC_LOG_ERROR,
|
||||
"UNIX domain sockets not yet supported");
|
||||
return (ISC_R_FAILURE);
|
||||
|
||||
#if 0
|
||||
/* XXX: no unix domain socket support in netmgr */
|
||||
for (element2 = cfg_list_first(unixcontrols);
|
||||
element2 != NULL;
|
||||
element2 = cfg_list_next(element2))
|
||||
{
|
||||
const cfg_obj_t *control = NULL;
|
||||
const cfg_obj_t *path = NULL;
|
||||
isc_sockaddr_t addr;
|
||||
isc_result_t result;
|
||||
|
||||
/*
|
||||
* The parser handles BIND 8 configuration file
|
||||
* syntax, so it allows unix phrases as well
|
||||
* inet phrases with no keys{} clause.
|
||||
*/
|
||||
control = cfg_listelt_value(element2);
|
||||
|
||||
path = cfg_tuple_get(control, "path");
|
||||
result = isc_sockaddr_frompath(
|
||||
&addr, cfg_obj_asstring(path));
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
isc_log_write(
|
||||
named_g_lctx,
|
||||
NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL,
|
||||
ISC_LOG_DEBUG(9),
|
||||
"control channel '%s': %s",
|
||||
cfg_obj_asstring(path),
|
||||
isc_result_totext(result));
|
||||
continue;
|
||||
}
|
||||
|
||||
isc_log_write(named_g_lctx,
|
||||
NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL,
|
||||
ISC_LOG_DEBUG(9),
|
||||
"processing control channel '%s'",
|
||||
cfg_obj_asstring(path));
|
||||
|
||||
update_listener(cp, &listener, control, config,
|
||||
&addr, aclconfctx,
|
||||
cfg_obj_asstring(path),
|
||||
isc_socktype_unix);
|
||||
|
||||
if (listener != NULL) {
|
||||
/*
|
||||
* Remove the listener from the old
|
||||
* list, so it won't be shut down.
|
||||
*/
|
||||
ISC_LIST_UNLINK(cp->listeners, listener,
|
||||
link);
|
||||
} else {
|
||||
/*
|
||||
* This is a new listener.
|
||||
*/
|
||||
add_listener(cp, &listener, control,
|
||||
config, &addr, aclconfctx,
|
||||
cfg_obj_asstring(path),
|
||||
isc_socktype_unix);
|
||||
}
|
||||
|
||||
if (listener != NULL) {
|
||||
ISC_LIST_APPEND(new_listeners, listener,
|
||||
link);
|
||||
}
|
||||
}
|
||||
#endif
|
||||
}
|
||||
} else {
|
||||
int i;
|
||||
|
||||
@@ -1375,7 +1461,6 @@ named_controls_destroy(named_controls_t **ctrlsp) {
|
||||
named_controls_t *controls = *ctrlsp;
|
||||
*ctrlsp = NULL;
|
||||
|
||||
REQUIRE(controls->shuttingdown);
|
||||
REQUIRE(ISC_LIST_EMPTY(controls->listeners));
|
||||
|
||||
LOCK(&controls->symtab_lock);
|
||||
|
||||
@@ -66,5 +66,8 @@ named_config_getport(const cfg_obj_t *config, const char *type,
|
||||
in_port_t *portp);
|
||||
|
||||
isc_result_t
|
||||
named_config_getkeyalgorithm(const char *str, unsigned int *typep,
|
||||
named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
|
||||
uint16_t *digestbits);
|
||||
isc_result_t
|
||||
named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
|
||||
unsigned int *typep, uint16_t *digestbits);
|
||||
|
||||
@@ -50,6 +50,7 @@
|
||||
|
||||
EXTERN isc_mem_t *named_g_mctx INIT(NULL);
|
||||
EXTERN unsigned int named_g_cpus INIT(0);
|
||||
EXTERN unsigned int named_g_udpdisp INIT(0);
|
||||
EXTERN isc_loop_t *named_g_mainloop INIT(NULL);
|
||||
EXTERN isc_loopmgr_t *named_g_loopmgr INIT(NULL);
|
||||
EXTERN bool named_g_loopmgr_running INIT(false);
|
||||
@@ -118,6 +119,11 @@ EXTERN const char *named_g_logfile INIT(NULL);
|
||||
EXTERN const char *named_g_defaultsessionkeyfile INIT(NAMED_LOCALSTATEDIR
|
||||
"/run/named/"
|
||||
"session.key");
|
||||
EXTERN const char *named_g_defaultlockfile INIT(NAMED_LOCALSTATEDIR "/run/"
|
||||
"named/"
|
||||
"named."
|
||||
"lock");
|
||||
EXTERN bool named_g_forcelock INIT(false);
|
||||
|
||||
#if NAMED_RUN_PID_DIR
|
||||
EXTERN const char *named_g_defaultpidfile INIT(NAMED_LOCALSTATEDIR "/run/named/"
|
||||
|
||||
@@ -56,6 +56,9 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user);
|
||||
void
|
||||
named_os_writepidfile(const char *filename, bool first_time);
|
||||
|
||||
bool
|
||||
named_os_issingleton(const char *filename);
|
||||
|
||||
void
|
||||
named_os_shutdown(void);
|
||||
|
||||
|
||||
@@ -65,7 +65,6 @@ struct named_server {
|
||||
dns_zonemgr_t *zonemgr;
|
||||
dns_viewlist_t viewlist;
|
||||
dns_kasplist_t kasplist;
|
||||
dns_keystorelist_t keystorelist;
|
||||
ns_interfacemgr_t *interfacemgr;
|
||||
dns_db_t *in_roothints;
|
||||
|
||||
@@ -93,7 +92,7 @@ struct named_server {
|
||||
|
||||
named_statschannellist_t statschannels;
|
||||
|
||||
dst_key_t *sessionkey;
|
||||
dns_tsigkey_t *sessionkey;
|
||||
char *session_keyfile;
|
||||
dns_name_t *session_keyname;
|
||||
unsigned int session_keyalg;
|
||||
@@ -104,6 +103,8 @@ struct named_server {
|
||||
|
||||
dns_dtenv_t *dtenv; /*%< Dnstap environment */
|
||||
|
||||
char *lockfile;
|
||||
|
||||
isc_tlsctx_cache_t *tlsctx_server_cache;
|
||||
isc_tlsctx_cache_t *tlsctx_client_cache;
|
||||
|
||||
|
||||
@@ -22,7 +22,7 @@ ISC_LANG_BEGINDECLS
|
||||
|
||||
isc_result_t
|
||||
named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
isc_mem_t *mctx, dns_tsigkeyring_t **ringp);
|
||||
isc_mem_t *mctx, dns_tsig_keyring_t **ringp);
|
||||
/*%<
|
||||
* Create a TSIG key ring and configure it according to the 'key'
|
||||
* statements in the global and view configuration objects.
|
||||
|
||||
@@ -28,8 +28,8 @@ ISC_LANG_BEGINDECLS
|
||||
isc_result_t
|
||||
named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
|
||||
dns_kasplist_t *kasplist, dns_keystorelist_t *keystores,
|
||||
dns_zone_t *zone, dns_zone_t *raw);
|
||||
dns_kasplist_t *kasplist, dns_zone_t *zone,
|
||||
dns_zone_t *raw);
|
||||
/*%<
|
||||
* Configure or reconfigure a zone according to the named.conf
|
||||
* data.
|
||||
@@ -44,9 +44,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
*/
|
||||
|
||||
bool
|
||||
named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
|
||||
const cfg_obj_t *vconfig, const cfg_obj_t *config,
|
||||
dns_kasplist_t *kasplist);
|
||||
named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig);
|
||||
/*%<
|
||||
* If 'zone' can be safely reconfigured according to the configuration
|
||||
* data in 'zconfig', return true. If the configuration data is so
|
||||
@@ -55,12 +53,10 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
|
||||
*/
|
||||
|
||||
bool
|
||||
named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
|
||||
const cfg_obj_t *config, dns_kasplist_t *kasplist);
|
||||
named_zone_inlinesigning(const cfg_obj_t *zconfig);
|
||||
/*%<
|
||||
* Determine if zone uses inline-signing. This is true if inline-signing
|
||||
* is set to yes, in the zone clause or in the zone's dnssec-policy clause.
|
||||
* By default, dnssec-policy uses inline-signing.
|
||||
* is set to yes.
|
||||
*/
|
||||
|
||||
isc_result_t
|
||||
|
||||
+29
-71
@@ -89,7 +89,6 @@
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/opensslv.h>
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/provider.h>
|
||||
#endif
|
||||
#ifdef HAVE_LIBXML2
|
||||
@@ -103,14 +102,6 @@
|
||||
#include <nghttp2/nghttp2.h>
|
||||
#endif
|
||||
|
||||
/* On DragonFly BSD the header does not provide jemalloc API */
|
||||
#if defined(HAVE_MALLOC_NP_H) && !defined(__DragonFly__)
|
||||
#include <malloc_np.h>
|
||||
#include <sys/malloc.h> /* For M_VERSION */
|
||||
#elif defined(HAVE_JEMALLOC)
|
||||
#include <jemalloc/jemalloc.h>
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Include header files for database drivers here.
|
||||
*/
|
||||
@@ -194,7 +185,7 @@ named_main_earlyfatal(const char *format, ...) {
|
||||
}
|
||||
va_end(args);
|
||||
|
||||
_exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
noreturn static void
|
||||
@@ -233,7 +224,7 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
|
||||
if (named_g_coreok) {
|
||||
abort();
|
||||
}
|
||||
_exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
noreturn static void
|
||||
@@ -273,7 +264,7 @@ library_fatal_error(const char *file, int line, const char *func,
|
||||
if (named_g_coreok) {
|
||||
abort();
|
||||
}
|
||||
_exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -312,7 +303,7 @@ usage(void) {
|
||||
"[-p port] [-s]\n"
|
||||
" [-S sockets] [-t chrootdir] [-u "
|
||||
"username] [-U listeners]\n"
|
||||
" [-m "
|
||||
" [-X lockfile] [-m "
|
||||
"{usage|trace|record|size|mctx}]\n"
|
||||
" [-M fill|nofill]\n"
|
||||
"usage: named [-v|-V|-C]\n");
|
||||
@@ -493,9 +484,6 @@ list_hmac_algorithms(isc_buffer_t *b) {
|
||||
for (dst_algorithm_t i = DST_ALG_HMAC_FIRST; i <= DST_ALG_HMAC_LAST;
|
||||
i++)
|
||||
{
|
||||
if (i == DST_ALG_GSSAPI) {
|
||||
continue;
|
||||
}
|
||||
if (dst_algorithm_supported(i)) {
|
||||
isc_buffer_putstr(b, " ");
|
||||
isc_buffer_putstr(b, dst_hmac_algorithm_totext(i));
|
||||
@@ -604,13 +592,6 @@ printversion(bool verbose) {
|
||||
UV_VERSION_MINOR, UV_VERSION_PATCH);
|
||||
printf("linked to libuv version: %s\n", uv_version_string());
|
||||
printf("compiled with %s version: %s\n", RCU_FLAVOR, RCU_VERSION);
|
||||
#if defined(JEMALLOC_VERSION)
|
||||
printf("compiled with jemalloc version: %u.%u.%u\n",
|
||||
JEMALLOC_VERSION_MAJOR, JEMALLOC_VERSION_MINOR,
|
||||
JEMALLOC_VERSION_BUGFIX);
|
||||
#elif defined(M_VERSION)
|
||||
printf("compiled with system jemalloc version: %u\n", M_VERSION);
|
||||
#endif
|
||||
#if HAVE_LIBNGHTTP2
|
||||
nghttp2_info *nginfo = NULL;
|
||||
printf("compiled with libnghttp2 version: %s\n", NGHTTP2_VERSION);
|
||||
@@ -671,6 +652,7 @@ printversion(bool verbose) {
|
||||
printf(" rndc configuration: %s\n", rndcconf);
|
||||
printf(" nsupdate session key: %s\n", named_g_defaultsessionkeyfile);
|
||||
printf(" named PID file: %s\n", named_g_defaultpidfile);
|
||||
printf(" named lock file: %s\n", named_g_defaultlockfile);
|
||||
#if defined(HAVE_GEOIP2)
|
||||
#define RTC(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
|
||||
RTC(cfg_parser_create(mctx, named_g_lctx, &parser));
|
||||
@@ -892,7 +874,7 @@ parse_command_line(int argc, char *argv[]) {
|
||||
printf("# Built-in default values. "
|
||||
"This is NOT the run-time configuration!\n");
|
||||
printf("%s", named_config_getdefault());
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
case 'd':
|
||||
named_g_debuglevel = parse_int(isc_commandline_argument,
|
||||
"debug "
|
||||
@@ -948,36 +930,41 @@ parse_command_line(int argc, char *argv[]) {
|
||||
parse_T_opt(isc_commandline_argument);
|
||||
break;
|
||||
case 'U':
|
||||
/* Obsolete. No longer in use. Ignore. */
|
||||
named_g_udpdisp = parse_int(isc_commandline_argument,
|
||||
"number of UDP listeners "
|
||||
"per interface");
|
||||
break;
|
||||
case 'u':
|
||||
named_g_username = isc_commandline_argument;
|
||||
break;
|
||||
case 'v':
|
||||
printversion(false);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
case 'V':
|
||||
printversion(true);
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
case 'x':
|
||||
/* Obsolete. No longer in use. Ignore. */
|
||||
break;
|
||||
case 'X':
|
||||
/* Obsolete. No longer in use. Abort. */
|
||||
named_main_earlyfatal("option '-X' has been removed");
|
||||
named_g_forcelock = true;
|
||||
if (strcasecmp(isc_commandline_argument, "none") != 0) {
|
||||
named_g_defaultlockfile =
|
||||
isc_commandline_argument;
|
||||
} else {
|
||||
named_g_defaultlockfile = NULL;
|
||||
}
|
||||
break;
|
||||
case 'F':
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
|
||||
fips = OSSL_PROVIDER_load(NULL, "fips");
|
||||
if (fips == NULL) {
|
||||
ERR_clear_error();
|
||||
named_main_earlyfatal(
|
||||
"Failed to load FIPS provider");
|
||||
}
|
||||
base = OSSL_PROVIDER_load(NULL, "base");
|
||||
if (base == NULL) {
|
||||
OSSL_PROVIDER_unload(fips);
|
||||
ERR_clear_error();
|
||||
named_main_earlyfatal(
|
||||
"Failed to load base provider");
|
||||
}
|
||||
@@ -993,7 +980,7 @@ parse_command_line(int argc, char *argv[]) {
|
||||
case '?':
|
||||
usage();
|
||||
if (isc_commandline_option == '?') {
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
}
|
||||
p = strchr(NAMED_MAIN_ARGS, isc_commandline_option);
|
||||
if (p == NULL || *++p != ':') {
|
||||
@@ -1036,6 +1023,16 @@ create_managers(void) {
|
||||
ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
|
||||
named_g_cpus_detected, named_g_cpus_detected == 1 ? "" : "s",
|
||||
named_g_cpus, named_g_cpus == 1 ? "" : "s");
|
||||
if (named_g_udpdisp == 0) {
|
||||
named_g_udpdisp = named_g_cpus_detected;
|
||||
}
|
||||
if (named_g_udpdisp > named_g_cpus) {
|
||||
named_g_udpdisp = named_g_cpus;
|
||||
}
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
|
||||
"using %u UDP listener%s per interface", named_g_udpdisp,
|
||||
named_g_udpdisp == 1 ? "" : "s");
|
||||
|
||||
isc_managers_create(&named_g_mctx, named_g_cpus, &named_g_loopmgr,
|
||||
&named_g_netmgr);
|
||||
@@ -1178,30 +1175,6 @@ setup(void) {
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"linked to libuv version: %s", uv_version_string());
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"compiled with %s version: %s", RCU_FLAVOR, RCU_VERSION);
|
||||
#if defined(JEMALLOC_VERSION)
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"compiled with jemalloc version: %u.%u.%u",
|
||||
JEMALLOC_VERSION_MAJOR, JEMALLOC_VERSION_MINOR,
|
||||
JEMALLOC_VERSION_BUGFIX);
|
||||
#elif defined(M_VERSION)
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"compiled with system jemalloc version: %u", M_VERSION);
|
||||
#endif
|
||||
#if HAVE_LIBNGHTTP2
|
||||
nghttp2_info *nginfo = NULL;
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"compiled with libnghttp2 version: %s", NGHTTP2_VERSION);
|
||||
nginfo = nghttp2_version(1);
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"linked to libnghttp2 version: %s", nginfo->version_str);
|
||||
#endif
|
||||
#ifdef HAVE_LIBXML2
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
@@ -1227,21 +1200,6 @@ setup(void) {
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"linked to zlib version: %s", zlibVersion());
|
||||
#endif /* if defined(HAVE_ZLIB) && defined(ZLIB_VERSION) */
|
||||
#if defined(HAVE_GEOIP2)
|
||||
/* Unfortunately, no version define on link time */
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"linked to maxminddb version: %s", MMDB_lib_version());
|
||||
#endif /* if defined(HAVE_GEOIP2) */
|
||||
#if defined(HAVE_DNSTAP)
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"compiled with protobuf-c version: %s",
|
||||
PROTOBUF_C_VERSION);
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"linked to protobuf-c version: %s", protobuf_c_version());
|
||||
#endif /* if defined(HAVE_DNSTAP) */
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
|
||||
"----------------------------------------------------");
|
||||
|
||||
+5
-2
@@ -21,7 +21,7 @@ named - Internet domain name server
|
||||
Synopsis
|
||||
~~~~~~~~
|
||||
|
||||
:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-E** engine-name] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-U** #listeners] [**-u** user] [**-v**] [**-V**] ]
|
||||
:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-E** engine-name] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-U** #listeners] [**-u** user] [**-v**] [**-V**] [**-X** lock-file]
|
||||
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
@@ -198,7 +198,10 @@ Options
|
||||
|
||||
.. option:: -X lock-file
|
||||
|
||||
This option has been removed and using it will cause a fatal error.
|
||||
This option acquires a lock on the specified file at runtime; this helps to
|
||||
prevent duplicate :program:`named` instances from running simultaneously.
|
||||
Use of this option overrides the ``lock-file`` option in
|
||||
:iscman:`named.conf`. If set to ``none``, the lock file check is disabled.
|
||||
|
||||
Signals
|
||||
~~~~~~~
|
||||
|
||||
+81
-2
@@ -51,7 +51,9 @@
|
||||
#endif /* ifdef HAVE_LIBSCF */
|
||||
|
||||
static char *pidfile = NULL;
|
||||
static char *lockfile = NULL;
|
||||
static int devnullfd = -1;
|
||||
static int singletonfd = -1;
|
||||
|
||||
#ifndef ISC_FACILITY
|
||||
#define ISC_FACILITY LOG_DAEMON
|
||||
@@ -428,10 +430,10 @@ named_os_daemonize(void) {
|
||||
char buf;
|
||||
n = read(dfd[0], &buf, 1);
|
||||
if (n == 1) {
|
||||
_exit(EXIT_SUCCESS);
|
||||
_exit(0);
|
||||
}
|
||||
} while (n == -1 && errno == EINTR);
|
||||
_exit(EXIT_FAILURE);
|
||||
_exit(1);
|
||||
}
|
||||
(void)close(dfd[0]);
|
||||
|
||||
@@ -703,6 +705,24 @@ cleanup_pidfile(void) {
|
||||
pidfile = NULL;
|
||||
}
|
||||
|
||||
static void
|
||||
cleanup_lockfile(void) {
|
||||
if (singletonfd != -1) {
|
||||
close(singletonfd);
|
||||
singletonfd = -1;
|
||||
}
|
||||
|
||||
if (lockfile != NULL) {
|
||||
int n = unlink(lockfile);
|
||||
if (n == -1 && errno != ENOENT) {
|
||||
named_main_earlywarning("unlink '%s': failed",
|
||||
lockfile);
|
||||
}
|
||||
free(lockfile);
|
||||
lockfile = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Ensure that a directory exists.
|
||||
* NOTE: This function overwrites the '/' characters in 'filename' with
|
||||
@@ -886,10 +906,69 @@ named_os_writepidfile(const char *filename, bool first_time) {
|
||||
(void)fclose(fh);
|
||||
}
|
||||
|
||||
bool
|
||||
named_os_issingleton(const char *filename) {
|
||||
char strbuf[ISC_STRERRORSIZE];
|
||||
struct flock lock;
|
||||
|
||||
if (singletonfd != -1) {
|
||||
return (true);
|
||||
}
|
||||
|
||||
if (strcasecmp(filename, "none") == 0) {
|
||||
return (true);
|
||||
}
|
||||
|
||||
/*
|
||||
* Make the containing directory if it doesn't exist.
|
||||
*/
|
||||
lockfile = strdup(filename);
|
||||
if (lockfile == NULL) {
|
||||
strerror_r(errno, strbuf, sizeof(strbuf));
|
||||
named_main_earlyfatal("couldn't allocate memory for '%s': %s",
|
||||
filename, strbuf);
|
||||
} else {
|
||||
int ret = mkdirpath(lockfile, named_main_earlywarning);
|
||||
if (ret == -1) {
|
||||
named_main_earlywarning("couldn't create '%s'",
|
||||
filename);
|
||||
cleanup_lockfile();
|
||||
return (false);
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* named_os_openfile() uses safeopen() which removes any existing
|
||||
* files. We can't use that here.
|
||||
*/
|
||||
singletonfd = open(filename, O_WRONLY | O_CREAT,
|
||||
S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
|
||||
if (singletonfd == -1) {
|
||||
cleanup_lockfile();
|
||||
return (false);
|
||||
}
|
||||
|
||||
memset(&lock, 0, sizeof(lock));
|
||||
lock.l_type = F_WRLCK;
|
||||
lock.l_whence = SEEK_SET;
|
||||
lock.l_start = 0;
|
||||
lock.l_len = 1;
|
||||
|
||||
/* Non-blocking (does not wait for lock) */
|
||||
if (fcntl(singletonfd, F_SETLK, &lock) == -1) {
|
||||
close(singletonfd);
|
||||
singletonfd = -1;
|
||||
return (false);
|
||||
}
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
void
|
||||
named_os_shutdown(void) {
|
||||
closelog();
|
||||
cleanup_pidfile();
|
||||
cleanup_lockfile();
|
||||
}
|
||||
|
||||
void
|
||||
|
||||
+506
-485
File diff suppressed because it is too large
Load Diff
+54
-622
@@ -33,9 +33,7 @@
|
||||
#include <dns/rdatatype.h>
|
||||
#include <dns/resolver.h>
|
||||
#include <dns/stats.h>
|
||||
#include <dns/transport.h>
|
||||
#include <dns/view.h>
|
||||
#include <dns/xfrin.h>
|
||||
#include <dns/zt.h>
|
||||
|
||||
#include <ns/stats.h>
|
||||
@@ -466,8 +464,6 @@ init_desc(void) {
|
||||
SET_RESSTATDESC(zonequota, "spilled due to zone quota", "ZoneQuota");
|
||||
SET_RESSTATDESC(serverquota, "spilled due to server quota",
|
||||
"ServerQuota");
|
||||
SET_RESSTATDESC(clientquota, "spilled due to clients per query quota",
|
||||
"ClientQuota");
|
||||
SET_RESSTATDESC(nextitem, "waited for next item", "NextItem");
|
||||
SET_RESSTATDESC(priming, "priming queries", "Priming");
|
||||
|
||||
@@ -555,6 +551,8 @@ init_desc(void) {
|
||||
SET_SOCKSTATDESC(udp6open, "UDP/IPv6 sockets opened", "UDP6Open");
|
||||
SET_SOCKSTATDESC(tcp4open, "TCP/IPv4 sockets opened", "TCP4Open");
|
||||
SET_SOCKSTATDESC(tcp6open, "TCP/IPv6 sockets opened", "TCP6Open");
|
||||
SET_SOCKSTATDESC(unixopen, "Unix domain sockets opened", "UnixOpen");
|
||||
SET_SOCKSTATDESC(rawopen, "Raw sockets opened", "RawOpen");
|
||||
SET_SOCKSTATDESC(udp4openfail, "UDP/IPv4 socket open failures",
|
||||
"UDP4OpenFail");
|
||||
SET_SOCKSTATDESC(udp6openfail, "UDP/IPv6 socket open failures",
|
||||
@@ -563,10 +561,18 @@ init_desc(void) {
|
||||
"TCP4OpenFail");
|
||||
SET_SOCKSTATDESC(tcp6openfail, "TCP/IPv6 socket open failures",
|
||||
"TCP6OpenFail");
|
||||
SET_SOCKSTATDESC(unixopenfail, "Unix domain socket open failures",
|
||||
"UnixOpenFail");
|
||||
SET_SOCKSTATDESC(rawopenfail, "Raw socket open failures",
|
||||
"RawOpenFail");
|
||||
SET_SOCKSTATDESC(udp4close, "UDP/IPv4 sockets closed", "UDP4Close");
|
||||
SET_SOCKSTATDESC(udp6close, "UDP/IPv6 sockets closed", "UDP6Close");
|
||||
SET_SOCKSTATDESC(tcp4close, "TCP/IPv4 sockets closed", "TCP4Close");
|
||||
SET_SOCKSTATDESC(tcp6close, "TCP/IPv6 sockets closed", "TCP6Close");
|
||||
SET_SOCKSTATDESC(unixclose, "Unix domain sockets closed", "UnixClose");
|
||||
SET_SOCKSTATDESC(fdwatchclose, "FDwatch sockets closed",
|
||||
"FDWatchClose");
|
||||
SET_SOCKSTATDESC(rawclose, "Raw sockets closed", "RawClose");
|
||||
SET_SOCKSTATDESC(udp4bindfail, "UDP/IPv4 socket bind failures",
|
||||
"UDP4BindFail");
|
||||
SET_SOCKSTATDESC(udp6bindfail, "UDP/IPv6 socket bind failures",
|
||||
@@ -575,6 +581,10 @@ init_desc(void) {
|
||||
"TCP4BindFail");
|
||||
SET_SOCKSTATDESC(tcp6bindfail, "TCP/IPv6 socket bind failures",
|
||||
"TCP6BindFail");
|
||||
SET_SOCKSTATDESC(unixbindfail, "Unix domain socket bind failures",
|
||||
"UnixBindFail");
|
||||
SET_SOCKSTATDESC(fdwatchbindfail, "FDwatch socket bind failures",
|
||||
"FdwatchBindFail");
|
||||
SET_SOCKSTATDESC(udp4connectfail, "UDP/IPv4 socket connect failures",
|
||||
"UDP4ConnFail");
|
||||
SET_SOCKSTATDESC(udp6connectfail, "UDP/IPv6 socket connect failures",
|
||||
@@ -583,6 +593,10 @@ init_desc(void) {
|
||||
"TCP4ConnFail");
|
||||
SET_SOCKSTATDESC(tcp6connectfail, "TCP/IPv6 socket connect failures",
|
||||
"TCP6ConnFail");
|
||||
SET_SOCKSTATDESC(unixconnectfail, "Unix domain socket connect failures",
|
||||
"UnixConnFail");
|
||||
SET_SOCKSTATDESC(fdwatchconnectfail, "FDwatch socket connect failures",
|
||||
"FDwatchConnFail");
|
||||
SET_SOCKSTATDESC(udp4connect, "UDP/IPv4 connections established",
|
||||
"UDP4Conn");
|
||||
SET_SOCKSTATDESC(udp6connect, "UDP/IPv6 connections established",
|
||||
@@ -591,30 +605,48 @@ init_desc(void) {
|
||||
"TCP4Conn");
|
||||
SET_SOCKSTATDESC(tcp6connect, "TCP/IPv6 connections established",
|
||||
"TCP6Conn");
|
||||
SET_SOCKSTATDESC(unixconnect, "Unix domain connections established",
|
||||
"UnixConn");
|
||||
SET_SOCKSTATDESC(fdwatchconnect,
|
||||
"FDwatch domain connections established",
|
||||
"FDwatchConn");
|
||||
SET_SOCKSTATDESC(tcp4acceptfail, "TCP/IPv4 connection accept failures",
|
||||
"TCP4AcceptFail");
|
||||
SET_SOCKSTATDESC(tcp6acceptfail, "TCP/IPv6 connection accept failures",
|
||||
"TCP6AcceptFail");
|
||||
SET_SOCKSTATDESC(unixacceptfail,
|
||||
"Unix domain connection accept failures",
|
||||
"UnixAcceptFail");
|
||||
SET_SOCKSTATDESC(tcp4accept, "TCP/IPv4 connections accepted",
|
||||
"TCP4Accept");
|
||||
SET_SOCKSTATDESC(tcp6accept, "TCP/IPv6 connections accepted",
|
||||
"TCP6Accept");
|
||||
SET_SOCKSTATDESC(unixaccept, "Unix domain connections accepted",
|
||||
"UnixAccept");
|
||||
SET_SOCKSTATDESC(udp4sendfail, "UDP/IPv4 send errors", "UDP4SendErr");
|
||||
SET_SOCKSTATDESC(udp6sendfail, "UDP/IPv6 send errors", "UDP6SendErr");
|
||||
SET_SOCKSTATDESC(tcp4sendfail, "TCP/IPv4 send errors", "TCP4SendErr");
|
||||
SET_SOCKSTATDESC(tcp6sendfail, "TCP/IPv6 send errors", "TCP6SendErr");
|
||||
SET_SOCKSTATDESC(unixsendfail, "Unix domain send errors",
|
||||
"UnixSendErr");
|
||||
SET_SOCKSTATDESC(fdwatchsendfail, "FDwatch send errors",
|
||||
"FDwatchSendErr");
|
||||
SET_SOCKSTATDESC(udp4recvfail, "UDP/IPv4 recv errors", "UDP4RecvErr");
|
||||
SET_SOCKSTATDESC(udp6recvfail, "UDP/IPv6 recv errors", "UDP6RecvErr");
|
||||
SET_SOCKSTATDESC(tcp4recvfail, "TCP/IPv4 recv errors", "TCP4RecvErr");
|
||||
SET_SOCKSTATDESC(tcp6recvfail, "TCP/IPv6 recv errors", "TCP6RecvErr");
|
||||
SET_SOCKSTATDESC(unixrecvfail, "Unix domain recv errors",
|
||||
"UnixRecvErr");
|
||||
SET_SOCKSTATDESC(fdwatchrecvfail, "FDwatch recv errors",
|
||||
"FDwatchRecvErr");
|
||||
SET_SOCKSTATDESC(rawrecvfail, "Raw recv errors", "RawRecvErr");
|
||||
SET_SOCKSTATDESC(udp4active, "UDP/IPv4 sockets active", "UDP4Active");
|
||||
SET_SOCKSTATDESC(udp6active, "UDP/IPv6 sockets active", "UDP6Active");
|
||||
SET_SOCKSTATDESC(tcp4active, "TCP/IPv4 sockets active", "TCP4Active");
|
||||
SET_SOCKSTATDESC(tcp6active, "TCP/IPv6 sockets active", "TCP6Active");
|
||||
SET_SOCKSTATDESC(tcp4clients, "TCP/IPv4 clients currently connected",
|
||||
"TCP4Clients");
|
||||
SET_SOCKSTATDESC(tcp6clients, "TCP/IPv6 clients currently connected",
|
||||
"TCP6Clients");
|
||||
SET_SOCKSTATDESC(unixactive, "Unix domain sockets active",
|
||||
"UnixActive");
|
||||
SET_SOCKSTATDESC(rawactive, "Raw sockets active", "RawActive");
|
||||
INSIST(i == isc_sockstatscounter_max);
|
||||
|
||||
/* Initialize DNSSEC statistics */
|
||||
@@ -1270,7 +1302,6 @@ cleanup:
|
||||
#define STATS_XML_STATUS 0x00 /* display only common statistics */
|
||||
#define STATS_XML_SERVER 0x01
|
||||
#define STATS_XML_ZONES 0x02
|
||||
#define STATS_XML_XFRINS 0x04
|
||||
#define STATS_XML_NET 0x08
|
||||
#define STATS_XML_MEM 0x10
|
||||
#define STATS_XML_TRAFFIC 0x20
|
||||
@@ -1456,280 +1487,6 @@ cleanup:
|
||||
return (ISC_R_FAILURE);
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
xfrin_xmlrender(dns_zone_t *zone, void *arg) {
|
||||
char buf[1024 + 32]; /* sufficiently large for zone name and class */
|
||||
dns_rdataclass_t rdclass;
|
||||
const char *ztype;
|
||||
uint32_t serial;
|
||||
isc_sockaddr_t addr;
|
||||
const isc_sockaddr_t *addrp = NULL;
|
||||
char addr_buf[ISC_SOCKADDR_FORMATSIZE];
|
||||
dns_transport_type_t transport_type;
|
||||
xmlTextWriterPtr writer = arg;
|
||||
dns_zonestat_level_t statlevel;
|
||||
int xmlrc;
|
||||
dns_xfrin_t *xfr = NULL;
|
||||
bool is_firstrefresh, is_running, is_deferred, is_presoa, is_pending;
|
||||
bool needs_refresh;
|
||||
bool is_first_data_received, is_ixfr;
|
||||
unsigned int nmsg = 0;
|
||||
unsigned int nrecs = 0;
|
||||
uint64_t nbytes = 0;
|
||||
|
||||
statlevel = dns_zone_getstatlevel(zone);
|
||||
if (statlevel == dns_zonestat_none) {
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
if (dns_zone_getxfr(zone, &xfr, &is_firstrefresh, &is_running,
|
||||
&is_deferred, &is_presoa, &is_pending,
|
||||
&needs_refresh) != ISC_R_SUCCESS)
|
||||
{
|
||||
/*
|
||||
* Failed to get information about the zone's incoming transfer
|
||||
* (if any), but we still want to continue generating the
|
||||
* remaining parts of the output.
|
||||
*/
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
if (!is_running && !is_deferred && !is_presoa && !is_pending &&
|
||||
!needs_refresh)
|
||||
{
|
||||
if (xfr != NULL) {
|
||||
dns_xfrin_detach(&xfr);
|
||||
}
|
||||
/* No ongoing/queued transfer. */
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
if (is_running && xfr == NULL) {
|
||||
/* The transfer is finished, and it's shutting down. */
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "xfrin"));
|
||||
|
||||
dns_zone_nameonly(zone, buf, sizeof(buf));
|
||||
TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "name",
|
||||
ISC_XMLCHAR buf));
|
||||
|
||||
rdclass = dns_zone_getclass(zone);
|
||||
dns_rdataclass_format(rdclass, buf, sizeof(buf));
|
||||
TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "class",
|
||||
ISC_XMLCHAR buf));
|
||||
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "type"));
|
||||
ztype = user_zonetype(zone);
|
||||
if (ztype != NULL) {
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR ztype));
|
||||
} else {
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
|
||||
}
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "serial"));
|
||||
if (dns_zone_getserial(zone, &serial) == ISC_R_SUCCESS) {
|
||||
TRY0(xmlTextWriterWriteFormatString(writer, "%u", serial));
|
||||
} else {
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
|
||||
}
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "remoteserial"));
|
||||
if (is_running) {
|
||||
serial = dns_xfrin_getendserial(xfr);
|
||||
if (serial != 0) {
|
||||
TRY0(xmlTextWriterWriteFormatString(writer, "%u",
|
||||
serial));
|
||||
} else {
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
|
||||
}
|
||||
} else {
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
|
||||
}
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "firstrefresh"));
|
||||
TRY0(xmlTextWriterWriteString(
|
||||
writer, ISC_XMLCHAR(is_firstrefresh ? "Yes" : "No")));
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "state"));
|
||||
if (is_running) {
|
||||
const char *xfr_state = NULL;
|
||||
|
||||
dns_xfrin_getstate(xfr, &xfr_state, &is_first_data_received,
|
||||
&is_ixfr);
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR xfr_state));
|
||||
} else if (is_deferred) {
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "Deferred"));
|
||||
} else if (is_presoa) {
|
||||
TRY0(xmlTextWriterWriteString(writer,
|
||||
ISC_XMLCHAR "Refresh SOA"));
|
||||
} else if (is_pending) {
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "Pending"));
|
||||
} else if (needs_refresh) {
|
||||
TRY0(xmlTextWriterWriteString(writer,
|
||||
ISC_XMLCHAR "Needs Refresh"));
|
||||
} else {
|
||||
UNREACHABLE();
|
||||
}
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "refreshqueued"));
|
||||
TRY0(xmlTextWriterWriteString(
|
||||
writer,
|
||||
ISC_XMLCHAR(is_running && needs_refresh ? "Yes" : "No")));
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "localaddr"));
|
||||
if (is_running) {
|
||||
addrp = dns_xfrin_getsourceaddr(xfr);
|
||||
isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
|
||||
} else if (is_presoa) {
|
||||
addr = dns_zone_getsourceaddr(zone);
|
||||
isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
|
||||
} else {
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
|
||||
}
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "remoteaddr"));
|
||||
if (is_running) {
|
||||
addrp = dns_xfrin_getprimaryaddr(xfr);
|
||||
isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
|
||||
} else if (is_presoa) {
|
||||
addr = dns_zone_getprimaryaddr(zone);
|
||||
isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
|
||||
} else {
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
|
||||
}
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "soatransport"));
|
||||
if (is_running || is_presoa) {
|
||||
if (is_running) {
|
||||
transport_type = dns_xfrin_getsoatransporttype(xfr);
|
||||
} else {
|
||||
transport_type = dns_zone_getrequesttransporttype(zone);
|
||||
}
|
||||
if (transport_type == DNS_TRANSPORT_UDP) {
|
||||
TRY0(xmlTextWriterWriteString(writer,
|
||||
ISC_XMLCHAR "UDP"));
|
||||
} else if (transport_type == DNS_TRANSPORT_TCP) {
|
||||
TRY0(xmlTextWriterWriteString(writer,
|
||||
ISC_XMLCHAR "TCP"));
|
||||
} else if (transport_type == DNS_TRANSPORT_TLS) {
|
||||
TRY0(xmlTextWriterWriteString(writer,
|
||||
ISC_XMLCHAR "TLS"));
|
||||
} else if (transport_type == DNS_TRANSPORT_NONE) {
|
||||
TRY0(xmlTextWriterWriteString(writer,
|
||||
ISC_XMLCHAR "None"));
|
||||
} else {
|
||||
/* We don't expect any other SOA transport type. */
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
|
||||
}
|
||||
} else {
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
|
||||
}
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "transport"));
|
||||
if (is_running) {
|
||||
transport_type = dns_xfrin_gettransporttype(xfr);
|
||||
if (transport_type == DNS_TRANSPORT_TCP) {
|
||||
TRY0(xmlTextWriterWriteString(writer,
|
||||
ISC_XMLCHAR "TCP"));
|
||||
} else if (transport_type == DNS_TRANSPORT_TLS) {
|
||||
TRY0(xmlTextWriterWriteString(writer,
|
||||
ISC_XMLCHAR "TLS"));
|
||||
} else {
|
||||
/* We don't expect any other transport type. */
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
|
||||
}
|
||||
} else {
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
|
||||
}
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "tsigkeyname"));
|
||||
if (is_running) {
|
||||
const dns_name_t *tsigkeyname = dns_xfrin_gettsigkeyname(xfr);
|
||||
char tsigkeyname_buf[DNS_NAME_FORMATSIZE];
|
||||
|
||||
if (tsigkeyname != NULL) {
|
||||
dns_name_format(tsigkeyname, tsigkeyname_buf,
|
||||
sizeof(tsigkeyname_buf));
|
||||
TRY0(xmlTextWriterWriteString(
|
||||
writer, ISC_XMLCHAR tsigkeyname_buf));
|
||||
}
|
||||
}
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "duration"));
|
||||
if (is_running || is_deferred || is_presoa || is_pending) {
|
||||
isc_time_t start = is_running ? dns_xfrin_getstarttime(xfr)
|
||||
: dns_zone_getxfrintime(zone);
|
||||
isc_time_t now = isc_time_now();
|
||||
isc_time_t diff;
|
||||
uint32_t sec;
|
||||
|
||||
isc_time_subtract(&now, &start, &diff);
|
||||
sec = isc_time_seconds(&diff);
|
||||
TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu32, sec));
|
||||
} else {
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "0"));
|
||||
}
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
|
||||
if (is_running) {
|
||||
dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes);
|
||||
}
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nmsg"));
|
||||
TRY0(xmlTextWriterWriteFormatString(writer, "%u", nmsg));
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nrecs"));
|
||||
TRY0(xmlTextWriterWriteFormatString(writer, "%u", nrecs));
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nbytes"));
|
||||
TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64, nbytes));
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "ixfr"));
|
||||
if (is_running && is_first_data_received) {
|
||||
TRY0(xmlTextWriterWriteString(
|
||||
writer, ISC_XMLCHAR(is_ixfr ? "Yes" : "No")));
|
||||
} else {
|
||||
TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR ""));
|
||||
}
|
||||
TRY0(xmlTextWriterEndElement(writer));
|
||||
|
||||
TRY0(xmlTextWriterEndElement(writer)); /* xfrin */
|
||||
|
||||
if (xfr != NULL) {
|
||||
dns_xfrin_detach(&xfr);
|
||||
}
|
||||
|
||||
return (ISC_R_SUCCESS);
|
||||
|
||||
cleanup:
|
||||
if (xfr != NULL) {
|
||||
dns_xfrin_detach(&xfr);
|
||||
}
|
||||
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
|
||||
"Failed at xfrin_xmlrender()");
|
||||
|
||||
return (ISC_R_FAILURE);
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
generatexml(named_server_t *server, uint32_t flags, int *buflen,
|
||||
xmlChar **buf) {
|
||||
@@ -2008,12 +1765,11 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
|
||||
*/
|
||||
view = ISC_LIST_HEAD(server->viewlist);
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "views"));
|
||||
while (view != NULL && ((flags & (STATS_XML_SERVER | STATS_XML_ZONES |
|
||||
STATS_XML_XFRINS)) != 0))
|
||||
while (view != NULL &&
|
||||
((flags & (STATS_XML_SERVER | STATS_XML_ZONES)) != 0))
|
||||
{
|
||||
isc_stats_t *istats = NULL;
|
||||
dns_stats_t *dstats = NULL;
|
||||
dns_adb_t *adb = NULL;
|
||||
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "view"));
|
||||
TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "name",
|
||||
@@ -2022,17 +1778,9 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
|
||||
if ((flags & STATS_XML_ZONES) != 0) {
|
||||
TRY0(xmlTextWriterStartElement(writer,
|
||||
ISC_XMLCHAR "zones"));
|
||||
CHECK(dns_view_apply(view, true, NULL, zone_xmlrender,
|
||||
writer));
|
||||
TRY0(xmlTextWriterEndElement(writer)); /* /zones */
|
||||
}
|
||||
|
||||
if ((flags & STATS_XML_XFRINS) != 0) {
|
||||
TRY0(xmlTextWriterStartElement(writer,
|
||||
ISC_XMLCHAR "xfrins"));
|
||||
CHECK(dns_zt_apply(view->zonetable, true, NULL,
|
||||
xfrin_xmlrender, writer));
|
||||
TRY0(xmlTextWriterEndElement(writer)); /* /xfrins */
|
||||
zone_xmlrender, writer));
|
||||
TRY0(xmlTextWriterEndElement(writer)); /* /zones */
|
||||
}
|
||||
|
||||
if ((flags & STATS_XML_SERVER) == 0) {
|
||||
@@ -2088,16 +1836,10 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
|
||||
TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters"));
|
||||
TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
|
||||
ISC_XMLCHAR "adbstat"));
|
||||
dns_view_getadb(view, &adb);
|
||||
if (adb != NULL) {
|
||||
result = dump_stats(dns_adb_getstats(adb),
|
||||
isc_statsformat_xml, writer, NULL,
|
||||
adbstats_xmldesc, dns_adbstats_max,
|
||||
adbstats_index, adbstat_values,
|
||||
ISC_STATSDUMP_VERBOSE);
|
||||
dns_adb_detach(&adb);
|
||||
CHECK(result);
|
||||
}
|
||||
CHECK(dump_stats(
|
||||
dns_adb_getstats(view->adb), isc_statsformat_xml,
|
||||
writer, NULL, adbstats_xmldesc, dns_adbstats_max,
|
||||
adbstats_index, adbstat_values, ISC_STATSDUMP_VERBOSE));
|
||||
TRY0(xmlTextWriterEndElement(writer)); /* </adbstats> */
|
||||
|
||||
/* <cachestats> */
|
||||
@@ -2223,17 +1965,6 @@ render_xml_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
|
||||
freecb, freecb_args));
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
render_xml_xfrins(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
|
||||
void *arg, unsigned int *retcode, const char **retmsg,
|
||||
const char **mimetype, isc_buffer_t *b,
|
||||
isc_httpdfree_t **freecb, void **freecb_args) {
|
||||
UNUSED(httpd);
|
||||
UNUSED(urlinfo);
|
||||
return (render_xml(STATS_XML_XFRINS, arg, retcode, retmsg, mimetype, b,
|
||||
freecb, freecb_args));
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
render_xml_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
|
||||
void *arg, unsigned int *retcode, const char **retmsg,
|
||||
@@ -2276,7 +2007,6 @@ render_xml_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
|
||||
#define STATS_JSON_STATUS 0x00 /* display only common statistics */
|
||||
#define STATS_JSON_SERVER 0x01
|
||||
#define STATS_JSON_ZONES 0x02
|
||||
#define STATS_JSON_XFRINS 0x04
|
||||
#define STATS_JSON_NET 0x08
|
||||
#define STATS_JSON_MEM 0x10
|
||||
#define STATS_JSON_TRAFFIC 0x20
|
||||
@@ -2527,260 +2257,6 @@ cleanup:
|
||||
return (result);
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
xfrin_jsonrender(dns_zone_t *zone, void *arg) {
|
||||
isc_result_t result;
|
||||
char buf[1024 + 32]; /* sufficiently large for zone name and class */
|
||||
char classbuf[64]; /* sufficiently large for class */
|
||||
char *zone_name_only = NULL;
|
||||
char *class_only = NULL;
|
||||
dns_rdataclass_t rdclass;
|
||||
uint32_t serial;
|
||||
json_object *xfrinarray = (json_object *)arg;
|
||||
json_object *xfrinobj = NULL;
|
||||
isc_sockaddr_t addr;
|
||||
const isc_sockaddr_t *addrp = NULL;
|
||||
char addr_buf[ISC_SOCKADDR_FORMATSIZE];
|
||||
dns_transport_type_t transport_type;
|
||||
dns_zonestat_level_t statlevel;
|
||||
dns_xfrin_t *xfr = NULL;
|
||||
bool is_firstrefresh, is_running, is_deferred, is_presoa, is_pending;
|
||||
bool needs_refresh;
|
||||
bool is_first_data_received, is_ixfr;
|
||||
unsigned int nmsg = 0;
|
||||
unsigned int nrecs = 0;
|
||||
uint64_t nbytes = 0;
|
||||
|
||||
statlevel = dns_zone_getstatlevel(zone);
|
||||
if (statlevel == dns_zonestat_none) {
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
dns_zone_nameonly(zone, buf, sizeof(buf));
|
||||
zone_name_only = buf;
|
||||
|
||||
rdclass = dns_zone_getclass(zone);
|
||||
dns_rdataclass_format(rdclass, classbuf, sizeof(classbuf));
|
||||
class_only = classbuf;
|
||||
|
||||
if (dns_zone_getserial(zone, &serial) != ISC_R_SUCCESS) {
|
||||
xfrinobj = addzone(zone_name_only, class_only,
|
||||
user_zonetype(zone), 0, false);
|
||||
} else {
|
||||
xfrinobj = addzone(zone_name_only, class_only,
|
||||
user_zonetype(zone), serial, true);
|
||||
}
|
||||
|
||||
if (xfrinobj == NULL) {
|
||||
result = ISC_R_NOMEMORY;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
result = dns_zone_getxfr(zone, &xfr, &is_firstrefresh, &is_running,
|
||||
&is_deferred, &is_presoa, &is_pending,
|
||||
&needs_refresh);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
result = ISC_R_SUCCESS;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
if (!is_running && !is_deferred && !is_presoa && !is_pending &&
|
||||
!needs_refresh)
|
||||
{
|
||||
/* No ongoing/queued transfer. */
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
if (is_running && xfr == NULL) {
|
||||
/* The transfer is finished, and it's shutting down. */
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
if (is_running) {
|
||||
serial = dns_xfrin_getendserial(xfr);
|
||||
if (serial != 0) {
|
||||
json_object_object_add(xfrinobj, "remoteserial",
|
||||
json_object_new_int64(serial));
|
||||
}
|
||||
}
|
||||
|
||||
json_object_object_add(
|
||||
xfrinobj, "firstrefresh",
|
||||
json_object_new_string(is_firstrefresh ? "Yes" : "No"));
|
||||
|
||||
if (is_running) {
|
||||
const char *xfr_state = NULL;
|
||||
|
||||
dns_xfrin_getstate(xfr, &xfr_state, &is_first_data_received,
|
||||
&is_ixfr);
|
||||
json_object_object_add(xfrinobj, "state",
|
||||
json_object_new_string(xfr_state));
|
||||
} else if (is_deferred) {
|
||||
json_object_object_add(xfrinobj, "state",
|
||||
json_object_new_string("Deferred"));
|
||||
} else if (is_presoa) {
|
||||
json_object_object_add(xfrinobj, "state",
|
||||
json_object_new_string("Refresh SOA"));
|
||||
} else if (is_pending) {
|
||||
json_object_object_add(xfrinobj, "state",
|
||||
json_object_new_string("Pending"));
|
||||
} else if (needs_refresh) {
|
||||
json_object_object_add(xfrinobj, "state",
|
||||
json_object_new_string("Needs Refresh"));
|
||||
} else {
|
||||
UNREACHABLE();
|
||||
}
|
||||
|
||||
json_object_object_add(
|
||||
xfrinobj, "refreshqueued",
|
||||
json_object_new_string(is_running && needs_refresh ? "Yes"
|
||||
: "No"));
|
||||
|
||||
if (is_running) {
|
||||
addrp = dns_xfrin_getsourceaddr(xfr);
|
||||
isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
|
||||
json_object_object_add(xfrinobj, "localaddr",
|
||||
json_object_new_string(addr_buf));
|
||||
} else if (is_presoa) {
|
||||
addr = dns_zone_getsourceaddr(zone);
|
||||
isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
|
||||
json_object_object_add(xfrinobj, "localaddr",
|
||||
json_object_new_string(addr_buf));
|
||||
} else {
|
||||
json_object_object_add(xfrinobj, "localaddr",
|
||||
json_object_new_string("-"));
|
||||
}
|
||||
|
||||
if (is_running) {
|
||||
addrp = dns_xfrin_getprimaryaddr(xfr);
|
||||
isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
|
||||
json_object_object_add(xfrinobj, "remoteaddr",
|
||||
json_object_new_string(addr_buf));
|
||||
} else if (is_presoa) {
|
||||
addr = dns_zone_getprimaryaddr(zone);
|
||||
isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
|
||||
json_object_object_add(xfrinobj, "remoteaddr",
|
||||
json_object_new_string(addr_buf));
|
||||
} else {
|
||||
json_object_object_add(xfrinobj, "remoteaddr",
|
||||
json_object_new_string("-"));
|
||||
}
|
||||
|
||||
if (is_running || is_presoa) {
|
||||
if (is_running) {
|
||||
transport_type = dns_xfrin_getsoatransporttype(xfr);
|
||||
} else {
|
||||
transport_type = dns_zone_getrequesttransporttype(zone);
|
||||
}
|
||||
|
||||
if (transport_type == DNS_TRANSPORT_UDP) {
|
||||
json_object_object_add(xfrinobj, "soatransport",
|
||||
json_object_new_string("UDP"));
|
||||
} else if (transport_type == DNS_TRANSPORT_TCP) {
|
||||
json_object_object_add(xfrinobj, "soatransport",
|
||||
json_object_new_string("TCP"));
|
||||
} else if (transport_type == DNS_TRANSPORT_TLS) {
|
||||
json_object_object_add(xfrinobj, "soatransport",
|
||||
json_object_new_string("TLS"));
|
||||
} else if (transport_type == DNS_TRANSPORT_NONE) {
|
||||
json_object_object_add(xfrinobj, "soatransport",
|
||||
json_object_new_string("None"));
|
||||
} else {
|
||||
/* We don't expect any other SOA transport type. */
|
||||
json_object_object_add(xfrinobj, "soatransport",
|
||||
json_object_new_string("-"));
|
||||
}
|
||||
} else {
|
||||
json_object_object_add(xfrinobj, "soatransport",
|
||||
json_object_new_string("-"));
|
||||
}
|
||||
|
||||
if (is_running) {
|
||||
transport_type = dns_xfrin_gettransporttype(xfr);
|
||||
if (transport_type == DNS_TRANSPORT_TCP) {
|
||||
json_object_object_add(xfrinobj, "transport",
|
||||
json_object_new_string("TCP"));
|
||||
} else if (transport_type == DNS_TRANSPORT_TLS) {
|
||||
json_object_object_add(xfrinobj, "transport",
|
||||
json_object_new_string("TLS"));
|
||||
} else {
|
||||
/* We don't expect any other transport type. */
|
||||
json_object_object_add(xfrinobj, "transport",
|
||||
json_object_new_string("-"));
|
||||
}
|
||||
} else {
|
||||
json_object_object_add(xfrinobj, "transport",
|
||||
json_object_new_string("-"));
|
||||
}
|
||||
|
||||
if (is_running) {
|
||||
const dns_name_t *tsigkeyname = dns_xfrin_gettsigkeyname(xfr);
|
||||
char tsigkeyname_buf[DNS_NAME_FORMATSIZE];
|
||||
|
||||
if (tsigkeyname != NULL) {
|
||||
dns_name_format(tsigkeyname, tsigkeyname_buf,
|
||||
sizeof(tsigkeyname_buf));
|
||||
json_object_object_add(
|
||||
xfrinobj, "tsigkeyname",
|
||||
json_object_new_string(tsigkeyname_buf));
|
||||
} else {
|
||||
json_object_object_add(xfrinobj, "tsigkeyname", NULL);
|
||||
}
|
||||
} else {
|
||||
json_object_object_add(xfrinobj, "tsigkeyname", NULL);
|
||||
}
|
||||
|
||||
if (is_running || is_deferred || is_presoa || is_pending) {
|
||||
isc_time_t start = is_running ? dns_xfrin_getstarttime(xfr)
|
||||
: dns_zone_getxfrintime(zone);
|
||||
isc_time_t now = isc_time_now();
|
||||
isc_time_t diff;
|
||||
uint32_t sec;
|
||||
|
||||
isc_time_subtract(&now, &start, &diff);
|
||||
sec = isc_time_seconds(&diff);
|
||||
json_object_object_add(xfrinobj, "duration",
|
||||
json_object_new_int64((int64_t)sec));
|
||||
} else {
|
||||
json_object_object_add(xfrinobj, "duration",
|
||||
json_object_new_int64(0));
|
||||
}
|
||||
|
||||
if (is_running) {
|
||||
dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes);
|
||||
}
|
||||
json_object_object_add(xfrinobj, "nmsg",
|
||||
json_object_new_int64((int64_t)nmsg));
|
||||
json_object_object_add(xfrinobj, "nrecs",
|
||||
json_object_new_int64((int64_t)nrecs));
|
||||
json_object_object_add(
|
||||
xfrinobj, "nbytes",
|
||||
json_object_new_int64(nbytes > INT64_MAX ? INT64_MAX
|
||||
: (int64_t)nbytes));
|
||||
|
||||
if (is_running && is_first_data_received) {
|
||||
json_object_object_add(
|
||||
xfrinobj, "ixfr",
|
||||
json_object_new_string(is_ixfr ? "Yes" : "No"));
|
||||
} else {
|
||||
json_object_object_add(xfrinobj, "ixfr",
|
||||
json_object_new_string(""));
|
||||
}
|
||||
|
||||
json_object_array_add(xfrinarray, xfrinobj);
|
||||
xfrinobj = NULL;
|
||||
result = ISC_R_SUCCESS;
|
||||
|
||||
cleanup:
|
||||
if (xfr != NULL) {
|
||||
dns_xfrin_detach(&xfr);
|
||||
}
|
||||
if (xfrinobj != NULL) {
|
||||
json_object_put(xfrinobj);
|
||||
}
|
||||
return (result);
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
generatejson(named_server_t *server, size_t *msglen, const char **msg,
|
||||
json_object **rootp, uint32_t flags) {
|
||||
@@ -2999,9 +2475,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
|
||||
#endif /* ifdef HAVE_DNSTAP */
|
||||
}
|
||||
|
||||
if ((flags &
|
||||
(STATS_JSON_SERVER | STATS_JSON_ZONES | STATS_JSON_XFRINS)) != 0)
|
||||
{
|
||||
if ((flags & (STATS_JSON_ZONES | STATS_JSON_SERVER)) != 0) {
|
||||
viewlist = json_object_new_object();
|
||||
CHECKMEM(viewlist);
|
||||
|
||||
@@ -3009,8 +2483,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
|
||||
|
||||
view = ISC_LIST_HEAD(server->viewlist);
|
||||
while (view != NULL) {
|
||||
json_object *za, *xa, *v = json_object_new_object();
|
||||
dns_adb_t *adb = NULL;
|
||||
json_object *za, *v = json_object_new_object();
|
||||
|
||||
CHECKMEM(v);
|
||||
json_object_object_add(viewlist, view->name, v);
|
||||
@@ -3019,8 +2492,8 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
|
||||
CHECKMEM(za);
|
||||
|
||||
if ((flags & STATS_JSON_ZONES) != 0) {
|
||||
CHECK(dns_view_apply(view, true, NULL,
|
||||
zone_jsonrender, za));
|
||||
CHECK(dns_zt_apply(view->zonetable, true, NULL,
|
||||
zone_jsonrender, za));
|
||||
}
|
||||
|
||||
if (json_object_array_length(za) != 0) {
|
||||
@@ -3029,20 +2502,6 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
|
||||
json_object_put(za);
|
||||
}
|
||||
|
||||
xa = json_object_new_array();
|
||||
CHECKMEM(xa);
|
||||
|
||||
if ((flags & STATS_JSON_XFRINS) != 0) {
|
||||
CHECK(dns_zt_apply(view->zonetable, true, NULL,
|
||||
xfrin_jsonrender, xa));
|
||||
}
|
||||
|
||||
if (json_object_array_length(xa) != 0) {
|
||||
json_object_object_add(v, "xfrins", xa);
|
||||
} else {
|
||||
json_object_put(xa);
|
||||
}
|
||||
|
||||
if ((flags & STATS_JSON_SERVER) != 0) {
|
||||
json_object *res = NULL;
|
||||
dns_stats_t *dstats = NULL;
|
||||
@@ -3130,11 +2589,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
|
||||
json_object_object_add(res, "cachestats",
|
||||
counters);
|
||||
|
||||
dns_view_getadb(view, &adb);
|
||||
if (adb != NULL) {
|
||||
istats = dns_adb_getstats(adb);
|
||||
dns_adb_detach(&adb);
|
||||
}
|
||||
istats = dns_adb_getstats(view->adb);
|
||||
if (istats != NULL) {
|
||||
counters = json_object_new_object();
|
||||
CHECKMEM(counters);
|
||||
@@ -3426,17 +2881,6 @@ render_json_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
|
||||
freecb, freecb_args));
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
render_json_xfrins(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
|
||||
void *arg, unsigned int *retcode, const char **retmsg,
|
||||
const char **mimetype, isc_buffer_t *b,
|
||||
isc_httpdfree_t **freecb, void **freecb_args) {
|
||||
UNUSED(httpd);
|
||||
UNUSED(urlinfo);
|
||||
return (render_json(STATS_JSON_XFRINS, arg, retcode, retmsg, mimetype,
|
||||
b, freecb, freecb_args));
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
render_json_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
|
||||
void *arg, unsigned int *retcode, const char **retmsg,
|
||||
@@ -3642,9 +3086,6 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
|
||||
isc_httpdmgr_addurl(listener->httpdmgr,
|
||||
"/xml/v" STATS_XML_VERSION_MAJOR "/zones", false,
|
||||
render_xml_zones, server);
|
||||
isc_httpdmgr_addurl(listener->httpdmgr,
|
||||
"/xml/v" STATS_XML_VERSION_MAJOR "/xfrins", false,
|
||||
render_xml_xfrins, server);
|
||||
isc_httpdmgr_addurl(listener->httpdmgr,
|
||||
"/xml/v" STATS_XML_VERSION_MAJOR "/net", false,
|
||||
render_xml_net, server);
|
||||
@@ -3670,9 +3111,6 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
|
||||
isc_httpdmgr_addurl(listener->httpdmgr,
|
||||
"/json/v" STATS_JSON_VERSION_MAJOR "/zones", false,
|
||||
render_json_zones, server);
|
||||
isc_httpdmgr_addurl(listener->httpdmgr,
|
||||
"/json/v" STATS_JSON_VERSION_MAJOR "/xfrins", false,
|
||||
render_json_xfrins, server);
|
||||
isc_httpdmgr_addurl(listener->httpdmgr,
|
||||
"/json/v" STATS_JSON_VERSION_MAJOR "/net", false,
|
||||
render_json_net, server);
|
||||
@@ -4044,14 +3482,8 @@ named_stats_dump(named_server_t *server, FILE *fp) {
|
||||
for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
|
||||
view = ISC_LIST_NEXT(view, link))
|
||||
{
|
||||
dns_adb_t *adb = NULL;
|
||||
isc_stats_t *adbstats = NULL;
|
||||
isc_stats_t *adbstats = dns_adb_getstats(view->adb);
|
||||
|
||||
dns_view_getadb(view, &adb);
|
||||
if (adb != NULL) {
|
||||
adbstats = dns_adb_getstats(adb);
|
||||
dns_adb_detach(&adb);
|
||||
}
|
||||
if (adbstats == NULL) {
|
||||
continue;
|
||||
}
|
||||
|
||||
@@ -120,13 +120,11 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
|
||||
dns_transport_set_tls_versions);
|
||||
parse_transport_option(doh, transport, "ciphers",
|
||||
dns_transport_set_ciphers);
|
||||
parse_transport_option(doh, transport, "cipher-suites",
|
||||
dns_transport_set_cipher_suites);
|
||||
parse_transport_bool_option(
|
||||
doh, transport, "prefer-server-ciphers",
|
||||
dns_transport_set_prefer_server_ciphers);
|
||||
parse_transport_option(doh, transport, "ca-file",
|
||||
dns_transport_set_cafile);
|
||||
dns_transport_set_prefer_server_ciphers)
|
||||
parse_transport_option(doh, transport, "ca-file",
|
||||
dns_transport_set_cafile);
|
||||
parse_transport_option(doh, transport, "remote-hostname",
|
||||
dns_transport_set_remote_hostname);
|
||||
}
|
||||
@@ -174,13 +172,11 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
|
||||
dns_transport_set_tls_versions);
|
||||
parse_transport_option(tls, transport, "ciphers",
|
||||
dns_transport_set_ciphers);
|
||||
parse_transport_option(tls, transport, "cipher-suites",
|
||||
dns_transport_set_cipher_suites);
|
||||
parse_transport_bool_option(
|
||||
tls, transport, "prefer-server-ciphers",
|
||||
dns_transport_set_prefer_server_ciphers);
|
||||
parse_transport_option(tls, transport, "ca-file",
|
||||
dns_transport_set_cafile);
|
||||
dns_transport_set_prefer_server_ciphers)
|
||||
parse_transport_option(tls, transport, "ca-file",
|
||||
dns_transport_set_cafile);
|
||||
parse_transport_option(tls, transport, "remote-hostname",
|
||||
dns_transport_set_remote_hostname);
|
||||
}
|
||||
|
||||
+20
-19
@@ -31,7 +31,7 @@
|
||||
#include <named/tsigconf.h>
|
||||
|
||||
static isc_result_t
|
||||
add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
|
||||
add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
|
||||
isc_mem_t *mctx) {
|
||||
dns_tsigkey_t *tsigkey = NULL;
|
||||
const cfg_listelt_t *element;
|
||||
@@ -39,7 +39,10 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
|
||||
const char *keyid = NULL;
|
||||
unsigned char *secret = NULL;
|
||||
int secretalloc = 0;
|
||||
int secretlen = 0;
|
||||
isc_result_t ret;
|
||||
isc_stdtime_t now;
|
||||
uint16_t bits;
|
||||
|
||||
for (element = cfg_list_first(list); element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
@@ -47,14 +50,12 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
|
||||
const cfg_obj_t *algobj = NULL;
|
||||
const cfg_obj_t *secretobj = NULL;
|
||||
dns_name_t keyname;
|
||||
dst_algorithm_t alg = DST_ALG_UNKNOWN;
|
||||
const char *algstr = NULL;
|
||||
const dns_name_t *alg;
|
||||
const char *algstr;
|
||||
char keynamedata[1024];
|
||||
isc_buffer_t keynamesrc, keynamebuf;
|
||||
const char *secretstr = NULL;
|
||||
const char *secretstr;
|
||||
isc_buffer_t secretbuf;
|
||||
int secretlen = 0;
|
||||
uint16_t bits;
|
||||
|
||||
key = cfg_listelt_value(element);
|
||||
keyid = cfg_obj_asstring(cfg_map_getname(key));
|
||||
@@ -103,17 +104,13 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
|
||||
}
|
||||
secretlen = isc_buffer_usedlength(&secretbuf);
|
||||
|
||||
ret = dns_tsigkey_create(&keyname, alg, secret, secretlen, mctx,
|
||||
&tsigkey);
|
||||
now = isc_stdtime_now();
|
||||
ret = dns_tsigkey_create(&keyname, alg, secret, secretlen,
|
||||
false, false, NULL, now, now, mctx,
|
||||
ring, &tsigkey);
|
||||
isc_mem_put(mctx, secret, secretalloc);
|
||||
secret = NULL;
|
||||
if (ret == ISC_R_SUCCESS) {
|
||||
ret = dns_tsigkeyring_add(ring, tsigkey);
|
||||
}
|
||||
if (ret != ISC_R_SUCCESS) {
|
||||
if (tsigkey != NULL) {
|
||||
dns_tsigkey_detach(&tsigkey);
|
||||
}
|
||||
goto failure;
|
||||
}
|
||||
/*
|
||||
@@ -126,20 +123,21 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
|
||||
return (ISC_R_SUCCESS);
|
||||
|
||||
failure:
|
||||
cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
|
||||
"configuring key '%s': %s", keyid, isc_result_totext(ret));
|
||||
|
||||
if (secret != NULL) {
|
||||
isc_mem_put(mctx, secret, secretalloc);
|
||||
}
|
||||
cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
|
||||
"configuring key '%s': %s", keyid, isc_result_totext(ret));
|
||||
return (ret);
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
isc_mem_t *mctx, dns_tsigkeyring_t **ringp) {
|
||||
isc_mem_t *mctx, dns_tsig_keyring_t **ringp) {
|
||||
const cfg_obj_t *maps[3];
|
||||
const cfg_obj_t *keylist;
|
||||
dns_tsigkeyring_t *ring = NULL;
|
||||
dns_tsig_keyring_t *ring = NULL;
|
||||
isc_result_t result;
|
||||
int i;
|
||||
|
||||
@@ -154,7 +152,10 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
}
|
||||
maps[i] = NULL;
|
||||
|
||||
dns_tsigkeyring_create(mctx, &ring);
|
||||
result = dns_tsigkeyring_create(mctx, &ring);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (result);
|
||||
}
|
||||
|
||||
for (i = 0;; i++) {
|
||||
if (maps[i] == NULL) {
|
||||
|
||||
+126
-84
@@ -289,7 +289,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
|
||||
if (n == 0) {
|
||||
types = NULL;
|
||||
} else {
|
||||
types = isc_mem_cget(mctx, n, sizeof(*types));
|
||||
types = isc_mem_get(mctx, n * sizeof(*types));
|
||||
}
|
||||
|
||||
i = 0;
|
||||
@@ -319,8 +319,8 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
|
||||
ISC_LOG_ERROR,
|
||||
"'%s' is not a valid count",
|
||||
bracket);
|
||||
isc_mem_cput(mctx, types, n,
|
||||
sizeof(*types));
|
||||
isc_mem_put(mctx, types,
|
||||
n * sizeof(*types));
|
||||
goto cleanup;
|
||||
}
|
||||
} else {
|
||||
@@ -334,7 +334,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
|
||||
ISC_LOG_ERROR,
|
||||
"'%.*s' is not a valid type",
|
||||
(int)r.length, str);
|
||||
isc_mem_cput(mctx, types, n, sizeof(*types));
|
||||
isc_mem_put(mctx, types, n * sizeof(*types));
|
||||
goto cleanup;
|
||||
}
|
||||
}
|
||||
@@ -344,7 +344,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
|
||||
mtype, dns_fixedname_name(&fname), n,
|
||||
types);
|
||||
if (types != NULL) {
|
||||
isc_mem_cput(mctx, types, n, sizeof(*types));
|
||||
isc_mem_put(mctx, types, n * sizeof(*types));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -705,7 +705,7 @@ strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp,
|
||||
if (*s == '\0') {
|
||||
/* We have reached the end of the string. */
|
||||
*argcp = n;
|
||||
*argvp = isc_mem_cget(mctx, n, sizeof(char *));
|
||||
*argvp = isc_mem_get(mctx, n * sizeof(char *));
|
||||
} else {
|
||||
char *p = s;
|
||||
while (*p != ' ' && *p != '\t' && *p != '\0') {
|
||||
@@ -770,27 +770,24 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
|
||||
*/
|
||||
static bool
|
||||
isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
|
||||
const isc_sockaddr_t *dstaddr, dns_rdataclass_t rdclass,
|
||||
void *arg ISC_ATTR_UNUSED) {
|
||||
dns_aclenv_t *env = NULL;
|
||||
dns_view_t *view = NULL;
|
||||
const isc_sockaddr_t *dstaddr, dns_rdataclass_t rdclass, void *arg) {
|
||||
ns_interfacemgr_t *interfacemgr = (ns_interfacemgr_t *)arg;
|
||||
dns_aclenv_t *env = ns_interfacemgr_getaclenv(interfacemgr);
|
||||
dns_view_t *view;
|
||||
dns_tsigkey_t *key = NULL;
|
||||
isc_netaddr_t netsrc;
|
||||
isc_netaddr_t netdst;
|
||||
|
||||
/* interfacemgr can be destroyed only in exclusive mode. */
|
||||
if (named_g_server->interfacemgr == NULL) {
|
||||
if (interfacemgr == NULL) {
|
||||
return (true);
|
||||
}
|
||||
|
||||
if (!ns_interfacemgr_listeningon(named_g_server->interfacemgr, dstaddr))
|
||||
{
|
||||
if (!ns_interfacemgr_listeningon(interfacemgr, dstaddr)) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
isc_netaddr_fromsockaddr(&netsrc, srcaddr);
|
||||
isc_netaddr_fromsockaddr(&netdst, dstaddr);
|
||||
env = ns_interfacemgr_getaclenv(named_g_server->interfacemgr);
|
||||
|
||||
for (view = ISC_LIST_HEAD(named_g_server->viewlist); view != NULL;
|
||||
view = ISC_LIST_NEXT(view, link))
|
||||
@@ -809,7 +806,7 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
|
||||
bool match;
|
||||
isc_result_t result;
|
||||
|
||||
result = dns_view_gettsig(view, mykey->name, &key);
|
||||
result = dns_view_gettsig(view, &mykey->name, &key);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
continue;
|
||||
}
|
||||
@@ -866,8 +863,8 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
|
||||
isc_result_t
|
||||
named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
|
||||
dns_kasplist_t *kasplist, dns_keystorelist_t *keystorelist,
|
||||
dns_zone_t *zone, dns_zone_t *raw) {
|
||||
dns_kasplist_t *kasplist, dns_zone_t *zone,
|
||||
dns_zone_t *raw) {
|
||||
isc_result_t result;
|
||||
const char *zname;
|
||||
dns_rdataclass_t zclass;
|
||||
@@ -885,7 +882,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
uint32_t count;
|
||||
unsigned int dbargc;
|
||||
char **dbargv;
|
||||
static char default_dbtype[] = ZONEDB_DEFAULT;
|
||||
static char default_dbtype[] = "rbt";
|
||||
static char dlz_dbtype[] = "dlz";
|
||||
char *cpval = default_dbtype;
|
||||
isc_mem_t *mctx = dns_zone_getmctx(zone);
|
||||
@@ -905,6 +902,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
dns_stats_t *rcvquerystats;
|
||||
dns_stats_t *dnssecsignstats;
|
||||
dns_zonestat_level_t statlevel = dns_zonestat_none;
|
||||
int seconds;
|
||||
dns_ttl_t maxttl = 0; /* unlimited */
|
||||
dns_zone_t *mayberaw = (raw != NULL) ? raw : zone;
|
||||
bool transferinsecs = ns_server_getoption(named_g_server->sctx,
|
||||
@@ -1000,7 +998,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
* compiler w/o generating a warning.
|
||||
*/
|
||||
dns_zone_setdbtype(zone, dbargc, (const char *const *)dbargv);
|
||||
isc_mem_cput(mctx, dbargv, dbargc, sizeof(*dbargv));
|
||||
isc_mem_put(mctx, dbargv, dbargc * sizeof(*dbargv));
|
||||
if (cpval != default_dbtype && cpval != dlz_dbtype) {
|
||||
isc_mem_free(mctx, cpval);
|
||||
}
|
||||
@@ -1174,9 +1172,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
rcvquerystats = NULL;
|
||||
dnssecsignstats = NULL;
|
||||
if (statlevel == dns_zonestat_full) {
|
||||
isc_stats_create(mctx, &zoneqrystats, ns_statscounter_max);
|
||||
dns_rdatatypestats_create(mctx, &rcvquerystats);
|
||||
dns_dnssecsignstats_create(mctx, &dnssecsignstats);
|
||||
CHECK(isc_stats_create(mctx, &zoneqrystats,
|
||||
ns_statscounter_max));
|
||||
CHECK(dns_rdatatypestats_create(mctx, &rcvquerystats));
|
||||
CHECK(dns_dnssecsignstats_create(mctx, &dnssecsignstats));
|
||||
}
|
||||
dns_zone_setrequeststats(zone, zoneqrystats);
|
||||
dns_zone_setrcvquerystats(zone, rcvquerystats);
|
||||
@@ -1306,7 +1305,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
dns_zone_setoption(zone, DNS_ZONEOPT_NOTIFYTOSOA,
|
||||
cfg_obj_asboolean(obj));
|
||||
|
||||
dns_zone_setisself(zone, isself, NULL);
|
||||
dns_zone_setisself(zone, isself, named_g_server->interfacemgr);
|
||||
|
||||
CHECK(configure_zone_acl(
|
||||
zconfig, vconfig, config, allow_transfer, ac, zone,
|
||||
@@ -1502,7 +1501,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
}
|
||||
|
||||
if (use_kasp) {
|
||||
maxttl = dns_kasp_zonemaxttl(dns_zone_getkasp(zone), false);
|
||||
maxttl = dns_kasp_zonemaxttl(dns_zone_getkasp(zone));
|
||||
} else {
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "max-zone-ttl", &obj);
|
||||
@@ -1545,9 +1544,11 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
* use inline-signing (raw != NULL).
|
||||
*/
|
||||
if (ztype == dns_zone_primary || raw != NULL) {
|
||||
if (use_kasp) {
|
||||
int seconds;
|
||||
const cfg_obj_t *validity, *resign;
|
||||
bool allow = false, maint = false;
|
||||
bool sigvalinsecs;
|
||||
|
||||
if (use_kasp) {
|
||||
if (dns_kasp_nsec3(kasp)) {
|
||||
result = dns_zone_setnsec3param(
|
||||
zone, 1, dns_kasp_nsec3flags(kasp),
|
||||
@@ -1559,15 +1560,53 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
zone, 0, 0, 0, 0, NULL, true, false);
|
||||
}
|
||||
INSIST(result == ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
if (use_kasp) {
|
||||
seconds = (uint32_t)dns_kasp_sigvalidity_dnskey(kasp);
|
||||
dns_zone_setkeyvalidityinterval(zone, seconds);
|
||||
} else {
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "dnskey-sig-validity",
|
||||
&obj);
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
seconds = cfg_obj_asuint32(obj) * 86400;
|
||||
}
|
||||
dns_zone_setkeyvalidityinterval(zone, seconds);
|
||||
|
||||
if (use_kasp) {
|
||||
seconds = (uint32_t)dns_kasp_sigvalidity(kasp);
|
||||
dns_zone_setsigvalidityinterval(zone, seconds);
|
||||
|
||||
seconds = (uint32_t)dns_kasp_sigrefresh(kasp);
|
||||
dns_zone_setsigresigninginterval(zone, seconds);
|
||||
} else {
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "sig-validity-interval",
|
||||
&obj);
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
|
||||
sigvalinsecs = ns_server_getoption(
|
||||
named_g_server->sctx, NS_SERVER_SIGVALINSECS);
|
||||
validity = cfg_tuple_get(obj, "validity");
|
||||
seconds = cfg_obj_asuint32(validity);
|
||||
if (!sigvalinsecs) {
|
||||
seconds *= 86400;
|
||||
}
|
||||
dns_zone_setsigvalidityinterval(zone, seconds);
|
||||
|
||||
resign = cfg_tuple_get(obj, "re-sign");
|
||||
if (cfg_obj_isvoid(resign)) {
|
||||
seconds /= 4;
|
||||
} else if (!sigvalinsecs) {
|
||||
uint32_t r = cfg_obj_asuint32(resign);
|
||||
if (seconds > 7 * 86400) {
|
||||
seconds = r * 86400;
|
||||
} else {
|
||||
seconds = r * 3600;
|
||||
}
|
||||
} else {
|
||||
seconds = cfg_obj_asuint32(resign);
|
||||
}
|
||||
dns_zone_setsigresigninginterval(zone, seconds);
|
||||
}
|
||||
|
||||
obj = NULL;
|
||||
@@ -1576,8 +1615,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
filename = cfg_obj_asstring(obj);
|
||||
CHECK(dns_zone_setkeydirectory(zone, filename));
|
||||
}
|
||||
/* Also save a reference to the keystore list. */
|
||||
dns_zone_setkeystores(zone, keystorelist);
|
||||
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "sig-signing-signatures", &obj);
|
||||
@@ -1594,6 +1631,26 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
dns_zone_setprivatetype(zone, cfg_obj_asuint32(obj));
|
||||
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "update-check-ksk", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
|
||||
cfg_obj_asboolean(obj));
|
||||
/*
|
||||
* This setting will be ignored if dnssec-policy is used.
|
||||
* named-checkconf will error if both are configured.
|
||||
*/
|
||||
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "dnssec-dnskey-kskonly", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
dns_zone_setoption(zone, DNS_ZONEOPT_DNSKEYKSKONLY,
|
||||
cfg_obj_asboolean(obj));
|
||||
/*
|
||||
* This setting will be ignored if dnssec-policy is used.
|
||||
* named-checkconf will error if both are configured.
|
||||
*/
|
||||
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "dnssec-loadkeys-interval",
|
||||
&obj);
|
||||
@@ -1601,12 +1658,28 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
CHECK(dns_zone_setrefreshkeyinterval(zone,
|
||||
cfg_obj_asuint32(obj)));
|
||||
|
||||
obj = NULL;
|
||||
result = cfg_map_get(zoptions, "auto-dnssec", &obj);
|
||||
if (kasp != NULL) {
|
||||
bool s2i = (strcmp(dns_kasp_getname(kasp),
|
||||
"insecure") != 0);
|
||||
dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, true);
|
||||
dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, !s2i);
|
||||
dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, true);
|
||||
} else if (result == ISC_R_SUCCESS) {
|
||||
const char *arg = cfg_obj_asstring(obj);
|
||||
if (strcasecmp(arg, "allow") == 0) {
|
||||
allow = true;
|
||||
} else if (strcasecmp(arg, "maintain") == 0) {
|
||||
allow = maint = true;
|
||||
} else if (strcasecmp(arg, "off") == 0) {
|
||||
/* Default */
|
||||
} else {
|
||||
UNREACHABLE();
|
||||
}
|
||||
dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
|
||||
dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, false);
|
||||
dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1749,6 +1822,20 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNORESRVCNAME,
|
||||
ignore);
|
||||
|
||||
obj = NULL;
|
||||
result = cfg_map_get(zoptions, "dnssec-update-mode", &obj);
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
const char *arg = cfg_obj_asstring(obj);
|
||||
if (strcasecmp(arg, "no-resign") == 0) {
|
||||
dns_zone_setkeyopt(zone, DNS_ZONEKEY_NORESIGN,
|
||||
true);
|
||||
} else if (strcasecmp(arg, "maintain") == 0) {
|
||||
/* Default */
|
||||
} else {
|
||||
UNREACHABLE();
|
||||
}
|
||||
}
|
||||
|
||||
obj = NULL;
|
||||
result = named_config_get(maps, "serial-update-method", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS && obj != NULL);
|
||||
@@ -1919,9 +2006,7 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
|
||||
}
|
||||
|
||||
bool
|
||||
named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
|
||||
const cfg_obj_t *vconfig, const cfg_obj_t *config,
|
||||
dns_kasplist_t *kasplist) {
|
||||
named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
|
||||
const cfg_obj_t *zoptions = NULL;
|
||||
const cfg_obj_t *obj = NULL;
|
||||
const char *cfilename;
|
||||
@@ -1955,8 +2040,7 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
|
||||
has_raw = false;
|
||||
}
|
||||
|
||||
inline_signing = named_zone_inlinesigning(zconfig, vconfig, config,
|
||||
kasplist);
|
||||
inline_signing = named_zone_inlinesigning(zconfig);
|
||||
if (!inline_signing && has_raw) {
|
||||
dns_zone_log(zone, ISC_LOG_DEBUG(1),
|
||||
"not reusable: old zone was inline-signing");
|
||||
@@ -1993,57 +2077,15 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
|
||||
}
|
||||
|
||||
bool
|
||||
named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
|
||||
const cfg_obj_t *config, dns_kasplist_t *kasplist) {
|
||||
const cfg_obj_t *maps[4];
|
||||
named_zone_inlinesigning(const cfg_obj_t *zconfig) {
|
||||
const cfg_obj_t *zoptions = NULL;
|
||||
const cfg_obj_t *signing = NULL;
|
||||
const cfg_obj_t *policy = NULL;
|
||||
dns_kasp_t *kasp = NULL;
|
||||
isc_result_t res;
|
||||
bool inline_signing = false;
|
||||
int i = 0;
|
||||
|
||||
maps[i++] = cfg_tuple_get(zconfig, "options");
|
||||
if (vconfig != NULL) {
|
||||
maps[i++] = cfg_tuple_get(vconfig, "options");
|
||||
}
|
||||
if (config != NULL) {
|
||||
const cfg_obj_t *options = NULL;
|
||||
(void)cfg_map_get(config, "options", &options);
|
||||
if (options != NULL) {
|
||||
maps[i++] = options;
|
||||
}
|
||||
}
|
||||
maps[i] = NULL;
|
||||
|
||||
/* Check the value in dnssec-policy. */
|
||||
policy = NULL;
|
||||
res = named_config_get(maps, "dnssec-policy", &policy);
|
||||
/* If no dnssec-policy found, then zone is not using inline-signing. */
|
||||
if (res != ISC_R_SUCCESS ||
|
||||
strcmp(cfg_obj_asstring(policy), "none") == 0)
|
||||
{
|
||||
return (false);
|
||||
}
|
||||
|
||||
/* Lookup the policy. */
|
||||
res = dns_kasplist_find(kasplist, cfg_obj_asstring(policy), &kasp);
|
||||
if (res != ISC_R_SUCCESS) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
inline_signing = dns_kasp_inlinesigning(kasp);
|
||||
dns_kasp_detach(&kasp);
|
||||
|
||||
/*
|
||||
* The zone option 'inline-signing' may override the value in
|
||||
* dnssec-policy. This is a zone-only option, so look in maps[0]
|
||||
* only.
|
||||
*/
|
||||
res = cfg_map_get(maps[0], "inline-signing", &signing);
|
||||
if (res == ISC_R_SUCCESS && cfg_obj_isboolean(signing)) {
|
||||
return (cfg_obj_asboolean(signing));
|
||||
}
|
||||
zoptions = cfg_tuple_get(zconfig, "options");
|
||||
inline_signing = (cfg_map_get(zoptions, "inline-signing", &signing) ==
|
||||
ISC_R_SUCCESS &&
|
||||
cfg_obj_asboolean(signing));
|
||||
|
||||
return (inline_signing);
|
||||
}
|
||||
|
||||
+167
-204
@@ -102,8 +102,6 @@
|
||||
|
||||
#define DNSDEFAULTPORT 53
|
||||
|
||||
#define DEFAULT_EDNS_BUFSIZE 1232
|
||||
|
||||
/* Number of addresses to request from isc_getaddresses() */
|
||||
#define MAX_SERVERADDRS 4
|
||||
|
||||
@@ -121,6 +119,8 @@ static bool is_dst_up = false;
|
||||
static bool use_tls = false;
|
||||
static bool usevc = false;
|
||||
static bool usegsstsig = false;
|
||||
static bool use_win2k_gsstsig = false;
|
||||
static bool tried_other_gsstsig = false;
|
||||
static bool local_only = false;
|
||||
static isc_nm_t *netmgr = NULL;
|
||||
static isc_loopmgr_t *loopmgr = NULL;
|
||||
@@ -137,7 +137,7 @@ static dns_name_t *userzone = NULL;
|
||||
static dns_name_t *zname = NULL;
|
||||
static dns_name_t tmpzonename = DNS_NAME_INITEMPTY;
|
||||
static dns_name_t restart_primary = DNS_NAME_INITEMPTY;
|
||||
static dns_tsigkeyring_t *gssring = NULL;
|
||||
static dns_tsig_keyring_t *gssring = NULL;
|
||||
static dns_tsigkey_t *tsigkey = NULL;
|
||||
static dst_key_t *sig0key = NULL;
|
||||
static isc_sockaddr_t *servers = NULL;
|
||||
@@ -177,8 +177,6 @@ static isc_mutex_t answer_lock;
|
||||
static dns_message_t *answer = NULL;
|
||||
static uint32_t default_ttl = 0;
|
||||
static bool default_ttl_set = false;
|
||||
static uint32_t lease = 0, keylease = 0;
|
||||
static bool lease_set = false, keylease_set = false;
|
||||
static bool checknames = true;
|
||||
static bool checksvcb = true;
|
||||
static const char *resolvconf = RESOLV_CONF;
|
||||
@@ -242,8 +240,8 @@ error(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
|
||||
static void
|
||||
primary_from_servers(void) {
|
||||
if (primary_servers != NULL && primary_servers != servers) {
|
||||
isc_mem_cput(gmctx, primary_servers, primary_alloc,
|
||||
sizeof(isc_sockaddr_t));
|
||||
isc_mem_put(gmctx, primary_servers,
|
||||
primary_alloc * sizeof(isc_sockaddr_t));
|
||||
}
|
||||
primary_servers = servers;
|
||||
primary_total = ns_total;
|
||||
@@ -279,7 +277,8 @@ fatal(const char *format, ...) {
|
||||
vfprintf(stderr, format, args);
|
||||
va_end(args);
|
||||
fprintf(stderr, "\n");
|
||||
_exit(EXIT_FAILURE);
|
||||
isc__tls_setfatalmode();
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -367,8 +366,7 @@ reset_system(void) {
|
||||
if (updatemsg != NULL) {
|
||||
dns_message_reset(updatemsg, DNS_MESSAGE_INTENTRENDER);
|
||||
} else {
|
||||
dns_message_create(gmctx, NULL, NULL, DNS_MESSAGE_INTENTRENDER,
|
||||
&updatemsg);
|
||||
dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &updatemsg);
|
||||
}
|
||||
updatemsg->opcode = dns_opcode_update;
|
||||
if (usegsstsig) {
|
||||
@@ -378,17 +376,18 @@ reset_system(void) {
|
||||
if (gssring != NULL) {
|
||||
dns_tsigkeyring_detach(&gssring);
|
||||
}
|
||||
tried_other_gsstsig = false;
|
||||
}
|
||||
}
|
||||
|
||||
static bool
|
||||
parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
|
||||
parse_hmac(const dns_name_t **hmac, const char *hmacstr, size_t len,
|
||||
uint16_t *digestbitsp) {
|
||||
uint16_t digestbits = 0;
|
||||
isc_result_t result;
|
||||
char buf[20];
|
||||
|
||||
REQUIRE(hmac_alg != NULL);
|
||||
REQUIRE(hmac != NULL && *hmac == NULL);
|
||||
REQUIRE(hmacstr != NULL);
|
||||
|
||||
if (len >= sizeof(buf)) {
|
||||
@@ -400,9 +399,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
|
||||
strlcpy(buf, hmacstr, ISC_MIN(len + 1, sizeof(buf)));
|
||||
|
||||
if (strcasecmp(buf, "hmac-md5") == 0) {
|
||||
*hmac_alg = DST_ALG_HMACMD5;
|
||||
*hmac = DNS_TSIG_HMACMD5_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
|
||||
*hmac_alg = DST_ALG_HMACMD5;
|
||||
*hmac = DNS_TSIG_HMACMD5_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[9], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 128) {
|
||||
error("digest-bits out of range [0..128]");
|
||||
@@ -410,9 +409,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
|
||||
}
|
||||
*digestbitsp = (digestbits + 7) & ~0x7U;
|
||||
} else if (strcasecmp(buf, "hmac-sha1") == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA1;
|
||||
*hmac = DNS_TSIG_HMACSHA1_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha1-", 10) == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA1;
|
||||
*hmac = DNS_TSIG_HMACSHA1_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[10], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 160) {
|
||||
error("digest-bits out of range [0..160]");
|
||||
@@ -420,9 +419,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
|
||||
}
|
||||
*digestbitsp = (digestbits + 7) & ~0x7U;
|
||||
} else if (strcasecmp(buf, "hmac-sha224") == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA224;
|
||||
*hmac = DNS_TSIG_HMACSHA224_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha224-", 12) == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA224;
|
||||
*hmac = DNS_TSIG_HMACSHA224_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[12], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 224) {
|
||||
error("digest-bits out of range [0..224]");
|
||||
@@ -430,9 +429,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
|
||||
}
|
||||
*digestbitsp = (digestbits + 7) & ~0x7U;
|
||||
} else if (strcasecmp(buf, "hmac-sha256") == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA256;
|
||||
*hmac = DNS_TSIG_HMACSHA256_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha256-", 12) == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA256;
|
||||
*hmac = DNS_TSIG_HMACSHA256_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[12], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 256) {
|
||||
error("digest-bits out of range [0..256]");
|
||||
@@ -440,9 +439,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
|
||||
}
|
||||
*digestbitsp = (digestbits + 7) & ~0x7U;
|
||||
} else if (strcasecmp(buf, "hmac-sha384") == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA384;
|
||||
*hmac = DNS_TSIG_HMACSHA384_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha384-", 12) == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA384;
|
||||
*hmac = DNS_TSIG_HMACSHA384_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[12], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 384) {
|
||||
error("digest-bits out of range [0..384]");
|
||||
@@ -450,9 +449,9 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
|
||||
}
|
||||
*digestbitsp = (digestbits + 7) & ~0x7U;
|
||||
} else if (strcasecmp(buf, "hmac-sha512") == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA512;
|
||||
*hmac = DNS_TSIG_HMACSHA512_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha512-", 12) == 0) {
|
||||
*hmac_alg = DST_ALG_HMACSHA512;
|
||||
*hmac = DNS_TSIG_HMACSHA512_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[12], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 512) {
|
||||
error("digest-bits out of range [0..512]");
|
||||
@@ -487,12 +486,12 @@ setup_keystr(void) {
|
||||
isc_buffer_t secretbuf;
|
||||
isc_result_t result;
|
||||
isc_buffer_t keynamesrc;
|
||||
char *secretstr = NULL;
|
||||
char *s = NULL, *n = NULL;
|
||||
char *secretstr;
|
||||
char *s, *n;
|
||||
dns_fixedname_t fkeyname;
|
||||
dns_name_t *mykeyname = NULL;
|
||||
char *name = NULL;
|
||||
dst_algorithm_t hmac_alg;
|
||||
dns_name_t *mykeyname;
|
||||
char *name;
|
||||
const dns_name_t *hmacname = NULL;
|
||||
uint16_t digestbits = 0;
|
||||
|
||||
mykeyname = dns_fixedname_initname(&fkeyname);
|
||||
@@ -511,11 +510,11 @@ setup_keystr(void) {
|
||||
}
|
||||
name = secretstr;
|
||||
secretstr = n + 1;
|
||||
if (!parse_hmac(keystr, s - keystr, &hmac_alg, &digestbits)) {
|
||||
exit(EXIT_FAILURE);
|
||||
if (!parse_hmac(&hmacname, keystr, s - keystr, &digestbits)) {
|
||||
exit(1);
|
||||
}
|
||||
} else {
|
||||
hmac_alg = DST_ALG_HMACMD5;
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
name = keystr;
|
||||
n = s;
|
||||
}
|
||||
@@ -542,8 +541,9 @@ setup_keystr(void) {
|
||||
secretlen = isc_buffer_usedlength(&secretbuf);
|
||||
|
||||
debug("keycreate");
|
||||
result = dns_tsigkey_create(mykeyname, hmac_alg, secret, secretlen,
|
||||
gmctx, &tsigkey);
|
||||
result = dns_tsigkey_create(mykeyname, hmacname, secret, secretlen,
|
||||
false, false, NULL, 0, 0, gmctx, NULL,
|
||||
&tsigkey);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "could not create key from %s: %s\n", keystr,
|
||||
isc_result_totext(result));
|
||||
@@ -626,7 +626,7 @@ static void
|
||||
setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
|
||||
dst_key_t *dstkey = NULL;
|
||||
isc_result_t result;
|
||||
dst_algorithm_t hmac_alg = DST_ALG_UNKNOWN;
|
||||
const dns_name_t *hmacname = NULL;
|
||||
|
||||
debug("Creating key...");
|
||||
|
||||
@@ -657,26 +657,37 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
|
||||
|
||||
switch (dst_key_alg(dstkey)) {
|
||||
case DST_ALG_HMACMD5:
|
||||
case DST_ALG_HMACSHA1:
|
||||
case DST_ALG_HMACSHA224:
|
||||
case DST_ALG_HMACSHA256:
|
||||
case DST_ALG_HMACSHA384:
|
||||
case DST_ALG_HMACSHA512:
|
||||
hmac_alg = dst_key_alg(dstkey);
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
break;
|
||||
default:
|
||||
case DST_ALG_HMACSHA1:
|
||||
hmacname = DNS_TSIG_HMACSHA1_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA224:
|
||||
hmacname = DNS_TSIG_HMACSHA224_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA256:
|
||||
hmacname = DNS_TSIG_HMACSHA256_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA384:
|
||||
hmacname = DNS_TSIG_HMACSHA384_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA512:
|
||||
hmacname = DNS_TSIG_HMACSHA512_NAME;
|
||||
break;
|
||||
}
|
||||
if (hmacname != NULL) {
|
||||
result = dns_tsigkey_createfromkey(
|
||||
dst_key_name(dstkey), hmacname, dstkey, false, false,
|
||||
NULL, 0, 0, mctx, NULL, &tsigkey);
|
||||
dst_key_free(&dstkey);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "could not create key from %s: %s\n",
|
||||
keyfile, isc_result_totext(result));
|
||||
return;
|
||||
}
|
||||
} else {
|
||||
dst_key_attach(dstkey, &sig0key);
|
||||
dst_key_free(&dstkey);
|
||||
return;
|
||||
}
|
||||
|
||||
result = dns_tsigkey_createfromkey(dst_key_name(dstkey), hmac_alg,
|
||||
dstkey, false, false, NULL, 0, 0,
|
||||
mctx, &tsigkey);
|
||||
dst_key_free(&dstkey);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "could not create key from %s: %s\n", keyfile,
|
||||
isc_result_totext(result));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -688,12 +699,12 @@ doshutdown(void) {
|
||||
* to NULL.
|
||||
*/
|
||||
if (primary_servers != NULL && primary_servers != servers) {
|
||||
isc_mem_cput(gmctx, primary_servers, primary_alloc,
|
||||
sizeof(isc_sockaddr_t));
|
||||
isc_mem_put(gmctx, primary_servers,
|
||||
primary_alloc * sizeof(isc_sockaddr_t));
|
||||
}
|
||||
|
||||
if (servers != NULL) {
|
||||
isc_mem_cput(gmctx, servers, ns_alloc, sizeof(isc_sockaddr_t));
|
||||
isc_mem_put(gmctx, servers, ns_alloc * sizeof(isc_sockaddr_t));
|
||||
}
|
||||
|
||||
if (localaddr4 != NULL) {
|
||||
@@ -802,7 +813,7 @@ create_name(const char *str, char *namedata, size_t len, dns_name_t *name) {
|
||||
}
|
||||
|
||||
static void
|
||||
setup_system(void *arg ISC_ATTR_UNUSED) {
|
||||
setup_system(void) {
|
||||
isc_result_t result;
|
||||
isc_sockaddr_t bind_any, bind_any6;
|
||||
isc_sockaddrlist_t *nslist;
|
||||
@@ -834,7 +845,7 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
|
||||
if (primary_servers == servers) {
|
||||
primary_servers = NULL;
|
||||
}
|
||||
isc_mem_cput(gmctx, servers, ns_alloc, sizeof(isc_sockaddr_t));
|
||||
isc_mem_put(gmctx, servers, ns_alloc * sizeof(isc_sockaddr_t));
|
||||
}
|
||||
|
||||
ns_inuse = 0;
|
||||
@@ -849,7 +860,7 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
|
||||
default_servers = !local_only;
|
||||
|
||||
ns_total = ns_alloc = (have_ipv4 ? 1 : 0) + (have_ipv6 ? 1 : 0);
|
||||
servers = isc_mem_cget(gmctx, ns_alloc, sizeof(isc_sockaddr_t));
|
||||
servers = isc_mem_get(gmctx, ns_alloc * sizeof(isc_sockaddr_t));
|
||||
|
||||
if (have_ipv6) {
|
||||
memset(&in6, 0, sizeof(in6));
|
||||
@@ -891,7 +902,7 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
|
||||
}
|
||||
|
||||
ns_alloc = ns_total;
|
||||
servers = isc_mem_cget(gmctx, ns_alloc, sizeof(isc_sockaddr_t));
|
||||
servers = isc_mem_get(gmctx, ns_alloc * sizeof(isc_sockaddr_t));
|
||||
|
||||
i = 0;
|
||||
for (sa = ISC_LIST_HEAD(*nslist); sa != NULL;
|
||||
@@ -923,7 +934,7 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
|
||||
|
||||
irs_resconf_destroy(&resconf);
|
||||
|
||||
result = dns_dispatchmgr_create(gmctx, loopmgr, netmgr, &dispatchmgr);
|
||||
result = dns_dispatchmgr_create(gmctx, netmgr, &dispatchmgr);
|
||||
check_result(result, "dns_dispatchmgr_create");
|
||||
|
||||
result = dst_lib_init(gmctx, NULL);
|
||||
@@ -971,7 +982,7 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
|
||||
dns_transport_set_always_verify_remote(transport,
|
||||
tls_always_verify_remote);
|
||||
|
||||
result = dns_requestmgr_create(gmctx, loopmgr, dispatchmgr, dispatchv4,
|
||||
result = dns_requestmgr_create(gmctx, dispatchmgr, dispatchv4,
|
||||
dispatchv6, &requestmgr);
|
||||
check_result(result, "dns_requestmgr_create");
|
||||
|
||||
@@ -1053,7 +1064,7 @@ pre_parse_args(int argc, char **argv) {
|
||||
"[-A tlscafile] [-H tlshostname] "
|
||||
"[-O] ] [-v] [-V] [-P] [-T] [-4 | -6] "
|
||||
"[filename]\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
|
||||
case 'P':
|
||||
for (t = 0xff00; t <= 0xfffe; t++) {
|
||||
@@ -1091,7 +1102,7 @@ pre_parse_args(int argc, char **argv) {
|
||||
}
|
||||
}
|
||||
if (doexit) {
|
||||
exit(EXIT_SUCCESS);
|
||||
exit(0);
|
||||
}
|
||||
isc_commandline_reset = true;
|
||||
isc_commandline_index = 1;
|
||||
@@ -1125,6 +1136,7 @@ parse_args(int argc, char **argv) {
|
||||
break;
|
||||
case 'A':
|
||||
use_tls = true;
|
||||
usevc = true;
|
||||
tls_ca_file = isc_commandline_argument;
|
||||
break;
|
||||
case 'C':
|
||||
@@ -1139,10 +1151,12 @@ parse_args(int argc, char **argv) {
|
||||
break;
|
||||
case 'E':
|
||||
use_tls = true;
|
||||
usevc = true;
|
||||
tls_client_cert_file = isc_commandline_argument;
|
||||
break;
|
||||
case 'H':
|
||||
use_tls = true;
|
||||
usevc = true;
|
||||
tls_hostname = isc_commandline_argument;
|
||||
break;
|
||||
case 'M':
|
||||
@@ -1153,6 +1167,7 @@ parse_args(int argc, char **argv) {
|
||||
break;
|
||||
case 'K':
|
||||
use_tls = true;
|
||||
usevc = true;
|
||||
tls_client_key_file = isc_commandline_argument;
|
||||
break;
|
||||
case 'l':
|
||||
@@ -1166,7 +1181,7 @@ parse_args(int argc, char **argv) {
|
||||
"bad library debug value "
|
||||
"'%s'\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
logdebuglevel = i;
|
||||
break;
|
||||
@@ -1181,12 +1196,15 @@ parse_args(int argc, char **argv) {
|
||||
break;
|
||||
case 'g':
|
||||
usegsstsig = true;
|
||||
use_win2k_gsstsig = false;
|
||||
break;
|
||||
case 'o':
|
||||
usegsstsig = true;
|
||||
use_win2k_gsstsig = true;
|
||||
break;
|
||||
case 'O':
|
||||
use_tls = true;
|
||||
usevc = true;
|
||||
tls_always_verify_remote = false;
|
||||
break;
|
||||
case 'p':
|
||||
@@ -1197,11 +1215,12 @@ parse_args(int argc, char **argv) {
|
||||
"bad port number "
|
||||
"'%s'\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
case 'S':
|
||||
use_tls = true;
|
||||
usevc = true;
|
||||
break;
|
||||
case 't':
|
||||
result = isc_parse_uint32(&timeout,
|
||||
@@ -1209,7 +1228,7 @@ parse_args(int argc, char **argv) {
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "bad timeout '%s'\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
if (timeout == 0) {
|
||||
timeout = UINT_MAX;
|
||||
@@ -1221,7 +1240,7 @@ parse_args(int argc, char **argv) {
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "bad udp timeout '%s'\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
case 'r':
|
||||
@@ -1230,7 +1249,7 @@ parse_args(int argc, char **argv) {
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "bad udp retries '%s'\n",
|
||||
isc_commandline_argument);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
@@ -1241,19 +1260,19 @@ parse_args(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option: %c\n", argv[0],
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
if (keyfile != NULL && keystr != NULL) {
|
||||
fprintf(stderr, "%s: cannot specify both -k and -y\n", argv[0]);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
#if HAVE_GSSAPI
|
||||
if (usegsstsig && (keyfile != NULL || keystr != NULL)) {
|
||||
fprintf(stderr, "%s: cannot specify -g with -k or -y\n",
|
||||
argv[0]);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
#else /* HAVE_GSSAPI */
|
||||
if (usegsstsig) {
|
||||
@@ -1261,12 +1280,11 @@ parse_args(int argc, char **argv) {
|
||||
"%s: cannot specify -g or -o, "
|
||||
"program not linked with GSS API Library\n",
|
||||
argv[0]);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
#endif /* HAVE_GSSAPI */
|
||||
|
||||
if (use_tls) {
|
||||
usevc = true;
|
||||
if ((tls_client_key_file == NULL) !=
|
||||
(tls_client_cert_file == NULL))
|
||||
{
|
||||
@@ -1274,14 +1292,14 @@ parse_args(int argc, char **argv) {
|
||||
"%s: cannot specify the -K option without"
|
||||
"the -E option, and vice versa.\n",
|
||||
argv[0]);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
if (tls_ca_file != NULL && tls_always_verify_remote == false) {
|
||||
fprintf(stderr,
|
||||
"%s: cannot specify the -A option in "
|
||||
"conjuction with the -O option.\n",
|
||||
argv[0]);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1295,7 +1313,7 @@ parse_args(int argc, char **argv) {
|
||||
fprintf(stderr, "could not open '%s': %s\n",
|
||||
argv[isc_commandline_index],
|
||||
isc_result_totext(result));
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
if (!force_interactive) {
|
||||
@@ -1521,90 +1539,6 @@ evaluate_prereq(char *cmdline) {
|
||||
return (make_prereq(cmdline, ispositive, isrrset));
|
||||
}
|
||||
|
||||
static void
|
||||
updateopt(void) {
|
||||
isc_result_t result;
|
||||
dns_ednsopt_t ednsopts[1];
|
||||
unsigned char ul[8];
|
||||
unsigned int count = 0;
|
||||
|
||||
if (lease_set) {
|
||||
isc_buffer_t b;
|
||||
INSIST(count < ARRAY_SIZE(ednsopts));
|
||||
ednsopts[count++] = (dns_ednsopt_t){ .code = DNS_OPT_UL,
|
||||
.length = keylease_set ? 8
|
||||
: 4,
|
||||
.value = ul };
|
||||
|
||||
isc_buffer_init(&b, ul, sizeof(ul));
|
||||
isc_buffer_putuint32(&b, lease);
|
||||
isc_buffer_putuint32(&b, keylease);
|
||||
}
|
||||
|
||||
if (count != 0) {
|
||||
dns_rdataset_t *opt = NULL;
|
||||
result = dns_message_buildopt(updatemsg, &opt, 0,
|
||||
DEFAULT_EDNS_BUFSIZE, 0, ednsopts,
|
||||
count);
|
||||
check_result(result, "dns_message_buildopt");
|
||||
result = dns_message_setopt(updatemsg, opt);
|
||||
check_result(result, "dns_message_setopt");
|
||||
} else {
|
||||
result = dns_message_setopt(updatemsg, NULL);
|
||||
check_result(result, "dns_message_setopt");
|
||||
}
|
||||
}
|
||||
|
||||
static uint16_t
|
||||
evaluate_lease(char *cmdline) {
|
||||
char *word;
|
||||
isc_result_t result;
|
||||
uint32_t value1, value2;
|
||||
|
||||
word = nsu_strsep(&cmdline, " \t\r\n");
|
||||
if (word == NULL || *word == 0) {
|
||||
fprintf(stderr, "could not read ttl\n");
|
||||
return (STATUS_SYNTAX);
|
||||
}
|
||||
|
||||
if (!strcasecmp(word, "none")) {
|
||||
lease = 0;
|
||||
lease_set = false;
|
||||
keylease = 0;
|
||||
keylease_set = false;
|
||||
updateopt();
|
||||
return (STATUS_MORE);
|
||||
}
|
||||
|
||||
result = isc_parse_uint32(&value1, word, 10);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (STATUS_SYNTAX);
|
||||
}
|
||||
|
||||
word = nsu_strsep(&cmdline, " \t\r\n");
|
||||
if (word == NULL || *word == 0) {
|
||||
lease = value1;
|
||||
lease_set = true;
|
||||
keylease = 0;
|
||||
keylease_set = false;
|
||||
updateopt();
|
||||
return (STATUS_MORE);
|
||||
}
|
||||
|
||||
result = isc_parse_uint32(&value2, word, 10);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (STATUS_SYNTAX);
|
||||
}
|
||||
|
||||
lease = value1;
|
||||
lease_set = true;
|
||||
keylease = value2;
|
||||
keylease_set = true;
|
||||
updateopt();
|
||||
|
||||
return (STATUS_MORE);
|
||||
}
|
||||
|
||||
static uint16_t
|
||||
evaluate_server(char *cmdline) {
|
||||
char *word, *server;
|
||||
@@ -1644,14 +1578,15 @@ evaluate_server(char *cmdline) {
|
||||
if (primary_servers == servers) {
|
||||
primary_servers = NULL;
|
||||
}
|
||||
isc_mem_cput(gmctx, servers, ns_alloc, sizeof(isc_sockaddr_t));
|
||||
isc_mem_put(gmctx, servers, ns_alloc * sizeof(isc_sockaddr_t));
|
||||
}
|
||||
|
||||
default_servers = false;
|
||||
|
||||
ns_alloc = MAX_SERVERADDRS;
|
||||
ns_inuse = 0;
|
||||
servers = isc_mem_cget(gmctx, ns_alloc, sizeof(isc_sockaddr_t));
|
||||
servers = isc_mem_getx(gmctx, ns_alloc * sizeof(isc_sockaddr_t),
|
||||
ISC_MEM_ZERO);
|
||||
ns_total = get_addresses(server, (in_port_t)port, servers, ns_alloc);
|
||||
if (ns_total == 0) {
|
||||
return (STATUS_SYNTAX);
|
||||
@@ -1721,7 +1656,7 @@ evaluate_key(char *cmdline) {
|
||||
int secretlen;
|
||||
unsigned char *secret = NULL;
|
||||
isc_buffer_t secretbuf;
|
||||
dst_algorithm_t hmac_alg = DST_ALG_UNKNOWN;
|
||||
const dns_name_t *hmacname = NULL;
|
||||
uint16_t digestbits = 0;
|
||||
char *n;
|
||||
|
||||
@@ -1735,12 +1670,12 @@ evaluate_key(char *cmdline) {
|
||||
|
||||
n = strchr(namestr, ':');
|
||||
if (n != NULL) {
|
||||
if (!parse_hmac(namestr, n - namestr, &hmac_alg, &digestbits)) {
|
||||
if (!parse_hmac(&hmacname, namestr, n - namestr, &digestbits)) {
|
||||
return (STATUS_SYNTAX);
|
||||
}
|
||||
namestr = n + 1;
|
||||
} else {
|
||||
hmac_alg = DST_ALG_HMACMD5;
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
}
|
||||
|
||||
isc_buffer_init(&b, namestr, strlen(namestr));
|
||||
@@ -1772,8 +1707,9 @@ evaluate_key(char *cmdline) {
|
||||
if (tsigkey != NULL) {
|
||||
dns_tsigkey_detach(&tsigkey);
|
||||
}
|
||||
result = dns_tsigkey_create(mykeyname, hmac_alg, secret, secretlen,
|
||||
gmctx, &tsigkey);
|
||||
result = dns_tsigkey_create(mykeyname, hmacname, secret, secretlen,
|
||||
false, false, NULL, 0, 0, gmctx, NULL,
|
||||
&tsigkey);
|
||||
isc_mem_free(gmctx, secret);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "could not create key from %s %s: %s\n",
|
||||
@@ -2246,7 +2182,7 @@ show_message(FILE *stream, dns_message_t *msg, const char *description) {
|
||||
if (bufsz > MAXTEXT) {
|
||||
fprintf(stderr, "could not allocate large enough "
|
||||
"buffer to display message\n");
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
if (buf != NULL) {
|
||||
isc_buffer_free(&buf);
|
||||
@@ -2309,9 +2245,6 @@ do_next_command(char *cmdline) {
|
||||
if (strcasecmp(word, "add") == 0) {
|
||||
return (update_addordelete(cmdline, false));
|
||||
}
|
||||
if (strcasecmp(word, "lease") == 0) {
|
||||
return (evaluate_lease(cmdline));
|
||||
}
|
||||
if (strcasecmp(word, "server") == 0) {
|
||||
return (evaluate_server(cmdline));
|
||||
}
|
||||
@@ -2370,6 +2303,7 @@ do_next_command(char *cmdline) {
|
||||
if (strcasecmp(word, "gsstsig") == 0) {
|
||||
#if HAVE_GSSAPI
|
||||
usegsstsig = true;
|
||||
use_win2k_gsstsig = false;
|
||||
#else /* HAVE_GSSAPI */
|
||||
fprintf(stderr, "gsstsig not supported\n");
|
||||
#endif /* HAVE_GSSAPI */
|
||||
@@ -2378,6 +2312,7 @@ do_next_command(char *cmdline) {
|
||||
if (strcasecmp(word, "oldgsstsig") == 0) {
|
||||
#if HAVE_GSSAPI
|
||||
usegsstsig = true;
|
||||
use_win2k_gsstsig = true;
|
||||
#else /* HAVE_GSSAPI */
|
||||
fprintf(stderr, "gsstsig not supported\n");
|
||||
#endif /* HAVE_GSSAPI */
|
||||
@@ -2403,6 +2338,8 @@ do_next_command(char *cmdline) {
|
||||
"the request)\n"
|
||||
"gsstsig (use GSS_TSIG to "
|
||||
"sign the request)\n"
|
||||
"oldgsstsig (use Microsoft's "
|
||||
"GSS_TSIG to sign the request)\n"
|
||||
"zone name (set the zone to be "
|
||||
"updated)\n"
|
||||
"class CLASS (set the zone's DNS "
|
||||
@@ -2484,7 +2421,7 @@ static void
|
||||
done_update(void) {
|
||||
ddebug("done_update()");
|
||||
|
||||
isc_async_current(getinput, NULL);
|
||||
isc_async_current(loopmgr, getinput, NULL);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -2561,7 +2498,7 @@ update_completed(void *arg) {
|
||||
}
|
||||
|
||||
LOCK(&answer_lock);
|
||||
dns_message_create(gmctx, NULL, NULL, DNS_MESSAGE_INTENTPARSE, &answer);
|
||||
dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &answer);
|
||||
result = dns_request_getresponse(request, answer,
|
||||
DNS_MESSAGEPARSE_PRESERVEORDER);
|
||||
switch (result) {
|
||||
@@ -2749,7 +2686,7 @@ recvsoa(void *arg) {
|
||||
reqinfo = NULL;
|
||||
|
||||
ddebug("About to create rcvmsg");
|
||||
dns_message_create(gmctx, NULL, NULL, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
|
||||
dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
|
||||
result = dns_request_getresponse(request, rcvmsg,
|
||||
DNS_MESSAGEPARSE_PRESERVEORDER);
|
||||
if (result == DNS_R_TSIGERRORSET && servers != NULL) {
|
||||
@@ -2766,9 +2703,9 @@ recvsoa(void *arg) {
|
||||
dns_message_renderreset(soaquery);
|
||||
ddebug("retrying soa request without TSIG");
|
||||
|
||||
if (!default_servers && usevc) {
|
||||
if (usevc) {
|
||||
options |= DNS_REQUESTOPT_TCP;
|
||||
if (use_tls) {
|
||||
if (!default_servers && use_tls) {
|
||||
req_transport = transport;
|
||||
req_tls_ctx_cache = tls_ctx_cache;
|
||||
}
|
||||
@@ -2914,19 +2851,20 @@ lookforsoa:
|
||||
if (default_servers) {
|
||||
char serverstr[DNS_NAME_MAXTEXT + 1];
|
||||
isc_buffer_t buf;
|
||||
size_t size;
|
||||
|
||||
isc_buffer_init(&buf, serverstr, sizeof(serverstr));
|
||||
result = dns_name_totext(&primary, DNS_NAME_OMITFINALDOT, &buf);
|
||||
result = dns_name_totext(&primary, true, &buf);
|
||||
check_result(result, "dns_name_totext");
|
||||
serverstr[isc_buffer_usedlength(&buf)] = 0;
|
||||
|
||||
if (primary_servers != NULL && primary_servers != servers) {
|
||||
isc_mem_cput(gmctx, primary_servers, primary_alloc,
|
||||
sizeof(isc_sockaddr_t));
|
||||
isc_mem_put(gmctx, primary_servers,
|
||||
primary_alloc * sizeof(isc_sockaddr_t));
|
||||
}
|
||||
primary_alloc = MAX_SERVERADDRS;
|
||||
primary_servers = isc_mem_cget(gmctx, primary_alloc,
|
||||
sizeof(isc_sockaddr_t));
|
||||
size = primary_alloc * sizeof(isc_sockaddr_t);
|
||||
primary_servers = isc_mem_getx(gmctx, size, ISC_MEM_ZERO);
|
||||
primary_total = get_addresses(serverstr, dnsport,
|
||||
primary_servers, primary_alloc);
|
||||
if (primary_total == 0) {
|
||||
@@ -2998,9 +2936,9 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
|
||||
dns_transport_t *req_transport = NULL;
|
||||
isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
|
||||
|
||||
if (!default_servers && usevc) {
|
||||
if (usevc) {
|
||||
options |= DNS_REQUESTOPT_TCP;
|
||||
if (use_tls) {
|
||||
if (!default_servers && use_tls) {
|
||||
req_transport = transport;
|
||||
req_tls_ctx_cache = tls_ctx_cache;
|
||||
}
|
||||
@@ -3111,8 +3049,13 @@ start_gssrequest(dns_name_t *primary) {
|
||||
if (gssring != NULL) {
|
||||
dns_tsigkeyring_detach(&gssring);
|
||||
}
|
||||
gssring = NULL;
|
||||
result = dns_tsigkeyring_create(gmctx, &gssring);
|
||||
|
||||
dns_tsigkeyring_create(gmctx, &gssring);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("dns_tsigkeyring_create failed: %s",
|
||||
isc_result_totext(result));
|
||||
}
|
||||
|
||||
dns_name_format(primary, namestr, sizeof(namestr));
|
||||
if (kserver == NULL) {
|
||||
@@ -3160,12 +3103,13 @@ start_gssrequest(dns_name_t *primary) {
|
||||
keyname->attributes.nocompress = true;
|
||||
|
||||
rmsg = NULL;
|
||||
dns_message_create(gmctx, NULL, NULL, DNS_MESSAGE_INTENTRENDER, &rmsg);
|
||||
dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &rmsg);
|
||||
|
||||
/* Build first request. */
|
||||
context = GSS_C_NO_CONTEXT;
|
||||
result = dns_tkey_buildgssquery(rmsg, keyname, servname, 0, &context,
|
||||
gmctx, &err_message);
|
||||
result = dns_tkey_buildgssquery(rmsg, keyname, servname, NULL, 0,
|
||||
&context, use_win2k_gsstsig, gmctx,
|
||||
&err_message);
|
||||
if (result == ISC_R_FAILURE) {
|
||||
fprintf(stderr, "tkey query failed: %s\n",
|
||||
err_message != NULL ? err_message : "unknown error");
|
||||
@@ -3275,7 +3219,7 @@ recvgss(void *arg) {
|
||||
isc_mem_put(gmctx, reqinfo, sizeof(nsu_gssinfo_t));
|
||||
|
||||
ddebug("recvgss creating rcvmsg");
|
||||
dns_message_create(gmctx, NULL, NULL, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
|
||||
dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
|
||||
|
||||
result = dns_request_getresponse(request, rcvmsg,
|
||||
DNS_MESSAGEPARSE_PRESERVEORDER);
|
||||
@@ -3290,19 +3234,23 @@ recvgss(void *arg) {
|
||||
fatal("invalid OPCODE in response to GSS-TSIG query");
|
||||
}
|
||||
|
||||
if (rcvmsg->rcode == dns_rcode_formerr && !tried_other_gsstsig) {
|
||||
ddebug("recvgss trying %s GSS-TSIG",
|
||||
use_win2k_gsstsig ? "Standard" : "Win2k");
|
||||
if (use_win2k_gsstsig) {
|
||||
use_win2k_gsstsig = false;
|
||||
} else {
|
||||
use_win2k_gsstsig = true;
|
||||
}
|
||||
tried_other_gsstsig = true;
|
||||
start_gssrequest(&restart_primary);
|
||||
goto done;
|
||||
}
|
||||
|
||||
if (rcvmsg->rcode != dns_rcode_noerror &&
|
||||
rcvmsg->rcode != dns_rcode_nxdomain)
|
||||
{
|
||||
char rcode[64];
|
||||
isc_buffer_t b;
|
||||
|
||||
isc_buffer_init(&b, rcode, sizeof(rcode) - 1);
|
||||
result = dns_rcode_totext(rcvmsg->rcode, &b);
|
||||
check_result(result, "dns_rcode_totext");
|
||||
rcode[isc_buffer_usedlength(&b)] = 0;
|
||||
|
||||
fatal("response to GSS-TSIG query was unsuccessful (%s)",
|
||||
rcode);
|
||||
fatal("response to GSS-TSIG query was unsuccessful");
|
||||
}
|
||||
|
||||
servname = dns_fixedname_initname(&fname);
|
||||
@@ -3311,8 +3259,10 @@ recvgss(void *arg) {
|
||||
result = dns_name_fromtext(servname, &buf, dns_rootname, 0, NULL);
|
||||
check_result(result, "dns_name_fromtext");
|
||||
|
||||
tsigkey = NULL;
|
||||
result = dns_tkey_gssnegotiate(tsigquery, rcvmsg, servname, &context,
|
||||
&tsigkey, gssring, &err_message);
|
||||
&tsigkey, gssring, use_win2k_gsstsig,
|
||||
&err_message);
|
||||
switch (result) {
|
||||
case DNS_R_CONTINUE:
|
||||
dns_message_detach(&rcvmsg);
|
||||
@@ -3338,6 +3288,18 @@ recvgss(void *arg) {
|
||||
* the TSIG -- this too is a spec violation, but it's
|
||||
* the least insane thing to do.
|
||||
*/
|
||||
#if 0
|
||||
/*
|
||||
* Verify the signature.
|
||||
*/
|
||||
rcvmsg->state = DNS_SECTION_ANY;
|
||||
dns_message_setquerytsig(rcvmsg, NULL);
|
||||
result = dns_message_settsigkey(rcvmsg, tsigkey);
|
||||
check_result(result, "dns_message_settsigkey");
|
||||
result = dns_message_checksig(rcvmsg, NULL);
|
||||
ddebug("tsig verification: %s", isc_result_totext(result));
|
||||
check_result(result, "dns_message_checksig");
|
||||
#endif /* 0 */
|
||||
|
||||
send_update(&tmpzonename, &primary_servers[primary_inuse]);
|
||||
setzoneclass(dns_rdataclass_none);
|
||||
@@ -3348,6 +3310,7 @@ recvgss(void *arg) {
|
||||
err_message != NULL ? err_message : "");
|
||||
}
|
||||
|
||||
done:
|
||||
dns_request_destroy(&request);
|
||||
dns_message_detach(&tsigquery);
|
||||
|
||||
@@ -3386,8 +3349,7 @@ start_update(void) {
|
||||
return;
|
||||
}
|
||||
|
||||
dns_message_create(gmctx, NULL, NULL, DNS_MESSAGE_INTENTRENDER,
|
||||
&soaquery);
|
||||
dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &soaquery);
|
||||
|
||||
if (default_servers) {
|
||||
soaquery->flags |= DNS_MESSAGEFLAG_RD;
|
||||
@@ -3567,7 +3529,8 @@ main(int argc, char **argv) {
|
||||
timeoutms = timeout * 1000;
|
||||
isc_nm_settimeouts(netmgr, timeoutms, timeoutms, timeoutms, timeoutms);
|
||||
|
||||
isc_loopmgr_setup(loopmgr, setup_system, NULL);
|
||||
setup_system();
|
||||
|
||||
isc_loopmgr_setup(loopmgr, getinput, NULL);
|
||||
isc_loopmgr_teardown(loopmgr, shutdown_program, NULL);
|
||||
isc_loopmgr_run(loopmgr);
|
||||
@@ -3576,7 +3539,7 @@ main(int argc, char **argv) {
|
||||
|
||||
if (seenerror) {
|
||||
return (2);
|
||||
} else {
|
||||
return (0);
|
||||
}
|
||||
|
||||
return (0);
|
||||
}
|
||||
|
||||
@@ -149,10 +149,8 @@ Options
|
||||
|
||||
.. option:: -o
|
||||
|
||||
This option is deprecated. Previously, it enabled a
|
||||
non-standards-compliant variant of GSS-TSIG that was used by Windows
|
||||
2000. Since that OS is now long past its end of life, this option is
|
||||
now treated as a synonym for :option:`-g`.
|
||||
This option enables a non-standards-compliant variant of GSS-TSIG
|
||||
used by Windows 2000.
|
||||
|
||||
.. option:: -O
|
||||
|
||||
@@ -302,9 +300,8 @@ The command formats and their meanings are as follows:
|
||||
:option:`-g` on the command line.
|
||||
|
||||
``oldgsstsig``
|
||||
This command is deprecated and will be removed in a future release.
|
||||
Previously, it caused ``nsupdate`` to use the Windows 2000 version of
|
||||
GSS-TSIG to sign updates. It is now treated as a synonym for ``gsstsig``.
|
||||
This command uses the Windows 2000 version of GSS-TSIG to sign the updates. This is
|
||||
equivalent to specifying :option:`-o` on the command line.
|
||||
|
||||
``realm [realm_name]``
|
||||
When using GSS-TSIG, this command specifies the use of ``realm_name`` rather than the default realm
|
||||
@@ -323,11 +320,6 @@ The command formats and their meanings are as follows:
|
||||
By default check-svcb processing is on. If check-svcb processing
|
||||
fails, the record is not added to the UPDATE message.
|
||||
|
||||
``lease time [keytime]``
|
||||
Set the EDNS Update Lease (UL) option to value to ``time`` and
|
||||
optionally also set the key lease time to ``keytime`` in seconds.
|
||||
If ``time`` is ``none`` the lease times are cleared.
|
||||
|
||||
``prereq nxdomain domain-name``
|
||||
This command requires that no resource record of any type exist with the name
|
||||
``domain-name``.
|
||||
|
||||
+19
-9
@@ -260,11 +260,18 @@ get_addresses(const char *host, in_port_t port) {
|
||||
|
||||
REQUIRE(host != NULL);
|
||||
|
||||
count = SERVERADDRS - nserveraddrs;
|
||||
result = isc_getaddresses(host, port, &serveraddrs[nserveraddrs], count,
|
||||
&found);
|
||||
nserveraddrs += found;
|
||||
|
||||
if (*host == '/') {
|
||||
result = isc_sockaddr_frompath(&serveraddrs[nserveraddrs],
|
||||
host);
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
nserveraddrs++;
|
||||
}
|
||||
} else {
|
||||
count = SERVERADDRS - nserveraddrs;
|
||||
result = isc_getaddresses(
|
||||
host, port, &serveraddrs[nserveraddrs], count, &found);
|
||||
nserveraddrs += found;
|
||||
}
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("couldn't get address for '%s': %s", host,
|
||||
isc_result_totext(result));
|
||||
@@ -348,7 +355,7 @@ rndc_recvdone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
|
||||
|
||||
isccc_sexpr_free(&response);
|
||||
|
||||
isccc_ccmsg_disconnect(ccmsg);
|
||||
isccc_ccmsg_invalidate(ccmsg);
|
||||
isc_loopmgr_shutdown(loopmgr);
|
||||
}
|
||||
|
||||
@@ -511,6 +518,11 @@ rndc_startconnect(isc_sockaddr_t *addr) {
|
||||
case AF_INET6:
|
||||
local = &local6;
|
||||
break;
|
||||
case AF_UNIX:
|
||||
/*
|
||||
* TODO: support UNIX domain sockets in netgmr.
|
||||
*/
|
||||
fatal("UNIX domain sockets not currently supported");
|
||||
default:
|
||||
UNREACHABLE();
|
||||
}
|
||||
@@ -932,7 +944,7 @@ main(int argc, char **argv) {
|
||||
default:
|
||||
fprintf(stderr, "%s: unhandled option -%c\n", program,
|
||||
isc_commandline_option);
|
||||
exit(EXIT_FAILURE);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1003,8 +1015,6 @@ main(int argc, char **argv) {
|
||||
|
||||
isc_loopmgr_run(loopmgr);
|
||||
|
||||
isccc_ccmsg_invalidate(&rndc_ccmsg);
|
||||
|
||||
isc_log_destroy(&log);
|
||||
isc_log_setcontext(NULL);
|
||||
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
/*
|
||||
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
*
|
||||
* SPDX-License-Identifier: MPL-2.0
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
*/
|
||||
|
||||
/*
|
||||
* Sample rndc configuration file.
|
||||
*/
|
||||
|
||||
options {
|
||||
default-server localhost;
|
||||
default-key "key";
|
||||
};
|
||||
|
||||
server localhost {
|
||||
key "key";
|
||||
};
|
||||
|
||||
key "cc64b3d1db63fc88d7cb5d2f9f57d258" {
|
||||
algorithm hmac-sha256;
|
||||
secret "34f88008d07deabbe65bd01f1d233d47";
|
||||
};
|
||||
|
||||
server "test1" {
|
||||
key "cc64b3d1db63fc88d7cb5d2f9f57d258";
|
||||
port 5353;
|
||||
addresses { 10.53.0.1; };
|
||||
};
|
||||
|
||||
key "key" {
|
||||
algorithm hmac-sha256;
|
||||
secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
|
||||
};
|
||||
+10
-9
@@ -265,9 +265,10 @@ Currently supported commands are:
|
||||
immediately re-signed by the new keys, but is allowed to
|
||||
incrementally re-sign over time.
|
||||
|
||||
This command requires that the zone be configured with a ``dnssec-policy``, and
|
||||
also requires the zone to be configured to allow dynamic DNS. (See "Dynamic
|
||||
Update Policies" in the Administrator Reference Manual for more details.)
|
||||
This command requires that the zone be configured with a ``dnssec-policy``, or
|
||||
that the ``auto-dnssec`` zone option be set to ``maintain``, and also requires the
|
||||
zone to be configured to allow dynamic DNS. (See "Dynamic Update Policies" in
|
||||
the Administrator Reference Manual for more details.)
|
||||
|
||||
.. option:: managed-keys (status | refresh | sync | destroy) [class [view]]
|
||||
|
||||
@@ -440,7 +441,6 @@ Currently supported commands are:
|
||||
.. option:: zone [class [view]]
|
||||
|
||||
If a zone is specified, this command reloads only the given zone.
|
||||
If no zone is specified, the reloading happens asynchronously.
|
||||
|
||||
.. program:: rndc
|
||||
|
||||
@@ -504,9 +504,11 @@ Currently supported commands are:
|
||||
the zone's DNSKEY RRset. If the DNSKEY RRset is changed, then the
|
||||
zone is automatically re-signed with the new key set.
|
||||
|
||||
This command requires that the zone be configured with a ``dnssec-policy``, and
|
||||
also requires the zone to be configured to allow dynamic DNS. (See "Dynamic
|
||||
Update Policies" in the Administrator Reference Manual for more details.)
|
||||
This command requires that the zone be configured with a ``dnssec-policy``, or
|
||||
that the ``auto-dnssec`` zone option be set to ``allow`` or ``maintain``,
|
||||
and also requires the zone to be configured to allow dynamic DNS. (See
|
||||
"Dynamic Update Policies" in the BIND 9 Administrator Reference Manual for more
|
||||
details.)
|
||||
|
||||
See also :option:`rndc loadkeys`.
|
||||
|
||||
@@ -605,8 +607,7 @@ Currently supported commands are:
|
||||
refused. If the zone has changed and the ``ixfr-from-differences``
|
||||
option is in use, the journal file is updated to reflect
|
||||
changes in the zone. Otherwise, if the zone has changed, any existing
|
||||
journal file is removed. If no zone is specified, the reloading happens
|
||||
asynchronously.
|
||||
journal file is removed.
|
||||
|
||||
See also :option:`rndc freeze`.
|
||||
|
||||
|
||||
+2
-2
@@ -18,7 +18,6 @@
|
||||
#include <stdbool.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include <isc/tls.h>
|
||||
|
||||
@@ -46,5 +45,6 @@ fatal(const char *format, ...) {
|
||||
vfprintf(stderr, format, args);
|
||||
va_end(args);
|
||||
fprintf(stderr, "\n");
|
||||
_exit(EXIT_FAILURE);
|
||||
isc__tls_setfatalmode();
|
||||
exit(1);
|
||||
}
|
||||
|
||||
@@ -19,7 +19,7 @@ $len = @ARGV[1] if (@ARGV == 2);
|
||||
|
||||
my @chars = split("", "abcdefghijklmnopqrstuvwxyz123456789");
|
||||
|
||||
srand;
|
||||
srand;
|
||||
for (my $i = 0; $i < @ARGV[0]; $i++) {
|
||||
my $name = "";
|
||||
for (my $j = 0; $j < $len; $j++) {
|
||||
|
||||
@@ -31,7 +31,7 @@ print"\$TTL 300 ; 5 minutes
|
||||
NS ns
|
||||
ns A 10.53.0.3\n";
|
||||
|
||||
srand;
|
||||
srand;
|
||||
for (my $i = 0; $i < $nrecords; $i++) {
|
||||
my $name = "";
|
||||
for (my $j = 0; $j < 8; $j++) {
|
||||
|
||||
@@ -11,20 +11,20 @@
|
||||
# See the COPYRIGHT file distributed with this work for additional
|
||||
# information regarding copyright ownership.
|
||||
|
||||
usage() {
|
||||
echo "Usage: $0 [-s] <number of zones> [<records per zone>]"
|
||||
echo " -s: use the same zone file all zones"
|
||||
exit 1
|
||||
usage () {
|
||||
echo "Usage: $0 [-s] <number of zones> [<records per zone>]"
|
||||
echo " -s: use the same zone file all zones"
|
||||
exit 1
|
||||
}
|
||||
|
||||
if [ "$#" -lt 1 -o "$#" -gt 3 ]; then
|
||||
usage
|
||||
usage
|
||||
fi
|
||||
|
||||
single_file=""
|
||||
if [ $1 = "-s" ]; then
|
||||
single_file=yes
|
||||
shift
|
||||
single_file=yes
|
||||
shift
|
||||
fi
|
||||
|
||||
nzones=$1
|
||||
@@ -35,9 +35,9 @@ nrecords=5
|
||||
|
||||
. ../system/conf.sh
|
||||
|
||||
cat <<EOF
|
||||
cat << EOF
|
||||
options {
|
||||
directory "$(pwd)";
|
||||
directory "`pwd`";
|
||||
listen-on { localhost; };
|
||||
listen-on-v6 { localhost; };
|
||||
port 5300;
|
||||
@@ -58,7 +58,7 @@ controls {
|
||||
|
||||
logging {
|
||||
channel basic {
|
||||
file "$(pwd)/named.log" versions 3 size 100m;
|
||||
file "`pwd`/named.log" versions 3 size 100m;
|
||||
severity info;
|
||||
print-time yes;
|
||||
print-severity no;
|
||||
@@ -72,11 +72,11 @@ logging {
|
||||
EOF
|
||||
|
||||
$PERL makenames.pl $nzones | while read zonename; do
|
||||
if [ $single_file ]; then
|
||||
echo "zone $zonename { type primary; file \"smallzone.db\"; };"
|
||||
else
|
||||
[ -d zones ] || mkdir zones
|
||||
$PERL mkzonefile.pl $zonename $nrecords >zones/$zonename.db
|
||||
echo "zone $zonename { type primary; file \"zones/$zonename.db\"; };"
|
||||
fi
|
||||
if [ $single_file ]; then
|
||||
echo "zone $zonename { type primary; file \"smallzone.db\"; };"
|
||||
else
|
||||
[ -d zones ] || mkdir zones
|
||||
$PERL mkzonefile.pl $zonename $nrecords > zones/$zonename.db
|
||||
echo "zone $zonename { type primary; file \"zones/$zonename.db\"; };"
|
||||
fi
|
||||
done
|
||||
|
||||
@@ -13,17 +13,9 @@ named.run
|
||||
/random.data
|
||||
/*.log
|
||||
/*.trs
|
||||
/*.xml
|
||||
/resolve
|
||||
/run.sh
|
||||
/run.log
|
||||
/start.sh
|
||||
/stop.sh
|
||||
/ifconfig.sh
|
||||
|
||||
# Ignore file names with underscore in their name except python or shell files.
|
||||
# This is done to ignore the temporary directories and symlinks created by the
|
||||
# pytest runner, which contain underscore in their file names.
|
||||
/*_*
|
||||
!/*_*.py
|
||||
!/*_*.sh
|
||||
!/_common
|
||||
|
||||
@@ -24,10 +24,8 @@ LDADD += \
|
||||
$(LIBDNS_LIBS)
|
||||
|
||||
if HAVE_PERL
|
||||
if HAVE_PYTHON
|
||||
if HAVE_PYTEST
|
||||
|
||||
noinst_PROGRAMS = \
|
||||
check_PROGRAMS = \
|
||||
feature-test \
|
||||
makejournal \
|
||||
pipelined/pipequeries \
|
||||
@@ -70,14 +68,23 @@ rpz_dnsrps_LDADD = \
|
||||
$(LIBDNS_LIBS) \
|
||||
$(DLOPEN_LIBS)
|
||||
|
||||
# Longer running tests are listed (and executed) first to take the most
|
||||
# advantage of parallel execution.
|
||||
TESTS = \
|
||||
rpz \
|
||||
rpzrecurse \
|
||||
serve-stale \
|
||||
timeouts \
|
||||
upforwd \
|
||||
TESTS =
|
||||
|
||||
if HAVE_PERLMOD_TIME_HIRES
|
||||
TESTS += serve-stale
|
||||
endif HAVE_PERLMOD_TIME_HIRES
|
||||
|
||||
if HAVE_PERLMOD_NET_DNS
|
||||
TESTS += \
|
||||
rpzrecurse
|
||||
endif HAVE_PERLMOD_NET_DNS
|
||||
|
||||
if HAVE_LIBNGHTTP2
|
||||
TESTS += \
|
||||
doth
|
||||
endif
|
||||
|
||||
TESTS += \
|
||||
acl \
|
||||
additional \
|
||||
addzone \
|
||||
@@ -89,22 +96,15 @@ TESTS = \
|
||||
case \
|
||||
catz \
|
||||
cds \
|
||||
chain \
|
||||
checkconf \
|
||||
checkds \
|
||||
checknames \
|
||||
checkzone \
|
||||
cookie \
|
||||
database \
|
||||
dialup \
|
||||
digdelv \
|
||||
dispatch \
|
||||
dlzexternal \
|
||||
dns64 \
|
||||
dnssec \
|
||||
dnstap \
|
||||
doth \
|
||||
dsdigest \
|
||||
dupsigs \
|
||||
dyndb \
|
||||
ecdsa \
|
||||
eddsa \
|
||||
@@ -112,20 +112,16 @@ TESTS = \
|
||||
emptyzones \
|
||||
enginepkcs11 \
|
||||
filter-aaaa \
|
||||
fetchlimit \
|
||||
formerr \
|
||||
forward \
|
||||
geoip2 \
|
||||
glue \
|
||||
idna \
|
||||
include-multiplecfg \
|
||||
inline \
|
||||
integrity \
|
||||
ixfr \
|
||||
hooks \
|
||||
host \
|
||||
journal \
|
||||
kasp \
|
||||
keepalive \
|
||||
keyfromlabel \
|
||||
legacy \
|
||||
@@ -136,41 +132,28 @@ TESTS = \
|
||||
metadata \
|
||||
mirror \
|
||||
mkeys \
|
||||
multisigner \
|
||||
names \
|
||||
notify \
|
||||
nsec3 \
|
||||
nslookup \
|
||||
nsupdate \
|
||||
nzd2nzf \
|
||||
padding \
|
||||
pending \
|
||||
proxy \
|
||||
pipelined \
|
||||
qmin \
|
||||
reclimit \
|
||||
redirect \
|
||||
resolver \
|
||||
rndc \
|
||||
rootkeysentinel \
|
||||
rpzextra \
|
||||
rpz \
|
||||
rrchecker \
|
||||
rrl \
|
||||
rrsetorder \
|
||||
rsabigexponent \
|
||||
runtime \
|
||||
sfcache \
|
||||
shutdown \
|
||||
smartsign \
|
||||
sortlist \
|
||||
spf \
|
||||
staticstub \
|
||||
statistics \
|
||||
statschannel \
|
||||
stress \
|
||||
stub \
|
||||
synthfromdnssec \
|
||||
tcp \
|
||||
tools \
|
||||
transport-acl \
|
||||
tsig \
|
||||
@@ -180,21 +163,62 @@ TESTS = \
|
||||
verify \
|
||||
views \
|
||||
wildcard \
|
||||
xfer \
|
||||
xferquota \
|
||||
zero \
|
||||
zonechecks
|
||||
|
||||
else !HAVE_PYTEST
|
||||
check:
|
||||
echo pytest is not available, no tests were ran
|
||||
exit 1
|
||||
endif !HAVE_PYTEST
|
||||
else !HAVE_PYTHON
|
||||
check:
|
||||
echo Python is not available, no tests were ran
|
||||
exit 1
|
||||
endif !HAVE_PYTHON
|
||||
if HAVE_LMDB
|
||||
TESTS += nzd2nzf
|
||||
endif # HAVE_LMDB
|
||||
|
||||
if HAVE_PERLMOD_NET_DNS
|
||||
|
||||
TESTS += \
|
||||
fetchlimit \
|
||||
ixfr \
|
||||
nsupdate \
|
||||
resolver \
|
||||
statistics \
|
||||
stress \
|
||||
upforwd \
|
||||
zero
|
||||
|
||||
if HAVE_DNSTAP
|
||||
TESTS += dnstap
|
||||
endif
|
||||
|
||||
if HAVE_PERLMOD_FILE_FETCH
|
||||
TESTS += statschannel
|
||||
endif HAVE_PERLMOD_FILE_FETCH
|
||||
|
||||
if HAVE_PERLMOD_DIGEST_HMAC
|
||||
TESTS += xfer
|
||||
endif HAVE_PERLMOD_DIGEST_HMAC
|
||||
|
||||
if HAVE_PERLMOD_NET_DNS_NAMESERVER
|
||||
TESTS += reclimit
|
||||
endif HAVE_PERLMOD_NET_DNS_NAMESERVER
|
||||
|
||||
endif HAVE_PERLMOD_NET_DNS
|
||||
|
||||
if HAVE_PYTHON
|
||||
TESTS += kasp keymgr2kasp tcp pipelined
|
||||
|
||||
if HAVE_PYTEST
|
||||
TESTS += checkds dispatch rpzextra shutdown timeouts
|
||||
endif
|
||||
|
||||
if HAVE_PYMOD_DNS
|
||||
TESTS += qmin cookie
|
||||
if HAVE_PERLMOD_NET_DNS
|
||||
TESTS += digdelv dnssec forward
|
||||
if HAVE_PERLMOD_NET_DNS_NAMESERVER
|
||||
TESTS += chain
|
||||
endif HAVE_PERLMOD_NET_DNS_NAMESERVER
|
||||
endif HAVE_PERLMOD_NET_DNS
|
||||
endif HAVE_PYMOD_DNS
|
||||
|
||||
endif HAVE_PYTHON
|
||||
|
||||
else !HAVE_PERL
|
||||
check:
|
||||
echo Perl is not available, no tests were ran
|
||||
@@ -209,9 +233,9 @@ LOG_DRIVER_V_1 = --verbose yes
|
||||
LOG_DRIVER = $(srcdir)/custom-test-driver
|
||||
AM_LOG_DRIVER_FLAGS = $(LOG_DRIVER_V)
|
||||
|
||||
LOG_COMPILER = $(srcdir)/run.sh
|
||||
LOG_COMPILER = $(builddir)/run.sh
|
||||
AM_LOG_FLAGS = -r
|
||||
|
||||
$(TESTS): run.sh
|
||||
|
||||
test-local: check
|
||||
|
||||
clean-local::
|
||||
-find -L . -mindepth 1 -maxdepth 1 -type d -name "*_*" -and -not -name "_common" -exec rm -rf {} \;
|
||||
|
||||
@@ -0,0 +1,651 @@
|
||||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
|
||||
SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
|
||||
Introduction
|
||||
===
|
||||
This directory holds a simple test environment for running bind9 system tests
|
||||
involving multiple name servers.
|
||||
|
||||
With the exception of "common" (which holds configuration information common to
|
||||
multiple tests), each directory holds a set of scripts and configuration
|
||||
files to test different parts of BIND. The directories are named for the
|
||||
aspect of BIND they test, for example:
|
||||
|
||||
dnssec/ DNSSEC tests
|
||||
forward/ Forwarding tests
|
||||
glue/ Glue handling tests
|
||||
|
||||
etc.
|
||||
|
||||
Typically each set of tests sets up 2-5 name servers and then performs one or
|
||||
more tests against them. Within the test subdirectory, each name server has a
|
||||
separate subdirectory containing its configuration data. These subdirectories
|
||||
are named "nsN" or "ansN" (where N is a number between 1 and 8, e.g. ns1, ans2
|
||||
etc.)
|
||||
|
||||
The tests are completely self-contained and do not require access to the real
|
||||
DNS. Generally, one of the test servers (usually ns1) is set up as a root
|
||||
nameserver and is listed in the hints file of the others.
|
||||
|
||||
|
||||
Preparing to Run the Tests
|
||||
===
|
||||
To enable all servers to run on the same machine, they bind to separate virtual
|
||||
IP addresses on the loopback interface. ns1 runs on 10.53.0.1, ns2 on
|
||||
10.53.0.2, etc. Before running any tests, you must set up these addresses by
|
||||
running the command
|
||||
|
||||
sh ifconfig.sh up
|
||||
|
||||
as root. The interfaces can be removed by executing the command:
|
||||
|
||||
sh ifconfig.sh down
|
||||
|
||||
... also as root.
|
||||
|
||||
The servers use unprivileged ports (above 1024) instead of the usual port 53,
|
||||
so they can be run without root privileges once the interfaces have been set
|
||||
up.
|
||||
|
||||
|
||||
Note for MacOS Users
|
||||
---
|
||||
If you wish to make the interfaces survive across reboots, copy
|
||||
org.isc.bind.system and org.isc.bind.system.plist to /Library/LaunchDaemons
|
||||
then run
|
||||
|
||||
launchctl load /Library/LaunchDaemons/org.isc.bind.system.plist
|
||||
|
||||
... as root.
|
||||
|
||||
|
||||
Running the System Tests
|
||||
===
|
||||
|
||||
Running an Individual Test
|
||||
---
|
||||
The tests can be run individually using the following command:
|
||||
|
||||
sh run.sh [flags] <test-name> [<test-arguments>]
|
||||
|
||||
e.g.
|
||||
|
||||
sh run.sh [flags] notify
|
||||
|
||||
Optional flags are:
|
||||
|
||||
-k Keep servers running after the test completes. Each test
|
||||
usually starts a number of nameservers, either instances
|
||||
of the "named" being tested, or custom servers (written in
|
||||
Python or Perl) that feature test-specific behavior. The
|
||||
servers are automatically started before the test is run
|
||||
and stopped after it ends. This flag leaves them running
|
||||
at the end of the test, so that additional queries can be
|
||||
sent by hand. To stop the servers afterwards, use the
|
||||
command "sh stop.sh <test-name>".
|
||||
|
||||
-n Noclean - do not remove the output files if the test
|
||||
completes successfully. By default, files created by the
|
||||
test are deleted if it passes; they are not deleted if the
|
||||
test fails.
|
||||
|
||||
-p <number> Sets the range of ports used by the test. A block of 100
|
||||
ports is available for each test, the number given to the
|
||||
"-p" switch being the number of the start of that block
|
||||
(e.g. "-p 7900" will mean that the test is able to use
|
||||
ports 7900 through 7999). If not specified, the test will
|
||||
have ports 5000 to 5099 available to it.
|
||||
|
||||
Arguments are:
|
||||
|
||||
test-name Mandatory. The name of the test, which is the name of the
|
||||
subdirectory in bin/tests/system holding the test files.
|
||||
|
||||
test-arguments Optional arguments that are passed to each of the test's
|
||||
scripts.
|
||||
|
||||
|
||||
Running All The System Tests
|
||||
---
|
||||
To run all the system tests, enter the command:
|
||||
|
||||
make [-j numproc] test
|
||||
|
||||
The optional "numproc" argument specifies the maximum number of tests that can
|
||||
run in parallel. The default is 1, which means that all of the tests run
|
||||
sequentially. If greater than 1, up to "numproc" tests will run simultaneously,
|
||||
new tests being started as tests finish. Each test will get a unique set of
|
||||
ports, so there is no danger of tests interfering with one another. Parallel
|
||||
running will reduce the total time taken to run the BIND system tests, but will
|
||||
mean that the output from all the tests sent to the screen will be mixed up
|
||||
with one another.
|
||||
|
||||
In this case, retention of the output files after a test completes successfully
|
||||
is specified by setting the environment variable SYSTEMTEST_NO_CLEAN to 1 prior
|
||||
to running make, e.g.
|
||||
|
||||
SYSTEMTEST_NO_CLEAN=1 make [-j numproc] test
|
||||
|
||||
while setting environment variable SYSTEMTEST_FORCE_COLOR to 1 forces system
|
||||
test output to be printed in color.
|
||||
|
||||
|
||||
Format of Test Output
|
||||
---
|
||||
All output from the system tests is in the form of lines with the following
|
||||
structure:
|
||||
|
||||
<letter>:<test-name>:<message> [(<number>)]
|
||||
|
||||
e.g.
|
||||
|
||||
I:catz:checking that dom1.example is not served by primary (1)
|
||||
|
||||
The meanings of the fields are as follows:
|
||||
|
||||
<letter>
|
||||
This indicates the type of message. This is one of:
|
||||
|
||||
S Start of the test
|
||||
A Start of test (retained for backwards compatibility)
|
||||
T Start of test (retained for backwards compatibility)
|
||||
E End of the test
|
||||
I Information. A test will typically output many of these messages
|
||||
during its run, indicating test progress. Note that such a message may
|
||||
be of the form "I:testname:failed", indicating that a sub-test has
|
||||
failed.
|
||||
R Result. Each test will result in one such message, which is of the
|
||||
form:
|
||||
|
||||
R:<test-name>:<result>
|
||||
|
||||
where <result> is one of:
|
||||
|
||||
PASS The test passed
|
||||
FAIL The test failed
|
||||
SKIPPED The test was not run, usually because some
|
||||
prerequisites required to run the test are missing.
|
||||
|
||||
<test-name>
|
||||
This is the name of the test from which the message emanated, which is also the
|
||||
name of the subdirectory holding the test files.
|
||||
|
||||
<message>
|
||||
This is text output by the test during its execution.
|
||||
|
||||
(<number>)
|
||||
If present, this will correlate with a file created by the test. The tests
|
||||
execute commands and route the output of each command to a file. The name of
|
||||
this file depends on the command and the test, but will usually be of the form:
|
||||
|
||||
<command>.out.<suffix><number>
|
||||
|
||||
e.g. nsupdate.out.test28, dig.out.q3. This aids diagnosis of problems by
|
||||
allowing the output that caused the problem message to be identified.
|
||||
|
||||
|
||||
Re-Running the Tests
|
||||
---
|
||||
If there is a requirement to re-run a test (or the entire test suite), the
|
||||
files produced by the tests should be deleted first. Normally, these files are
|
||||
deleted if the test succeeds but are retained on error. The run.sh script
|
||||
automatically calls a given test's clean.sh script before invoking its setup.sh
|
||||
script.
|
||||
|
||||
Deletion of the files produced by the set of tests (e.g. after the execution of
|
||||
make) can be carried out using the command:
|
||||
|
||||
sh cleanall.sh
|
||||
|
||||
or
|
||||
|
||||
make testclean
|
||||
|
||||
(Note that the Makefile has two other targets for cleaning up files: "clean"
|
||||
will delete all the files produced by the tests, as well as the object and
|
||||
executable files used by the tests. "distclean" does all the work of "clean"
|
||||
as well as deleting configuration files produced by "configure".)
|
||||
|
||||
|
||||
Developer Notes
|
||||
===
|
||||
This section is intended for developers writing new tests.
|
||||
|
||||
|
||||
Overview
|
||||
---
|
||||
As noted above, each test is in a separate directory. To interact with the
|
||||
test framework, the directories contain the following standard files:
|
||||
|
||||
prereq.sh Run at the beginning to determine whether the test can be run at
|
||||
all; if not, we see a R:SKIPPED result. This file is optional:
|
||||
if not present, the test is assumed to have all its prerequisites
|
||||
met.
|
||||
|
||||
setup.sh Run after prereq.sh, this sets up the preconditions for the tests.
|
||||
Although optional, virtually all tests will require such a file to
|
||||
set up the ports they should use for the test.
|
||||
|
||||
tests.sh Runs the actual tests. This file is mandatory.
|
||||
|
||||
clean.sh Run at the end to clean up temporary files, but only if the test
|
||||
was completed successfully and its running was not inhibited by the
|
||||
"-n" switch being passed to "run.sh". Otherwise the temporary
|
||||
files are left in place for inspection.
|
||||
|
||||
ns<N> These subdirectories contain test name servers that can be queried
|
||||
or can interact with each other. The value of N indicates the
|
||||
address the server listens on: for example, ns2 listens on
|
||||
10.53.0.2, and ns4 on 10.53.0.4. All test servers use an
|
||||
unprivileged port, so they don't need to run as root. These
|
||||
servers log at the highest debug level and the log is captured in
|
||||
the file "named.run".
|
||||
|
||||
ans<N> Like ns[X], but these are simple mock name servers implemented in
|
||||
Perl or Python. They are generally programmed to misbehave in ways
|
||||
named would not so as to exercise named's ability to interoperate
|
||||
with badly behaved name servers.
|
||||
|
||||
|
||||
Port Usage
|
||||
---
|
||||
In order for the tests to run in parallel, each test requires a unique set of
|
||||
ports. These are specified by the "-p" option passed to "run.sh", which sets
|
||||
environment variables that the scripts listed above can reference.
|
||||
|
||||
The convention used in the system tests is that the number passed is the start
|
||||
of a range of 100 ports. The test is free to use the ports as required,
|
||||
although the first ten ports in the block are named and generally tests use the
|
||||
named ports for their intended purpose. The names of the environment variables
|
||||
are:
|
||||
|
||||
PORT Number to be used for the query port.
|
||||
CONTROLPORT Number to be used as the RNDC control port.
|
||||
EXTRAPORT1 - EXTRAPORT8 Eight port numbers that can be used as needed.
|
||||
|
||||
Two other environment variables are defined:
|
||||
|
||||
LOWPORT The lowest port number in the range.
|
||||
HIGHPORT The highest port number in the range.
|
||||
|
||||
Since port ranges usually start on a boundary of 10, the variables are set such
|
||||
that the last digit of the port number corresponds to the number of the
|
||||
EXTRAPORTn variable. For example, if the port range were to start at 5200, the
|
||||
port assignments would be:
|
||||
|
||||
PORT = 5200
|
||||
EXTRAPORT1 = 5201
|
||||
:
|
||||
EXTRAPORT8 = 5208
|
||||
CONTROLPORT = 5209
|
||||
LOWPORT = 5200
|
||||
HIGHPORT = 5299
|
||||
|
||||
When running tests in parallel (i.e. giving a value of "numproc" greater than 1
|
||||
in the "make" command listed above), it is guaranteed that each
|
||||
test will get a set of unique port numbers.
|
||||
|
||||
|
||||
Writing a Test
|
||||
---
|
||||
The test framework requires up to four shell scripts (listed above) as well as
|
||||
a number of nameserver instances to run. Certain expectations are put on each
|
||||
script:
|
||||
|
||||
|
||||
General
|
||||
---
|
||||
1. Each of the four scripts will be invoked with the command
|
||||
|
||||
(cd <test-directory> ; sh <script> [<arguments>] )
|
||||
|
||||
... so that working directory when the script starts executing is the test
|
||||
directory.
|
||||
|
||||
2. Arguments can be only passed to the script if the test is being run as a
|
||||
one-off with "run.sh". In this case, everything on the command line after the
|
||||
name of the test is passed to each script. For example, the command:
|
||||
|
||||
sh run.sh -p 12300 mytest -D xyz
|
||||
|
||||
... will run "mytest" with a port range of 12300 to 12399. Each of the
|
||||
framework scripts provided by the test will be invoked using the remaining
|
||||
arguments, e.g.:
|
||||
|
||||
(cd mytest ; sh prereq.sh -D xyz)
|
||||
(cd mytest ; sh setup.sh -D xyz)
|
||||
(cd mytest ; sh tests.sh -D xyz)
|
||||
(cd mytest ; sh clean.sh -D xyz)
|
||||
|
||||
No arguments will be passed to the test scripts if the test is run as part of
|
||||
a run of the full test suite (e.g. the tests are started with make).
|
||||
|
||||
3. Each script should start with the following lines:
|
||||
|
||||
. ../conf.sh
|
||||
|
||||
"conf.sh" defines a series of environment variables together with functions
|
||||
useful for the test scripts.
|
||||
|
||||
|
||||
prereq.sh
|
||||
---
|
||||
As noted above, this is optional. If present, it should check whether specific
|
||||
software needed to run the test is available and/or whether BIND has been
|
||||
configured with the appropriate options required.
|
||||
|
||||
* If the software required to run the test is present and the BIND
|
||||
configure options are correct, prereq.sh should return with a status code
|
||||
of 0.
|
||||
|
||||
* If the software required to run the test is not available and/or BIND
|
||||
has not been configured with the appropriate options, prereq.sh should
|
||||
return with a status code of 1.
|
||||
|
||||
* If there is some other problem (e.g. prerequisite software is available
|
||||
but is not properly configured), a status code of 255 should be returned.
|
||||
|
||||
|
||||
setup.sh
|
||||
---
|
||||
This is responsible for setting up the configuration files used in the test.
|
||||
|
||||
To cope with the varying port number, ports are not hard-coded into
|
||||
configuration files (or, for that matter, scripts that emulate nameservers).
|
||||
Instead, setup.sh is responsible for editing the configuration files to set the
|
||||
port numbers.
|
||||
|
||||
To do this, configuration files should be supplied in the form of templates
|
||||
containing tokens identifying ports. The tokens have the same name as the
|
||||
environment variables listed above, but are prefixed and suffixed by the "@"
|
||||
symbol. For example, a fragment of a configuration file template might look
|
||||
like:
|
||||
|
||||
controls {
|
||||
inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
|
||||
};
|
||||
|
||||
options {
|
||||
query-source address 10.53.0.1;
|
||||
notify-source 10.53.0.1;
|
||||
transfer-source 10.53.0.1;
|
||||
port @PORT@;
|
||||
allow-new-zones yes;
|
||||
};
|
||||
|
||||
setup.sh should copy the template to the desired filename using the
|
||||
"copy_setports" shell function defined in "conf.sh", i.e.
|
||||
|
||||
copy_setports ns1/named.conf.in ns1/named.conf
|
||||
|
||||
This replaces the tokens @PORT@, @CONTROLPORT@, @EXTRAPORT1@ through
|
||||
@EXTRAPORT8@ with the contents of the environment variables listed above.
|
||||
setup.sh should do this for all configuration files required when the test
|
||||
starts.
|
||||
|
||||
("setup.sh" should also use this method for replacing the tokens in any Perl or
|
||||
Python name servers used in the test.)
|
||||
|
||||
|
||||
tests.sh
|
||||
---
|
||||
This is the main test file and the contents depend on the test. The contents
|
||||
are completely up to the developer, although most test scripts have a form
|
||||
similar to the following for each sub-test:
|
||||
|
||||
1. n=`expr $n + 1`
|
||||
2. echo_i "prime cache nodata.example ($n)"
|
||||
3. ret=0
|
||||
4. $DIG -p ${PORT} @10.53.0.1 nodata.example TXT > dig.out.test$n
|
||||
5. grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
||||
6. grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
|
||||
7. if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
8. status=`expr $status + $ret`
|
||||
|
||||
1. Increment the test number "n" (initialized to zero at the start of the
|
||||
script).
|
||||
|
||||
2. Indicate that the sub-test is about to begin. Note that "echo_i" instead
|
||||
of "echo" is used. echo_i is a function defined in "conf.sh" which will
|
||||
prefix the message with "I:<testname>:", so allowing the output from each
|
||||
test to be identified within the output. The test number is included in
|
||||
the message in order to tie the sub-test with its output.
|
||||
|
||||
3. Initialize return status.
|
||||
|
||||
4 - 6. Carry out the sub-test. In this case, a nameserver is queried (note
|
||||
that the port used is given by the PORT environment variable, which was set
|
||||
by the inclusion of the file "conf.sh" at the start of the script). The
|
||||
output is routed to a file whose suffix includes the test number. The
|
||||
response from the server is examined and, in this case, if the required
|
||||
string is not found, an error is indicated by setting "ret" to 1.
|
||||
|
||||
7. If the sub-test failed, a message is printed. "echo_i" is used to print
|
||||
the message to add the prefix "I:<test-name>:" before it is output.
|
||||
|
||||
8. "status", used to track how many of the sub-tests have failed, is
|
||||
incremented accordingly. The value of "status" determines the status
|
||||
returned by "tests.sh", which in turn determines whether the framework
|
||||
prints the PASS or FAIL message.
|
||||
|
||||
Regardless of this, rules that should be followed are:
|
||||
|
||||
a. Use the environment variables set by conf.sh to determine the ports to use
|
||||
for sending and receiving queries.
|
||||
|
||||
b. Use a counter to tag messages and to associate the messages with the output
|
||||
files.
|
||||
|
||||
c. Store all output produced by queries/commands into files. These files
|
||||
should be named according to the command that produced them, e.g. "dig"
|
||||
output should be stored in a file "dig.out.<suffix>", the suffix being
|
||||
related to the value of the counter.
|
||||
|
||||
d. Use "echo_i" to output informational messages.
|
||||
|
||||
e. Retain a count of test failures and return this as the exit status from
|
||||
the script.
|
||||
|
||||
|
||||
clean.sh
|
||||
---
|
||||
The inverse of "setup.sh", this is invoked by the framework to clean up the
|
||||
test directory. It should delete all files that have been created by the test
|
||||
during its run.
|
||||
|
||||
|
||||
Starting Nameservers
|
||||
---
|
||||
As noted earlier, a system test will involve a number of nameservers. These
|
||||
will be either instances of named, or special servers written in a language
|
||||
such as Perl or Python.
|
||||
|
||||
For the former, the version of "named" being run is that in the "bin/named"
|
||||
directory in the tree holding the tests (i.e. if "make test" is being run
|
||||
immediately after "make", the version of "named" used is that just built). The
|
||||
configuration files, zone files etc. for these servers are located in
|
||||
subdirectories of the test directory named "nsN", where N is a small integer.
|
||||
The latter are special nameservers, mostly used for generating deliberately bad
|
||||
responses, located in subdirectories named "ansN" (again, N is an integer).
|
||||
In addition to configuration files, these directories should hold the
|
||||
appropriate script files as well.
|
||||
|
||||
Note that the "N" for a particular test forms a single number space, e.g. if
|
||||
there is an "ns2" directory, there cannot be an "ans2" directory as well.
|
||||
Ideally, the directory numbers should start at 1 and work upwards.
|
||||
|
||||
When running a test, the servers are started using "start.sh" (which is nothing
|
||||
more than a wrapper for start.pl). The options for "start.pl" are documented
|
||||
in the header for that file, so will not be repeated here. In summary, when
|
||||
invoked by "run.sh", start.pl looks for directories named "nsN" or "ansN" in
|
||||
the test directory and starts the servers it finds there.
|
||||
|
||||
|
||||
"named" Command-Line Options
|
||||
---
|
||||
By default, start.pl starts a "named" server with the following options:
|
||||
|
||||
-c named.conf Specifies the configuration file to use (so by implication,
|
||||
each "nsN" nameserver's configuration file must be called
|
||||
named.conf).
|
||||
|
||||
-d 99 Sets the maximum debugging level.
|
||||
|
||||
-D <name> The "-D" option sets a string used to identify the
|
||||
nameserver in a process listing. In this case, the string
|
||||
is the name of the subdirectory.
|
||||
|
||||
-g Runs the server in the foreground and logs everything to
|
||||
stderr.
|
||||
|
||||
-m record
|
||||
Turns on these memory usage debugging flags.
|
||||
|
||||
-U 4 Uses four listeners.
|
||||
|
||||
-X named.lock Acquires a lock on this file in the "nsN" directory, so
|
||||
preventing multiple instances of this named running in this
|
||||
directory (which could possibly interfere with the test).
|
||||
|
||||
All output is sent to a file called "named.run" in the nameserver directory.
|
||||
|
||||
The options used to start named can be altered. There are three ways of doing
|
||||
this. "start.pl" checks the methods in a specific order: if a check succeeds,
|
||||
the options are set and any other specification is ignored. In order, these
|
||||
are:
|
||||
|
||||
1. Specifying options to "start.sh"/"start.pl" after the name of the test
|
||||
directory, e.g.
|
||||
|
||||
sh start.sh reclimit ns1 -- "-c n.conf -d 43"
|
||||
|
||||
(This is only really useful when running tests interactively.)
|
||||
|
||||
2. Including a file called "named.args" in the "nsN" directory. If present,
|
||||
the contents of the first non-commented, non-blank line of the file are used as
|
||||
the named command-line arguments. The rest of the file is ignored.
|
||||
|
||||
3. Tweaking the default command line arguments with "-T" options. This flag is
|
||||
used to alter the behavior of BIND for testing and is not documented in the
|
||||
ARM. The presence of certain files in the "nsN" directory adds flags to
|
||||
the default command line (the content of the files is irrelevant - it
|
||||
is only the presence that counts):
|
||||
|
||||
named.noaa Appends "-T noaa" to the command line, which causes
|
||||
"named" to never set the AA bit in an answer.
|
||||
|
||||
named.dropedns Adds "-T dropedns" to the command line, which causes
|
||||
"named" to recognise EDNS options in messages, but drop
|
||||
messages containing them.
|
||||
|
||||
named.maxudp1460 Adds "-T maxudp1460" to the command line, setting the
|
||||
maximum UDP size handled by named to 1460.
|
||||
|
||||
named.maxudp512 Adds "-T maxudp512" to the command line, setting the
|
||||
maximum UDP size handled by named to 512.
|
||||
|
||||
named.noedns Appends "-T noedns" to the command line, which disables
|
||||
recognition of EDNS options in messages.
|
||||
|
||||
named.notcp Adds "-T notcp", which disables TCP in "named".
|
||||
|
||||
named.soa Appends "-T nosoa" to the command line, which disables
|
||||
the addition of SOA records to negative responses (or to
|
||||
the additional section if the response is triggered by RPZ
|
||||
rewriting).
|
||||
|
||||
Starting Other Nameservers
|
||||
---
|
||||
In contrast to "named", nameservers written in Perl or Python (whose script
|
||||
file should have the name "ans.pl" or "ans.py" respectively) are started with a
|
||||
fixed command line. In essence, the server is given the address and nothing
|
||||
else.
|
||||
|
||||
(This is not strictly true: Python servers are provided with the number of the
|
||||
query port to use. Altering the port used by Perl servers currently requires
|
||||
creating a template file containing the "@PORT@" token, and having "setup.sh"
|
||||
substitute the actual port being used before the test starts.)
|
||||
|
||||
|
||||
Stopping Nameservers
|
||||
---
|
||||
As might be expected, the test system stops nameservers with the script
|
||||
"stop.sh", which is little more than a wrapper for "stop.pl". Like "start.pl",
|
||||
the options available are listed in the file's header and will not be repeated
|
||||
here.
|
||||
|
||||
In summary though, the nameservers for a given test, if left running by
|
||||
specifying the "-k" flag to "run.sh" when the test is started, can be stopped
|
||||
by the command:
|
||||
|
||||
sh stop.sh <test-name> [server]
|
||||
|
||||
... where if the server (e.g. "ns1", "ans3") is not specified, all servers
|
||||
associated with the test are stopped.
|
||||
|
||||
|
||||
Adding a Test to the System Test Suite
|
||||
---
|
||||
Once a test has been created, the following files should be edited:
|
||||
|
||||
* conf.sh.common The name of the test should be added to the PARALLEL_COMMON
|
||||
variable.
|
||||
|
||||
* Makefile.am The name of the test should be added to the TESTS variable.
|
||||
|
||||
(It is likely that a future iteration of the system test suite will remove the
|
||||
need to edit multiple files to add a test.)
|
||||
|
||||
|
||||
Valgrind
|
||||
---
|
||||
When running system tests, named can be run under Valgrind. The output from
|
||||
Valgrind are sent to per-process files that can be reviewed after the test has
|
||||
completed. To enable this, set the USE_VALGRIND environment variable to
|
||||
"helgrind" to run the Helgrind tool, or any other value to run the Memcheck
|
||||
tool. To use "helgrind" effectively, build BIND with --disable-atomic.
|
||||
|
||||
|
||||
Maintenance Notes
|
||||
===
|
||||
This section is aimed at developers maintaining BIND's system test framework.
|
||||
|
||||
Notes on Parallel Execution
|
||||
---
|
||||
Although execution of an individual test is controlled by "run.sh", which
|
||||
executes the above shell scripts (and starts the relevant servers) for each
|
||||
test, the running of all tests in the test suite is controlled by the Makefile.
|
||||
|
||||
All system tests are capable of being run in parallel. For this to work, each
|
||||
test needs to use a unique set of ports. To avoid the need to define which
|
||||
tests use which ports (and so risk port clashes as further tests are added),
|
||||
the ports are determined by "get_ports.sh", a port broker script which keeps
|
||||
track of ports given to each individual system test.
|
||||
|
||||
|
||||
Cleaning Up From Tests
|
||||
---
|
||||
When a test is run, up to three different types of files are created:
|
||||
|
||||
1. Files generated by the test itself, e.g. output from "dig" and "rndc", are
|
||||
stored in the test directory.
|
||||
|
||||
2. Files produced by named which may not be cleaned up if named exits
|
||||
abnormally, e.g. core files, PID files etc., are stored in the test directory.
|
||||
|
||||
If the test fails, all these files are retained. But if the test succeeds,
|
||||
they are cleaned up at different times:
|
||||
|
||||
1. Files generated by the test itself are cleaned up by the test's own
|
||||
"clean.sh", which is called from "run.sh".
|
||||
|
||||
2. Files that may not be cleaned up if named exits abnormally can be removed
|
||||
using the "cleanall.sh" script.
|
||||
@@ -1,474 +0,0 @@
|
||||
<!--
|
||||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
|
||||
SPDX-License-Identifier: MPL-2.0
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
-->
|
||||
|
||||
# BIND9 System Test Framework
|
||||
|
||||
This directory holds test environments for running bind9 system tests involving
|
||||
multiple name servers.
|
||||
|
||||
Each system test directory holds a set of scripts and configuration files to
|
||||
test different parts of BIND. The directories are named for the aspect of BIND
|
||||
they test, for example:
|
||||
|
||||
dnssec/ DNSSEC tests
|
||||
forward/ Forwarding tests
|
||||
glue/ Glue handling tests
|
||||
|
||||
etc.
|
||||
|
||||
A system test directory must start with an alphabetic character and may not
|
||||
contain any special characters. Only hyphen may be used as a word separator.
|
||||
|
||||
Typically each set of tests sets up 2-5 name servers and then performs one or
|
||||
more tests against them. Within the test subdirectory, each name server has a
|
||||
separate subdirectory containing its configuration data. These subdirectories
|
||||
are named "nsN" or "ansN" (where N is a number between 1 and 8, e.g. ns1, ans2
|
||||
etc.)
|
||||
|
||||
The tests are completely self-contained and do not require access to the real
|
||||
DNS. Generally, one of the test servers (usually ns1) is set up as a root
|
||||
nameserver and is listed in the hints file of the others.
|
||||
|
||||
|
||||
## Running the Tests
|
||||
|
||||
### Prerequisites
|
||||
|
||||
To run system tests, make sure you have the following dependencies installed:
|
||||
|
||||
- python3
|
||||
- pytest
|
||||
- perl
|
||||
- dnspython
|
||||
- pytest-xdist (for parallel execution)
|
||||
|
||||
Individual system tests might also require additional dependencies. If those
|
||||
are missing, the affected tests will be skipped and should produce a message
|
||||
specifying what additional prerequisites they expect.
|
||||
|
||||
### Network Setup
|
||||
|
||||
To enable all servers to run on the same machine, they bind to separate virtual
|
||||
IP addresses on the loopback interface. ns1 runs on 10.53.0.1, ns2 on
|
||||
10.53.0.2, etc. Before running any tests, you must set up these addresses by
|
||||
running the command
|
||||
|
||||
sh ifconfig.sh up
|
||||
|
||||
as root. The interfaces can be removed by executing the command:
|
||||
|
||||
sh ifconfig.sh down
|
||||
|
||||
... also as root.
|
||||
|
||||
The servers use unprivileged ports (above 1024) instead of the usual port 53,
|
||||
so they can be run without root privileges once the interfaces have been set
|
||||
up.
|
||||
|
||||
**Note for MacOS Users**
|
||||
|
||||
If you wish to make the interfaces survive across reboots, copy
|
||||
org.isc.bind.system and org.isc.bind.system.plist to /Library/LaunchDaemons
|
||||
then run
|
||||
|
||||
launchctl load /Library/LaunchDaemons/org.isc.bind.system.plist
|
||||
|
||||
... as root.
|
||||
|
||||
### Running a Single Test
|
||||
|
||||
The recommended way is to use pytest and its test selection facilities:
|
||||
|
||||
pytest -k <test-name-or-pattern>
|
||||
|
||||
Using `-k` to specify a pattern allows to run a single pytest test case within
|
||||
a system test. E.g. you can use `-k test_sslyze_dot` to execute just the
|
||||
`test_sslyze_dot()` function from `doth/tests_sslyze.py`.
|
||||
|
||||
However, using the `-k` pattern might pick up more tests than intended. You can
|
||||
use the `--collect-only` option to check the list of tests which match you `-k`
|
||||
pattern. If you just want to execute all system tests within a single test
|
||||
directory, you can also use the utility script:
|
||||
|
||||
./run.sh system_test_dir_name
|
||||
|
||||
### Running All the System Tests
|
||||
|
||||
Issuing plain `pytest` command without any argument will execute all tests
|
||||
sequentially. To execute them in parallel, ensure you have pytest-xdist
|
||||
installed and run:
|
||||
|
||||
pytest [-n <number-of-workers>]
|
||||
|
||||
Alternately, using the make command is also supported:
|
||||
|
||||
make [-j numproc] test
|
||||
|
||||
### rr
|
||||
|
||||
When running system tests, named can be run under the rr tool. rr records a
|
||||
trace to the $system_test/nsX/named-Y/ directory, which can be later used to
|
||||
replay named. To enable this, execute start.pl with the USE_RR environment
|
||||
variable set.
|
||||
|
||||
### Test Artifacts
|
||||
|
||||
Each test module is executed inside a unique temporary directory which contains
|
||||
all the artifacts from the test run. If the tests succeed, they are deleted by
|
||||
default. To override this behaviour, pass `--noclean` to pytest.
|
||||
|
||||
The directory name starts with the system test name, followed by `_tmp_XXXXXX`,
|
||||
i.e. `dns64_tmp_r07vei9s` for `dns64` test run. Since this name changes each
|
||||
run, a convenience symlink that has a stable name is also created. It points to
|
||||
the latest test artifacts directory and has a form of `dns64_sh_dns64`
|
||||
(depending on the particular test module).
|
||||
|
||||
To clean up the temporary directories and symlinks, run `make clean-local` in
|
||||
the system test directory.
|
||||
|
||||
The following test artifacts are typically available:
|
||||
|
||||
- pytest.log.txt: main log file with test output
|
||||
- files generated by the test itself, e.g. output from "dig" and "rndc"
|
||||
- files produced by named, other tools or helper scripts
|
||||
|
||||
|
||||
## Writing System Tests
|
||||
|
||||
### File Overview
|
||||
|
||||
Tests are organized into system test directories which may hold one or more
|
||||
test modules (python files). Each module may have multiple test cases. The
|
||||
system test directories may contain the following standard files:
|
||||
|
||||
- `tests_*.py`: These python files are picked up by pytest as modules. If they
|
||||
contain any test functions, they're added to the test suite.
|
||||
|
||||
- `setup.sh`: This sets up the preconditions for the tests. Although optional,
|
||||
virtually all tests will require such a file to set up the ports they should
|
||||
use for the test.
|
||||
|
||||
- `tests.sh`: Any shell-based tests are located within this file. Runs the
|
||||
actual tests.
|
||||
|
||||
- `tests_sh_*.py`: A glue file for the pytest runner for executing shell tests.
|
||||
|
||||
- `ns<N>`: These subdirectories contain test name servers that can be queried
|
||||
or can interact with each other. The value of N indicates the address the
|
||||
server listens on: for example, ns2 listens on 10.53.0.2, and ns4 on
|
||||
10.53.0.4. All test servers use an unprivileged port, so they don't need to
|
||||
run as root. These servers log at the highest debug level and the log is
|
||||
captured in the file "named.run".
|
||||
|
||||
- `ans<N>`: Like ns[X], but these are simple mock name servers implemented in
|
||||
Perl or Python. They are generally programmed to misbehave in ways named
|
||||
would not so as to exercise named's ability to interoperate with badly
|
||||
behaved name servers.
|
||||
|
||||
### Module Scope
|
||||
|
||||
A module is a python file which contains test functions. Every system
|
||||
test directory may contain multiple modules (i.e. tests_*.py files).
|
||||
|
||||
The server setup/teardown is performed for each module. Bundling test cases
|
||||
together inside a single module may save some resources. However, test cases
|
||||
inside a single module can't be executed in parallel.
|
||||
|
||||
It is possible to execute different modules defined within a single system test
|
||||
directory in parallel. This is possible thanks to executing the tests inside a
|
||||
temporary directory and proper port assignment to ensure there won't be any
|
||||
conflicts.
|
||||
|
||||
### Port Usage
|
||||
|
||||
In order for the tests to run in parallel, each test requires a unique set of
|
||||
ports. This is ensured by the pytest runner, which assigns a unique set of
|
||||
ports to each test module.
|
||||
|
||||
Inside the python tests, it is possible to use the `ports` fixture to get the
|
||||
assigned port numbers. They're also set as environment variables. These include:
|
||||
|
||||
- `PORT`: used as the basic dns port
|
||||
- `TLSPORT`: used as the port for DNS-over-TLS
|
||||
- `HTTPPORT`, `HTTPSPORT`: used as the ports for DNS-over-HTTP
|
||||
- `CONTROLPORT`: used as the RNDC control port
|
||||
- `EXTRAPORT1` through `EXTRAPORT8`: additional ports that can be used as needed
|
||||
|
||||
### Logging
|
||||
|
||||
Each module has a separate log which will be saved as pytest.log.txt in the
|
||||
temporary directory in which the test is executed. This log includes messages
|
||||
for this module setup/teardown as well as any logging from the tests. Logging
|
||||
level DEBUG and above will be present in this log.
|
||||
|
||||
In general, any log messages using INFO or above will also be printed out
|
||||
during pytest execution. In CI, the pytest output is also saved to
|
||||
pytest.out.txt in the bin/tests/system directory.
|
||||
|
||||
### Adding a Test to the System Test Suite
|
||||
|
||||
Once a test has been created it will be automatically picked up by the pytest
|
||||
runner if it upholds the convention expected by pytest (especially when it comes
|
||||
to naming files and test functions).
|
||||
|
||||
However, if a new system test directory is created, it also needs to be added to
|
||||
`TESTS` in `Makefile.am`, in order to work with `make check`.
|
||||
|
||||
|
||||
## Test Files
|
||||
|
||||
### setup.sh
|
||||
|
||||
This script is responsible for setting up the configuration files used in the
|
||||
test. It is used by both the python and shell tests. It is interpreted just
|
||||
before the servers are started up for each test module.
|
||||
|
||||
To cope with the varying port number, ports are not hard-coded into
|
||||
configuration files (or, for that matter, scripts that emulate nameservers).
|
||||
Instead, setup.sh is responsible for editing the configuration files to set the
|
||||
port numbers.
|
||||
|
||||
To do this, configuration files should be supplied in the form of templates
|
||||
containing tokens identifying ports. The tokens have the same name as the
|
||||
environment variables listed above, but are prefixed and suffixed by the "@"
|
||||
symbol. For example, a fragment of a configuration file template might look
|
||||
like:
|
||||
|
||||
controls {
|
||||
inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
|
||||
};
|
||||
|
||||
options {
|
||||
query-source address 10.53.0.1;
|
||||
notify-source 10.53.0.1;
|
||||
transfer-source 10.53.0.1;
|
||||
port @PORT@;
|
||||
allow-new-zones yes;
|
||||
};
|
||||
|
||||
setup.sh should copy the template to the desired filename using the
|
||||
"copy_setports" shell function defined in "conf.sh", i.e.
|
||||
|
||||
copy_setports ns1/named.conf.in ns1/named.conf
|
||||
|
||||
This replaces tokens like @PORT@ with the contents of the environment variables
|
||||
listed above. setup.sh should do this for all configuration files required when
|
||||
the test starts.
|
||||
|
||||
("setup.sh" should also use this method for replacing the tokens in any Perl or
|
||||
Python name servers used in the test.)
|
||||
|
||||
### tests_*.py
|
||||
|
||||
These are test modules containing tests written in python. Every test is a
|
||||
function which begins with the name `test_` (according to pytest convention). It
|
||||
is possible to pass fixtures to the test function by specifying their name as
|
||||
function arguments. Fixtures are used to provide context to the tests, e.g.:
|
||||
|
||||
- `ports` is a dictionary with assigned port numbers
|
||||
|
||||
### tests_sh_*.py
|
||||
|
||||
These are glue files that are required to execute shell based tests (see below).
|
||||
These modules shouldn't contain any python tests (use a separate file instead).
|
||||
|
||||
### tests.sh
|
||||
|
||||
This is the test file for shell based tests.
|
||||
|
||||
|
||||
## Nameservers
|
||||
|
||||
As noted earlier, a system test will involve a number of nameservers. These
|
||||
will be either instances of named, or special servers written in a language
|
||||
such as Perl or Python.
|
||||
|
||||
For the former, the version of "named" being run is that in the "bin/named"
|
||||
directory in the tree holding the tests (i.e. if "make test" is being run
|
||||
immediately after "make", the version of "named" used is that just built). The
|
||||
configuration files, zone files etc. for these servers are located in
|
||||
subdirectories of the test directory named "nsN", where N is a small integer.
|
||||
The latter are special nameservers, mostly used for generating deliberately bad
|
||||
responses, located in subdirectories named "ansN" (again, N is an integer).
|
||||
In addition to configuration files, these directories should hold the
|
||||
appropriate script files as well.
|
||||
|
||||
Note that the "N" for a particular test forms a single number space, e.g. if
|
||||
there is an "ns2" directory, there cannot be an "ans2" directory as well.
|
||||
Ideally, the directory numbers should start at 1 and work upwards.
|
||||
|
||||
When tests are executed, pytest takes care of the test setup and teardown. It
|
||||
looks for any `nsN` and `ansN` directories in the system test directory and
|
||||
starts those servers.
|
||||
|
||||
### `named` Command-Line Options
|
||||
|
||||
By default, `named` server is started with the following options:
|
||||
|
||||
-c named.conf Specifies the configuration file to use (so by implication,
|
||||
each "nsN" nameserver's configuration file must be called
|
||||
named.conf).
|
||||
|
||||
-d 99 Sets the maximum debugging level.
|
||||
|
||||
-D <name> The "-D" option sets a string used to identify the
|
||||
nameserver in a process listing. In this case, the string
|
||||
is the name of the subdirectory.
|
||||
|
||||
-g Runs the server in the foreground and logs everything to
|
||||
stderr.
|
||||
|
||||
-m record
|
||||
Turns on these memory usage debugging flags.
|
||||
|
||||
All output is sent to a file called `named.run` in the nameserver directory.
|
||||
|
||||
The options used to start named can be altered. There are a couple ways of
|
||||
doing this. `start.pl` checks the methods in a specific order: if a check
|
||||
succeeds, the options are set and any other specification is ignored. In order,
|
||||
these are:
|
||||
|
||||
1. Specifying options to `start.pl` or `start_server` shell utility function
|
||||
after the name of the test directory, e.g.
|
||||
|
||||
start_server --noclean --restart --port ${PORT} ns1 -- "-D xfer-ns1 -T transferinsecs -T transferslowly"
|
||||
|
||||
2. Including a file called "named.args" in the "nsN" directory. If present,
|
||||
the contents of the first non-commented, non-blank line of the file are used as
|
||||
the named command-line arguments. The rest of the file is ignored.
|
||||
|
||||
3. Tweaking the default command line arguments with "-T" options. This flag is
|
||||
used to alter the behavior of BIND for testing and is not documented in the
|
||||
ARM. The presence of certain files in the "nsN" directory adds flags to
|
||||
the default command line (the content of the files is irrelevant - it
|
||||
is only the presence that counts):
|
||||
|
||||
named.noaa Appends "-T noaa" to the command line, which causes
|
||||
"named" to never set the AA bit in an answer.
|
||||
|
||||
named.dropedns Adds "-T dropedns" to the command line, which causes
|
||||
"named" to recognise EDNS options in messages, but drop
|
||||
messages containing them.
|
||||
|
||||
named.maxudp1460 Adds "-T maxudp1460" to the command line, setting the
|
||||
maximum UDP size handled by named to 1460.
|
||||
|
||||
named.maxudp512 Adds "-T maxudp512" to the command line, setting the
|
||||
maximum UDP size handled by named to 512.
|
||||
|
||||
named.noedns Appends "-T noedns" to the command line, which disables
|
||||
recognition of EDNS options in messages.
|
||||
|
||||
named.notcp Adds "-T notcp", which disables TCP in "named".
|
||||
|
||||
named.soa Appends "-T nosoa" to the command line, which disables
|
||||
the addition of SOA records to negative responses (or to
|
||||
the additional section if the response is triggered by RPZ
|
||||
rewriting).
|
||||
|
||||
### Running Nameservers Interactively
|
||||
|
||||
In order to debug the nameservers, you can let pytest perform the nameserver
|
||||
setup and interact with the servers before the test starts, or even at specific
|
||||
points during the test, using the `--trace` option to drop you into pdb debugger
|
||||
which pauses the execution of the tests, while keeping the server state intact:
|
||||
|
||||
pytest -k dns64 --trace
|
||||
|
||||
|
||||
## Developer Notes
|
||||
|
||||
### Test discovery and collection
|
||||
|
||||
There are two distinct types of system tests. The first is a shell script
|
||||
tests.sh containing individual test cases executed sequentially and the
|
||||
success/failure is determined by return code. The second type is a regular
|
||||
pytest file which contains test functions.
|
||||
|
||||
Dealing with the regular pytest files doesn't require any special consideration
|
||||
as long as the naming conventions are met. Discovering the tests.sh tests is
|
||||
more complicated.
|
||||
|
||||
The chosen solution is to add a bit of glue for each system test. For every
|
||||
tests.sh, there is an accompanying tests_sh_*.py file that contains a test
|
||||
function which utilizes a custom run_tests_sh fixture to call the tests.sh
|
||||
script. Other solutions were tried and eventually rejected. While this
|
||||
introduces a bit of extra glue, it is the most portable, compatible and least
|
||||
complex solution.
|
||||
|
||||
### Compatibility with older pytest version
|
||||
|
||||
Keep in mind that the pytest runner must work with ancient versions of pytest.
|
||||
When implementing new features, it is advisable to check feature support in
|
||||
pytest and pytest-xdist in older distributions first.
|
||||
|
||||
As a general rule, any changes to the pytest runner need to keep working on all
|
||||
platforms in CI that use the pytest runner. As of 2023-11-14, the oldest
|
||||
supported version is whatever is available in EL8.
|
||||
|
||||
We may need to add more compat code eventually to handle breaking upstream
|
||||
changes. For example, using request.fspath attribute is already deprecated in
|
||||
latest pytest.
|
||||
|
||||
### Format of Shell Test Output
|
||||
|
||||
Shell-based tests have the following format of output:
|
||||
|
||||
<letter>:<test-name>:<message> [(<number>)]
|
||||
|
||||
e.g.
|
||||
|
||||
I:catz:checking that dom1.example is not served by primary (1)
|
||||
|
||||
The meanings of the fields are as follows:
|
||||
|
||||
<letter>
|
||||
This indicates the type of message. This is one of:
|
||||
|
||||
S Start of the test
|
||||
A Start of test (retained for backwards compatibility)
|
||||
T Start of test (retained for backwards compatibility)
|
||||
E End of the test
|
||||
I Information. A test will typically output many of these messages
|
||||
during its run, indicating test progress. Note that such a message may
|
||||
be of the form "I:testname:failed", indicating that a sub-test has
|
||||
failed.
|
||||
R Result. Each test will result in one such message, which is of the
|
||||
form:
|
||||
|
||||
R:<test-tmpdir>:<result>
|
||||
|
||||
where <result> is one of:
|
||||
|
||||
PASS The test passed
|
||||
FAIL The test failed
|
||||
SKIPPED The test was not run, usually because some
|
||||
prerequisites required to run the test are missing.
|
||||
|
||||
<test-tmpdir>
|
||||
This is the name of the temporary test directory from which the message
|
||||
emanated, which is also the name of the subdirectory holding the test files.
|
||||
|
||||
<message>
|
||||
This is text output by the test during its execution.
|
||||
|
||||
(<number>)
|
||||
If present, this will correlate with a file created by the test. The tests
|
||||
execute commands and route the output of each command to a file. The name of
|
||||
this file depends on the command and the test, but will usually be of the form:
|
||||
|
||||
<command>.out.<suffix><number>
|
||||
|
||||
e.g. nsupdate.out.test28, dig.out.q3. This aids diagnosis of problems by
|
||||
allowing the output that caused the problem message to be identified.
|
||||
|
||||
@@ -20,6 +20,7 @@ rm -f ns2/example.db ns2/tsigzone.db ns2/example.db.jnl
|
||||
rm -f */named.conf
|
||||
rm -f */named.memstats
|
||||
rm -f */named.run
|
||||
rm -f ns*/named.lock
|
||||
rm -f ns*/_default.nzf
|
||||
rm -f ns*/_default.nzd*
|
||||
rm -f ns*/managed-keys.bind* ns*/*.mkeys*
|
||||
|
||||
@@ -32,7 +32,6 @@ options {
|
||||
notify yes;
|
||||
ixfr-from-differences yes;
|
||||
check-integrity no;
|
||||
dnssec-validation no;
|
||||
};
|
||||
|
||||
key one {
|
||||
@@ -47,7 +46,7 @@ key two {
|
||||
|
||||
zone "." {
|
||||
type hint;
|
||||
file "../../_common/root.hint";
|
||||
file "../../common/root.hint";
|
||||
};
|
||||
|
||||
zone "example" {
|
||||
|
||||
@@ -32,7 +32,6 @@ options {
|
||||
notify yes;
|
||||
ixfr-from-differences yes;
|
||||
check-integrity no;
|
||||
dnssec-validation no;
|
||||
};
|
||||
|
||||
key one {
|
||||
@@ -47,7 +46,7 @@ key two {
|
||||
|
||||
zone "." {
|
||||
type hint;
|
||||
file "../../_common/root.hint";
|
||||
file "../../common/root.hint";
|
||||
};
|
||||
|
||||
zone "example" {
|
||||
|
||||
@@ -32,7 +32,6 @@ options {
|
||||
notify yes;
|
||||
ixfr-from-differences yes;
|
||||
check-integrity no;
|
||||
dnssec-validation no;
|
||||
};
|
||||
|
||||
key one {
|
||||
@@ -60,7 +59,7 @@ acl accept {
|
||||
|
||||
zone "." {
|
||||
type hint;
|
||||
file "../../_common/root.hint";
|
||||
file "../../common/root.hint";
|
||||
};
|
||||
|
||||
zone "example" {
|
||||
|
||||
@@ -32,7 +32,6 @@ options {
|
||||
notify yes;
|
||||
ixfr-from-differences yes;
|
||||
check-integrity no;
|
||||
dnssec-validation no;
|
||||
};
|
||||
|
||||
key one {
|
||||
@@ -59,7 +58,7 @@ acl check2 { !key two; 10.53.0.2; };
|
||||
|
||||
zone "." {
|
||||
type hint;
|
||||
file "../../_common/root.hint";
|
||||
file "../../common/root.hint";
|
||||
};
|
||||
|
||||
zone "example" {
|
||||
|
||||
@@ -32,7 +32,6 @@ options {
|
||||
notify yes;
|
||||
ixfr-from-differences yes;
|
||||
check-integrity no;
|
||||
dnssec-validation no;
|
||||
allow-query-on { 10.53.0.2; };
|
||||
blackhole { 10.53.0.8; };
|
||||
};
|
||||
@@ -49,7 +48,7 @@ key two {
|
||||
|
||||
zone "." {
|
||||
type hint;
|
||||
file "../../_common/root.hint";
|
||||
file "../../common/root.hint";
|
||||
};
|
||||
|
||||
zone "example" {
|
||||
|
||||
@@ -23,7 +23,6 @@ options {
|
||||
notify no;
|
||||
allow-new-zones yes;
|
||||
allow-transfer { none; };
|
||||
dnssec-validation no;
|
||||
};
|
||||
|
||||
controls {
|
||||
|
||||
@@ -23,7 +23,6 @@ options {
|
||||
notify no;
|
||||
allow-new-zones yes;
|
||||
allow-transfer { none; };
|
||||
dnssec-validation no;
|
||||
};
|
||||
|
||||
controls {
|
||||
|
||||
+81
-136
@@ -11,64 +11,48 @@
|
||||
# See the COPYRIGHT file distributed with this work for additional
|
||||
# information regarding copyright ownership.
|
||||
|
||||
set -e
|
||||
|
||||
. ../conf.sh
|
||||
|
||||
DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
|
||||
RNDCCMD="$RNDC -c ../_common/rndc.conf -p ${CONTROLPORT} -s"
|
||||
RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
|
||||
|
||||
status=0
|
||||
t=0
|
||||
|
||||
echo_i "testing basic ACL processing"
|
||||
# key "one" should fail
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 || {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
|
||||
# any other key should be fine
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 && {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
copy_setports ns2/named2.conf.in ns2/named.conf
|
||||
rndc_reload ns2 10.53.0.2
|
||||
sleep 5
|
||||
|
||||
# prefix 10/8 should fail
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 || {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
# any other address should work, as long as it sends key "one"
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 || {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 && {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
echo_i "testing nested ACL processing"
|
||||
# all combinations of 10.53.0.{1|2} with key {one|two}, should succeed
|
||||
@@ -77,66 +61,45 @@ rndc_reload ns2 10.53.0.2
|
||||
sleep 5
|
||||
|
||||
# should succeed
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 10.53.0.2 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 && {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 10.53.0.2 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
# should succeed
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 10.53.0.2 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 && {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 10.53.0.2 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
# should succeed
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 && {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
# should succeed
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 && {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
# but only one or the other should fail
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 || {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 10.53.0.2 axfr >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 || {
|
||||
echo_i "test $tt failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 10.53.0.2 axfr > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1; }
|
||||
|
||||
# and other values? right out
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:three:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 || {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:three:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
# now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
|
||||
copy_setports ns2/named4.conf.in ns2/named.conf
|
||||
@@ -144,82 +107,64 @@ rndc_reload ns2 10.53.0.2
|
||||
sleep 5
|
||||
|
||||
# should succeed
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 10.53.0.2 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 && {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 10.53.0.2 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
# should succeed
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 && {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
# should fail
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 10.53.0.2 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 || {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 10.53.0.2 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
# should fail
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 || {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 10.53.0.1 axfr -y "${DEFAULT_HMAC}:two:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
# should fail
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG $DIGOPTS tsigzone. \
|
||||
@10.53.0.2 -b 10.53.0.3 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" >dig.out.${t}
|
||||
grep "^;" dig.out.${t} >/dev/null 2>&1 || {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 10.53.0.3 axfr -y "${DEFAULT_HMAC}:one:1234abcd8765" > dig.out.${t}
|
||||
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
echo_i "testing allow-query-on ACL processing"
|
||||
copy_setports ns2/named5.conf.in ns2/named.conf
|
||||
rndc_reload ns2 10.53.0.2
|
||||
sleep 5
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
$DIG -p ${PORT} +tcp soa example. \
|
||||
@10.53.0.2 -b 10.53.0.3 >dig.out.${t}
|
||||
grep "status: NOERROR" dig.out.${t} >/dev/null 2>&1 || {
|
||||
echo_i "test $t failed"
|
||||
status=1
|
||||
}
|
||||
@10.53.0.2 -b 10.53.0.3 > dig.out.${t}
|
||||
grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
||||
|
||||
echo_i "testing blackhole ACL processing"
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
ret=0
|
||||
$DIG -p ${PORT} +tcp soa example. \
|
||||
@10.53.0.2 -b 10.53.0.3 >dig.out.1.${t}
|
||||
grep "status: NOERROR" dig.out.1.${t} >/dev/null 2>&1 || ret=1
|
||||
@10.53.0.2 -b 10.53.0.3 > dig.out.1.${t}
|
||||
grep "status: NOERROR" dig.out.1.${t} > /dev/null 2>&1 || ret=1
|
||||
$DIG -p ${PORT} +tcp soa example. \
|
||||
@10.53.0.2 -b 10.53.0.8 >dig.out.2.${t} && ret=1
|
||||
grep "status: NOERROR" dig.out.2.${t} >/dev/null 2>&1 && ret=1
|
||||
grep "communications error" dig.out.2.${t} >/dev/null 2>&1 || ret=1
|
||||
@10.53.0.2 -b 10.53.0.8 > dig.out.2.${t}
|
||||
grep "status: NOERROR" dig.out.2.${t} > /dev/null 2>&1 && ret=1
|
||||
grep "communications error" dig.out.2.${t} > /dev/null 2>&1 || ret=1
|
||||
$DIG -p ${PORT} soa example. \
|
||||
@10.53.0.2 -b 10.53.0.3 >dig.out.3.${t}
|
||||
grep "status: NOERROR" dig.out.3.${t} >/dev/null 2>&1 || ret=1
|
||||
@10.53.0.2 -b 10.53.0.3 > dig.out.3.${t}
|
||||
grep "status: NOERROR" dig.out.3.${t} > /dev/null 2>&1 || ret=1
|
||||
$DIG -p ${PORT} soa example. \
|
||||
@10.53.0.2 -b 10.53.0.8 >dig.out.4.${t} && ret=1
|
||||
grep "status: NOERROR" dig.out.4.${t} >/dev/null 2>&1 && ret=1
|
||||
grep "timed out" dig.out.4.${t} >/dev/null 2>&1 || ret=1
|
||||
grep ";; no servers could be reached" dig.out.4.${t} >/dev/null 2>&1 || ret=1
|
||||
@10.53.0.2 -b 10.53.0.8 > dig.out.4.${t}
|
||||
grep "status: NOERROR" dig.out.4.${t} > /dev/null 2>&1 && ret=1
|
||||
grep "timed out" dig.out.4.${t} > /dev/null 2>&1 || ret=1
|
||||
grep ";; no servers could be reached" dig.out.4.${t} > /dev/null 2>&1 || ret=1
|
||||
[ $ret -eq 0 ] || echo_i "failed"
|
||||
status=$((status + ret))
|
||||
status=`expr $status + $ret`
|
||||
|
||||
# AXFR tests against ns3
|
||||
|
||||
@@ -229,26 +174,26 @@ echo_i "calling addzone example.com on ns3"
|
||||
$RNDCCMD 10.53.0.3 addzone 'example.com {type primary; file "example.db"; }; '
|
||||
sleep 1
|
||||
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
ret=0
|
||||
echo_i "checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
|
||||
$DIG -p ${PORT} @10.53.0.3 example.com axfr >dig.out.${t} 2>&1
|
||||
$DIG -p ${PORT} @10.53.0.3 example.com axfr > dig.out.${t} 2>&1
|
||||
grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
|
||||
[ $ret -eq 0 ] || echo_i "failed"
|
||||
status=$((status + ret))
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo_i "calling rndc reconfig"
|
||||
rndc_reconfig ns3 10.53.0.3
|
||||
|
||||
sleep 1
|
||||
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
ret=0
|
||||
echo_i "re-checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
|
||||
$DIG -p ${PORT} @10.53.0.3 example.com axfr >dig.out.${t} 2>&1
|
||||
$DIG -p ${PORT} @10.53.0.3 example.com axfr > dig.out.${t} 2>&1
|
||||
grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
|
||||
[ $ret -eq 0 ] || echo_i "failed"
|
||||
status=$((status + ret))
|
||||
status=`expr $status + $ret`
|
||||
|
||||
# AXFR tests against ns4
|
||||
|
||||
@@ -258,26 +203,26 @@ echo_i "calling addzone example.com on ns4"
|
||||
$RNDCCMD 10.53.0.4 addzone 'example.com {type primary; file "example.db"; }; '
|
||||
sleep 1
|
||||
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
ret=0
|
||||
echo_i "checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
|
||||
$DIG -p ${PORT} @10.53.0.4 example.com axfr >dig.out.${t} 2>&1
|
||||
$DIG -p ${PORT} @10.53.0.4 example.com axfr > dig.out.${t} 2>&1
|
||||
grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
|
||||
[ $ret -eq 0 ] || echo_i "failed"
|
||||
status=$((status + ret))
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo_i "calling rndc reconfig"
|
||||
rndc_reconfig ns4 10.53.0.4
|
||||
|
||||
sleep 1
|
||||
|
||||
t=$((t + 1))
|
||||
t=`expr $t + 1`
|
||||
ret=0
|
||||
echo_i "re-checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
|
||||
$DIG -p ${PORT} @10.53.0.4 example.com axfr >dig.out.${t} 2>&1
|
||||
$DIG -p ${PORT} @10.53.0.4 example.com axfr > dig.out.${t} 2>&1
|
||||
grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
|
||||
[ $ret -eq 0 ] || echo_i "failed"
|
||||
status=$((status + ret))
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo_i "exit status: $status"
|
||||
[ $status -eq 0 ] || exit 1
|
||||
|
||||
@@ -1,14 +0,0 @@
|
||||
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
#
|
||||
# SPDX-License-Identifier: MPL-2.0
|
||||
#
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
#
|
||||
# See the COPYRIGHT file distributed with this work for additional
|
||||
# information regarding copyright ownership.
|
||||
|
||||
|
||||
def test_acl(run_tests_sh):
|
||||
run_tests_sh()
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user